Sample_18e0f8faca

by malwarelabrobot on January 31st, 2015 in Malware Descriptions.

mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Malware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

Dynamic Analysis

Static Analysis

Network Activity

Map

Strings from Dumps

Removals

MD5: 18e0f8faca7b8c5d291cd4d91d5ed91d
SHA1: 31795e4cb7fd814759a2c70570bcfe7894d9bc5b
SHA256: 7da9804c95102c54a3a89a1cde31e5d747d53c88b6030c4c826ab3960f31956b
SSDeep: 24576:wRevMp /Qlb VoDLhb/ZPPtKWMAEeazRjDRWbXxIZ:w8MpYYSVo/l/ZPPt/rEeaQI
Size: 1074000 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: Exent Technologies Ltd.
Created at: 2008-08-20 16:51:24
Analyzed on: Windows7Ada SP1 64-bit

Summary:

Malware. Malware, short for malicious software, is any software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

Payload

No specific payload has been found.

Process activity

The Malware creates the following process(es):

GoogleUpdate.exe:3496
GoogleUpdate.exe:3556
GoogleUpdate.exe:3612
cmhelper.exe:2792
cmhelper.exe:2988
cmhelper.exe:476
cmhelper.exe:2676
GPlayer.exe:1140
GPlayer.exe:600
GPlayer.exe:3460
GPlayer.exe:888
GPlayer.exe:2644
GPlayer.exe:2836
GPlayer.exe:3300
FreeRideGames.exe:1440
Regsvr32.exe:700
RegEdit.exe:3432
RegEdit.exe:204
%original file name%.exe:3900
setup.exe:4068
setup.exe:3264
taskeng.exe:628
40.0.2214.94_chrome_installer.exe:3052
Free Ride Games.exe:3700

The Malware injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process GoogleUpdate.exe:3496 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\40.0.2214.94\40.0.2214.94_chrome_installer.exe (312970 bytes)
%Program Files% (x86)\Google\Update\Install\{5D8BBC2E-D20F-40E5-A8E7-225F2F6C618F}\40.0.2214.94_chrome_installer.exe (331841 bytes)

The process cmhelper.exe:2792 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Low\WT3G2UFC.txt (109 bytes)

The process cmhelper.exe:2988 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Low\H0HH7P9Y.txt (217 bytes)

The process cmhelper.exe:476 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Low\XO2ANQBU.txt (324 bytes)

The process GPlayer.exe:1140 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Info\2.clg (1105 bytes)
%Program Files% (x86)\FreeRide Games\Info\1.clg (15493 bytes)

The process GPlayer.exe:600 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Info\13.clg (15517 bytes)
%Program Files% (x86)\FreeRide Games\Info\14.clg (1107 bytes)

The process GPlayer.exe:3460 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Info\11.clg (15517 bytes)
%Program Files% (x86)\FreeRide Games\Info\12.clg (1107 bytes)

The process GPlayer.exe:888 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Info\8.clg (1105 bytes)
%Program Files% (x86)\FreeRide Games\Info\7.clg (15493 bytes)

The process GPlayer.exe:2644 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Info\5.clg (15493 bytes)
%Program Files% (x86)\FreeRide Games\Info\6.clg (1105 bytes)

The process GPlayer.exe:2836 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Info\9.clg (15493 bytes)
%Program Files% (x86)\FreeRide Games\Info\10.clg (1107 bytes)

The process GPlayer.exe:3300 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Info\4.clg (1105 bytes)
%Program Files% (x86)\FreeRide Games\Info\3.clg (15493 bytes)

The process FreeRideGames.exe:1440 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\ISSetup.dll (11297 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.exe (16089 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\0x0409.ini (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.zip (4508 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\pftw1.pkg (24322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\data1.cab (14367 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\plf43D3.tmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ext43D4.tmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\data1.hdr (1941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\layout.bin (515 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\data2.cab (157015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.inx (6224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setupapplet.jar (541 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.iss (256 bytes)

The process Regsvr32.exe:700 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\AppLoader2KEx.dll (966 bytes)

The process %original file name%.exe:3900 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\resourceDll.dll (161 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_uninsep.bat (174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\Free Ride Games.exe (989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\ExentCtlInstaller.dll (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\000A25F7 (948 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\cmhelper.exe (192 bytes)

The process setup.exe:4068 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto4b80.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_a4af4.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop4eea.rra (181 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\dl_i4dc1.rra (32 bytes)
%Program Files% (x86)\FreeRide Games\FRGN4ad5.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFx45d5.rra (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\cmhe49fa.rra (4456 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e4e4e.rra (11 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\pb4db2.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c7a.rra (47 bytes)
%Program Files% (x86)\FreeRide Games\Skin\NIBmps\NetI4b13.rra (3780 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\help4c1c.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\upda4bce.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\eror4da2.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs4eda.rra (13 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d64.rra (51 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pids4b23.rra (58 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bott4d06.rra (1 bytes)
C:\Users\Public\Desktop\Play My Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load4e8c.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\glut4920.rra (4314 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_04c3b.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\myGa4ae4.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g4e5d.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game4eea.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\skin4ce7.rra (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\GPla492f.rra (154846 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\skip4bbf.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\repo49fa.rra (364 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\fram4de1.rra (14 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\canc4b90.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\spla4e00.rra (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu45b6.rra (6043 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\ISSetup.dll (577 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exs45b6.rra (12834 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Serv4d83.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\clos4b9f.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRi4d06.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Sett4ae4.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\MyGa4d93.rra (4298 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc4bfd.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_45c7.rra (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a29.rra\exs44a39.rra (2335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{811A1279-A06D-4182-A972-4A2A4B4D0E40}\0x0409.ini (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB} (4 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu48d2.rra (14400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG49fa.rra\AppL4a0a.rra (32102 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\myGa4db2.rra (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a19.rra\frg-4a19.rra (4456 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\flas4dd1.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan4eda.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\help4c2c.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\GameInfoDefault\md4b03.rra (383 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regi45b6.rra (29 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\load4d25.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play4e8c.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4ca9.rra (18 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\trac4e00.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\back4b90.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\erro4cd7.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_c4af4.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\GameInfoDefault\Game4b03.rra (12 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\logi4b03.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\erro4cc8.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\gplayer\gpla4d35.rra (4329 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\adGa4cb8.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_14c4b.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Sett4d83.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i4e5d.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\play4e0f.rra (144 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\yesn4e0f.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\atta4cf7.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\layo4da2.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos4e7d.rra (1106 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{811A1279-A06D-4182-A972-4A2A4B4D0E40}\setup.ini (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\og_i4cd7.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\erro4dd1.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\og_i4df0.rra (625 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\main4ebb.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logo4d25.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Chan4d45.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\lice45b6.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a4e3e.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear4ef9.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\load4d16.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_24c4b.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\MyDo4d83.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\dl_i4cc8.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\exs46cf.rra (7168 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\logi4cd7.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Data\Loca4a96.rra (13 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\MyGa4d83.rra (17 bytes)
C:\ProgramData\FreeRide Games\layo51a8.rra (515 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun4e8c.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin4f19.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\favi4d54.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b71.rra (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\ISBE45d5.rra (4314 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide4c2c.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\auto4cc8.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec4f19.rra (807 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Conn4d45.rra (296 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d65.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b51.rra (25 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s4e6d.rra (12 bytes)
C:\ProgramData\FreeRide Games\setu51c7.rra (5800 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\logi4de1.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Help4d73.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Win84f86.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\spla4ce7.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ4ebb.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data4b80.rra (31 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\logi4e0f.rra (144 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retr4d25.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\skip4bce.rra (3 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu4910.rra (6040 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\play4df0.rra (729 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\info4eab.rra (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGa45c6.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin4f09.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c89.rra (46 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Langs\0409\EXEt4bde.rra (843 bytes)
%Program Files% (x86)\FreeRide Games\Skin\inde4ae4.rra (34 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi4e3e.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\drop4dc1.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi4e7d.rra (262 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\debu4b03.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\more4c3b.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\Loca4a97.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_4d35.rra (10 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\GATr4d93.rra (2326 bytes)
%Program Files% (x86)\FreeRide Games\X5XS4a48.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Data\Loca4aa6.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b32.rra (22 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u4e6d.rra (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DMF8LOSK.txt (1580 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main4ef9.rra (18 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\clie4dc1.rra (509 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Onli4d83.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\core45d5.rra (2334 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG49fa.rra\wh_P4a19.rra (4456 bytes)
C:\Windows\Downloaded Program Files\Exen4ab5.rra (32172 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\fram4cd7.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\ExentComponents.ini (1169 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\ISBEW64.exe (110 bytes)
%Program Files% (x86)\FreeRide Games\Clie4ae4.rra (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isr45e5.rra (18974 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_m4af4.rra (24 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos4c1c.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l4e6d.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\GPla4d73.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\Game49bc.rra (65287 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\sign4e00.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_d4af4.rra (15 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC4ecb.rra (6 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Tray4ad5.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\mg_i4cd7.rra (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BN58NRCY.txt (1580 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu4920.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d4e3e.rra (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a19.rra\3rdP4a29.rra (26 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\post4df1.rra (966 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_4bfd.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl4ecb.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\nobu4baf.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d73.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a29.rra\DoDl4a29.rra (4456 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b23.rra (4 bytes)
C:\ProgramData\FreeRide Games\data514a.rra (158522 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\icon4da2.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c99.rra (21 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\defa4b23.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e4e4f.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Stri45e5.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Skin4ae4.rra (352 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\mg_i4de1.rra (20 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBo4cf7.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\X5Ex4a39.rra (20620 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a19.rra\lice4a29.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_4c0d.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\Chec4b80.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m4e6d.rra (18 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\clos4b90.rra (1 bytes)
C:\ProgramData\FreeRide Games\exs5198.rra (7168 bytes)
C:\Windows\SysWOW64\d3dx4aa6.rra (32512 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d55.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\yesn4ce7.rra (2 bytes)
C:\ProgramData\FreeRide Games\setu51a8.rra (14400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isres_0x0409.dll (561 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\Loca4a96.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Langs\0409\Stri4bed.rra (11940 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_14c3b.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\erro4e0f.rra (144 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\IAF4d73.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\yesb4bde.rra (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4578.rra (100 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d54.rra (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\exs.dll (380 bytes)
%Program Files% (x86)\FreeRide Games\Play My Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\GPlr4d73.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\swit4e00.rra (3 bytes)
C:\ProgramData\FreeRide Games\data513b.rra (14400 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o4e6d.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\npGa4f19.rra (13264 bytes)
%Program Files% (x86)\FreeRide Games\FreeRide Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\play4e3e.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm4c4b.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLe4d06.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc4bfd.rra (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\dotn45d5.rra (11 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\nobu4b9f.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load4ef9.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b42.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR4f09.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\Game49db.rra (8760 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp4eab.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\Most4d93.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_4c1c.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4ZF5FJ2F.txt (1580 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\jque4de1.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topL4d25.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defa45e5.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn4e9c.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bott4d16.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrt.dll (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG49fa.rra\AX3249fa.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim4b71.rra (13 bytes)
C:\Windows\Downloaded Program Files\ExentControl.ocx (1 bytes)
C:\ProgramData\FreeRide Games\setu51b7.rra (6477 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp4e9c.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load4eea.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_p4af4.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord4e8c.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann4e2f.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flas4d16.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\OffL4d45.rra (396 bytes)
%Program Files% (x86)\FreeRide Games\report.ini (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\GPlr499d.rra (32516 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topR4d25.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.log (323 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\erro4dc1.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott4eda.rra (35 bytes)
C:\Users\Public\Desktop\FreeRide Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho4b80.rra (2334 bytes)
C:\ProgramData\FreeRide Games\0x04513b.rra (21 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Langs\0409\Erro4bed.rra (15 bytes)
%Program Files% (x86)\FreeRide Games\exs.dll (380 bytes)
%Program Files% (x86)\FreeRide Games\Data\vers4a96.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\layo4db2.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\pinb4baf.rra (4 bytes)
C:\ProgramData\FreeRide Games\ISSe5198.rra (10504 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Exit4d45.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPla45c6.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\mg4b23.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\upda4e1f.rra (96 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c5b.rra (40 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\spac4db2.rra (49 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4cb8.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo4ef9.rra (14 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgTo4d06.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\pinb4bbf.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\key_4de1.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b61.rra (40 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs4f09.rra (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\Repo49eb.rra (31560 bytes)
%Program Files% (x86)\FreeRide Games\exs.ini (6228 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\dial4cc8.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\preR4df0.rra (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a29.rra\exs44a29.rra (12834 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\post4df0.rra (966 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo48c2.rra (515 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\AC_R4dc1.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\npEx4ad5.rra (8760 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\GPlr4cf7.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto4b71.rra (32 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dial4da2.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\GameInfoDefault\Spla4b03.rra (29 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrt45e5.rra (8434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Font45d5.rra (39 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs4ecb.rra (10 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x044910.rra (21 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai4eab.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\dl4b23.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\sett4ce7.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\Loca4aa6.rra (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\data1.hdr (57 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann4e1f.rra (6 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data48c2.rra (15968 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop4eda.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_45c6.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c6a.rra (47 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe48f1.rra (10504 bytes)

The process setup.exe:3264 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\cs.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\xinput1_3.dll (162 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome.dll (30950 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\chrome.exe (1686 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\de.pak (496 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\VisualElementsManifest.xml (400 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\kn.pak (1309 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\default_apps (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_100_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\he.pak (660 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\drive.crx (53 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\en-GB.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\hu.pak (604 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\en-US.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp (4 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114 (8 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\youtube.crx (47 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\it.pak (561 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sr.pak (868 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\hi.pak (1175 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\pt-PT.pak (568 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sw.pak (481 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libegl.dll (423 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\nb.pak (521 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\lt.pak (564 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\VisualElements\logo.png (7 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\nl.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\Locales (8 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ja.pak (693 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\external_extensions.json (5 bytes)
%Program Files% (x86)\Google\Chrome\Application\chrome.exe (17554 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libpeerconnection.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\zh-CN.pak (465 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\zh-TW.pak (471 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\pdf.dll (58 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fa.pak (817 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\metro_driver.dll (1013 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\te.pak (1276 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\VisualElements\smalllogo.png (21 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ca.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\uk.pak (897 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ro.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\pt-BR.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\id.pak (520 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\chrmstp.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\wow_helper.exe (146 bytes)
C:\Windows\Temp\chrome_installer.log (7903 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sl.pak (530 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ko.pak (580 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ml.pak (1503 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\vi.pak (653 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\PepperFlash\manifest.json (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ru.pak (892 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\docs.crx (12 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\icudtl.dat (59 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\search.crx (54 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Extensions\external_extensions.json (103 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\PepperFlash\pepflashplayer.dll (63 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fr.pak (611 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\pl.pak (569 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\gmail.crx (48 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\tr.pak (570 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ta.pak (1375 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ms.pak (432 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\d3dcompiler_46.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fi.pak (540 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fil.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sv.pak (529 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\et.pak (504 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_child.dll (32722 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\mr.pak (1159 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\widevinecdmadapter.dll (285 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_200_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\secondarytile.png (641 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\es.pak (586 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\es-419.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\bn.pak (1211 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\lv.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\delegate_execute.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\ffmpegsumo.dll (50 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ar.pak (766 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\hr.pak (538 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libglesv2.dll (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\am.pak (792 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libexif.dll (621 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\nacl64.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\VisualElements (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\resources.pak (64 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\40.0.2214.94.manifest (226 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sk.pak (596 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\th.pak (1153 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_elf.dll (268 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\da.pak (521 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\nacl_irt_x86_64.nexe (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\VisualElements\splash-620x300.png (22 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\nacl_irt_x86_32.nexe (51 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\chrome.7z (270363 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\bg.pak (949 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\gu.pak (1137 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\el.pak (1040 bytes)

The process 40.0.2214.94_chrome_installer.exe:3052 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Windows\Temp\CR_E9170.tmp\CHROME.PACKED.7Z (44833 bytes)
C:\Windows\Temp\CR_E9170.tmp\setup.exe (17361 bytes)
C:\Windows\Temp\CR_E9170.tmp\SETUP.EX_ (375 bytes)

The process Free Ride Games.exe:3700 makes changes in the file system.
The Malware creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bubbleLeft[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\index[1] (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\progressFooter[1] (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\initialized[1] (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\SDM_DB_148.xml (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SDM_PROGRESS[1].css (732 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\minimize_up[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\defines[1] (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Exent\GI20150130062650GMT.Log (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FO5KAIEW.txt (555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\defines[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\util[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\defines[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\close_disabled[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ga[1].js (22248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZQLSBFFB.txt (1493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\SDMLog.log (2600933 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\configuration[1] (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\bubbleRight[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\controller[1] (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion4[1].jpg (3875 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\progress[1] (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H9MVJRIA.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\header[1].htm (331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion1[1].jpg (3210 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\initialized[1] (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\header[1].jpg (1909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\beacon[1].js (750 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\util[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\conversionTracking[1].htm (95 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\FreeRideGames.exe (3202 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SDM_PROGRESS[1].css (732 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (224382 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\conf_defines[1] (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SDM_PROGRESS[1].htm (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\conf_defines[1] (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\close_up[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\servicePromotion1[1].jpg (3642 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SDM_HEADER2[1].css (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\defines[1] (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\resourceDll.dll (163 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\offlineheader[1] (199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PYQZ88UC.txt (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\functions[1] (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OJSXLTFR.txt (987 bytes)
%Program Files% (x86)\FreeRide Games\GPlayer.exe (485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SDM_PROGRESS[1].htm (1417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\EULAFooter[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\measurements[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\pageURLInfo[1] (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal (6361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\boxshot_sm[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_uninsdm.bat (370 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\offlineheader[1] (398 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (853 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7AOES2Y2.txt (297 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\RYDODTTC.txt (1580 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\initialized[1] (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\13[1].gif (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion3[1].gif (6898 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TG08AQ3A.txt (299 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\pageURLInfo[1] (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\conf_defines[1] (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\emptyFooter[1] (817 bytes)
%Program Files% (x86)\FreeRide Games\GameInst.dll (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Temp\ietemp1.dat (760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\gamesInQueue[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SDMHTMLInterfaces[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M98OPKUM.txt (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1FODHOFN.txt (1580 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\10L2XWWX.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion2[1].jpg (6611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\cookies-journal (13980 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\defines[1] (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4ZD31FGP.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\connecting_anim[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cookies (1338 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2NBE45IM.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\util[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JQGFUK9R.txt (1195 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\extrnalHandler[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\connection[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\connecting_anim[1] (4 bytes)

Registry activity

The process GoogleUpdate.exe:3496 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ActivePingDayStartSec" = "1422518422"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"DownloadProgressPercent" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"DayOfLastRollCall" = "2950"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"LastCheckSuccess" = "1422599488"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState]
"StateValue" = "16"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"RollCallDayStartSec" = "1422518422"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastCheckSuccess" = "1422599531"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"RollCallDayStartSec" = "1422518422"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastChecked" = "1422599488"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"pv" = "35.0.1916.153"

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"InstallTimeRemainingMs" = "4294967295"

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}]
"pv" = "35.0.1916.153"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"DownloadTimeRemainingMs" = "4294967295"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"DayOfLastActivity" = "2950"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerResult" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"RollCallDayStartSec" = "1422518422"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateTime" = "1422599531"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerResult" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"InstallProgressPercent" = "4294967295"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"pv" = "1.3.25.11"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"RollCallDayStartSec" = "1422518422"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"DayOfLastRollCall" = "2950"
"ActivePingDayStartSec" = "1422518422"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerError" = "2"

[HKCU\Software\Google\Update\ClientState\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"dr" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"LastCheckSuccess" = "1422599488"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}\CurrentState]
"StateValue" = "17"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerError" = "2"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableCount" = "1"
"DayOfLastActivity" = "2950"
"DayOfLastRollCall" = "2950"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
"StateValue" = "3"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"DayOfLastRollCall" = "2950"

[HKCU\Software\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"pv" = "35.0.1916.153"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]
"StateValue" = "7"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableSince" = "Type: REG_QWORD, Length: 8"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}\CurrentState]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{FDA71E6F-AC4C-4A00-8B70-9958A68906BF}\CurrentState]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}\CurrentState]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\CurrentState]

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerSuccessLaunchCmdLine"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerSuccessLaunchCmdLine"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerExtraCode1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableCount"

[HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerExtraCode1"
"LastInstallerResult"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"old-uid"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerError"
"LastInstallerResult"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"LastInstallerResultUIString"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"iid"
"LastInstallerResultUIString"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"dr"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"LastInstallerError"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"UpdateAvailableSince"

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"LastInstallerError"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UpdateAvailableCount"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{430FD4D0-B729-4F61-AA34-91526481799D}]
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"dr"
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"tttoken"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerResult"

The process GoogleUpdate.exe:3556 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"IsMSIHelperRegistered" = "1"
"LastStartedAU" = "1422599460"

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process GoogleUpdate.exe:3612 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Classes\Local Settings\MuiCache\2A\52C64B7E]
"LanguageList" = "en-US, en"

[HKCU\Software\Google\Update\proxy]
"source" = "IEWPAD"

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update]
"uid"
"old-uid"

The process cmhelper.exe:2792 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies]
"CachePrefix" = "Cookie:"

The process cmhelper.exe:2988 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

The process cmhelper.exe:476 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

The process cmhelper.exe:2676 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies]
"CacheLimit" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\History]
"CacheLimit" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Content]
"CacheLimit" = "256000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache\Cookies]
"CachePrefix" = "Cookie:"

The process GPlayer.exe:1140 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"MaxFilesCount" = "16"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\2]
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\2]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\2.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "E2 C5 F9 BA 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\2]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\1]
"TicketID" = "1204111893"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\1]
"RTyp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"RecoverSendFilesCount" = "3"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\1]
"ErrorID" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\1]
"STyp" = "0"
"PlayTime" = "0"
"TargetURL" = ""
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\1.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 42 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\2]
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\2]
"PlayTime" = "0"
"ErrorID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\2]
"STyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\2]
[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\1]

The Malware deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process GPlayer.exe:600 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\14]
"TargetURL" = ""
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\13]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\13.clg"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\14]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\14.clg"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\13]
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\13]
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9E F7 48 C0 55 3C D0 01"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\13]
"PlayTime" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "13"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\14]
"ErrorID" = "0"
"PlayTime" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4B 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\13]
"TicketID" = "1204111893"
"ErrorID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\14]
"STyp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\13]
"STyp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\14]
"TicketID" = "1204111893"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\13]
[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\14]

The Malware deletes the following value(s) in system registry:

The process GPlayer.exe:3460 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\11]
"TicketID" = "1204111893"
"PlayTime" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\11]
"STyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9E F7 48 C0 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\11]
"TargetURL" = ""

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\11]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\11.clg"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\12]
"TicketID" = "1204111893"
"ErrorID" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "11"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\11]
"ErrorID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 4A 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\12]
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\12]
"STyp" = "0"
"PlayTime" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\12]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\12.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\12]
"TargetURL" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\11]
"RTyp" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\12]
[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\11]

The Malware deletes the following value(s) in system registry:

The process GPlayer.exe:888 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\8]
"RTyp" = "0"
"ErrorID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\7]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\8]
"TicketID" = "1204111893"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9E F7 48 C0 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\7]
"STyp" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\7]
"PlayTime" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "7"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\8]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\8.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\8]
"STyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 48 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\8]
"PlayTime" = "0"
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\7]
"ErrorID" = "0"
"RTyp" = "0"
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\7]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\7.clg"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\8]
[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\7]

The Malware deletes the following value(s) in system registry:

The process GPlayer.exe:2644 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\5]
"TicketID" = "1204111893"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\5]
"STyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\5]
"TargetURL" = ""
"ErrorID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9E F7 48 C0 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\6]
"PlayTime" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\6]
"ErrorID" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\5]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\5.clg"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "5"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\6]
"TicketID" = "1204111893"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\5]
"RTyp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\6]
"RTyp" = "0"
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 47 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\5]
"PlayTime" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\6]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\6.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\6]
"STyp" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\6]
[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\5]

The Malware deletes the following value(s) in system registry:

The process GPlayer.exe:2836 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\9]
"TicketID" = "1204111893"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\10]
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\9]
"TargetURL" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\10]
"PlayTime" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9E F7 48 C0 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\10]
"STyp" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\9]
"STyp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\10]
"ErrorID" = "0"
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\10.clg"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "9"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\9]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\9.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 49 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\10]
"RTyp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\9]
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\9]
"PlayTime" = "0"
"ErrorID" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\10]
"TicketID" = "1204111893"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\9]
[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\10]

The Malware deletes the following value(s) in system registry:

The process GPlayer.exe:3300 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\4]
"PlayTime" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\3]
"STyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\3]
"TicketID" = "1204111893"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\3]
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\3.clg"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "9E F7 48 C0 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\4]
"ErrorID" = "0"
"filepath" = "%Program Files% (x86)\FreeRide Games\Info\4.clg"
"TicketID" = "1204111893"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"GPlayer.exe" = "10"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\3]
"RTyp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastFileIndex" = "3"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\4]
"STyp" = "0"
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 46 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\3]
"ErrorID" = "0"
"TargetURL" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\4]
"RTyp" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\3]
"PlayTime" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\3]
[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG\4]

The Malware deletes the following value(s) in system registry:

The process RegEdit.exe:3432 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\Stats\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\iexplore\AllowedDomains\*]
"Count" = "0"

[HKCR\Wow6432Node\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"Version" = "1.0"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\ProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"

[HKCR\AppID\{B415CD14-B45D-4BCA-B552-B06175C38606}]
"(Default)" = "FireBreathWin"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\Version]
"(Default)" = "1"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}]
"(Default)" = "IFBControl"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"Extension" = ""
"(Default)" = "Game Treat Widget"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\VersionIndependentProgID]
"(Default)" = "GameTreatWidget.GameTreatWidget"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION]
"GTR.exe" = "9999"

[HKCR\GameTreatWidget.GameTreatWidget\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKCR\Wow6432Node\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}]
"(Default)" = "IFBComEventSource"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus\1]
"(Default)" = "131473"

[HKCR\GameTreatWidget.GameTreatWidget\CurVer]
"(Default)" = "GameTreatWidget.GameTreatWidget.1"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\MiscStatus]
"(Default)" = "0"

[HKCR\GameTreatWidget.GameTreatWidget.1]
"(Default)" = "Game Treat Widget"

[HKCR\MIME\Database\Content Type\application/x-gametreatwidget]
"CLSID" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}]
"(Default)" = "Game Treat Widget"

[HKCR\Wow6432Node\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"Version" = "1.0"

[HKCR\GameTreatWidget.GameTreatWidget.1\CLSID]
"(Default)" = "{44d07caa-4fc4-5a84-9951-a485ad808d0e}"

[HKCR\Wow6432Node\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"Version" = "1.0"

[HKCR\AppID\npGameTreatWidget.dll]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"

[HKCR\Wow6432Node\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{FEFD8F9E-7F71-5307-A9E8-D2E60A4AAECA}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}]
"(Default)" = "IFBComJavascriptObject"

[HKCR\GameTreatWidget.GameTreatWidget]
"(Default)" = "Game Treat Widget"

[HKCR\Wow6432Node\Interface\{C9C1FD39-F2D3-50C9-AA6E-662D0EB26128}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\Wow6432Node\Interface\{7E8621A2-3513-5BAD-85D8-D624558847C7}\TypeLib]
"(Default)" = "{103DFC4E-147A-5606-9B4E-1C216DF227A1}"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0]
"(Default)" = "GameTreatWidget 1.0 Type Library"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"AppID" = "{B415CD14-B45D-4BCA-B552-B06175C38606}"

The process RegEdit.exe:204 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"Value" = "1"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingLastState" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"Value" = "168,43200"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"Value" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"Value" = "1800"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"IsVisible" = "0"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"RunPlayerOnStartUp" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"Value" = "1800"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\CLG]
"LastSuccessfulErrURL" = "http://player.freeridegames.com/opTools/errorReport.jsp"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"Value" = "2"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"Value" = "http://beta.freeridegames.com/messages/contentpush/"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushFadingScheme]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanUpInterval]
"Value" = "60000"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"Value" = "1000"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"Value" = "Default"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"Value" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKCU\Software\Exent\Exetender\Providers\148\Settings]
"SchedulingEnable" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"Value" = "http://player.freeridegames.com/do/gameInfo?contentId=%GAME_ID%"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Communication\SkinComType]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssCheckReminderTimerIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"Value" = "ON(143_CAMPAIGN_SERIAL_ID)ON(143_TURNKEY)ON(143_FIRST_BROWSER)NN(143_CAMPAIGN_PERFORMED_CONVERSIONS)NN(143_DAYS_PLAYED)NN(143_REACTIVATION_ID)NN(143_GAG)NN(143_UDOM)"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Partner\PartnerDomain]
"Value" = "player.freeridegames.com"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckURL]
"Value" = "http://player.freeridegames.com/do/PlayerUpdateInfo"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"Value" = "10"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssCheckUpdatesIntervalInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\MessagesSoundEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"Value" = "4320"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eSPT]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"Value" = "http://player.freeridegames.com/opTools/clientReport.jsp?theme=Home"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"Value" = "20000"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Version]
"Value" = "117802240"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssPersistentMessageFadingScheme]
"Value" = "168,86400"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"Value" = "86400000"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"Value" = "http://beta.freeridegames.com/messages/rss/"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssUserType]
"Value" = "old"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\RamMaxWindowSize]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClosePlayerOnIdle]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"Value" = "30000"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\LastShutdownOK]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRecovery]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"Value" = "http://player.freeridegames.com/check.jsp"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\PropmtBeforeCreatingShortcut]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSNamesEx]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\SleepingPeriod]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Scheduling\LastDirectionFileIndex]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"Value" = "30000"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyAddress]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CheckDiskSpaceInterval]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoDiskManagment]
"IsVisible" = "1"
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\IGA\IGAOptions]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSDelExp]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientCleanupOffsetMSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Version]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIntervalInMinutes]
"Value" = "360"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AccessWebPageConnectionTimeout]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnableForOldUser]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Partner\PartnerName]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\MediaChangerHotKey]
"Value" = "193"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Version]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushAIGsListUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushCheckTimerIntervalInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\NetworkStateUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\ClientKeepaliveInterval]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"Value" = "player.freeridegames.com"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\UserProfile\UserChannel]
"Value" = "default"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushEnable]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeCheckIdleIntervalInMinutes]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSEnabled]
"Value" = "1"
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyPort]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClientReport\UseClientReportUrl]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableShortcut]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\OfflineShortcutFolder]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentPush\ContentPushShowMsgDurationInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CoreInitFlags]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssFeedUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eLPL]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\IGA\GameInfoURL]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\CreateUninstallShortcutMode]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeRadio]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Scheduling\SchedulingEnable]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ContentStatus\ContentStatusShowMsgDurationInSec]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoErrorReport]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Proxy\ProxyRadio]
"IsReadOnly" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\EnableDumpReport]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Rss\RssDefaultShowMsgDurationInSec]
"Value" = "3600"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\PRV\eSSTy]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeEnable]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\EnableDesktopShortcut]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\OSLUpdIntMin]
"Value" = "1440"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\NetworkInterfacesCount]
"IsReadOnly" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CS\CSDomain]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\RunPlayerOnStartUp]
"IsVisible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\TK\TKEnabled]
"Value" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\AutoClientUpgrade\AutoClientUpgradeReminderIntervalInMinutes]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\ClientReport\ClientReportUrl]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Shortcuts\OpenShortcutInIE]
"IsVisible" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\CMC\CurrentUser]
"Value" = "advoyris"

The process %original file name%.exe:3900 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

The process setup.exe:4068 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\DownloadInformation]
"CodeBase" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Contains\Files\C:\Windows\Downloaded Program Files]
"ExentControl.ocx" = ""

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Disks\C]
"Games Dir" = "Remote Programs"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ToolboxBitmap32]
"(Default)" = "C:\Windows\Downloaded Program Files\ExentControl.ocx, 101"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 41 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayName" = "FreeRide Games"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"LastModified" = "Wed, 20 Jun 2012 06:42:12 GMT"

[HKCR\Wow6432Node\CLSID\{44d07caa-4fc4-5a84-9951-a485ad808d0e}\InprocServer32]
"(Default)" = "%Program Files% (x86)\FreeRide Games\npGameTreatWidget.dll"

[HKCR\Wow6432Node\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"Version" = "1.1"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Disks\C]
"Size" = "26914"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Wow6432Node\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCR\ExentControl.ExentInf1.1]
"(Default)" = "ExentInf1 Class"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"LogMode" = "1"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\@exent.com/npExentControl,version=7.1.0.1]
"Path" = "%Program Files% (x86)\FreeRide Games\npExentControl.dll"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Publisher" = "Exent Technologies"
"Language" = "1033"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\HELPDIR]
"(Default)" = "C:\Windows\Downloaded Program Files"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"URLInfoAbout" = "www.exent.com"
"InstallLocation" = "%Program Files% (x86)\FreeRide Games"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}]
"(Default)" = "IExentCtlStub"

[HKCR\ExentControl.ExentStub\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentInf1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"Version" = "16777219"

[HKCU\Software\AppDataLow\Software\ExentControl]
"runInstallFlag" = "1"

[HKCR\Wow6432Node\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\MozillaPlugins\www.exent.com/GameTreatWidget]
"Path" = "%Program Files% (x86)\FreeRide Games\NPGameTreatPlugin.dll"

[HKCR\Wow6432Node\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\Windows\Downloaded Program Files]
"ExentControl.ocx" = "1"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\0\win32]
"(Default)" = "%Program Files% (x86)\FreeRide Games\npGameTreatWidget.dll"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = ""

[HKCR\Wow6432Node\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}]
"(Default)" = "_IExentInfEvents"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppName" = "GPlayer.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayIcon" = "%Program Files% (x86)\FreeRide Games\myGames.ico"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallStringOriginal" = "%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Setup.exe -runfromtemp"

[HKCR\TypeLib\{103DFC4E-147A-5606-9B4E-1C216DF227A1}\1.0\HELPDIR]
"(Default)" = "%Program Files% (x86)\FreeRide Games"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoModify" = "1"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\TypeLib]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "E2 C5 F9 BA 55 3C D0 01"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}]
"(Default)" = "IExentInf"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Disks\C]
"Keep Free Space" = "50"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum" = "0"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\ProgID]
"(Default)" = "ExentControl.ExentInf1.1"

[HKCR\Wow6432Node\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\VersionIndependentProgID]
"(Default)" = "ExentControl.ExentStub"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallDate" = "20150130"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1]
"(Default)" = "ExentControl 1.1 Type Library"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"(Default)" = "%Program Files% (x86)\FreeRide Games\FreeRide Games"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair" = "1"

[HKCR\Wow6432Node\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}]
"(Default)" = "_IExentInfEvents"

[HKCR\Wow6432Node\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\FLAGS]
"(Default)" = "0"

[HKCR\Wow6432Node\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecision" = "0"

[HKCR\ExentControl.ExentStub.1]
"(Default)" = "ExentStub Class"

[HKCR\ExentControl.ExentInf1]
"(Default)" = "ExentInf1 Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\EXEtender.exe]
"Path" = "%Program Files% (x86)\FreeRide Games"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus\1]
"(Default)" = "132497"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"AppPath" = "%Program Files% (x86)\FreeRide Games"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\MiscStatus]
"(Default)" = "0"

[HKCR\Wow6432Node\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl" = ""
"WpadDecisionTime" = "39 78 6C B7 55 3C D0 01"

[HKCR\exent\shell\open\command]
"(Default)" = "%Program Files% (x86)\FreeRide Games\Win8Launcher.exe %1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/Windows/Downloaded Program Files/ExentControl.ocx]
"{4FF78044-96B4-4312-A5B7-FDA3CB328095}" = ""

[HKCR\ExentControl.ExentStub]
"(Default)" = "ExentStub Class"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"Installer" = "MSICD"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"Version" = "1.1"

[HKCR\ExentControl.ExentInf1\CurVer]
"(Default)" = "ExentControl.ExentInf1.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"InstallSource" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"Version" = "1.1"

[HKCR\ExentControl.ExentStub\CurVer]
"(Default)" = "ExentControl.ExentStub.1"

[HKCR\TypeLib\{D60BB9DB-17C1-4115-9887-6E47FA954061}\1.1\0\win32]
"(Default)" = "C:\Windows\Downloaded Program Files\ExentControl.ocx"

[HKCR\Wow6432Node\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = "ExentStub Class"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ProductGUID" = "{6C26A305-4549-4A8A-9F03-25719C03B0FB}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"SystemComponent" = "0"

[HKCR\Wow6432Node\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InprocServer32]
"(Default)" = "C:\Windows\Downloaded Program Files\ExentControl.ocx"

[HKCR\ExentControl.ExentStub.1\CLSID]
"(Default)" = "{5FB1E1AE-138D-45B3-809C-A41858AA44D9}"

[HKCR\Wow6432Node\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\TypeLib]
"Version" = "1.1"

[HKCR\Wow6432Node\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}]
"(Default)" = "IExentCtlStub"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"VersionMajor" = "1"

[HKCR\Wow6432Node\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}]
"(Default)" = "IExentInf"

[HKCR\Interface\{CBF3AB6E-743A-4B00-B563-BE8C3774F3F6}\ProxyStubClsid32]
"(Default)" = "{00020420-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"UninstallString" = "%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409 -removeonly"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "E2 C5 F9 BA 55 3C D0 01"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\InstalledVersion]
"(Default)" = "07,02,00,07"

[HKCR\ExentControl.ExentInf1.1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCR\Wow6432Node\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\ProgID]
"(Default)" = "ExentControl.ExentStub.1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"Version" = "1.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"LogFile" = "%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ilg"

[HKCR\ExentControl.ExentInf1\CLSID]
"(Default)" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCR\Wow6432Node\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\TypeLib]
"Version" = "1.1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRemove" = "0"

[HKCR\Interface\{9563E921-78AF-48BD-AEB0-696998875C4E}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"ModifyPath" = "%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe -runfromtemp -l0x0409"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}\Version]
"(Default)" = "1.1"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"Progress" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}]
"(Default)" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7C28FE5C-51FE-464E-A9B4-5E5AF02B514C}]
"Policy" = "3"

[HKCR\Wow6432Node\CLSID\{4FF78044-96B4-4312-A5B7-FDA3CB328095}]
"(Default)" = "ExentInf1 Class"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"RegOwner" = "Windows User"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ModuleUsage\C:/Windows/Downloaded Program Files/ExentControl.ocx]
".Owner" = "{4FF78044-96B4-4312-A5B7-FDA3CB328095}"

[HKCR\Wow6432Node\CLSID\{5FB1E1AE-138D-45B3-809C-A41858AA44D9}\InprocServer32]
"(Default)" = "C:\Windows\Downloaded Program Files\ExentControl.ocx"

[HKCR\exent]
"URL Protocol" = ""

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"VersionMinor" = "0"

[HKCR\exent]
"(Default)" = "URL:Exent Protocol"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148]
"BinPath" = "%Program Files% (x86)\FreeRide Games"

[HKCR\Interface\{DDB2EFCB-F22B-4FD6-AB70-701F29DAC008}\TypeLib]
"(Default)" = "{D60BB9DB-17C1-4115-9887-6E47FA954061}"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"DisplayVersion" = "1.00.0003"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc" = "Completed"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKLM\SOFTWARE\Wow6432Node\Exent Technologies\FreeRide Games]
[HKLM\SOFTWARE\Wow6432Node\Exent Technologies]
[HKLM\SOFTWARE\Wow6432Node\Exent Technologies\FreeRide Games\1.00.0003]

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRepair"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoDetect"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MajorVersion"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoRemove"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"NoModify"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ExtResponse"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{6C26A305-4549-4A8A-9F03-25719C03B0FB}]
"MinorVersion"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"
"Progress"

The process setup.exe:3264 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ap" = "-stage:preconditions-multi-chrome-full"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"VersionMajor" = "2214"
"DisplayVersion" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerExtraCode1" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"NoModify" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}]
"pv" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"pv" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"pv" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UninstallString" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe"
"InstallerResult" = "0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"WebAccessible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"DisplayName" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UninstallArguments" = " --uninstall --multi-install --system-level"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"UninstallArguments" = " --uninstall --multi-install --chrome --system-level"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"UninstallString" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"SendsPings" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{FDA71E6F-AC4C-4a00-8B70-9958A68906BF}]
"Name" = "Google Chrome App Launcher"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\query-eula-acceptance]
"RunAsUser" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"UninstallString" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --uninstall --multi-install --chrome --system-level"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerError" = "2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"Version" = "24,0,0,0"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\query-eula-acceptance]
"WebAccessible" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"InstallerError" = "2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"Version" = "40.0.2214.94"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"Name" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{8A69D345-D564-463C-AFF1-A69D9E530F96}]
"ap" = "-multi-chrome-full"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"StubPath" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\chrmstp.exe --configure-user-settings --verbose-logging --system-level --multi-install --chrome"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"InstallLocation" = "%Program Files% (x86)\Google\Chrome\Application"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"Localized Name" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\on-os-upgrade]
"CommandLine" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --on-os-upgrade --multi-install --chrome --system-level --verbose-logging"

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
"(Default)" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\delegate_execute.exe"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"RunAsUser" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"VersionMinor" = "94"
"NoRepair" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\quick-enable-application-host]
"CommandLine" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --multi-install --app-launcher --ensure-google-update-present"

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
"ServerExecutable" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\delegate_execute.exe"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"DisplayIcon" = "%Program Files% (x86)\Google\Chrome\Application\chrome.exe,0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"(Default)" = "Google Chrome"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\on-os-upgrade]
"AutoRunOnOSUpgrade" = "1"

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}]
"(Default)" = "CommandExecuteImpl Class"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}]
"Name" = "Google Chrome binaries"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{4DC8B4CA-1BDA-483e-B5FA-D3C12E15B62D}\Commands\query-eula-acceptance]
"CommandLine" = "%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe --query-eula-acceptance --system-level"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome]
"Publisher" = "Google Inc."

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
"IsInstalled" = "1"

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerResult" = "0"

The Malware deletes the following registry key(s):

[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}]
[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\LocalServer32]
[HKCR\Wow6432Node\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}\Programmable]
[HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Commands\install-extension]

The Malware deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"InstallerExtraCode1"

The process taskeng.exe:628 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake\{038E4E4D-F46A-45EF-B39C-EACC8EA8E5B9}]
"data" = "4D 45 4F 57 01 00 00 00 E4 B7 BD 92 8B F2 A0 46"

The process 40.0.2214.94_chrome_installer.exe:3052 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Wow6432Node\Google\Update\ClientState\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}]
"ap" = "-multi-chrome-full"

The process Free Ride Games.exe:3700 makes changes in the system registry.
The Malware creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm]
"fdwSupport" = "1"
"aFormatTagCache" = "01 00 00 00 10 00 00 00 02 00 00 00 32 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History]
"CachePrefix" = "Visited:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionReason" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"cFormatTags" = "3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 09 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm]
"cFormatTags" = "2"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadNetworkName" = "Network 3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm]
"cFilterTags" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"fdwSupport" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionTime" = "39 78 6C B7 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"cFormatTags" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecision" = "0"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"fdwSupport" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 31 00 00 00 14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content]
"CachePrefix" = ""

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 11 00 00 00 14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionReason" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecisionTime" = "39 78 6C B7 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm]
"cFilterTags" = "0"

[HKLM\SOFTWARE\Wow6432Node\Exent\Exetender\Providers\148\Settings\Communication\WebComType]
"Value" = "1"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610]
"cFilterTags" = "0"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER]
"Free Ride Games.exe" = "10"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
"ResumePage" = "index.html#PageId=SDM_PROGRESS"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm]
"fdwSupport" = "1"
"cFormatTags" = "2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies]
"CachePrefix" = "Cookie:"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDecisionReason" = "1"
"WpadDecision" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDecisionTime" = "39 78 6C B7 55 3C D0 01"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 06 00 00 00 12 00 00 00"

To automatically run itself each time Windows is booted, the Malware adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '659050'"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Malware deletes the following registry key(s):

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\SDM]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148]

The Malware deletes the following value(s) in system registry:

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorNum"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f3-c8-bd]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\00-50-56-f5-e5-a3]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"
"AutoDetect"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFavoritesInitialSelection"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{9C99CCBB-10A0-4B2A-A5BE-4CAC43F74632}]
"WpadDetectedUrl"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFeedsInitialSelection"

[HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\AppDataLow\Software\Exent\Exetender\Providers\148\IS]
"ErrorDesc"

The Malware disables automatic startup of the application by deleting the following autorun value:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM"

Dropped PE files

MD5	File path
72ef2d24d0efd50633e348426acb452f	c:\Program Files (x86)\FreeRide Games\AX32.dll
b3c69f6569b3ddf8f90e0fe882981a5d	c:\Program Files (x86)\FreeRide Games\AppLoader2KEx.dll
3645930301faace148be2813e8ce7977	c:\Program Files (x86)\FreeRide Games\DoDlg.exe
112811fe88dc3437ba8e731209f66465	c:\Program Files (x86)\FreeRide Games\GPlayer.exe
e440493ee5b307736dbcccab3b6d4bd5	c:\Program Files (x86)\FreeRide Games\GPlrLanc.exe
9373af11b046df0de7cd437ad2e99638	c:\Program Files (x86)\FreeRide Games\GameInst.dll
f1ec77deb12d8637c010ee26e1a28e0d	c:\Program Files (x86)\FreeRide Games\GameLauncher.exe
d2e90286b623106bf283749f49b496f1	c:\Program Files (x86)\FreeRide Games\Report.exe
dcbd967ad77dd43f27695a2168df4aba	c:\Program Files (x86)\FreeRide Games\Uninstall.exe
6948135f67b2df555191c1555b2e596a	c:\Program Files (x86)\FreeRide Games\Win8Launcher.exe
32b58f0e8502a24a50fd6e714e8b4eaa	c:\Program Files (x86)\FreeRide Games\X5Ex_Pr148.sys
8ab65f649dd26b8adb9995b31b5d8595	c:\Program Files (x86)\FreeRide Games\X5XSEx_Pr148.sys
ae81517636a17218e6fed6116452ccbc	c:\Program Files (x86)\FreeRide Games\cmhelper.exe
d5783da0f964882bc555a83da5e2bad5	c:\Program Files (x86)\FreeRide Games\exs.dll
55c38709c3c879b2d0fa24f751d2c824	c:\Program Files (x86)\FreeRide Games\glutil.dll
c330e3f40bb38bcb04e4743407c8b6c9	c:\Program Files (x86)\FreeRide Games\npExentControl.dll
2bf0c68e22ce28da549d85e38713955e	c:\Program Files (x86)\FreeRide Games\npGameTreatWidget.dll
9bc0902f50e58167b4b778ef6f1b1103	c:\Program Files (x86)\FreeRide Games\wh_Pr148.dll
1bf0fc52d41be3f3c1025b3971bc49a0	c:\Program Files (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSetup.dll
9afff8eae9918d5051b52eb432d6dac0	c:\Program Files (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.exe
1bf0fc52d41be3f3c1025b3971bc49a0	c:\ProgramData\FreeRide Games\ISSetup.dll
d5783da0f964882bc555a83da5e2bad5	c:\ProgramData\FreeRide Games\exs.dll
9afff8eae9918d5051b52eb432d6dac0	c:\ProgramData\FreeRide Games\setup.exe
1bf0fc52d41be3f3c1025b3971bc49a0	c:\Users\All Users\FreeRide Games\ISSetup.dll
d5783da0f964882bc555a83da5e2bad5	c:\Users\All Users\FreeRide Games\exs.dll
9afff8eae9918d5051b52eb432d6dac0	c:\Users\All Users\FreeRide Games\setup.exe
7ac9b56c15369c1c950d32e9084b9dde	c:\Windows\Downloaded Program Files\ExentControl.ocx
39c858645cbf37b83bc907e188f8bc85	c:\Windows\SysWOW64\d3dx9_32.dll
39c858645cbf37b83bc907e188f8bc85	c:\Windows\System32\d3dx9_32.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

Using the driver "038B9178 \??\%Program Files% (x86)\FreeRide Games\X5XSEx_Pr148.Sys" the Malware attaches its filter-device object to the Volume Device Object (VDO) of the file system driver.

Propagation

VersionInfo

Company Name: Exent Technologies Ltd.
Product Name: ExentCtl Module
Product Version: 07.02.00.01
Legal Copyright: Copyright (c) 1996-2007 Exent Technologies Ltd. All rights reserved.
Legal Trademarks:
Original Filename: ExentCtl.ocx
Internal Name: ExentCtl
File Version: 07.02.00.01
File Description: ExentCtl Module
Comments: Release.
Language: English (United States)

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Section MD5
.text	4096	67586	69632	4.53151	13d4df63a29071e604d09a6768d2e641
.rdata	73728	9413	12288	2.89315	1aae2e1490b0b801344569bed4d29505
.data	86016	19400	16384	0.903431	b02c7e2c998cd8ec273626efa37333f3
.rsrc	106496	963096	966656	5.36094	fd039aa7373d1f9040955ed82095602e

Dropped from:

Downloaded by:

Similar by SSDeep:

6e1af1017ec3546c111e3e628485d2f1

Similar by Lavasoft Polymorphic Checker:

Total found: 2
6e1af1017ec3546c111e3e628485d2f1
814af48a0a1cf3284b03e0d26c232363

URLs

URL	IP
hxxp://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=659050	8.25.144.120
hxxp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=659050&type=EN_NO_TB	8.25.144.120
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB	8.25.144.120
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB	8.25.144.120
hxxp://a1507.b.akamai.net/free/frg/products/659050/boxshot_sm.jpg
hxxp://a1697.b.akamai.net/FRG_site/downloads/geo/en/Exetender_Default.exe
hxxp://e8296.g.akamaiedge.net/check.jsp
hxxp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue Flo&GameId=659050	8.25.144.120
hxxp://a1697.b.akamai.net/freeride_marketing/SDM/SDM_standard/header.html
hxxp://23.64.208.80/meter/www.freeridegames.com/13.gif
hxxp://a1294.w20.akamai.net/beacon.js
hxxp://a1294.w20.akamai.net/b?c1=2&c2=6035233&ns__t=1422599206452&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=
hxxp://www-google-analytics.l.google.com/ga.js
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB	8.25.144.120
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
hxxp://www-google-analytics.l.google.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=618211728&utmhn=player.freeridegames.com&utmcs=windows-1252&utmsr=1716x901&utmvp=640x308&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Progress&utmhid=1440158697&utmr=-&utmp=/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue%20Flo&GameId=659050&utmht=1422599206728&utmac=UA-4994835-2&utmcc=__utma=1.2032673383.1422599207.1422599207.1422599207.1;+__utmz=1.1422599207.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1269284425&utmredir=1&utmu=qlAAAAAAAAAAAAAAAAAAAAAE~
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/js/defines.js
hxxp://e8296.g.akamaiedge.net/product/img/SDM/servicePromotion1.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg
hxxp://player.freeridegames.com/do/gateway?sId=Default	8.25.144.120
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationstart	8.25.144.120
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion2.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg
hxxp://a1507.b.akamai.net/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=playerinstallationfinished	8.25.144.120
hxxp://player.freeridegames.com/do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB	8.25.144.120
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1	8.25.144.120
hxxp://player.freeridegames.com/opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0	8.25.144.120
hxxp://player.freeridegames.com/opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB	8.25.144.120
hxxp://a1697.b.akamai.net/my_games?gameId=659050
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp
hxxp://a1697.b.akamai.net/static/marketing/main/css/main.css?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38
hxxp://a1697.b.akamai.net/static/marketing/header/css/header.css
hxxp://a1697.b.akamai.net/static/marketing/header/js/header.js
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38
hxxp://www-google-analytics.l.google.com/js/plusone.js
hxxp://player.freeridegames.com/do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599219446	8.25.144.120
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js
hxxp://a1697.b.akamai.net/static/marketing/main/css/templates.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/gamebox.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/sprite_sheet.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/hover_elements_sheet.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/tinybox.css
hxxp://a1697.b.akamai.net/static/marketing/main/css/download_assist.css
hxxp://a1697.b.akamai.net/static/marketing/main/img/background_pixel.jpg
hxxp://a1697.b.akamai.net/static/marketing/footer/css/footer.css
hxxp://a1697.b.akamai.net/static/marketing/header/img/ui_elements.png
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_left_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_right_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_pagenation_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_left_rib.jpg
hxxp://player.freeridegames.com/do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599219946	8.25.144.120
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_right_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/header/img/logo.png
hxxp://a1697.b.akamai.net/static/marketing/header/img/icons.png
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_pagenation_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot?
hxxp://a1507.b.akamai.net/free/frg/products/554350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/616550/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/450950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/608450/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/661050/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/680950/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/labels_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_top_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_corners.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/preload.gif
hxxp://a1507.b.akamai.net/free/frg/products/631850/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/558350/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/yellow_bottom_rib.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/sprite_sheet.png
hxxp://a1507.b.akamai.net/free/frg/products/616950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/589550/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_top_rib.jpg
hxxp://a1507.b.akamai.net/free/frg/products/633350/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_corners.jpg
hxxp://a1507.b.akamai.net/free/frg/products/563750/boxshot.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/containers/green_bottom_rib.jpg
hxxp://a1507.b.akamai.net/free/frg/products/668950/boxshot.jpg
hxxp://a1294.w20.akamai.net/connect/xd_arbiter/DU1Ia251o0y.js?version=41
hxxp://a1507.b.akamai.net/free/frg/products/710650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/624150/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/643650/boxshot.jpg
hxxp://a749.dsw4.akamai.net/connect/xd_arbiter/DU1Ia251o0y.js?version=41
hxxp://a1507.b.akamai.net/free/frg/products/575350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/582150/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/632750/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/761850/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/524350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/674750/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/571950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/719950/boxshot.jpg
hxxp://a1697.b.akamai.net/action/JSONService
hxxp://a1507.b.akamai.net/free/frg/products/559350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/699950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/642550/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/765950/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/701650/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/748750/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/766250/boxshot.jpg
hxxp://a1697.b.akamai.net/Security.xml
hxxp://a1507.b.akamai.net/free/frg/products/619350/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/578250/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/667850/boxshot.jpg
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7ef43f358967e0e4
hxxp://a1507.b.akamai.net/free/frg/products/735250/boxshot.jpg
hxxp://a1507.b.akamai.net/free/frg/products/764350/boxshot.jpg
hxxp://e6845.ce.akamaiedge.net/crls/secureca.crl
hxxp://www.public-trust.com/cgi-bin/CRL/2018/cdp.crl
hxxp://a1697.b.akamai.net/static/marketing/footer/img/footer_pixel.jpg
hxxp://a1697.b.akamai.net/static/marketing/main/img/hover_elements_sheet.png
hxxp://www-googletagmanager.l.google.com/gtm.js?id=GTM-MJF4W9
hxxp://stats.l.doubleclick.net/dc.js
hxxp://player.freeridegames.com/do/gateway?sId=FRG_Website&subId=&actid=&udom=partners.freeridegames.com	8.25.144.120
hxxp://star.c10r.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1aa58c94f2bf34&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ff30ab89be913e2c&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
hxxp://a1697.b.akamai.net/banners/default/300x250_INT_ROS_tribel.html
hxxp://a1697.b.akamai.net/banners/DE/Tribal/728x90_ros_de_tribal.html
hxxp://pagead.l.doubleclick.net/pagead/conversion_async.js
hxxp://stats.l.doubleclick.net/__utm.gif?utmwv=5.6.2dc&utms=1&utmn=1711251411&utmhn=partners.freeridegames.com&utmcs=utf-8&utmsr=1716x901&utmvp=1173x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Download free games, Play free games at FreeRide Games&utmhid=80483054&utmr=-&utmp=/my_games?gameId=659050&utmht=1422599221545&utmac=UA-4994835-25&utmcc=__utma=2252849.2023569898.1422599221.1422599221.1422599221.1;+__utmz=2252849.1422599221.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmu=q~
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/1018863546/?random=1422599221684&cv=7&fst=1422599221684&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/1057751771/?random=1422599221686&cv=7&fst=1422599221686&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://stats.l.doubleclick.net/__utm.gif?utmwv=5.6.2dc&utms=2&utmn=790040421&utmhn=partners.freeridegames.com&utmcs=utf-8&utmsr=1716x901&utmvp=1173x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Download free games, Play free games at FreeRide Games&utmhid=1024398902&utmr=-&utmp=/my_games?gameId=659050&utmht=1422599221790&utmac=UA-4994835-25&utmcc=__utma=2252849.2023569898.1422599221.1422599221.1422599221.1;+__utmz=2252849.1422599221.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmu=q~
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs=
hxxp://tags.expo9.exponential.com/tags/FreeRideGames/Germany_ROS/tags.js
hxxp://tags.expo9.exponential.com/tags/FreeRideGames/ROWROS/tags.js
hxxp://star.c10r.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1f4ae9d4166d89&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffd050ac5b52afc&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo=
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/1057751771/?random=1422599221891&cv=7&fst=1422599221891&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://pagead.l.doubleclick.net/pagead/viewthroughconversion/1018863546/?random=1422599221884&cv=7&fst=1422599221884&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://www.google.com/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3170539322
hxxp://e8218.ce.akamaiedge.net/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://www.google.com/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=2429367150
hxxp://www.google.com/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3601037774
hxxp://www.google.com/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=595483633
hxxp://cs9.wac.edgecastcdn.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys=
hxxp://www.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3601037774&ipr=y	173.194.113.223
hxxp://www.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=595483633&ipr=y	173.194.113.223
hxxp://www.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=2429367150&ipr=y	173.194.113.223
hxxp://www.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3170539322&ipr=y	173.194.113.223
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n
hxxp://a1507.b.akamai.net/MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O
hxxp://a1294.w20.akamai.net/pki/crl/products/MicrosoftRootAuthority.crl
hxxp://a1294.w20.akamai.net/pki/crl/products/MicWinHarComPCA_2010-11-01.crl
hxxp://a1294.w20.akamai.net/pki/crl/products/microsoftrootcert.crl
hxxp://a1294.w20.akamai.net/pki/crl/products/WinPCA.crl
hxxp://a1294.w20.akamai.net/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://a1621.g.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3b651923267984dc
hxxp://gs1.wac.v2cdn.net/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://hostedocsp.globalsign.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://a1697.b.akamai.net/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png
hxxp://player.freeridegames.com/do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599348437	8.25.144.120
hxxp://player.freeridegames.com/do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599348429	8.25.144.120
hxxp://a.tribalfusion.com/real/tags/FreeRideGames/Germany_ROS/tags.js
hxxp://a.tribalfusion.com/real/tags/FreeRideGames/ROWROS/tags.js
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCC0gVOkA+hgL
hxxp://www.public-trust.com/CRL/Omniroot2025.crl
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCG1HMsB+XmUO
hxxp://a.tribalfusion.com/displayAd.js?dver=0.4&th=8608858615
hxxp://gs1.wac.v2cdn.net/PublicSureServerSV.crl
hxxp://a.tribalfusion.com/j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=rowros&center=1&env=display&size=300x250&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19279864&a=1&adContainerId=richmedia_2&rnd=19283567
hxxp://a.tribalfusion.com/j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=germany_ros&center=1&env=display&size=728x90&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19279864&a=3&adContainerId=richmedia_4&rnd=19282202
hxxp://a.tribalfusion.com/j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=rowros&center=1&env=display&size=300x250&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19281807&a=1&adContainerId=richmedia_2&rnd=19279289
hxxp://a.tribalfusion.com/j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=germany_ros&center=1&env=display&size=728x90&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19281807&a=3&adContainerId=richmedia_4&rnd=19279832
hxxp://a.tribalfusion.com/p.media/avmPwnWHFXomUZdmVjnodfB3qni2tym3AZbFpFUZd0GMUYcZbY0VvMmaBS3bYWTFbZaUPv4PEbXSsFtQdFr1drnVA3M2GMYXbZbBUAir2PvcR6bK2Wrt1WBKndTM363Y4VnaUs38Uc78RAFuWd33UFMS5bIqWaMrVTMlQEJKSG3ZdQbesRHnbUVbaeua0Go/2713736/frame.html
hxxp://a.tribalfusion.com/p.media/awmPwn2FXxoWInYqPx2HbHQG7B2AnJmdiOVd760bM7YUQi0qqnSUnAUb3XTt3UobJnPUrt1TZbs5EFa4qj1mqFGYFfbUWM0nmfZcpGUqmHnJ3Erf2tmq5AnJprvEYcrTXsQYXGbnnEvT5U32VrnZbUAn5PqnXPVvMQd3w1drrWmry2sQ20UZbuhGKINZb/3002246/adTag.html
hxxp://ib.anycast.adnxs.com/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion
hxxp://ib.anycast.adnxs.com/ttj?id=1430727&referrer=www.freeridegames.com&ext_inv_code=TribalFusion
hxxp://ib.anycast.adnxs.com/bounce?/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion
hxxp://ib.anycast.adnxs.com/bounce?/ttj?id=1430727&referrer=www.freeridegames.com&ext_inv_code=TribalFusion
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430727&referrer=www.freeridegames.com&ext_inv_code=TribalFusion
hxxp://a1294.w20.akamai.net/p?c1=8&c2=6035746&c3=3054&c15=&cv=2.0&cj=1
hxxp://tags.wdc.bluekai.com/site/4229?id=18072662458704962385&redir=http://a.tribalfusion.com/i.match?p=b3&u=$_BK_UUID
hxxp://a1961.g.akamai.net/ANX_async_usersync.js
hxxp://pool.cast-prod-dlv-pull.ironsrc.netdna-cdn.com/scripts/au1107.html
hxxp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=www.freeridegames.com
hxxp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=www.freeridegames.com
hxxp://pool.cast-prod-dlv-pull.ironsrc.netdna-cdn.com/scripts/1/adnl.min.js
hxxp://ib.anycast.adnxs.com/a_usersync?cbfn=ANX_async_load
hxxp://a.tribalfusion.com/i.match?p=b3&u=QGc9Yy99999kB1+D
hxxp://217.79.188.10/js/adition.js
hxxp://aa.adfarm1.adition.com/js?wp_id=2659948
hxxp://imagesrv.adition.com/js/adition.js
hxxp://aa.adfarm1.adition.com/banner?sid=2659948&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=-1&h5s=0&wi=593011552&ac=1&screen_res=undefined&wpt=J&clickurl=
hxxp://aa.adfarm1.adition.com/banner?sid=2659948&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=-1&h5s=0&wi=200732349&ac=1&screen_res=undefined&wpt=J&clickurl=
hxxp://imagesrv.adition.com/js/acb/uid.html
hxxp://ad2.adfarm1.adition.com/js?wp_id=2554279&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=
hxxp://cast-prod-cs-delivery2.cloudapp.net/api/v/1/1107,1,0/?callback=cb_1422599350324&ts=1422599350324&connectionType=0&sessionId=Qvbxi&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://ib.anycast.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load
hxxp://cast-prod-cs-delivery2.cloudapp.net/api/v/1/1107,1,0/?callback=cb_1422599350355&ts=1422599350355&connectionType=0&sessionId=QuaTY&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=
hxxp://ad2.adfarm1.adition.com/js?wp_id=2554279&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=
hxxp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=
hxxp://pixel.ad.mlnadvertising.com/sync.ashx?partner=2591&psid=A1001&puid=3338670318734125865
hxxp://ads.w3hoster.de/adsi-j.php?s=14076&w=728&h=90&t=_blank&gpts=6110017589091237945
hxxp://ads.w3hoster.de/adsi-j.php?s=14076&w=728&h=90&t=_blank&gpts=6110017589092089913
hxxp://ib.anycast.adnxs.com/tt?id=2488352
hxxp://cast-prod-cs-delivery2.cloudapp.net/api/vp/1?clk=PXR3SD9nFWRRHbSWPOhcQ2Uu_4azObF4rx4Ca5gKE8BUd4iBKyn80qFKXHgtARTm0ftWLB8eBbJeWgtAIypzjg7eDYw-Kdll2VWqDUfnV_9Ipx2YyCQv9Hw093U62kwYzQwPeAU_bXtMctjJVnbBbgHZjkFYOYw4nkzmkr1UsGt4jcQsAoQ72m50_lHf-XGXXN5GMW7ivLh9fNTojvL0QWAMPqaNhHwo-QwUS0zKjtPIdlFGJh-hB8PDvRj4Qh56UWG73DKFuTBzwy_eiBhBTC46re7ry9jSrYKrd6AYoAg&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://cast-prod-cs-delivery2.cloudapp.net/api/vp/1?clk=0iO77Sl1u3WC4KyNH_vcLgX7eV1ko-HlUgZTKGhiNTl177HYZTv9w0vtO0TFys1eYQpuHB89izY3DtAS9fMQyiTKUpYwd5Jkt-2UWJ5-lYMzSc481jlWZBloByIjdDDdXA8SnZEVOmz8vixkwRF_z0KJ7cY7HTmcaioOKiNdvHq6jzBvpHZvj0S9YipGteQctT9q5fwHFBLdPMIYZBLzKM-1gcm3M0pZTkLzNlAA_z7F4ACE0PloVE8nlHSi4ZtArClytGYFWxRVdkgvL3k0cgZI_ZFeAKLTKraF72gcF6Q&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://imagesrv.adition.com/banners/533/oba_priv.sjs?oba=&domId=obaButton_6110017589091237945&btr=true&pos=top-right&cid=12452&aid=54647
hxxp://pixel.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A1001&puid=3338670318734125865
hxxp://imagesrv.adition.com/banners/533/oba_priv.sjs?oba=&domId=obaButton_6110017589092089913&btr=true&pos=top-right&cid=12452&aid=54647
hxxp://imagesrv.adition.com/js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_6110017589091237945&title=Advertising Alliance AG&text=Nutzungsbasierte Online-Werbung&url=http://www.advertising-alliance.de/opt-out.html&linkText=mehr Infos & deaktivieren&pos=top-right
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1422599329&bdh=SO02yqyQkNY1WzO0jjXO3C2hywU.&bdref=http://cdn.castplatform.com/scripts/au1107.html&bdtop=false&bdifs=4&id=2488352
hxxp://imagesrv.adition.com/js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_6110017589092089913&title=Advertising Alliance AG&text=Nutzungsbasierte Online-Werbung&url=http://www.advertising-alliance.de/opt-out.html&linkText=mehr Infos & deaktivieren&pos=top-right
hxxp://imagesrv.adition.com/js/adplayer/adplayer.min.css
hxxp://a1961.g.akamai.net/p/47/d1/cc/6b/47d1cc6bf034a7bd1124aee8bed80309.gif
hxxp://ib.anycast.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load
hxxp://ads.w3hoster.de/only.php?skrel=1&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=244535336147&r=2383948&cr=55818&sc=14076&re=hxxp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=www.freeridegames.com
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=245175&cr=55818&sc=14076&re=hxxp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=www.freeridegames.com
hxxp://ads.w3hoster.de/only.php?skrel=1&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==
hxxp://imagesrv.adition.com/js/adplayer/oba_icon.png
hxxp://ads.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==
hxxp://ads.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ac955129660
hxxp://c.live.com.nsatc.net/c.gif?anx_uid=3338670318734125865&Red3=MSAN_pd
hxxp://pagead.l.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzMzODY3MDMxODczNDEyNTg2NQ==
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7acd48572967
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ad179698380
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ac4d4470755
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ad553456474
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ad988118211
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7add59494056
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=8127c3635412
hxxp://ib.anycast.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620\|TOptOut=\|EANON=A%3d%26E%3dFFF%26W%3d1")
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=812f69926030
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=812ba9779386
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=8136a9601400
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=813322910071
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=813ab6358216
hxxp://ads.w3hoster.de/adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=813e73699780
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9474794&cr=58636&sc=14046&re=
hxxp://ib.anycast.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=2659804&cr=58414&sc=14046&re=
hxxp://adx.adnxs.com/mapuid?member=181&user=
hxxp://ad4.adfarm1.adition.com/js?wp_id=3086960&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad4.adfarm1.adition.com/js?wp_id=2566332&&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ds-any-world.ngd.ysm.yahoodns.net/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=1684536&cr=58588&sc=14046&re=
hxxp://ad4.adfarm1.adition.com/js?wp_id=2566327&&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58416_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ib.anycast.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=7418964&cr=58416&sc=14046&re=
hxxp://crt.comodoca.com/PositiveSSLCA.crt
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=6149992&cr=58700&sc=14046&re=
hxxp://ib.anycast.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load
hxxp://c.t4ft.de/c/de8640634.js
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=4775489&cr=58414&sc=14046&re=
hxxp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]
hxxp://adfarm1.adition.com/js?wp_id=65567&kid=1221974&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://any.edge.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif?meta=appNexus
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=6587465&cr=58620&sc=14046&re=
hxxp://ad2.adfarm1.adition.com/js?wp_id=2990114&kid=1210582&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://crt.comodoca.com/UTNAddTrustServerCA.crt
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9877122&cr=58585&sc=14046&re=
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=5711106&cr=58415&sc=14046&re=
hxxp://t.mookie1.com/rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=1869630&cr=58588&sc=14046&re=
hxxp://ad4.adfarm1.adition.com/js?wp_id=2566322&&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=4186957&cr=58636&sc=14046&re=
hxxp://ad2.adfarm1.adition.com/js?wp_id=3097401&kid=1219206&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58695_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ib.anycast.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=2017657&cr=58695&sc=14046&re=
hxxp://ib.anycast.adnxs.com/mapuid?member=364&user=3025970665045060
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9694363&cr=58697&sc=14046&re=
hxxp://ads.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9882440&cr=58415&sc=14046&re=
hxxp://ad2.adfarm1.adition.com/js?wp_id=3097401&kid=1221897&clickurl=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58697_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://crt.comodoca.com/AddTrustExternalCARoot.crl
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=-1&h5s=0&wi=652539272&ac=1&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865
hxxp://ad4.adfarm1.adition.com/banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=-1&h5s=0&wi=1733047328&ac=1&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ib.anycast.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load
hxxp://ad4.adfarm1.adition.com/banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=79&wi=1733047328&ac=2&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=64&wi=652539272&ac=2&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://na.gmtdmp.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865
hxxp://ib.anycast.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load
hxxp://crt.comodoca.com/UTN-USERFirst-Hardware.crl
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=3&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ib.anycast.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load
hxxp://ad4.adfarm1.adition.com/banner?sid=2566327&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=3&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58416_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=4&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://pixel.rubiconproject.net.akadns.net/tap.php?v=4894&nid=1986&put=3338670318734125865
hxxp://pixel.rubiconproject.net.akadns.net/tap.php?cookie_redirect=1&v=4894&nid=1986&put=3338670318734125865
hxxp://ad4.adfarm1.adition.com/banner?sid=2566327&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=4&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58416_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?id=537072399&val=3338670318734125865
hxxp://pug22000.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338670318734125865
hxxp://ocsp.comodoca.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRNDpBTXFXL4hq1AIFFLZkDOqgNdgQUuMoR6QYxedvDlMboGSq8uzUWMaQCEQCuH3DgeG4oxuqQCCTRf5D9
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?cc=1&id=537072399&val=3338670318734125865
hxxp://c.t4ft.de/bk/8640634?t=1422599352480&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&r=&f=1&cb=ftgs_8640634&x=
hxxp://adfarm1.adition.com/banner?sid=65567&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1221974&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ib.anycast.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load
hxxp://c.t4ft.de/bk/8640634?t=1422599352651&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&r=&f=1&cb=ftgs_8640634&x=
hxxp://pagead.l.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3338670318734125865
hxxp://ad4.adfarm1.adition.com/banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=5&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]
hxxp://c.t4ft.de/bk/8640634?t=1422599352685&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://ib.anycast.adnxs.com/setuid?entity=101&uid=3338670318734125865&code=CAESEOtIY_p5x_ubAlShQqSV770&google_cver=1
hxxp://c.t4ft.de/bk/8640634?t=1422599352774&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://any-pr.ybp.ysm.yahoodns.net/sync/msft/3338670318734125865
hxxp://ad4.adfarm1.adition.com/banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=6&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://c.t4ft.de/bk/8640634?t=1422599352825&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3338670318734125865;noCookies=t	209.94.144.19
hxxp://c.t4ft.de/bk/8640634?t=1422599352912&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://ad2.adfarm1.adition.com/banner?sid=2990114&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1210582&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3338670318734125865
hxxp://ad4.adfarm1.adition.com/banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=7&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=5&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3338670318734125865&mm_bnc&mm_bct
hxxp://ib.anycast.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=6&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3338670318734125865&url=hxxp://ib.adnxs.com/seg?add=673614
hxxp://ad4.adfarm1.adition.com/banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=8&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=7&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=8&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://anycast-europe.quantserve.com.akadns.net/dpixel?source=appnexus&eid=5&id=3338670318734125865
hxxp://ad2.adfarm1.adition.com/banner?sid=3097401&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1219206&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58695_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad4.adfarm1.adition.com/banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=9&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://ad2.adfarm1.adition.com/banner?sid=3097401&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1221897&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58697_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3338670318734125865&url=hxxp://ib.adnxs.com/seg?add=673614
hxxp://ad4.adfarm1.adition.com/banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=10&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl=
hxxp://dmp.3ay73.de/d/104/s/adex.js
hxxp://wlt-twiago.adspirit.info/adscript.php?pid=789&ord=6110017601960017977&rdclick=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl=
hxxp://dmp.3ay73.de/d/7727/d/t.js
hxxp://dmp.3ay73.de/d/104/6/s/analytic.js
hxxp://r.turn.com.akadns.net/r/bd?ddc=1&pid=54&cver=1&uid=3338670318734125865	46.228.164.11
hxxp://ad.ad-srv.net/zone/kw470o566d2z?subid=&redirectClick=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=http%3A%2F%2Fadfarm1.adition.com%2Fredi*lid%3D6110017597666427860%2Fsid%3D65567%2Fkid%3D1221974%2Fbid%3D3994675%2Fc%3D3001%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%3D
hxxp://dmp.3ay73.de/r/104/6/?c=100315090728510000
hxxp://ib.anycast.adnxs.com/getuid?http://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=$UID
hxxp://ad.ad-srv.net/request.php?zone=kw470o566d2z&nw=33&renderingType=javascript&namespace=e124e8caee&subid=&uid=undefined&screenSize=1716x901&screenSizeAvail=1716x857&clientSize=728x90&scrollPos=0x0&extData[]=&redirectClick=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=http%3A%2F%2Fadfarm1.adition.com%2Fredi*lid%3D6110017597666427860%2Fsid%3D65567%2Fkid%3D1221974%2Fbid%3D3994675%2Fc%3D3001%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%3D&documentReferer=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&ancestorOrigins=null&random=1275017335058&isIframe=1&container=&adPos=0x1970&adPosCheck=1x1971&adtagId=undefined
hxxp://uip.semasio.net/edn/1/info?_referrer=&sType=view&nCampaignId=2&nBannerId=2&nJs=1&_ignore=88126221955592050&nIframe=1	77.66.54.155
hxxp://pagead.l.doubleclick.net/pixel?google_nid=theadex_dmp&google_cm&axd_cuid=104&c=100315090728510000
hxxp://w5.b.cap-mii.net/imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=246631.83414114974
hxxp://dmp.3ay73.de/d/cm.gif?axd_pid=8&axd_fuid=CAESECAbMZA9QydOGSzhQC_fPEc&google_cver=1&axd_cuid=104&c=100315090728510000
hxxp://dmp.3ay73.de/d/104/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=3338670318734125865
hxxp://uip.semasio.net/edn/1/info2?_referrer=&sType=view&nCampaignId=2&nBannerId=2&nJs=1&_ignore=88126221955592050&nIframe=1	77.66.54.155
hxxp://dsp.adfarm1.adition.com/cookie.php?url=http://dsp.active-agent.com/cookie/?ssp=3&userid=%COOKIE%
hxxp://dsp.adfarm1.adition.com/cookie.php?url=http://dsp.active-agent.com/cookie/?dmp=1&userid=%COOKIE%&xxx=104&c=100315090728510000
hxxp://d.turn.com.akadns.net/r/dd/id/L2NzaWQvMS9jaWQvMjg0NDg2MjYvdC8y/dpuid/100315090728510000
hxxp://d.turn.com.akadns.net/r/dd/id/L2NzaWQvMS9jaWQvMjg0NjAyMTcvdC8w/url/hxxp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=$!{TURN_UUID}
hxxp://track-eu.adform.net/serving/cookie/match/?party=1010&adx_id=104
hxxp://ad.ad-srv.net/request.php?zone=kw470o566d2z&nw=33&renderingType=javascript&namespace=e124e8caee&subid=&uid=undefined&screenSize=1716x901&screenSizeAvail=1716x857&clientSize=728x90&scrollPos=0x0&extData[]=&redirectClick=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=http%3A%2F%2Fadfarm1.adition.com%2Fredi*lid%3D6110017597666427860%2Fsid%3D65567%2Fkid%3D1221974%2Fbid%3D3994675%2Fc%3D3001%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%3D&documentReferer=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&ancestorOrigins=null&random=1275017335058&isIframe=1&container=&adPos=0x1970&adPosCheck=1x1971&adtagId=undefined&uidRedirect=1
hxxp://track-eu.adform.net/serving/cookie/match/?CC=1&party=1010&adx_id=104
hxxp://dmp.3ay73.de/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=3614204343869728150
hxxp://w5.b.cap-mii.net/imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=369662.84632262785
hxxp://fra-ad-lb1.rfihub.com/cm?in=1&pub=345&userid=3338670318734125865
hxxp://star.c10r.facebook.com/fr/u.php?m=2821299455705972228&p=328546547221502&t=2592000
hxxp://dsp.adfarm1.adition.com/cookie.php?url=http://dsp.active-agent.com/cookie/?ssp=2&userid=%COOKIE%
hxxp://dmp.3ay73.de/d/104/i/2.gif?axd_pid=2&axd_fuid=5393689920369647502
hxxp://dsp.adfarm1.adition.com/cookie.php?url=http://dsp.active-agent.com/cookie/?ssp=1&userid=%COOKIE%
hxxp://w27.b.cap-mii.net/ping_match.gif?st=ADEX&rurl=http://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=6&axd_fuid=_wfivefivec_
hxxp://sync.active-agent.com/cookie/?ssp=3&userid=6110017589072035866
hxxp://sync.active-agent.com/cookie/?dmp=1&xxx=104&c=100315090728510000&userid=6110017589072035866
hxxp://dmp.3ay73.de/d/104/i/2.gif?c=100315090728510000&axd_pid=14&axd_fuid=6110017589072035866
hxxp://w5.b.cap-mii.net/imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=703830.1892982249
hxxp://sync.active-agent.com/cookie/?ssp=1&userid=6110017589072035866
hxxp://ib.anycast.adnxs.com/setuid?entity=254&code=6110017589072035866
hxxp://dmp.3ay73.de/d/104/6/i/1.gif?c=100315090728510000&t=1&location=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&protocol=http://&inframe=1&csource=1&tzo=-120
hxxp://dmp.3ay73.de/d/104/i/2.gif?c=100315090728510000&axd_pid=6&axd_fuid=7052af40-cf8f-45f7-952e-25f4ab050d93
hxxp://wlt-twiago.adspirit.info/adscript.php?&ref=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&vis=0&pid=789&ord=6110017601960017977&rdclick=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl=
hxxp://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a
hxxp://e3120.g.akamaiedge.net/m?dt_id=15233&ext_id=6110017589072035866
hxxp://c.t4ft.de/c/de8774481.js
hxxp://c.t4ft.de/bk/8774481?t=1422599354266&l=http://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a&r=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&f=1&cb=ftgs_8774481&x=
hxxp://p-aws-oregon-tag-01-1110002569.us-west-2.elb.amazonaws.com/e/xrefid.xgi?na_exid=3338670318734125865&na_pid=2684
hxxp://wlt-twiago.adspirit.info/adscript.php?&ref=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&vis=2&pid=789&ord=6110017601960017977&rdclick=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl=
hxxp://accado.adspirit.de/adscript.php?pid=2344&ord=1422599332&rdclick_0=hxxp://n18.ad.ad-srv.net/c/pfc9mz4nx5zb1se?tprd=
hxxp://accado.adspirit.de/adview.php?tz=1422599332779175&pid=2344&kid=333&wmid=7152&nvc=1&target=-
hxxp://cache2.ipercast.net/banner/asm_flashme.js
hxxp://cache2.ipercast.net/banner/accado/333/2014-12-23/0_OtrivinNight_160x600_GER.gif
hxxp://e2236.g.akamaiedge.net/xre/107/1078532/922460/js/j-1078532-922460.js
hxxp://a1697.b.akamai.net/favicon.ico
hxxp://wlt-twiago.adspirit.info/adview.php?tz=1422599332803860&pid=789&kid=4&wmid=3826&sid=4&nvc=1&target1=-
hxxp://wlt-twiago.adspirit.info/adview.php?tz=142259933223254&pid=789&kid=4&wmid=4015&sid=4&nvc=1&swid=3826&target1=-
hxxp://wlt-twiago.adspirit.info/adview.php?tz=142259933223254&pid=789&kid=4&wmid=3348&sid=4&nvc=1&swid=3826&target1=-
hxxp://wlt-twiago.adspirit.info/adview.php?tz=142259933223254&pid=789&kid=4&wmid=4178&sid=4&nvc=1&swid=3826&target1=-
hxxp://cache2.ipercast.net/banner/twiago/676/2014-10-31/0_Teilen16_9.jpeg
hxxp://cache2.ipercast.net/banner/twiago/761/2014-12-18/0_NCR_NE_Kampagne_Performance_1114_00_000_300x169.jpg
hxxp://cache2.ipercast.net/banner/twiago/815/2014-12-23/0_z010_300x169.jpg
hxxp://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=appnexus
hxxp://ad3.adfarm1.adition.com/js?wp_id=2813375&kid=1211553
hxxp://cm.adgrx.com/bridge.gif?AG_PID=appnexus
hxxp://wlt-twiago.adspirit.info/adview.php?tz=1422599315415646&pid=789&kid=4&wmid=4015&sid=4&nvc=1&swid=3826&target1=-
hxxp://wlt-twiago.adspirit.info/adview.php?tz=1422599315949108&pid=789&kid=4&wmid=3826&sid=4&nvc=1&target1=-
hxxp://wlt-twiago.adspirit.info/adview.php?tz=1422599315415646&pid=789&kid=4&wmid=4178&sid=4&nvc=1&swid=3826&target1=-
hxxp://wlt-twiago.adspirit.info/adview.php?tz=1422599315415646&pid=789&kid=4&wmid=3348&sid=4&nvc=1&swid=3826&target1=-
hxxp://ib.anycast.adnxs.com/setuid?entity=94&code=42a09b72-a849-11e4-a60c-78e7d1f6c9c0
hxxp://e2236.g.akamaiedge.net/pageFold/ftpagefold_v3.0.18.js
hxxp://w5.b.cap-mii.net/imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?764305987
hxxp://w5.b.cap-mii.net/imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?167021385
hxxp://ad3.adfarm1.adition.com/banner?sid=2813375&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1211553&screen_res=undefined&wpt=J&clickurl=
hxxp://271282852.r.cdn77.net/banner/twiago/815/2014-12-23/0_z010_300x169.jpg
hxxp://271282852.r.cdn77.net/banner/twiago/676/2014-10-31/0_Teilen16_9.jpeg
hxxp://271282852.r.cdn77.net/banner/twiago/761/2014-12-18/0_NCR_NE_Kampagne_Performance_1114_00_000_300x169.jpg
hxxp://imagesrv.adition.com/banners/250/files/00/00/03/9c/000000000924.gif
hxxp://w5.b.cap-mii.net/imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?694091172
hxxp://e2236.g.akamaiedge.net/xre/107/1078532/922460/image/922460.gif
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-608672771
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-166351247
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-435101647
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-813111153
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-241392218
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-588683927
hxxp://data-agkn-com-1834377660.eu-west-1.elb.amazonaws.com/pixel/2605/?che=022311&puid=3338670318734125865
hxxp://www-google-analytics.l.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCUoyoQiZhRO
hxxp://hostedocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM
hxxp://VA6DCSLB-2147269655.us-east-1.elb.amazonaws.com/ibs:dpid=358&dpuuid=3338670318734125865
hxxp://e6845.ce.akamaiedge.net/ThawtePremiumServerCA.crl
hxxp://hostedocsp.globalsign.com/gsorganizationvalg2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBReGXQV/tqUV3SNMRE+s25eR/vhjwQUXUayjcRLdBy77fVztjq3OI91nn4CEhEhsdKok21jslbiISkSn7ME6Q==
hxxp://VA6DCSLB-2147269655.us-east-1.elb.amazonaws.com/demconf.jpg?et:ibs\|data:dpid=358&dpuuid=3338670318734125865
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEE1fLDQIskwgzW1QfiRNyew=
hxxp://pagead.l.doubleclick.net/pixel?google_nid=accordant_dmp&google_cm&google_ck=1&APN=3338670318734125865
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQxsL2eHTbKwjJcY2gHLbXTx2GdSQQUp6KDuzRFQD381TBPErk+oQGf9tsCEAKOMv/kt6CYURxbwlEF3S8=
hxxp://d386jaag4hn9zl.cloudfront.net/gx.png?APN=3338670318734125865&google_gid=CAESENmAYpTPZntugDgw3jO6nz4&google_cver=1
hxxp://d.p-td.com.turn.com.akadns.net/r/dt/id/L21rdC80L21waWQvMjMwNjY2NTM/mpuid/3338670318734125865
hxxp://ib.anycast.adnxs.com/seg?add=
hxxp://ib.anycast.adnxs.com/getuid?https://p.adsymptotic.com/d/px?_pid=11272&_psign=cc9e6108df5584f8b2442f78e2d3c78d&_puuid=3338670318734125865
hxxp://sync.active-agent.com/cookie/?ssp=2&userid=6110017589072035866
hxxp://pagead.l.doubleclick.net/pixel?google_nid=agent&google_hm=NjExMDAxNzU4OTA3MjAzNTg2Ng==&type=response
hxxp://dsp.active-agent.com/cookie/?ssp=2&type=response
hxxp://sync.nj.zenoviaexchange.com/usersync2/apnx
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEG7MeqWnAyAJuM689OlS1JE=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEChTiL6sps8WmjYtXlOSTfM=
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=28&redir=http://sync.zenoviaexchange.com/usersync3/mediamath/1425/[MM_UUID]?zderedir=&zcc=1
hxxp://sync.nj.zenoviaexchange.com/usersync3/mediamath/1425/dbf254cb-24a3-4e00-920d-6f1d855c1a7b?zderedir=&zcc=1
hxxp://ib.anycast.adnxs.com/setuid?entity=227&code=ZU01v04-9561478d62191c1b11d185ac951f145d
hxxp://pxl.ace.advertising.com.adcom.akadns.net/cfcm.ashx?providerId=1006&appnexus_uid=3338670318734125865&$extMatch=1
hxxp://idsync-ext.rlcdn.com/379828.gif?partner_uid=3338670318734125865
hxxp://pixel.tapad.com/idsync/appnexus/receivethenpush?adnxs_uid=3338670318734125865
hxxp://ib.anycast.adnxs.com/setuid?entity=45&code=44b72611-a849-11e4-a895-005056a2376a
hxxp://idsync-ext.rlcdn.com/379828.gif?partner_uid=3338670318734125865&redirect=1
hxxp://track-eu.adform.net/serving/cookie/match/?party=3&id=3338670318734125865&mt=1
hxxp://global.ib-ibi.com/image.sbmx?go=242840&pid=260&xid=3338670318734125865&id1=
hxxp://w27.b.cap-mii.net/ping_match.gif?ei=AN&rurl=hxxp://ib.adnxs.com/setuid?entity=17&code=_wfivefivec_
hxxp://ib.anycast.adnxs.com/setuid?entity=17&code=7052af40-cf8f-45f7-952e-25f4ab050d93
hxxp://m.ib-ibi.com/image.sbmx?go=242840&pid=260&xid=3338670318734125865&id1=
hxxp://x.skimresources.com/?provider=captify&uid=3338670318734125865	54.246.183.156
hxxp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=bb2907ac1b42e83598c555edb1d581a2&uid=3338670318734125865
hxxp://ib.anycast.adnxs.com/getuid?hxxp://r.casalemedia.com/rum?cm_dsp_id=46&external_user_id=$UID
hxxp://e867.g.akamaiedge.net/rum?cm_dsp_id=46&external_user_id=3338670318734125865
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-955826505-0x0x51x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-492280933-0x0x50x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-70178975-0x0x50x0
hxxp://loadus.tm.ssl.exelator.com/load/?p=204&g=013&bi=3338670318734125865&j=0
hxxp://s3-1-w.amazonaws.com/pixel.gif
hxxp://map.dynectmedia6degrees.com/orbserv/hbpix?pixId=4138&pcv=33&ptid=9&tpuv=01&tpu=3338670318734125865
hxxp://map.dynectmedia6degrees.com/orbserv/hbpix?pixId=4138&pcv=33&tpu=3338670318734125865&ptid=9&tpuv=01&cckz=true
hxxp://ib.anycast.adnxs.com/setuid?entity=25&code=st6099ce4pic
hxxp://iad03-login.dotomi.com/appnexus/match?nuid=3338670318734125865
hxxp://iad03-login.dotomi.com/appnexus/match?dtm_test=236c4565ef5118a4&nuid=3338670318734125865
hxxp://ams02-login.dotomi.com/appnexus/match?fpc=2366&pnid=1982&nuid=3338670318734125865&trid=574502685977146491&fpctok=1&nuid=3338670318734125865
hxxp://disp.tidaltv.com/user?p=2b4fd3fbe1d8cdc4&r=1
hxxp://contextweb.map.fastly.net/bh/rtset?do=add&pid=545979&ev=3338670318734125865
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-665026422-0x0x175x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-603447532-0x0x175x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-516200727-0x0x175x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-245894870-0x0x302x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-545696636-0x0x302x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-131952831-0x0x302x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-225115148-0x0x601x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-488605887-0x0x601x0
hxxp://e2236.g.akamaiedge.net/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-597843830-0x0x600x0
hxxp://redirector.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe
hxxp://r3.sn-3c27ln7s.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://a749.dsw4.akamai.net/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://e8218.ce.akamaiedge.net/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k=
hxxp://ib.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load
hxxp://ib.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load
hxxp://cdn.adnxs.com/ANX_async_usersync.js	88.221.133.25
hxxp://ib.adnxs.com/tt?id=2488352
hxxp://t4ft.de/bk/8774481?t=1422599354266&l=http://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a&r=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&f=1&cb=ftgs_8774481&x=
hxxp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe
hxxp://cdn5.adspirit.de/banner/twiago/815/2014-12-23/0_z010_300x169.jpg
hxxp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif?meta=appNexus	204.79.197.200
hxxp://cdn.flashtalking.com/pageFold/ftpagefold_v3.0.18.js
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif
hxxp://ib.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load
hxxp://img.exent.com/free/frg/products/571950/boxshot.jpg
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_corners.jpg
hxxp://r3---sn-3c27ln7s.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1	173.194.21.114
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_bottom_rib.jpg
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?3b651923267984dc
hxxp://img.exent.com/free/frg/products/661050/boxshot.jpg
hxxp://img.exent.com/free/frg/products/608450/boxshot.jpg
hxxp://ib.adnxs.com/ttj?id=1430727&referrer=www.freeridegames.com&ext_inv_code=TribalFusion
hxxp://partners.freeridegames.com/favicon.ico
hxxp://servedby.flashtalking.com/imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?167021385
hxxp://ib.adnxs.com/a_usersync?cbfn=ANX_async_load
hxxp://c13.w3hoster.de/only.php?skrel=1&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==	85.195.90.127
hxxp://ib.adnxs.com/setuid?entity=254&code=6110017589072035866
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1018863546/?random=1422599221884&cv=7&fst=1422599221884&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38
hxxp://img.exent.com/free/frg/products/624150/boxshot.jpg
hxxp://cdn5.adspirit.de/banner/accado/333/2014-12-23/0_OtrivinNight_160x600_GER.gif
hxxp://crl.omniroot.com/PublicSureServerSV.crl
hxxp://ib.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load
hxxp://crl.verisign.com/pca3.crl	23.43.133.163
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=6587465&cr=58620&sc=14046&re=	85.195.90.127
hxxp://idsync.rlcdn.com/379828.gif?partner_uid=3338670318734125865
hxxp://img.exent.com/free/frg/products/632750/boxshot.jpg
hxxp://partners.freeridegames.com/static/marketing/main/css/download_assist.css
hxxp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=3614204343869728150
hxxp://a.twiago.com/adscript.php?&ref=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&vis=2&pid=789&ord=6110017601960017977&rdclick=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl=
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_right_rib.jpg
hxxp://e.nexac.com/e/xrefid.xgi?na_exid=3338670318734125865&na_pid=2684
hxxp://pixel.rubiconproject.com/tap.php?v=4894&nid=1986&put=3338670318734125865
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1057751771/?random=1422599221891&cv=7&fst=1422599221891&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://ib.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load
hxxp://ib.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load
hxxp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=3338670318734125865
hxxp://cdn.adnxs.com/p/47/d1/cc/6b/47d1cc6bf034a7bd1124aee8bed80309.gif	88.221.133.25
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599329&bdh=SO02yqyQkNY1WzO0jjXO3C2hywU.&bdref=http://cdn.castplatform.com/scripts/au1107.html&bdtop=false&bdifs=4&id=2488352
hxxp://img.exent.com/free/frg/products/668950/boxshot.jpg
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-245894870-0x0x302x0
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCG1HMsB+XmUO
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion
hxxp://stats.g.doubleclick.net/dc.js	173.194.66.157
hxxp://dmp.theadex.com/r/104/6/?c=100315090728510000
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3338670318734125865&mm_bnc&mm_bct
hxxp://ib.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-597843830-0x0x600x0
hxxp://ib.adnxs.com/setuid?entity=101&uid=3338670318734125865&code=CAESEOtIY_p5x_ubAlShQqSV770&google_cver=1
hxxp://img.exent.com/free/frg/products/680950/boxshot.jpg
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_corners.jpg
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=1869630&cr=58588&sc=14046&re=	85.195.90.127
hxxp://ib.adnxs.com/setuid?entity=227&code=ZU01v04-9561478d62191c1b11d185ac951f145d
hxxp://dmp.theadex.com/d/104/6/i/1.gif?c=100315090728510000&t=1&location=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&protocol=http://&inframe=1&csource=1&tzo=-120
hxxp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html
hxxp://ib.adnxs.com/getuid?hxxp://r.casalemedia.com/rum?cm_dsp_id=46&external_user_id=$UID
hxxp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==	85.195.90.127
hxxp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620\|TOptOut=\|EANON=A%3d%26E%3dFFF%26W%3d1")
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzMzODY3MDMxODczNDEyNTg2NQ==
hxxp://tags.bluekai.com/site/4229?id=18072662458704962385&redir=http://a.tribalfusion.com/i.match?p=b3&u=$_BK_UUID
hxxp://partners.freeridegames.com/static/marketing/main/css/tinybox.css
hxxp://ib.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load
hxxp://ib.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load
hxxp://sync.zenoviaexchange.com/usersync3/mediamath/1425/dbf254cb-24a3-4e00-920d-6f1d855c1a7b?zderedir=&zcc=1
hxxp://www.google-analytics.com/r/__utm.gif?utmwv=5.6.2&utms=1&utmn=618211728&utmhn=player.freeridegames.com&utmcs=windows-1252&utmsr=1716x901&utmvp=640x308&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Progress&utmhid=1440158697&utmr=-&utmp=/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue%20Flo&GameId=659050&utmht=1422599206728&utmac=UA-4994835-2&utmcc=__utma=1.2032673383.1422599207.1422599207.1422599207.1;+__utmz=1.1422599207.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmjid=1269284425&utmredir=1&utmu=qlAAAAAAAAAAAAAAAAAAAAAE~
hxxp://t4ft.de/bk/8640634?t=1422599352651&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&r=&f=1&cb=ftgs_8640634&x=
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38
hxxp://partners.freeridegames.com/static/marketing/header/css/header.css
hxxp://ib.adnxs.com/bounce?/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion
hxxp://partners.freeridegames.com/action/JSONService
hxxp://img.exent.com/free/frg/products/633350/boxshot.jpg
hxxp://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NjAyMTcvdC8w/url/hxxp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=$!{TURN_UUID}
hxxp://a.twiago.com/adview.php?tz=1422599315415646&pid=789&kid=4&wmid=4015&sid=4&nvc=1&swid=3826&target1=-
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=2659804&cr=58414&sc=14046&re=	85.195.90.127
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38
hxxp://www.google-analytics.com/ga.js
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-225115148-0x0x601x0
hxxp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338670318734125865	198.47.127.15
hxxp://t4ft.de/bk/8640634?t=1422599352685&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html
hxxp://partners.freeridegames.com/my_games?gameId=659050
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCUoyoQiZhRO
hxxp://cdn.castplatform.com/scripts/au1107.html
hxxp://stats.g.doubleclick.net/__utm.gif?utmwv=5.6.2dc&utms=1&utmn=1711251411&utmhn=partners.freeridegames.com&utmcs=utf-8&utmsr=1716x901&utmvp=1173x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Download free games, Play free games at FreeRide Games&utmhid=80483054&utmr=-&utmp=/my_games?gameId=659050&utmht=1422599221545&utmac=UA-4994835-25&utmcc=__utma=2252849.2023569898.1422599221.1422599221.1422599221.1;+__utmz=2252849.1422599221.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmu=q~	173.194.66.157
hxxp://img.exent.com/free/frg/products/450950/boxshot.jpg
hxxp://c.bing.com/c.gif?anx_uid=3338670318734125865&Red3=MSAN_pd
hxxp://ib.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load
hxxp://dmp.theadex.com/d/104/i/2.gif?axd_pid=2&axd_fuid=5393689920369647502
hxxp://d.agkn.com/pixel/2605/?che=022311&puid=3338670318734125865	54.76.37.114
hxxp://i.w55c.net/ping_match.gif?ei=AN&rurl=hxxp://ib.adnxs.com/setuid?entity=17&code=_wfivefivec_
hxxp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865
hxxp://a.twiago.com/adview.php?tz=1422599315415646&pid=789&kid=4&wmid=4178&sid=4&nvc=1&swid=3826&target1=-
hxxp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=6&axd_fuid=7052af40-cf8f-45f7-952e-25f4ab050d93
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430727&referrer=www.freeridegames.com&ext_inv_code=TribalFusion
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys=
hxxp://d.p-td.com/r/dt/id/L21rdC80L21waWQvMjMwNjY2NTM/mpuid/3338670318734125865
hxxp://cdn.adspirit.de/banner/twiago/676/2014-10-31/0_Teilen16_9.jpeg
hxxp://pr.ybp.yahoo.com/sync/msft/3338670318734125865
hxxp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3338670318734125865	46.228.164.11
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=7418964&cr=58416&sc=14046&re=	85.195.90.127
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_right_rib.jpg
hxxp://img.exent.com/free/frg/products/616950/boxshot.jpg
hxxp://www.googleadservices.com/pagead/conversion_async.js
hxxp://img.exent.com/free/frg/products/642550/boxshot.jpg
hxxp://b.scorecardresearch.com/b?c1=2&c2=6035233&ns__t=1422599206452&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9=	88.221.133.19
hxxp://ib.mookie1.com/image.sbmx?go=242840&pid=260&xid=3338670318734125865&id1=
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEG7MeqWnAyAJuM689OlS1JE=
hxxp://partners.freeridegames.com/static/marketing/footer/img/footer_pixel.jpg
hxxp://ib.adnxs.com/bounce?/ttj?id=1430727&referrer=www.freeridegames.com&ext_inv_code=TribalFusion
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo=
hxxp://servedby.flashtalking.com/imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?764305987
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-492280933-0x0x50x0
hxxp://dpm.demdex.net/demconf.jpg?et:ibs\|data:dpid=358&dpuuid=3338670318734125865
hxxp://t4ft.de/bk/8640634?t=1422599352774&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://crl.microsoft.com/pki/crl/products/WinPCA.crl
hxxp://ib.adnxs.com/setuid?entity=45&code=44b72611-a849-11e4-a895-005056a2376a
hxxp://pixel.rubiconproject.com/tap.php?cookie_redirect=1&v=4894&nid=1986&put=3338670318734125865
hxxp://partners.freeridegames.com/static/marketing/footer/css/footer.css
hxxp://connect.facebook.net/en_US/all.js	23.64.223.139
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=5711106&cr=58415&sc=14046&re=	85.195.90.127
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_left_rib.jpg
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-70178975-0x0x50x0
hxxp://partners.freeridegames.com/Security.xml
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38
hxxp://a.twiago.com/adscript.php?pid=789&ord=6110017601960017977&rdclick=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl=
hxxp://t4ft.de/bk/8640634?t=1422599352480&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&r=&f=1&cb=ftgs_8640634&x=
hxxp://crl.comodoca.com/AddTrustExternalCARoot.crl
hxxp://vassg141.ocsp.omniroot.com/MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O
hxxp://img.exent.com/free/frg/products/589550/boxshot.jpg
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg
hxxp://servedby.flashtalking.com/imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?694091172
hxxp://img.exent.com/free/frg/products/674750/boxshot.jpg
hxxp://cdn.adspirit.de/banner/twiago/761/2014-12-18/0_NCR_NE_Kampagne_Performance_1114_00_000_300x169.jpg
hxxp://crl.microsoft.com/pki/crl/products/MicWinHarComPCA_2010-11-01.crl
hxxp://ib.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-955826505-0x0x51x0
hxxp://c13.w3hoster.de/only.php?skrel=1&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==	85.195.90.127
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
hxxp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html
hxxp://a.twiago.com/adview.php?tz=1422599332803860&pid=789&kid=4&wmid=3826&sid=4&nvc=1&target1=-
hxxp://cdn.flashtalking.com/xre/107/1078532/922460/image/922460.gif
hxxp://partners.freeridegames.com/static/marketing/header/js/header.js
hxxp://d.castplatform.com/api/v/1/1107,1,0/?callback=cb_1422599350324&ts=1422599350324&connectionType=0&sessionId=Qvbxi&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_pagenation_rib.jpg
hxxp://partners.freeridegames.com/static/marketing/header/img/ui_elements.png
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=1684536&cr=58588&sc=14046&re=	85.195.90.127
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEChTiL6sps8WmjYtXlOSTfM=
hxxp://cdn.adspirit.de/banner/twiago/815/2014-12-23/0_z010_300x169.jpg
hxxp://d.castplatform.com/api/v/1/1107,1,0/?callback=cb_1422599350355&ts=1422599350355&connectionType=0&sessionId=QuaTY&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://img.exent.com/free/frg/products/554350/boxshot.jpg
hxxp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
hxxp://img.exent.com/free/frg/products/631850/boxshot.jpg
hxxp://c1.adform.net/serving/cookie/match/?party=1010&adx_id=104
hxxp://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM
hxxp://servedby.flashtalking.com/imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=369662.84632262785
hxxp://tb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQxsL2eHTbKwjJcY2gHLbXTx2GdSQQUp6KDuzRFQD381TBPErk+oQGf9tsCEAKOMv/kt6CYURxbwlEF3S8=
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3338670318734125865
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-241392218
hxxp://partners.freeridegames.com/static/marketing/main/img/sprite_sheet.png
hxxp://d.castplatform.com/api/vp/1?clk=PXR3SD9nFWRRHbSWPOhcQ2Uu_4azObF4rx4Ca5gKE8BUd4iBKyn80qFKXHgtARTm0ftWLB8eBbJeWgtAIypzjg7eDYw-Kdll2VWqDUfnV_9Ipx2YyCQv9Hw093U62kwYzQwPeAU_bXtMctjJVnbBbgHZjkFYOYw4nkzmkr1UsGt4jcQsAoQ72m50_lHf-XGXXN5GMW7ivLh9fNTojvL0QWAMPqaNhHwo-QwUS0zKjtPIdlFGJh-hB8PDvRj4Qh56UWG73DKFuTBzwy_eiBhBTC46re7ry9jSrYKrd6AYoAg&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://partners.freeridegames.com/static/marketing/main/img/hover_elements_sheet.png
hxxp://ib.adnxs.com/getuid?http://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=$UID
hxxp://cdn.castplatform.com/scripts/1/adnl.min.js
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38
hxxp://partners.freeridegames.com/static/marketing/main/css/templates.css
hxxp://dtm.gap.com/appnexus/match?fpc=2366&pnid=1982&nuid=3338670318734125865&trid=574502685977146491&fpctok=1&nuid=3338670318734125865
hxxp://img.exent.com/free/frg/products/748750/boxshot.jpg
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_bottom_rib.jpg
hxxp://crl.thawte.com/ThawtePremiumServerCA.crl
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-516200727-0x0x175x0
hxxp://us-u.openx.net/w/1.0/sd?id=537072399&val=3338670318734125865
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38
hxxp://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl
hxxp://a.twiago.com/adview.php?tz=142259933223254&pid=789&kid=4&wmid=4178&sid=4&nvc=1&swid=3826&target1=-
hxxp://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html
hxxp://img.exent.com/free/frg/products/659050/boxshot_sm.jpg
hxxp://partners.freeridegames.com/static/marketing/main/img/background_pixel.jpg
hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7ef43f358967e0e4
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9877122&cr=58585&sc=14046&re=	85.195.90.127
hxxp://ib.adnxs.com/getuid?https://p.adsymptotic.com/d/px?_pid=11272&_psign=cc9e6108df5584f8b2442f78e2d3c78d&_puuid=3338670318734125865
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-608672771
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38
hxxp://partners.freeridegames.com/static/marketing/main/css/sprite_sheet.css
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38
hxxp://img.exent.com/free/frg/products/699950/boxshot.jpg
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9474794&cr=58636&sc=14046&re=	85.195.90.127
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp
hxxp://dmp.theadex.com/d/104/6/s/analytic.js
hxxp://c1.adform.net/serving/cookie/match/?party=3&id=3338670318734125865&mt=1
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-603447532-0x0x175x0
hxxp://g.symcd.com/MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg==
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY=
hxxp://cm.g.doubleclick.net/pixel?google_nid=accordant_dmp&google_cm&google_ck=1&APN=3338670318734125865
hxxp://cdn.flashtalking.com/xre/107/1078532/922460/js/j-1078532-922460.js
hxxp://apnx-match.dotomi.com/appnexus/match?dtm_test=236c4565ef5118a4&nuid=3338670318734125865
hxxp://img.exent.com/free/frg/products/563750/boxshot.jpg
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEE1fLDQIskwgzW1QfiRNyew=
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css
hxxp://partners.freeridegames.com/static/marketing/main/css/hover_elements_sheet.css
hxxp://idpix.media6degrees.com/orbserv/hbpix?pixId=4138&pcv=33&ptid=9&tpuv=01&tpu=3338670318734125865
hxxp://t4ft.de/bk/8640634?t=1422599352825&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://dmp.theadex.com/d/104/s/adex.js
hxxp://ad.yieldlab.net/m?dt_id=15233&ext_id=6110017589072035866
hxxp://partners.freeridegames.com/static/marketing/main/img/preload.gif
hxxp://www.freeridegames.com/check.jsp	23.64.225.154
hxxp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=14&axd_fuid=6110017589072035866
hxxp://a.twiago.com/adview.php?tz=142259933223254&pid=789&kid=4&wmid=4015&sid=4&nvc=1&swid=3826&target1=-
hxxp://img.exent.com/free/frg/products/616550/boxshot.jpg
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=6149992&cr=58700&sc=14046&re=	85.195.90.127
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8=
hxxp://ocsp.omniroot.com/baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc=
hxxp://cm.g.doubleclick.net/pixel?google_nid=theadex_dmp&google_cm&axd_cuid=104&c=100315090728510000
hxxp://i.w55c.net/ping_match.gif?st=ADEX&rurl=http://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=6&axd_fuid=_wfivefivec_
hxxp://load.s3.amazonaws.com/pixel.gif
hxxp://partners.freeridegames.com/static/marketing/header/img/icons.png
hxxp://ib.adnxs.com/mapuid?member=364&user=3025970665045060
hxxp://img.exent.com/free/frg/products/761850/boxshot.jpg
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-131952831-0x0x302x0
hxxp://partners.freeridegames.com/static/marketing/main/css/gamebox.css
hxxp://stats.g.doubleclick.net/__utm.gif?utmwv=5.6.2dc&utms=2&utmn=790040421&utmhn=partners.freeridegames.com&utmcs=utf-8&utmsr=1716x901&utmvp=1173x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Download free games, Play free games at FreeRide Games&utmhid=1024398902&utmr=-&utmp=/my_games?gameId=659050&utmht=1422599221790&utmac=UA-4994835-25&utmcc=__utma=2252849.2023569898.1422599221.1422599221.1422599221.1;+__utmz=2252849.1422599221.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none);&utmu=q~	173.194.66.157
hxxp://t4ft.de/bk/8640634?t=1422599352912&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x=
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=2017657&cr=58695&sc=14046&re=	85.195.90.127
hxxp://ocsp.msocsp.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68=
hxxp://dmp.theadex.com/d/7727/d/t.js
hxxp://img.exent.com/free/frg/products/559350/boxshot.jpg
hxxp://img.exent.com/free/frg/products/558350/boxshot.jpg
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9694363&cr=58697&sc=14046&re=	85.195.90.127
hxxp://a.twiago.com/adview.php?tz=142259933223254&pid=789&kid=4&wmid=3348&sid=4&nvc=1&swid=3826&target1=-
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=4186957&cr=58636&sc=14046&re=	85.195.90.127
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=244535336147&r=2383948&cr=55818&sc=14076&re=hxxp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=www.freeridegames.com	85.195.90.127
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-665026422-0x0x175x0
hxxp://t.a3cloud.net/gx.png?APN=3338670318734125865&google_gid=CAESENmAYpTPZntugDgw3jO6nz4&google_cver=1
hxxp://cdn5.adspirit.de/banner/asm_flashme.js
hxxp://img.exent.com/free/frg/products/719950/boxshot.jpg
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38
hxxp://c1.adform.net/serving/cookie/match/?CC=1&party=1010&adx_id=104
hxxp://bh.contextweb.com/bh/rtset?do=add&pid=545979&ev=3338670318734125865
hxxp://an.pxl.ace.advertising.com/cfcm.ashx?providerId=1006&appnexus_uid=3338670318734125865&$extMatch=1
hxxp://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NDg2MjYvdC8y/dpuid/100315090728510000
hxxp://sync.apnx.zenoviaexchange.com/usersync2/apnx
hxxp://ib.adnxs.com/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3338670318734125865
hxxp://apnx-match.dotomi.com/appnexus/match?nuid=3338670318734125865
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCC0gVOkA+hgL
hxxp://b.scorecardresearch.com/beacon.js	88.221.133.19
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w=
hxxp://partners.freeridegames.com/static/marketing/main/css/main.css?version=38
hxxp://apis.google.com/js/plusone.js
hxxp://ib.adnxs.com/setuid?entity=17&code=7052af40-cf8f-45f7-952e-25f4ab050d93
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-166351247
hxxp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=3338670318734125865
hxxp://b.scorecardresearch.com/p?c1=8&c2=6035746&c3=3054&c15=&cv=2.0&cj=1	88.221.133.19
hxxp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs=
hxxp://www.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1f4ae9d4166d89&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffd050ac5b52afc&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
hxxp://a.twiago.com/adview.php?tz=1422599315949108&pid=789&kid=4&wmid=3826&sid=4&nvc=1&target1=-
hxxp://partners.freeridegames.com/static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot?
hxxp://a.twiago.com/adview.php?tz=1422599315415646&pid=789&kid=4&wmid=3348&sid=4&nvc=1&swid=3826&target1=-
hxxp://img.exent.com/free/frg/products/643650/boxshot.jpg
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=245175&cr=55818&sc=14076&re=hxxp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=www.freeridegames.com	85.195.90.127
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_top_rib.jpg
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38
hxxp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3338670318734125865
hxxp://ocsp2.globalsign.com/gsorganizationvalg2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBReGXQV/tqUV3SNMRE+s25eR/vhjwQUXUayjcRLdBy77fVztjq3OI91nn4CEhEhsdKok21jslbiISkSn7ME6Q==
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-435101647
hxxp://www.googletagmanager.com/gtm.js?id=GTM-MJF4W9	173.194.113.222
hxxp://ib.adnxs.com/seg?add=
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-488605887-0x0x601x0
hxxp://a.twiago.com/adscript.php?&ref=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&vis=0&pid=789&ord=6110017601960017977&rdclick=hxxp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl=
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk=
hxxp://servedby.flashtalking.com/imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=703830.1892982249
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=4775489&cr=58414&sc=14046&re=	85.195.90.127
hxxp://user-disp.tidaltv.com/user?p=2b4fd3fbe1d8cdc4&r=1
hxxp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
hxxp://loadm.exelator.com/load/?p=204&g=013&bi=3338670318734125865&j=0
hxxp://cdn5.adspirit.de/banner/twiago/761/2014-12-18/0_NCR_NE_Kampagne_Performance_1114_00_000_300x169.jpg
hxxp://img.exent.com/free/frg/products/582150/boxshot.jpg
hxxp://www.freeridegames.com/product/img/SDM/servicePromotion1.jpg	23.64.225.154
hxxp://ocsp.verisign.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI=
hxxp://servedby.flashtalking.com/imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=246631.83414114974
hxxp://dpm.demdex.net/ibs:dpid=358&dpuuid=3338670318734125865
hxxp://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NjExMDAxNzU4OTA3MjAzNTg2Ng==&type=response
hxxp://r.casalemedia.com/rum?cm_dsp_id=46&external_user_id=3338670318734125865
hxxp://crl.comodoca.com/UTN-USERFirst-Hardware.crl
hxxp://idsync.rlcdn.com/379828.gif?partner_uid=3338670318734125865&redirect=1
hxxp://img.exent.com/free/frg/products/701650/boxshot.jpg
hxxp://d.castplatform.com/api/vp/1?clk=0iO77Sl1u3WC4KyNH_vcLgX7eV1ko-HlUgZTKGhiNTl177HYZTv9w0vtO0TFys1eYQpuHB89izY3DtAS9fMQyiTKUpYwd5Jkt-2UWJ5-lYMzSc481jlWZBloByIjdDDdXA8SnZEVOmz8vixkwRF_z0KJ7cY7HTmcaioOKiNdvHq6jzBvpHZvj0S9YipGteQctT9q5fwHFBLdPMIYZBLzKM-1gcm3M0pZTkLzNlAA_z7F4ACE0PloVE8nlHSi4ZtArClytGYFWxRVdkgvL3k0cgZI_ZFeAKLTKraF72gcF6Q&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw=
hxxp://p.rfihub.com/cm?in=1&pub=345&userid=3338670318734125865
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1018863546/?random=1422599221684&cv=7&fst=1422599221684&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://crl.geotrust.com/crls/secureca.crl	23.43.133.163
hxxp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==	85.195.90.127
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-545696636-0x0x302x0
hxxp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/js/defines.js
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels_rib.jpg
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/green_pagenation_rib.jpg
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38
hxxp://sync.mathtag.com/sync/img?mt_exid=28&redir=http://sync.zenoviaexchange.com/usersync3/mediamath/1425/[MM_UUID]?zderedir=&zcc=1
hxxp://ib.adnxs.com/setuid?entity=25&code=st6099ce4pic
hxxp://ocsp.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k=
hxxp://c13.w3hoster.de/log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9882440&cr=58415&sc=14046&re=	85.195.90.127
hxxp://cdp1.public-trust.com/CRL/Omniroot2025.crl
hxxp://clients1.google.com/ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n
hxxp://www.facebook.com/fr/u.php?m=2821299455705972228&p=328546547221502&t=2592000
hxxp://partners.freeridegames.com/static/marketing/header/img/logo.png
hxxp://partners.freeridegames.com/system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png
hxxp://ib.adnxs.com/setuid?entity=94&code=42a09b72-a849-11e4-a60c-78e7d1f6c9c0
hxxp://cdn5.adspirit.de/banner/twiago/676/2014-10-31/0_Teilen16_9.jpeg
hxxp://dmp.theadex.com/d/cm.gif?axd_pid=8&axd_fuid=CAESECAbMZA9QydOGSzhQC_fPEc&google_cver=1&axd_cuid=104&c=100315090728510000
hxxp://www.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1aa58c94f2bf34&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ff30ab89be913e2c&relation=parent.parent&href=http://www.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-813111153
hxxp://stat.flashtalking.com/reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-588683927
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/1057751771/?random=1422599221686&cv=7&fst=1422599221686&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1
hxxp://idpix.media6degrees.com/orbserv/hbpix?pixId=4138&pcv=33&tpu=3338670318734125865&ptid=9&tpuv=01&cckz=true
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/yellow_left_rib.jpg
hxxp://partners.freeridegames.com/static/marketing/main/img/containers/labels.jpg
pfa.levexis.com	37.58.96.130
accounts.google.com	216.58.209.173
oauth.googleusercontent.com	173.194.113.202
adfarm.mediaplex.com	63.215.202.68

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

SURICATA UDPv4 invalid checksum
SURICATA IPv4 invalid checksum
ET POLICY FreeRide Games Some AVs report as TrojWare.Win32.Trojan.Agent.Gen
SURICATA STREAM SHUTDOWN RST invalid ack
SURICATA STREAM Packet with invalid ack
SURICATA HTTP response header invalid

Traffic

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=455915, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 13:01:57 GMT

Expires: Wed, 4 Feb 2015 13:01:57 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015012
8130157Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150128130157Z....20150204130157Z0...*.H............
.t.L~...vz..h.22..lK.iK...'ec...FR.... ....!..q*......1E..5r*,...]M..|
'..`e.UJ..S.._.jnGy......tT~.f..8.N.g0.V....!3........E...]b..........
d..6.......z?.........Y....6........a%......T|...-]D.2[.......4.%.A.w.
...................2. Jsa.Jb.R,.f.....>J....6o.....0...0..}0..e....
....:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 30.."0...*.H.............0............
\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd....
.x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x.....
.........6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o
...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0.
.0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .....
..0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830..
.*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a.
..nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7..
.=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v...
..\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%...
.<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1856

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

tAQAAAAAAADfew-AeQABAAYA2CAyAFoilAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:28 GMT

Server: Apache

Set-Cookie: JSESSIONID=01347949FC9A0AF4BCC60E0ECD101564; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:27:40 GMT

Last-Modified: Thu, 29 Jan 2015 19:47:05 GMT

Server: ECS (ams/D1C2)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015012
9184609Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20141203203511Z....20150428204011Z0...*.H.............4..}.8.
.)....l..JcW.a..i.2....i.:...9`...K .#..x...2........x...U....._.....K
]..k8....*4...H4.K.d9?G.*.Y..e.\.y.....d.........L~._R...&.i...qLM5...
.EL.......3.....P9....6....'....'........j.4.q..e.vcI.$v....W]z......5
tQ.c ....X..hXiA......x.8%...Ez.......U....0...0...0...........'..0...
*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0
 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229Z0G1.0
...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.
."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I..
....C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM
..*.4.MP..../[email protected]....
$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>
;.O....G.A........0..0... .....0......0...U.......0.0...U...........0.
..U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ
..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....j.t%..
e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..ud.....
CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&....q.[
z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?....E....
.......'>..O.._..<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard/header.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: dts1.freeridegames.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache/2.4.4 (Win64)

Last-Modified: Thu, 21 Feb 2013 10:04:09 GMT

Accept-Ranges: bytes

Content-Type: text/html

Content-Encoding: gzip

Content-Length: 1002

Date: Fri, 30 Jan 2015 06:26:24 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........Umo.6......W.Km,.....m5pl7)....n.."....F....#...=./s......I
Q....{....../......j.7..g...Z....s>YN./^...,.(LjSU....5{........Q.n
......og.....4f!3.....-.[..2...Kc..5&![[[.9.q....6.*..F.i....wh.b... .
.5V......7....t...O...qE*.......!..}.#.....1.....PxC. c.....&..Z...GZj
.W.r..j._..1tfE.vO.....)......u.V..q|[email protected].^...m..........
.......c.."....P.a...t..........WR$HH}.CV..P."2*.,.t.Z.~.....V...[...g
....,........h6....d..........l.....0.4..\8..M.$..3.)).P..`..v...^.kth
C.........)9-C.y....4RP#...4G....;.`.&.Df.S#......|.D.....p.XB.*0..$Z.
.,.'.5.5&....8. I.d ...LYo.F...)...)......=...S.U!U.......G.x9VeM...V.
4"01D5...Z..iJN.....CP...). d..9.&... ....A...N.'?.....|..y.i...H.....
.....T....t.Ic7(..:.'.85e&.~....H.....^h.%..;..._...O.gs......_@v.....
.......n...[..7......M.....b.{.d....n.....S.m...)`vlF...1..R..Ic.Y.l..
.....I.....6..U....S..p...........&.gph,.1...V.X........5...r.... ....
...,(I...V1.iaHt.....q.m...l.....0,.QM|{....x"~y&;t..n.......A.D~.;...
.....~.....7....w..)0l.....

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1860

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA4AA2AMIilAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:45 GMT

Server: Apache

Set-Cookie: JSESSIONID=C92449FF724FA970D546A184071E0960; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3338670318734125865&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dis.criteo.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Location: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3338670318734125865&url=hXXp://ib.adnxs.com/seg?add=673614

Server: Microsoft-IIS/7.5

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 254
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://dis.e
u.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3338670
318734125865&url=hXXp://ib.adnxs.com/seg?add=673614">here</a
>.</h2>..</body></html>..HTTP/1.1 302 Found..Loca
tion: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3
338670318734125865&url=hXXp://ib.adnxs.com/seg?add=673614..Server: Mic
rosoft-IIS/7.5..Date: Fri, 30 Jan 2015 06:28:50 GMT..Content-Length: 2
54..<html><head><title>Object moved</title><
;/head><body>..<h2>Object moved to <a href="hXXp://d
is.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=333
8670318734125865&url=hXXp://ib.adnxs.com/seg?add=673614">here&l
t;/a>.</h2>..</body></html>....

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com


HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 29 Jan 2015 06:15:01 GMT

ETag: "2015b-6ca-50dc46885cd67"

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Connection: Keep-Alive

Date: Fri, 30 Jan 2015 06:30:27 GMT

Content-Length: 1738

0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U..
..CyberTrust1"0 ..U....Baltimore CyberTrust Root..141203203511Z..15042
8204011Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..13
0130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140
212185542Z0....'....141112202254Z0....'....100217174732Z0....'#...1003
03201301Z0....'!...100312202204Z0....''q..100414175202Z0....'L...11022
4181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303
201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..1012081
75749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..11081
5145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...1
20111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....10
0216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100
908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..1012
08175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...11120
7220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012
182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...1301231
62633Z0....'....130904190524Z0....'....131024214319Z0....'....14012917
2435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204
601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...1407091719
30Z0....'/:..141119193302Z0....'k...120111220827Z0....'8...14071619120
3Z0....'....131219195909Z0....'....140219171545Z..0.0...U........0...*
.H.............7.im~...|.....3........]..Cm...Y.[.......c.J[.....^

<<< skipped >>>

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7add59494056 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1052

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[s.6.~...<..v.....(;.d.I/i.t.^[email protected]...#.6.&.<.
..|..U....J.#.[#..IkXz.b:..-%$).;.uk.6..].1....}F....7n..W..R.0.#....A
W^Hr..x>.4M&..E...q....&.....&;.J^.7........<.2;.j..............
.lZ....[..8...`1jH.iOJ;JsN..'`$..,.....Lg....k\..l4../...3.....d bha..
0.\....(@..!......R...]..\.(@..!..)...#q ....|..s.SB?....)V.....9s.6..
a.^.. .k6....%........{x...w.'....O.?..r~........O.... ...m.J..3.y....
..........n ........$.*..$ .&}iE.Dr.e.W.. i.k.,.[8b..F.Z..........v 8=
..8u...E....a.#...>y.U.....|.b..........d5..\U[.X.5i._r4.AR[..wZ.{.
o...U.....80o.8.]..s.......;mY..0.y.j.....s".......Y.^.......i..}U....
Wt.3:..E.hk#....*.$.W..}...........$.y.....%}.....*O.I.bO4.7('q.-./..H
...bE.>a$ ..V_GX.R.m..N.{..F...2..#|.sQ..).r.D.g1..l."..5......k...
:....Q......N..V...P....v..Q....b......o.Qm6.....q4.}>L....;.#x...L
2.8"...!.z.8,.......%E.?<...E./N.._.6.`...]._.W...^T^_R.G..M..X.OP.
....aQ.v...,...$...N..Uh...F-..DU.3)..1Le.B....I...F.].[...........A.f
'F.>.WW....F..r.TS...2$...hsB..j.c...<.q=...lY:'..Q..........F..
..@.,.i.3.j....Z..d..k....U.......

HEAD /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: redirector.gvt1.com


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:31:09 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://r3---sn-3c27ln7s.gvt1.com/edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1

Content-Type: text/html; charset=UTF-8

Server: ClientMapServer

Content-Length: 613

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Alternate-Protocol: 80:quic,p=0.02

HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:31:09 GMT..Pragma: no-ca
che..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, 
must-revalidate..Location: hXXp://r3---sn-3c27ln7s.gvt1.com/edgedl/chr
ome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirec
t=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=14
22599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,
pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECE
D4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1..Content-Type: text/html
; charset=UTF-8..Server: ClientMapServer..Content-Length: 613..X-XSS-P
rotection: 1; mode=block..X-Frame-Options: SAMEORIGIN..Alternate-Proto
col: 80:quic,p=0.02..

GET /d/104/6/s/analytic.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive

Cookie: axd=100315090728510003


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

Vary: Accept-Encoding

Content-Encoding: gzip

Last-Modified: Sat, 26 Jul 2014 17:17:52 GMT

ETag: "165099505"

Content-Type: text/javascript

Expires: Fri, 30 Jan 2015 07:28:51 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Content-Length: 1004

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws32.int03.theadex.com
.......S...V.o.6..Wz.I..H.n.T.;i.I=i].[.k.U.....l.&)[email protected]....~|.~
...$.....a$..u..2*n....rf^....Mm..b.(......74.b....|[email protected]..
g.... .I..k~I^^....".....x...L.'Rh..K*...!..&q..f.*.r.........`...D..C
..B.....0{K=...#.*$...D..*HF...........B.N.)'...~..........a...MX4.'..
]`|..l/.....7.;...W.....<...,iE}S.1p.bK.'.(c.(..0....>e.]..u..-.
Z.M....w.0..s:..Y.L......G3.p.....T>:......h........Q[..LrgJ.......
$..WK..Wh>yyG..E(..bDk|.i........u...i.0..YJ..([email protected]...
:.&..W..6h<..z.(.Z.."..H...i._N.i..t..0T.........ZS...&n!...].q.n..
..._..7....`..?.?=>|.*.7c:..W.7...d.....8.4=.....\..'.er.nk2 K.C.o.
.....}.|...Y..-}>....,fg..~^.h.G...%....Q......?...^fxr.)...X....a.
..gY..DjT..6s..5......TKE.....-..MSH.~..H.F..=.....m*...Y.Z.I....k.m.v
.....56..~.....6..>N.!7F...a ..[n.....6Sn....4$.\..Y..kU)]..e..T...
..,.z.F.k....qK.gH.W.).......-e>s...s ....fT..9../.....sV.b..ee..`.
[email protected]..$7..gSd.....O..W.u.?........
.Q.Mt.f..........A.....$h.o...}.....,{_.3..o[.3........


GET /r/104/6/?c=100315090728510000 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive

Cookie: axd=100315090728510003



104&c=100315090728510000' />.<img width='1' height='1' src='http
://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NjAyMTcvdC8w/url/hXXp://dmp.
theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=$!{
TURN_UUID}' />.<img width='1' height='1' src='hXXp://d.turn.com/
r/dd/id/L2NzaWQvMS9jaWQvMjg0NDg2MjYvdC8y/dpuid/100315090728510000' /&g
t;.        </body>.    </html>.    ..0......


GET /d/cm.gif?axd_pid=8&axd_fuid=CAESECAbMZA9QydOGSzhQC_fPEc&google_cver=1&axd_cuid=104&c=100315090728510000 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: axd=100315090728510003; tis=EP14_1:523|EP13A:523

DNT: 1

Connection: Keep-Alive

Host: dmp.theadex.com


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510000; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

Set-Cookie: tis=EP14_1:523|EP13A:523|EP8:523; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Content-type: image/gif

Content-Transfer-Encoding: binary

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws31.int03.theadex.com

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Access-Control-Allow-Credentials: true..X-Powere
d-By: PHP/5.4.4-14 deb7u12..Set-Cookie: axd=100315090728510000; expire
s=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com..Set-Cook
ie: tis=EP14_1:523|EP13A:523|EP8:523; expires=Mon, 27-Jan-20
25 06:28:52 GMT; path=/; domain=.theadex.com..P3P: CP="CAO PSA OUR"..E
xpires: Mon, 26 Jul 1997 05:00:00 GMT..Last-Modified: Fri, 30 Jan 2015
 06:28:52 GMT..Cache-Control: no-store, no-cache, must-revalidate..Cac
he-Control: post-check=0, pre-check=0..Pragma: no-cache..Content-type:
 image/gif..Content-Transfer-Encoding: binary..Content-Length: 43..Dat
e: Fri, 30 Jan 2015 06:28:52 GMT..Server: ws31.int03.theadex.com..GIF8
9a.............!.......,...........L..;..

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:26:40 GMT

Last-Modified: Thu, 29 Jan 2015 09:08:42 GMT

Server: ECS (ams/D1C4)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015012
9064609Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.j....20141203203511Z....20150428204011Z0...*.H..............-H.$..
...........^=....G..ai...I...,)vG.D..[R,.G.#(.D.<..Cg,}...;..2J#...
...GX....<b.&UFe'...I... I.o...&'....e..`..6.....`..~#......q.h|...
..C..#:2w..}.......39.EF.....Rj.M.9...^.....c.?Y/Rz...Q.~.2.I...5..,.$
o..U.....cg.H.[.(.....=.(..;.5...[.n....b*.......0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..<<< skipped >>>

GET /edn/1/info2?_referrer=&sType=view&nCampaignId=2&nBannerId=2&nJs=1&_ignore=88126221955592050&nIframe=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: uip.semasio.net

DNT: 1

Connection: Keep-Alive

Cookie: SEUNCY=C0E0D4BAFA15155D


HTTP/1.1 200 OK

X-Forwarded-Host: 77.66.11.196

Connection: close

Content-Type: image/gif

UIP-Response-Status: Ok

Frontend-ID: 4

Set-Cookie: SEUNCY=C0E0D4BAFA15155D; Expires=Wed, 29 Jul 2015 06:28:55 GMT; Path=/; Domain=.semasio.net; HttpOnly

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Expires: Sat, 01 Jan 2011 12:00:00 GMT

P3P: policyref="hXXp://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Length: 42

Routing-Server-ID: 4

Access-Control-Allow-Origin: *

GIF89a.............!.......,...........L.;..

GET /free/frg/products/608450/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive



Ku...>....j..cw9.&.CR{...P.-^.;]..E..Z..S.N..t.X....J..cdO.r..J..d.
)}@r...x&J.T...^..leHP..Z..@=>X..Lu...I......1P@@T...S..t.....BA.B.
7"........../...l} ;eda5".EH...l.....u..M:3.-...8<!......d....]).k.
....Cc.f.*U-#e.... .Cu1.gHWw,tnjT..C...S...?..T{IsZ...&....j....l)6...
ad[...,....=.N.]..5./)z..7F>.P...r..... .:.....a.......U.j..^Gyc<
;..]{$...9.L%.{..-...b...B....,N*('".T.[....o.7..Q......[.... .#.z^...
@X.{......,H.J..-.........xxV......6..>%]W..k.0............$..e....
*.Vg7.k...[3:!L.......................S.AI....&J..B.>.>...qfB..&
gt;..T*.O...d.U.........3.BT.G&E......{......tI....B.Y<..u....4Mr..
....w.U..mU..a.a..-.R.|.a.#O.6.....ko~..2.%]fJ.U...d.4.NF.u.....K.V..1
*x'.r.`.c...:5C._x....I........PI.k..q-.\-...lA......,TE.....8..m.....
.F.s.....9...S....W.h...-..|.d....j9.o..(.."[...,.U. `..m..c..%s/..A.s
NJ.gy\i.f.....d.W.n..B........!..P^J..5Ig...t.!....R.....XU.CR.p.....$
L.|. [[6.D`..Dh!4..."r{YX.'i7/9/...CI...../.[....g..s.O.......sn; k3.H
uqqS\.-..y4.;?....<...Bem.=T.).8...".....N\.NK;.,>K."....*...@..
......f...1l.E.....yXg...%K...-...TreG.-.........~EzT....J#M.x|.......
[email protected];NG6Po*....nW...Ipx..`_6..M...r......!o.......Q.U%k.7.A...i....l
.dA.vL.L.%..;._.<~..8....q..k.......Y .......?.xY.G5......r.......|
...B..(..gqX.z.....0i..c.......{...Z.D.k.d'.T..J.?.X.8...>r... Q..\
[....X1....).^..r.X....G ..{...e!..2u..o#.2y.....(...*m...9...W....1..
(I..`.}..6.2J...)....Go/...=.....4(...*U...5 &G..!5.q.UP......C..;0|.#
Q..4.,.......F4X..q....!....G.9i...X............A.......Dp<!.D.<<< skipped >>>

GET /free/frg/products/589550/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/575350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 25 Jan 2009 14:27:04 GMT

Content-Type: image/jpeg

Content-Length: 29740

Accept-Ranges: bytes

X-Varnish: 322100395 321522254

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!1.A"..Qa2.q.B#...R$....br...3CS.D%......................
..!1..AQ.aq."....2...B...Rbr.#.....3C..c$d..S.DT5............?.Z......
.-se..d..X..:...b_.L....'.B.K.[PCm....N.......Sr....?.T.%...K..8..09&T
....s...kb.5f.....@o..=2dZ.1..-TK.RTR.MM..t{.#.ey/...o$.{..$p.P4....*N
....n\}...s.}&_...[....2.x..S.. ....'.kZ%*.es..5........;.E(q....<.
....-..G"],......'......A_'zk.A.o......"".c..........J..nT........\[g8
gs......w...u.@}a.94%?..HI...5..'......N....T.=..'....@....~|..6X.....
..LiKrM.$.....A..r......#p.oN.1..a$..........8.#.N\.../...6..]U..O!c."
K...C......@Qi...%.%e*. ....4....A ..Sp......((W.^c>.....#.4kD.7.|.
"..u.GVKt},0.R.q)\[email protected].$x:.n.....u...^S..xe....e>..n...... 
z...Q...)i.....m..zBI.4W.h$iW..../*8.&[.c...U\I. >....u..8c.....C*.
.2;.K.*!.....rv...^..e....'y..c.\.VG'...W.>}qe.\...a..O......}.'.T.
.....J7S4`.......%}G'..........t..S.........[U.K...v.x.r..%.....(..A..
5..]...Y.A.yu.....R.. [email protected].(i....e...T......_..'ad.gq.fMfx..Bp..
...P.D..Ql.t..."B...7.e-..F.,)[email protected].<j?.J
..m...2o..K..O.w|.X.....%|.&...^(.OI...C.... [...{.(.[...)G.N..7.^LI..
.!_~l.E.M.......NL\. S....S2.Z..K.e.q/D..(~3.!M...T.&...m._....#.R[..m
....... ....i..[w.q.W...\.>..si.....9...6..;ra..y$...MkZ..u...P<<< skipped >>>

GET /free/frg/products/761850/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 26 Feb 2012 08:56:37 GMT

Content-Type: image/jpeg

Content-Length: 12469

Accept-Ranges: bytes

X-Varnish: 322100397 321652117

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".........................................D.......
...................!.1."AQ.2a..q..#3BRb..r......$CS...ED............
.......................9.......................!.1..AQ."aq2...BR.....#
[email protected]=......4.....H>.J....I.g..H...,..H.8W..
.QHM..gRZb.......H.Z.D.&.T.O..<.......j.f.~..P..H...T8R.W....G..G..
....U..7Hk.X.%.7.cC.8%.q........F3...u..).....w..O.NHA?S..............
}.W...M_.yv%..w>..w. i.....!..W$....?..S..v..kEE..2.LbUNx~..c2.....
..?.}....]|..6....v.......A....h.F.=.}.)5..5,8..*.z)'U}..{.....?......
...b.S..._..#.b?1._E.....W.T.{*.~.x..l..'.:..v.5x...f#;,...N....gh$e .
@=.....L...k........J.R.l.^..,...n..F.U....E.I..PSBBF.d..X8..x.Sa....L
.1..........i.eL.9U....2g...[.D.....T...h..........%.8.."..'.9....H...
..w..-;...?.g...%HP...c...\.2;j'U.x..$......1.rq....^.."..X.$.....q.s.
.....Q...tY.;.i..]....Ns.......e( .v...P.8..& .VMH.O...F...:.EQJ....r7
.........N.x....%.. ... ls.k......................6.DNV.F.Y..L...A..im
.-...h..P.k..Q..U...{j...:oNm.....*....P..Q.a>.dd.....Lu.....u.!...
....-....2TT=...>[email protected]\Aq.E...R...{OA..
..KCe.......I.1.'.(...z.U.....J"..n....H._.....N....N..\48E.M...R..d..
[email protected]../1.....R../......(>d...~:...6...].0.ASe.I...'.E.m..%N
..q.{.'z._...RB2L{.s..t..6...v.n.). [email protected] .\'...b.Z.)xr.<<< skipped >>>

GET /free/frg/products/699950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 15 Sep 2011 12:15:43 GMT

Content-Type: image/jpeg

Content-Length: 16837

Accept-Ranges: bytes

X-Varnish: 322100425 321717497

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d....................
......................................................................
......................................................................
......................................................................
...........!.1..A.Qa"..q..2#....B.Rb%.....3C..s&......................
..!1.A.Qa..q."2......R#...Bbr.....3C.S$4............?..K.'.r.d.".79.X&
.:F.. ..&..ww .)[........8......E...I..o.C].I.8*.P..P....O....[B....D.
...R..eIR....:..:\H....b.qk...7..z.2.....\Sn.Fw..$w$.).*aHl..g .....S.
...SZ...t...l..|.q.O....8f...E..ul.G_.4.:....s?.4^..sFoi....F...2..v..
.?.S.q.L..Er......OEYP."D.;.....w.....MDO....]*...t..b.N....a$Q....;..
.l..!.gPMg...R_....i...)TW.R.k.J.....G.h.Q.h...&.P.-.K.Is........_..4.
q......-5..O.M.M..n..<......'..8..(..z..0'.=./R..thT.)@.......:.M$s
$.....}C......{.k.u.*.>.}..1p...1..W*......[..B.]j..*..z......8.z..
(U.]....$....tP..>=4l.......M.@G~s...[......:...s... ..Pz..D.I.V..#
....m..b....B.OGW2!:.UP.t.V.Q..u...i...WJ&.V.....u..b....4.T..N..Rz.$.
.....p.V.zzi'G~<.G..;..`...P.(.lG......|...`.........d....7|A0.Q.C.
...u..q...Dk../e..m..:Lh.r.:XA.%^....u...U`.I.5.j.lQ...QXV..we.2....P.
......b5.?l.uNW.O...{..m.[...C...N.?O......*2 ..=.7N.."....Rcv...&..Wm
$.W.....tE..'.....ov..II...5UG..6...X.........)S..cE^...=I.z.}l.."....
.Y.CGY..3"5.(..*m......UH.b...F...%.Kv!.q....E.O@~Z.ArQ9. B.S..w\..8&g
t;.,....F....n... .W.l:.iOb..SC].I.E..U(.K............;.N..i:.....Z...
>.Q$...m...;...UO......Z.Zi.:..F."Z}.%...(.{gs.h. C.......P....<<< skipped >>>

GET /free/frg/products/701650/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 15 Sep 2011 12:15:52 GMT

Content-Type: image/jpeg

Content-Length: 18010

Accept-Ranges: bytes

X-Varnish: 322100470 321922249

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......F......Adobe.d....................
......................................................................
......................................................................
......................................................................
..........!".12B..AQR#aqbr.....3$.....C....Sc4%u.....d5...............
...........".12B.!AR...Qabr.........#....3..q...Cc4$T.............?.|.
....w....|.u...br$>.4$..k..@...\.Z..."#Y|;U...W..5.l_.j..V}/k..../0
..5...$6.....y.onX..P..]......M Jf.Cc...QA...)..rV....`....<.......
j:.="`o...ku...yHGj.<c.D....i....c..t...z<gePO.L...P...N.V......
........;...8.y..L~...av.e.dd;1.l...)...n ....J....;..M......?;G...wi.
..w..qU..q.4....\{.N...[..ml..O{............=?.1z.qe.-....3gjA...7D.3.
p.8..._..x..f..[..j.y ..a....r...<. ...&.n.SMJ1.6..`).M...u...Go..E
......M.JQyd.{..uE..2....&.M.n..t;.....&~Q...I.*.'[email protected].{.q,
.n..=..Ejf....7H......o..U.w.o..&.....................V...W....hfP..4.
^\TI.&.Lo._Lb..ov....V....33....V.).....S.zV.-./e.....Zwb`.*....q...Xp
j.... ..x..................7Hv.kj....vA>.;..4.)R.|...7z.a...v../?.O
.Xv.....5u...j..;...[...;e.5tj0.....<.4.5.D....($....u.....V..?.|&g
t;..C..w.."...N,.k.L.".."....^...M.;./0d.P.5&IC~K...7......*..=...hT*.
..".$#....A....=....$........@j0q.$U.)..C..(N.._%.s.Y.......b..%<~c
.45Gh.Q...:...u..n2.v.. =..{......e[.......y...4o}.].]d{....7.........
..7....&<.~Q.....Y>@....}.)Z....[@gJ.......X....:...A...jR.z....
..8).o.... p..(.r.a....G.Jv1!..r..U......*^..g......s.....).K..@..<<< skipped >>>

GET /?provider=captify&uid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: x.skimresources.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Content-Type: text/html; charset=UTF-8

Date: Fri, 30 Jan 2015 06:28:57 GMT

Location: hXXp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=bb2907ac1b42e83598c555edb1d581a2&uid=3338670318734125865

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Server: TornadoServer/2.4.1

Set-Cookie: skimGUID=bb2907ac1b42e83598c555edb1d581a2; Domain=.skimresources.com; expires=Sat, 30 Jan 2016 06:28:57 GMT; Path=/

Content-Length: 0

Connection: keep-alive

HTTP/1.1 302 Found..Content-Type: text/html; charset=UTF-8..Date: Fri,
 30 Jan 2015 06:28:57 GMT..Location: hXXp://d2tjil5tz17cbz.cloudfront.
net/s.gif?uid1=bb2907ac1b42e83598c555edb1d581a2&uid=333867031873412586
5..P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR I
ND CNT"..Server: TornadoServer/2.4.1..Set-Cookie: skimGUID=bb2907ac1b4
2e83598c555edb1d581a2; Domain=.skimresources.com; expires=Sat, 30 Jan 
2016 06:28:57 GMT; Path=/..Content-Length: 0..Connection: keep-alive..

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9877122&cr=58585&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: image2.pubmatic.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6

Set-Cookie: KRTBCOOKIE_57=476-uid:3338670318734125865; domain=pubmatic.com; expires=Mon, 29-Jan-2018 06:28:50 GMT; path=/

Set-Cookie: PUBRETARGET=dummy; domain=pubmatic.com; expires=Fri, 30-Jan-2015 06:28:50 GMT; path=/

Set-Cookie: PUBMDCID=3; domain=pubmatic.com; expires=Sat, 30-Jan-2016 06:28:50 GMT; path=/

Content-Length: 42

P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Connection: close

Content-Type: image/gif; charset=utf-8
GIF89a.............!.......,...........D.;..

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9694363&cr=58697&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /m?dt_id=15233&ext_id=6110017589072035866 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: ad.yieldlab.net


HTTP/1.1 204 No Content

Server: nginx

P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa OUR IND COM NAV INT"

Cache-Control: no-store, no-cache, max-age=-3600, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Expires: Wed, 18 Feb 2009 11:53:30 GMT

Date: Fri, 30 Jan 2015 06:28:52 GMT

Connection: keep-alive

Set-Cookie: id=26ad9370-51eb-4595-a067-b35c7e1710be; Domain=.yieldlab.net; Expires=Sat, 30-Jan-2016 06:28:52 GMT; Path=/
HTTP/1.1 204 No Content..Server: nginx..P3P: policyref="/w3c/p3p.xml",
 CP="NOI NID CURa ADMa DEVa OUR IND COM NAV INT"..Cache-Control: no-st
ore, no-cache, max-age=-3600, must-revalidate, post-check=0, pre-check
=0..Pragma: no-cache..Expires: Wed, 18 Feb 2009 11:53:30 GMT..Date: Fr
i, 30 Jan 2015 06:28:52 GMT..Connection: keep-alive..Set-Cookie: id=26
ad9370-51eb-4595-a067-b35c7e1710be; Domain=.yieldlab.net; Expires=Sat,
 30-Jan-2016 06:28:52 GMT; Path=/..

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 02:24:03 GMT

Expires: Sat, 31 Jan 2015 02:24:03 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 273757

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
6190213Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150126190213Z....20150202190213Z0...*.H................
...2..f......:.ge..oBA.l..`\...F.-%o..z9-...."g.2.5s#.K.[.........\...
W..j..^d..f.Yl.hL..".[..d.u..{....>1k.|Jj.L"...Z..yJ.e..I.......[\.
FZ...U....'.....m......f.$dv..S5.....|N.G.w.XK.Z.E.8.?....k..e.f(.[. .
h........-A`[S)...CL/.|.I........v..g'a.F.e.gDHTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 02:24:03 GMT.
.Expires: Sat, 31 Jan 2015 02:24:03 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 273757..Alternate-Protocol: 80:quic,p=0.02..Cache-Control
: public, max-age=345600..0..........0..... .....0......0...0......J..
....h.v....b..Z./..20150126190213Z0k0i0A0... ..........j.....p.I.#z...
(~d..J......h.v....b..Z./....2.S.......20150126190213Z....201502021902
13Z0...*.H...................2..f......:.ge..oBA.l..`\...F.-%o..z9-...
."g.2.5s#.K.[.........\...W..j..^d..f.Yl.hL..".[..d.u..{....>1k.|Jj
.L"...Z..yJ.e..I.......[\.FZ...U....'.....m......f.$dv..S5.....|N.G.w.
XK.Z.E.8.?....k..e.f(.[. .h........-A`[S)...CL/.|.I........v..g'a.F.e.
gD..<<< skipped >>>

GET /sync/img?mt_exid=28&redir=http://sync.zenoviaexchange.com/usersync3/mediamath/1425/[MM_UUID]?zderedir=&zcc=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: sync.mathtag.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid=dbf254cb-24a3-4e00-920d-6f1d855c1a7b; mt_misc=; uuidc=oZWUsz7rTFAjIZbTcEREjf3UWy  BhzzN8KVwsJzR6qN4jo6/pp/O45mRb0JVox/5pZN0Qe54gbmxeyJgmAeBw==


HTTP/1.1 302 Moved Temporarily

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Type: image/gif

Content-Length: 0

Connection: keep-alive

Keep-Alive: timeout=360

X-Echo-set-stash JSON-URI: "/sync/img?mt_exid=28&redir=http://sync.zenoviaexchange.com/usersync3/mediamath/1425/[MM_UUID]?zderedir=&zcc=1"

X-Echo-set-stash JSON-REFERER: "hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html"

Cache-Control: no-cache

Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sun, 01-Mar-2015 06:28:55 GMT

Location: hXXp://sync.zenoviaexchange.com/usersync3/mediamath/1425/dbf254cb-24a3-4e00-920d-6f1d855c1a7b?zderedir=&zcc=1

X-Echo-set-stash JSON-USER-AGENT: "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Server: mt2/2.11.1.rc7 ce1fa6b stats-refactor2 Sep 29 2014 14:10:14 cdg-pixel-x9 pid 0x2511 9489

Expires: Fri, 30 Jan 2015 06:28:54 GMT
HTTP/1.1 302 Moved Temporarily..Date: Fri, 30 Jan 2015 06:28:55 GMT..C
ontent-Type: image/gif..Content-Length: 0..Connection: keep-alive..Kee
p-Alive: timeout=360..X-Echo-set-stash JSON-URI: "/sync/img?mt_exid=28
&redir=http://sync.zenoviaexchange.com/usersync3/mediamath%2
F1425/[MM_UUID]?zderedir=&zcc=1"..X-Echo-set-stash JSON-
REFERER: "hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_r
os_de_tribal.html"..Cache-Control: no-cache..Set-Cookie: mt_misc=; dom
ain=.mathtag.com; path=/; expires=Sun, 01-Mar-2015 06:28:55 GMT..Locat
ion: hXXp://sync.zenoviaexchange.com/usersync3/mediamath/1425/dbf254cb
-24a3-4e00-920d-6f1d855c1a7b?zderedir=&zcc=1..X-Echo-set-stash JSON-US
ER-AGENT: "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; 
Trident/6.0)"..P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR B
US COM INT OTC PUR STA"..Server: mt2/2.11.1.rc7 ce1fa6b stats-refactor
2 Sep 29 2014 14:10:14 cdg-pixel-x9 pid 0x2511 9489..Expires: Fri, 30 
Jan 2015 06:28:54 GMT..<<< skipped >>>

GET /adview.php?tz=1422599315415646&pid=789&kid=4&wmid=4015&sid=4&nvc=1&swid=3826&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.11

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /pxj?bidder=10&seg=269711&action=store_my_setuid('7a2cf647-d25d-47ba-990a-3855845d6dbe') HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: secure.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/ID>nsXDgEREg(Pm?gvnX.Zf1(w'4tQWXM'F1]0r/Oe3/4R(m!-W(0Ml_IuZQy!^NnD2*jo9#a!yFf2yn7FLmD IcI2XK.]HGw3g^:@LN)s:0 Om@#[KxMxd!U2Wg2:OZrpe!A>XJ?hFSCRWScTq)[email protected]<ZZO#wlxfA6PJKHHM5JJG^-*%^Nytl9n92QtCBWsg%[2>.9(jXH17k:hc!FP2s>U6o#d3C>6E9u?]c:To8URD9ZD)/MG@Q2<Zd#?U6-(P :-8sV? caPbbY1cW]l$hr=4shnY*/5O<'ti`w5sMDjff?Eqr])=yC `2MFqu%TW%2Stm6wK@(bPWz-7*xk9@GVop?OtzaNL P7%Kgr*`ES- w>>6%]2xp[eonW1TRnjI'mTS!!)Ex1d^qd


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/ID>nsXDgEREg(Pm?gvnX.5fJ2EUwMNC)(b20gYicFf_5 7)HJ2=!Gd8sK6wcmPgSBtr)yEsY0S:mjpO4'S_-Q-.]1wAhXxyzgnJN]6MZmnItjfQ$Z]98brVr>`Ncp0iwSk-#MiI5[VG#QHQ!fk=OerzVN3IEn#WeG)QUhedth_*85>lOJJ<cjXp4TKV`W*m`J'E]7p/5R6[zpZdFX2nXRJ't#EVP:o(Xm?X.91EV@1Sa)YpLx%[BEC5KKeWQINOZ(a83B$ZJbiM(OI`006C0J$/(3i%p`Z*kF[ [bMi6C3O g7r6l^bkm@/j=>>?b%U(VA7 dB=yN2xndn*(AaIa/])6vr iZ`d%SncP.1k/8Jc7o*H_')P]a?Tp2S)>S*sAak*c*_YmF#2o; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:29:00 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333867031873412
5865; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:29
:00 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/ID>n
sXDgEREg(Pm?gvnX.5fJ2EUwMNC)(b20gYicFf_5 7)HJ2=!Gd8sK6wcmPgSBtr)yEsY0S
:mjpO4'S_-Q-.]1wAhXxyzgnJN]6MZmnItjfQ$Z]98brVr>`Ncp0iwSk-#MiI5[VG#Q
HQ!fk=OerzVN3IEn#WeG)QUhedth_*85>lOJJ<cjXp4TKV`W*m`J'E]7p/5R6[zp
ZdFX2nXRJ't#EVP:o(Xm?X.91EV@1Sa)YpLx%[BEC5KKeWQINOZ(a83B$ZJbiM(OI`006C
0J$/(3i%p`Z*kF[ [bMi6C3O g7r6l^bkm@/j=>>?b%U(VA7 dB=yN2xndn*(AaI
a/])6vr iZ`d%SncP.1k/8Jc7o*H_')P]a?Tp2S)>S*sAak*c*_YmF#2o; path=/; 
expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly..Co
ntent-Length: 43..Content-Type: image/gif..Date: Fri, 30 Jan 2015 06:2
9:00 GMT..GIF89a.............!.......,[email protected]..;..<<< skipped >>>

GET /do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599348437 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: player.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; JSESSIONID=49C83FF2E975AF303626693D6FF75A1F; 143_UDOM=partners.freeridegames.com; geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:46 GMT

Server: Apache

Set-Cookie: JSESSIONID=638B34FE6D5A536EB5F7BB6ECB7C844D; Path=/; HttpOnly

Content-Length: 313

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
updateClientCookies( [{name:'143_CAMPAIGN_SERIAL_ID',value:'Default-FR
G_Website',expire:'7776000'},{name:'143_UDOM',value:'partners.freeride
games.com',expire:'7776000'},{name:'143_TURNKEY',value:'Default-481422
599182472568',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Defau
lt-MSIE 7.0',expire:'7776000'}]);HTTP/1.1 200 OK..Date: Fri, 30 Jan 20
15 06:28:46 GMT..Server: Apache..Set-Cookie: JSESSIONID=638B34FE6D5A53
6EB5F7BB6ECB7C844D; Path=/; HttpOnly..Content-Length: 313..P3P: CP="ID
C CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3,
 max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-
8859-1..updateClientCookies( [{name:'143_CAMPAIGN_SERIAL_ID',value:'De
fault-FRG_Website',expire:'7776000'},{name:'143_UDOM',value:'partners.
freeridegames.com',expire:'7776000'},{name:'143_TURNKEY',value:'Defaul
t-481422599182472568',expire:'7776000'},{name:'143_FIRST_BROWSER',valu
e:'Default-MSIE 7.0',expire:'7776000'}]);..

GET /cgi-bin/CRL/2018/cdp.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.public-trust.com


HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Last-Modified: Tue, 20 Jan 2015 06:15:01 GMT

ETag: "200c0-409-50d0f5bed6e6c"

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Connection: Keep-Alive

Date: Fri, 30 Jan 2015 06:28:19 GMT

Content-Length: 1033

0...0..n...0...*.H........0u1.0...U....US1.0...U....GTE Corporation1'0
%..U....GTE CyberTrust Solutions, Inc.1#0!..U....GTE CyberTrust Global
 Root..141217194339Z..150419194839Z0...0....'.x..110110211653Z0....'..
..141119195306Z0....'B...141119195752Z0....'....141119200006Z0....'.:.
.071121154528Z0....'.v..080219183346Z0....'....080514142515Z0....'....
080515170349Z0....'....080924143337Z0....'#...081203144336Z0....''j..0
90209174351Z0....'b...100414181148Z0....'....080917150432Z0....'#...08
1203144209Z0....'#...081203144241Z0....'#...081203144304Z0....'%u..081
203144409Z0....'/9..090318130930Z0....'8...090715181853Z0....'TU..1001
13191852Z0....'k...101130163724Z0....'.B..111107193907Z0....'@...14111
9200409Z0....'....080917150312Z0....'....140709175318Z0....'....141210
173900Z0....'-E..141119195854Z0....'....141119200037Z0....'F...1412171
93909Z0....'F...141217193956Z..0.0...U........0...*.H............ ....
.....0.g97a.b...5.h.....<......G...}.E/.y1.n..>... ...........U.
.O../..1...~t[I/y.:.....s.#E....b.1.k.._........y#*...:Ol..HTTP/1.1 20
0 OK..Server: Apache/2.2.15 (CentOS)..Last-Modified: Tue, 20 Jan 2015 
06:15:01 GMT..ETag: "200c0-409-50d0f5bed6e6c"..Accept-Ranges: bytes..C
ontent-Type: application/x-pkcs7-crl..Connection: Keep-Alive..Date: Fr
i, 30 Jan 2015 06:28:19 GMT..Content-Length: 1033..0...0..n...0...*.H.
.......0u1.0...U....US1.0...U....GTE Corporation1'0%..U....GTE CyberTr
ust Solutions, Inc.1#0!..U....GTE CyberTrust Global Root..141217194339
Z..150419194839Z0...0....'.x..110110211653Z0....'....141119195306Z

<<< skipped >>>

GET /bh/rtset?do=add&pid=545979&ev=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: bh.contextweb.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"

Set-Cookie: V=0MmWUGDDxTVc;Path=/;Domain=.contextweb.com;Expires=Mon, 25-Jan-2016 06:29:01 GMT

Expires: -1

Set-Cookie: pb_rtb_ev=2-545979.3338670318734125865.0.0.1422599341154;Path=/;Domain=.contextweb.com;Expires=Sat, 30-Jan-2016 06:29:01 GMT

CW-Server: lga-bh07

Cache-Control: private, max-age=0, no-cache, no-store

Content-Language: en-US

Content-Type: image/gif; charset=ISO-8859-1

Server: Jetty(9.2.3.v20140905)

Set-Cookie: sto-id-20480-bh=LIAMMJAKJABP; Domain=contextweb.com; Expires=Fri, 30-Jan-2015 06:44:00 GMT; Path=/

Transfer-Encoding: chunked

Accept-Ranges: bytes

Date: Fri, 30 Jan 2015 06:29:01 GMT

Via: 1.1 varnish

Connection: keep-alive

X-Served-By: cache-fra1221-FRA

X-Cache: MISS

X-Cache-Hits: 0
31..GIF89a...................!.......,...........T..;..0..HTTP/1.1 200
 OK..P3P: policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa P
SAa OUR BUS COM NAV INT"..Set-Cookie: V=0MmWUGDDxTVc;Path=/;Domain=.co
ntextweb.com;Expires=Mon, 25-Jan-2016 06:29:01 GMT..Expires: -1..Set-C
ookie: pb_rtb_ev=2-545979.3338670318734125865.0.0.1422599341154;Path=/
;Domain=.contextweb.com;Expires=Sat, 30-Jan-2016 06:29:01 GMT..CW-Serv
er: lga-bh07..Cache-Control: private, max-age=0, no-cache, no-store..C
ontent-Language: en-US..Content-Type: image/gif; charset=ISO-8859-1..S
erver: Jetty(9.2.3.v20140905)..Set-Cookie: sto-id-20480-bh=LIAMMJAKJAB
P; Domain=contextweb.com; Expires=Fri, 30-Jan-2015 06:44:00 GMT; Path=
/..Transfer-Encoding: chunked..Accept-Ranges: bytes..Date: Fri, 30 Jan
 2015 06:29:01 GMT..Via: 1.1 varnish..Connection: keep-alive..X-Served
-By: cache-fra1221-FRA..X-Cache: MISS..X-Cache-Hits: 0..31..GIF89a....
...............!.......,...........T..;..0..<<< skipped >>>

GET /js?wp_id=2990114&kid=1210582&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc3=10039


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 24377713

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1083
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2990114);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad2.adfarm1.adition.com/banner?sid=2990114&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&kid=1210582&scre
en_res=' screen_res '&wpt=J&clickurl=http://c13.w3hoster.de/ad
sc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr
=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /ga.js HTTP/1.1

Accept: */*

Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue Flo&GameId=659050

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 05:09:26 GMT

Expires: Fri, 30 Jan 2015 07:09:26 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 16151

Age: 4618

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=7200
............yW...8.?..|{.....S..7.(m.....Ms.dY.iB....%.g..A..$...y.z..
%..<mm.I~2...3....k9Z.2.}5....G.........dx.O:.Nz'...:.....I*b.v.o..
q....Bh..z6..V.|.})[email protected]....'...`....3i..RC.%..0.Fz..J{.'C
/...#O\BP]..^..../e..<1..p0...&.i......f{..zm..'&.w1...:...Y:......
.....p....`.n4....vz.W....|\c.-GX...:...5.y..".F:.. $....'..b2......k.
...:.....e.. t-{..^.^.....P....3........d..6.nM...."...^..|..1z......d
q.t.}.....I46..Kb....1..A...t...q.N.7zt .P.a......o:0.>..$Y..x:=.$.
....r./..0........n.%.vA.Ke.*....P/.....My..\..t...J(WW....,.A..<Q.
.........E..e.(.K.$......uBa ..1..yN.v..E....D=...:..[...>..zX.l^..
_..z C..o.......Mk.............^\.G.I?.7.[...l.l=..@.......;...e./y,.c
R.w`.d_...0.L/..F.q` j......y.5L....Zp*....#w0.%....]..:T..W...l.4.1U.
,.W~.q0.=XO.z'..f.,/e..K..P".F.e..^..9..S...1..1..J.. .4....WW....K..I
..x......\[email protected]]...tj..3w$...cA... XD..F.a.......3...?..41.!.w}..T 
8...vj..(.....q.P...........S^r.......A..X.e.K=J.5,o..0..Q.|=.v..l....
....j..';...B..$..-....$Z.R.L.OB.tL/:....t..g[..:A......i..4o[e8..3grr
..SJI...2...\YW..j3.^J%.................x.?.6...){...o..V.c.........@h
i.8.=..jR....]....x^.`.<..7........y1..8...YT...iLm}..Ye7T. X..d..T
 L Ui.....q}........#....elF.........m.6-..[./.-.x[{5 ....,.<....b.
e..aK\].VWMZ....{.x(....O........p..[[email protected].)..x...Fk......4.Z.i p.
7..`>.o.Z..O*<.c.....i.f...fk.g....J..a..y.....c_.X..%..4.Gz.M$.
...j5oe.0......$T~..}....0FtC].`-...Z.O..V.:Z..54o.4...oI...... .) ..6
*...Y.1......B..-._..{r..1]F.....f..|8..u.OY...38..}5.c.`.. ....`.<<< skipped >>>

GET /r/__utm.gif?utmwv=5.6.2&utms=1&utmn=618211728&utmhn=player.freeridegames.com&utmcs=windows-1252&utmsr=1716x901&utmvp=640x308&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Progress&utmhid=1440158697&utmr=-&utmp=/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue%20Flo&GameId=659050&utmht=1422599206728&utmac=UA-4994835-2&utmcc=__utma=1.2032673383.1422599207.1422599207.1422599207.1;+__utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmjid=1269284425&utmredir=1&utmu=qlAAAAAAAAAAAAAAAAAAAAAE~ HTTP/1.1

Accept: */*

Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue Flo&GameId=659050

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Fri, 30 Jan 2015 06:26:24 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Fri, 30 Jan 2015 06:26:24 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..Alternate-Protocol: 80:quic,p=0.02..GIF89a.......
......,...........D..;..

GET /pki/crl/products/MicrosoftRootAuthority.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Thu, 20 Nov 2014 22:48:28 GMT

Accept-Ranges: bytes

ETag: "55cddc19145d01:0"

Server: Microsoft-IIS/8.5

VTag: 438589315900000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 603

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 06:26:42 GMT

Connection: keep-alive
0..W0..?...0...*.H........0p1 0)..U..."Copyright (c) 1997 Microsoft Co
rp.1.0...U....Microsoft Corporation1!0...U....Microsoft Root Authority
..141120183814Z..150219065814Z0:0...:..../...V..091210010336Z0........
$... ..020225080156Z._0]0...U.#..0...J\u".F....9.N...`...0... .....7..
.....0...U......&0... .....7......150218184814Z0...*.H.............iO.
P...;.....e...N.Y........}3.V&.O..[W...........\.....[. hc....-.....HU
]"gTS...Vo!.Q..`(.s(...?[...w...x.......G.d... V-?...-.J...y...4.K.X!.
....\.v;[email protected])..(.p)N..}.. ....n...T..K.,[email protected]|.g..k.N....rW..g.
...d...L.E.N.....s..j.......b....3.`.4..F*.....


GET /pki/crl/products/MicWinHarComPCA_2010-11-01.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sat, 24 May 2014 05:04:55 GMT

Accept-Ranges: bytes

ETag: "4af46b4d77cf1:0"

Server: Microsoft-IIS/8.5

VTag: 438476557200000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 588

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 06:26:42 GMT

Connection: keep-alive

0..H0..0...0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Copyright (c) 20
02 Microsoft Corp.1503..U...,Microsoft Windows Hardware Compatibility 
PCA..140523172754Z..440522173902Z.C0A0...U.#..0...[...M..L.UL..>..A
.B}0... .....7.........0...U......L0...*.H.............!0..0......R \0
....C....Y.D....a..|9...6..4.....Wg...Z....{\...... S[...i.....6.....(
....hTccx..3...;!....L....FT*._n..Ai...Z..z.;.......2B...<..m...0S.
...t.!aju.b}...%..m.J..:=...R..R9.......B./.._.E......... .......(L...
..dgC. ...t.........8..9......g..qHTTP/1.1 200 OK..Content-Type: appli
cation/pkix-crl..Last-Modified: Sat, 24 May 2014 05:04:55 GMT..Accept-
Ranges: bytes..ETag: "4af46b4d77cf1:0"..Server: Microsoft-IIS/8.5..VTa
g: 438476557200000000..P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo
 IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"..
X-Powered-By: ASP.NET..Content-Length: 588..Cache-Control: max-age=900
..Date: Fri, 30 Jan 2015 06:26:42 GMT..Connection: keep-alive..0..H0..
0...0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....Red
mond1.0...U....Microsoft Corporation1 0)..U..."Copyright (c) 2002 Micr
osoft Corp.1503..U...,Microsoft Windows Hardware Compatibility PCA..14
0523172754Z..440522173902Z.C0A0...U.#..0...[...M..L.UL..>..A.B}0...
 .....7.........0...U......L0...*.H.............!0..0......R \0....C..
..Y.D....a..|9...6..4.....Wg...Z....{\...... S[...i.....6.....(....hTc
cx..3...;!....L....FT*._n..Ai...Z..z.;.......2B...<..m...0S....

<<< skipped >>>

GET /ping_match.gif?ei=AN&rurl=hXXp://ib.adnxs.com/setuid?entity=17&code=_wfivefivec_ HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: i.w55c.net

DNT: 1

Connection: Keep-Alive

Cookie: wfivefivec=7052af40-cf8f-45f7-952e-25f4ab050d93


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:57 GMT

Server: Jetty(6.1.22)

Set-Cookie: wfivefivec=7052af40-cf8f-45f7-952e-25f4ab050d93;Path=/;Domain=.w55c.net;Expires=Sun, 29-Jan-2017 06:28:57 GMT

P3P: policyref="hXXps://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Content-Length: 0

X-Version: DataXu Pixel Tracker v3.8 20130813

Location: hXXp://ib.adnxs.com/setuid?entity=17&code=7052af40-cf8f-45f7-952e-25f4ab050d93

Via: 1.1 sjc061114 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive

HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:57 GMT..Server: Jetty
(6.1.22)..Set-Cookie: wfivefivec=7052af40-cf8f-45f7-952e-25f4ab050d93;
Path=/;Domain=.w55c.net;Expires=Sun, 29-Jan-2017 06:28:57 GMT..P3P: po
licyref="hXXps://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM 
INT STA OTC STP OUR CUR TAIo COR DSP NOI"..Cache-Control: no-cache, mu
st-revalidate..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GM
T..Content-Length: 0..X-Version: DataXu Pixel Tracker v3.8 20130813..L
ocation: hXXp://ib.adnxs.com/setuid?entity=17&code=7052af40-cf8f-45f7-
952e-25f4ab050d93..Via: 1.1 sjc061114 (MII-APC/2.4)..Keep-Alive: timeo
ut=2..Connection: Keep-Alive..

GET /tap.php?v=4894&nid=1986&put=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.rubiconproject.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 307 Temporary Redirect

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache-Coyote/1.1

Location: /tap.php?cookie_redirect=1&v=4894&nid=1986&put=3338670318734125865

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Pragma: no-cache

Cache-Control: no-cache, no-store, must-revalidate

Expires: 0

Content-Length: 0

Set-Cookie: c=1

Keep-Alive: timeout=30, max=9835

Connection: Keep-Alive

Content-Type: text/html; charset=UTF-8
....


GET /tap.php?cookie_redirect=1&v=4894&nid=1986&put=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.rubiconproject.com

DNT: 1

Connection: Keep-Alive

Cookie: c=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache-Coyote/1.1

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Pragma: no-cache

Cache-Control: no-cache, no-store, must-revalidate

Expires: 0

Content-Type: image/gif

Content-Length: 42

Set-Cookie: rpb=4894=1; Domain=.rubiconproject.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Set-Cookie: put_1986=3338670318734125865; Domain=.rubiconproject.com; Expires=Sun, 01-Mar-2015 06:28:49 GMT; Path=/

Set-Cookie: rpx=4894=44518,0,1,,; Domain=.pixel.rubiconproject.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Set-Cookie: khaos=I5J6WSRX-1-CQEN; Domain=.rubiconproject.com; Expires=Fri, 31-Jul-2015 18:28:50 GMT; Path=/

Keep-Alive: timeout=30, max=8401

Connection: Keep-Alive
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Date: Fri, 
30 Jan 2015 06:28:49 GMT..Server: Apache-Coyote/1.1..P3P: CP="NOI CURa
 ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Pragma: no-cache..Cache-
Control: no-cache, no-store, must-revalidate..Expires: 0..Content-Type
: image/gif..Content-Length: 42..Set-Cookie: rpb=4894=1; Domain=.rub
iconproject.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/..Set-Co
okie: put_1986=3338670318734125865; Domain=.rubiconproject.com; Expire
s=Sun, 01-Mar-2015 06:28:49 GMT; Path=/..Set-Cookie: rpx=4894=44518%
2C0,1,,; Domain=.pixel.rubiconproject.com; Expires=Sun, 01-Mar-2
015 06:28:50 GMT; Path=/..Set-Cookie: khaos=I5J6WSRX-1-CQEN; Domain=.r
ubiconproject.com; Expires=Fri, 31-Jul-2015 18:28:50 GMT; Path=/..Keep
-Alive: timeout=30, max=8401..Connection: Keep-Alive..GIF89a..........
...!.......,...........D.;..<<< skipped >>>

GET /request_content.php?s=8264270407502918&a=ee4d221a HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: n18.ad.ad-srv.net

DNT: 1

Connection: Keep-Alive

Cookie: uid=27e21e2c0ada99f8; 69b3d346ac=afe30d%3DfQXLE2O3KiDyQNcbF8FSZY5w6Fi4lkGdX5QUslu3%2Fm73SPvly89THKzfBLCj%2FWNvLxY6h9BqYpxRD21ytT2AwXYVTRPwswdC9GKLx5go3FJm%2FxEdyBcwiYvbPuvNgEOXF50qzVcwG8Rv%2FBEZNwjBfHw1RNr


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Apache

Cache-Control: no-store, no-cache, must-revalidate, max-age=0

Expires: Fri, 30 Jan 2015 06:28:52  0100

Pragma: no-cache

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 777

Connection: close

Content-Type: text/html; charset=utf-8
...........Umo.0..\$......].t.K..(......7..k..QbG...L..\\..`...}g...?.
.L.[....:...........#..y.X~m15&....bkt..NEt.d..n..0&d.D..f.....b.... I
*...LY. ......TB2~=.j..R..)r^.|[email protected]....$........8J.. ..X...v..|!..
J..HV...0.r.uO.~{31G=.......6..............mRd..{r:O.z:..!i...!...{}.Q
.Em.n./..b....a.v?.....a...n......GS.....0...g`t...|.......]T..A....x.
>g.n.$w'P...M.nam.`[email protected]..
.g.....S.nZ2.9....q.D.;R..M....a.w.E......h|..q..9.W.n.L,.A.S^..&...A.
8....gJ3......i...\p..P.GQ.t....UO=%...uA...L.....HIW..j...........n..
I.d...&.../..hnC.1......F'q..:NM.........1........O.....zN.....>.5.
..ek...!......?.0..O.e.....?.5.....*[email protected]....(.]'.`.......
..g..DT$.8....1.h4...w.o."...e.Y.}...`~...,{.5..n.}......r..%.o..w_..M
..|...u.hE.....

GET /e/v1/pixel/networks/1/partners/7142/users/3338670318734125865;noCookies=t HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.jumptap.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 43

Content-Type: image/gif

Cache-Control: no-cache, max-age=2592000

Server: Jetty(7.6.7.v20120910)

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Fri,
 30 Jan 2015 06:28:51 GMT..Content-Length: 43..Content-Type: image/gif
..Cache-Control: no-cache, max-age=2592000..Server: Jetty(7.6.7.v20120
910)..GIF89a.............!.......,...........D..;..

GET /image.sbmx?go=242840&pid=260&xid=3338670318734125865&id1= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.mookie1.com

DNT: 1

Connection: Keep-Alive

Cookie: id=3025970665045060; mdata=1|3025970665045060|1422599330; OAX=IAz1ClTLJKIAATbP


HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: image/gif

Expires: -1

Server: Microsoft-IIS/7.5

p3p: CP=\"DSP COR ADM DEV PSA PSD OUR\"

X-AspNet-Version: 4.0.30319

Set-Cookie: ibkukiuno=s=eb2f606e-7ed2-4fa9-be3f-4d29db682123&h=&v=0&l=-8587790075478282669&op=0&m=2001173362060711; domain=ib.mookie1.com; expires=Sat, 30-Jan-2016 06:28:57 GMT; path=/; HttpOnly

Set-Cookie: ibkukinet=3247109351=-8587790075478282669; domain=ib.mookie1.com; expires=Sat, 30-Jan-2016 06:28:57 GMT; path=/; HttpOnly

X-Powered-By: ASP.NET

p3p: CP="DSP COR ADM DEV PSA PSD OUR"

Date: Fri, 30 Jan 2015 06:28:57 GMT

Content-Length: 807

GIF89a............3..f.......... .. 3. f. .. .. ..U..U3.Uf.U..U..U....
..3..f..............3..f..............3..f..............3..f.........3
..3.33.f3..3..3..3 .3 33 f3 .3 .3 .3U.3U33Uf3U.3U.3U.3..3.33.f3..3..3.
.3..3.33.f3..3..3..3..3.33.f3..3..3..3..3.33.f3..3..3..f..f.3f.ff..f..
f..f .f 3f ff .f .f .fU.fU3fUffU.fU.fU.f..f.3f.ff..f..f..f..f.3f.ff..f
..f..f..f.3f.ff..f..f..f..f.3f.ff..f..f.......3..f.......... .. 3. f. 
.. .. ..U..U3.Uf.U..U..U......3..f..............3..f..............3..f
..............3..f..............3..f.......... .. 3. f. .. .. ..U..U3.
Uf.U..U..U......3..f..............3..f..............3..f..............
3..f..............3..f.......... .. 3. f. .. .. ..U..U3.Uf.U..U..U....
..3..f..............3..f..............3..f..............3..f..........
...........!.......,................;HTTP/1.1 200 OK..Cache-Control: n
o-cache..Pragma: no-cache..Content-Type: image/gif..Expires: -1..Serve
r: Microsoft-IIS/7.5..p3p: CP=\"DSP COR ADM DEV PSA PSD OUR\"..X-AspNe
t-Version: 4.0.30319..Set-Cookie: ibkukiuno=s=eb2f606e-7ed2-4fa9-be3f-
4d29db682123&h=&v=0&l=-8587790075478282669&op=0&m=2001173362060711; do
main=ib.mookie1.com; expires=Sat, 30-Jan-2016 06:28:57 GMT; path=/; Ht
tpOnly..Set-Cookie: ibkukinet=3247109351=-8587790075478282669; domain=
ib.mookie1.com; expires=Sat, 30-Jan-2016 06:28:57 GMT; path=/; HttpOnl
y..X-Powered-By: ASP.NET..p3p: CP="DSP COR ADM DEV PSA PSD OUR"..Date:
 Fri, 30 Jan 2015 06:28:57 GMT..Content-Length: 807..GIF89a...........
.3..f.......... .. 3. f. .. .. ..U..U3.Uf.U..U..U......3..f.......

<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?3b651923267984dc HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Wed, 12 Mar 2014 20:20:10 GMT

If-None-Match: "0b96c77303ecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 12 Sep 2014 18:47:05 GMT

Accept-Ranges: bytes

ETag: "805a83f2b9cecf1:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 56928

Date: Fri, 30 Jan 2015 06:27:10 GMT

Connection: keep-alive
MSCF....`.......,...................I.................,E.Y .authroot.s
tl..Y-..8..CK...<T...g.v!M.d..f.%d..}K..5..F. ...T..%.,YJ.,!T......
_..x.<=O.....yy....;3..>.|..~..\.....|......;..8..~.za...."A...q
.......g..m......<X........j"I........!..-w.....w....P...H..(.?}..2
.N. .u..a. ...=.C..D.F>rC.. ..|).=.. ..3b.8H.M...(...u8.%...W.g...\
YB.m:.....dE.........V....$....Dn:....0...S."...o..q.....K...I..K...(x
%....>A.R...`.0 .........<`L0mp...%....y.....g.n...R0Op..<..,
....`0$z.@..&.x"....T..H...<........~..E..".....<<.\B(.......
[email protected]/"...f.......k..Jm7j....R.5q....Rz.
.!@...].......Y.[........4.. .D8..&...t.J^O..Q.._..1.J.m5<'k.,....%
T....i.\.;.;q..S./ 8.?Bu.............}D.Q....L....*..[.."e......15m...
_.0.M........#..v!..<...@..?sc.y....*.....tX[........{.W4.Q...^u@..
*..QP.......~.L9N....2r...4.....B..-\(...b.d...K...O.8..Un.......V.<
;.......A...V.....(..s..f..q.{N0.hS.,..;M.|G|[email protected].._.....7._6...C.0...
A;L....%...M=Y.....f.JV.(.5.....0..?*...KZ....jM...8.6U...#...ew.?..?.
..........WE.Or..O>..{.'[email protected]}.o:?~....]&l
t;!...%....}@.d...L.p.a.g ..K."..N1!%..S.bT.H.-.....e..`.0$...0t..DX..
{.....#./...8.5..M...T.......D......V\C.zy.....3E:..>.{..).QW......
q....9..n..1....8%,.........r.p@.>. ...Q.?.p..7.?..7...&..!........
.`. .=....Sf..q.l.A.....L...t.}g..;...f....=.e.~.z....C..*R....H-..=..
.f..(t'.."....F...g._....n.J..U.4vr`}.....1..o@.....@.#...R. L8....z..
].|......3..y..-./....K..6{...s.<R`.}[email protected]....<<< skipped >>>

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=7&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601959886942

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 19
document.write('');..

GET /ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3758851217448081335; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 0
....


GET /bounce?/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 1063
!function(){function n(n){try{if(!window.location.ancestorOrigins)retu
rn;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r  )n.c
all(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}func
tion r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch
(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==
window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.docu
ment.referrer||null,location:n.location.href||null,isTop:n===window.to
p})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top}
)}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,
l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].refe
rrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l
==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c=
"&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="ht
tp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5
ZFPG0.' c '&id=1430847&referrer=freeridegames.com&ext_inv_code=TribalF
usion"></scr' 'ipt>')}();....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 9486557

Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 603
document.write('<iframe frameborder="0" width="728" height="90" mar
ginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http
://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4
GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqV
c47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAEC
wAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgA
MAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeride
games.com"></iframe>');document.write('<scr'   'ipt src="h
ttp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');ont>....<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=4197282237715168703; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40eCxrEQDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7y!8Gn8IPO.Q`x[G)pL5; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 124
ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=39136398759
4223&m=4197282237715168703", "c":9, "tagtype":"img"});HTTP/1.1 200 OK.
.Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires
: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/
w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo
 BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=4197
282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain
=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan
-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k
!M40eCxrEQDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7y!8Gn8IPO.Q`x[G)pL5
; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; Ht
tpOnly..Content-Type: application/javascript; charset=utf-8..Date: Fri
, 30 Jan 2015 06:28:48 GMT..Content-Length: 124..ANX_async_load({"url"
:"hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=41972822377151
68703", "c":9, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M40eCxrEQDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7y!8Gn8IPO.Q`x[G)pL5


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7xuSO(en2hurZozfKKZ)9'Ey=t tl); path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 144
ANX_async_load({"url":"hXXp://pixel.ad.mlnadvertising.com/sync.ashx?pa
rtner=2591&psid=A1001&puid=3338670318734125865", "c":8, "tagtype":"img
"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragm
a: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="h
ttp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo
 OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Se
t-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 
06:28:48 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/;
 expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..S
et-Cookie: anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY
7xuSO(en2hurZozfKKZ)9'Ey=t tl); path=/; expires=Thu, 30-Apr-2015 06:28
:48 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javasc
ript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:48 GMT..Content-Leng
th: 144..ANX_async_load({"url":"hXXp://pixel.ad.mlnadvertising.com/syn
c.ashx?partner=2591&psid=A1001&puid=3338670318734125865", "c":8, "tagt
ype":"img"});....
<<< skipped >>>

GET /tt?id=2488352 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7xuSO(en2hurZozfKKZ)9'Ey=t tl)


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 1093
<html><head></head><body style="margin:0;padding:
0"><script>!function(){function n(n){try{if(!window.location.
ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.l
ength;o>r;r  )n.call(null,window.location.ancestorOrigins[r],r)}cat
ch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.
call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isT
op:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.p
ush({referrer:n.document.referrer||null,location:n.location.href||null
,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,i
sTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="
",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l&
gt;0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.
ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeUR
IComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write
('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599329&bdh=SO
02yqyQkNY1WzO0jjXO3C2hywU.' c '&id=2488352"></scr' 'ipt>')}()
;</script></body></html>....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1422599329&bdh=SO02yqyQkNY1WzO0jjXO3C2hywU.&bdref=http://cdn.castplatform.com/scripts/au1107.html&bdtop=false&bdifs=4&id=2488352 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7xuSO(en2hurZozfKKZ)9'Ey=t tl)


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 18232338

Set-Cookie: anj=dTM7k!M40DF7/.XDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/S6aPHH9q)kTnJ!7 !!(xI $oV=; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 733
document.write('<a href="hXXp://ams1.ib.adnxs.com/click?DIzi4B8DZT9
XtqA3XMFhPxsv3SQGgaU_V7agN1zBYT8MjOLgHwNlP_maZoYYoc8JKatJQvdWVS6hJMtUA
AAAACD4JQB2AgAAnwMAAAIAAAASNBYBivQFAAAAAQBVU0QAVVNEACwB-gBqlQAAR8YAAgU
AAQIAAIYAMSPrJAAAAAA./cnd=!nQZoPwjd6aACEJLo2AgYiukXIAA./referrer=htt
p://ib.adnxs.com/tt?id=2488352/clickenc=http://track
.popmog.com/c/2047054/click?subid=2488352&sspdata=ams1CK
nWppL03tWqLhACGPm1mrOIo-jnCSIPMTkzLjEzOC4yNDQuMjMxKAEwocmspgU." target
="_blank"><img width="300" height="250" style="border-style: non
e" src="hXXp://cdn.adnxs.com/p/47/d1/cc/6b/47d1cc6bf034a7bd1124aee8bed
80309.gif"/></a>');document.write('<scr'   'ipt src="http:
//cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');
....
<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DF7/.XDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/S6aPHH9q)kTnJ!7 !!(xI $oV=


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.FDYRWSDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/SHKDc^PfPZpsQhBj).8'y!!@8vS[`i/; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 118
ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=333867031873412
5865&Red3=MSAN_pd", "c":7, "tagtype":"iframe"});HTTP/1.1 200 OK..Cache
-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat,
 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/po
licy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS C
OM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318
734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnx
s.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 
06:28:49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.FD
YRWSDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/SHKDc^PfPZpsQh
Bj).8'y!!@8vS[`i/; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; doma
in=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset
=utf-8..Date: Fri, 30 Jan 2015 06:28:49 GMT..Content-Length: 118..ANX_
async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=3338670318734125865
&Red3=MSAN_pd", "c":7, "tagtype":"iframe"});....
<<< skipped >>>

GET /pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.CwKyvPkDi2)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?W KdC

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.PLv]@UwMNC)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?WA>qU; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:49 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.PLv]@UwMNC)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?WA>qU


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.gDunaTDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw<Bh>bvRiM4DQLfHq#H':[4NRk4^POYh1**c*_Y[.rtq; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 150
ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86af
cfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":8, "tagtype
":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private.
.Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policy
ref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSA
o PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection:
 0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr
-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; p
ath=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpO
nly..Set-Cookie: anj=dTM7k!M4.gDunaTDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-&
lt;Uy(oT(p*J-I4>FNSPB?j>nh#Nw<Bh>bvRiM4DQLfHq#H':[4NRk4^PO
Yh1**c*_Y[.rtq; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=
.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=ut
f-8..Date: Fri, 30 Jan 2015 06:28:49 GMT..Content-Length: 150..ANX_asy
nc_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436
104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":8, "tagtype":"img"
});....
<<< skipped >>>

GET /ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M41$CxrEQDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw7v>oKgP/DrPb.EK<-KPeofC<R1P9OO>fg:Q3_QnJ!7 !!% A4x_1'

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 0
....


GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M41$CxrEQDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw7v>oKgP/DrPb.EK<-KPeofC<R1P9OO>fg:Q3_QnJ!7 !!% A4x_1'


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Prov
ider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif
?meta=appNexus", "c":7, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Contr
ol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 No
v 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p
3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV
 DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125
865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com;
 HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:
49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*eTF>
 e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>
;K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<; path=/; ex
pires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly..Cont
ent-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan 201
5 06:28:49 GMT..Content-Length: 182..ANX_async_load({"url":"hXXp://dps
.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52A
C15EB7D4/User/3338670318734125865/gif?meta=appNexus", "c":7, "tagtype"
:"img"});....
<<< skipped >>>

GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4NAaI`!Ome[(%pdi:udz^j).8'y!!@7*XlOcz; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 148
ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?s
rc.platformID=AN&src.visitorID=3338670318734125865", "c":4, "tagtype":
"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..P
ragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyre
f="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo 
PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0
..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2
015 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pat
h=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhfl
gxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4
NAaI`!Ome[(%pdi:udz^j).8'y!!@7*XlOcz; path=/; expires=Thu, 30-Apr-2015
 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/
javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..Conten
t-Length: 148..ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com
/tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865", "c
":4, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4N/xEe59::j$P)Zu/w2MKsQ4uVNN/t]SL>( D


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.wcvigæAqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4NAaI`!Ome[(%p_`pIzWHeo8SypRH?$I%o%m?iEOXv; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 148
ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?s
rc.platformID=AN&src.visitorID=3338670318734125865", "c":3, "tagtype":
"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..P
ragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyre
f="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo 
PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0
..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2
015 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pat
h=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: anj=dTM7k!M4.wcvigæAqeU2k_YVvO89'^:30/=Xr<8yhflgxB
-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4NAa
I`!Ome[(%p_`pIzWHeo8SypRH?$I%o%m?iEOXv; path=/; expires=Thu, 30-Apr-20
15 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Content-Type: applicatio
n/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..Cont
ent-Length: 148..ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.c
om/tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865", 
"c":3, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DDv<yXDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lgQ.*9LhVvSTHGi5(IO?9d]`yKliAh-ebzBj>Vntg:X'nLv-Bf7$FUVdFCpCbK!=w6e^U.^)


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.FCy@^UDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lD#k_4L5KKeWQINOZ(a83B$kZPP-7M=RCup_x`Mg7_QJnGB=9yOR%`$dTRQAl[OsH`E!@I$dN_2ZP; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/
partners/7142/users/3338670318734125865;noCookies=t", "c":2, "tagtype"
:"img"});....


GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.FCy@^UDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lD#k_4L5KKeWQINOZ(a83B$kZPP-7M=RCup_x`Mg7_QJnGB=9yOR%`$dTRQAl[OsH`E!@I$dN_2ZP


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/0Es8>[DgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lD#k_4L5KKeWQINOZ(a83B$kZPP-/jW)CuqdCSU7tk nWM4EmGc<Plrp>f0-'Op]%>.N#ua!Dh>b.CnY3Xn2(FU; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 104
ANX_async_load({"url":"hXXp://pr.ybp.yahoo.com/sync/msft/3338670318734
125865", "c":1, "tagtype":"img"});....


GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0Es8>[DgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lD#k_4L5KKeWQINOZ(a83B$kZPP-/jW)CuqdCSU7tk nWM4EmGc<Plrp>f0-'Op]%>.N#ua!Dh>b.CnY3Xn2(FU


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.gEVt4ZDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A1ayPjNzA7(Wd.tOM4dW[al3hTyg ?RnH4g/7C!qYX'Hl>e%1t(90tT9k O$)/MG@q1Vz!$Z/I6/#4Q6Nl*rk%_erC_'-K-.D5$qTE[*O[PG9j*-jcvNkMJ3HTMWcBq=WYiB@V39'Ey=LWY`S; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 128
ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexu
s&eid=5&id=3338670318734125865", "c":0, "tagtype":"img"});HTTP/1.1 200
 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Exp
ires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.
com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo 
OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=
3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; do
main=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31
-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=d
TM7k!M4.gEVt4ZDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVI
uK((VePyRW1PlGm@/s A1ayPjNzA7(Wd.tOM4dW[al3hTyg ?RnH4g/7C!qYX'Hl>e%
1t(90tT9k O$)/MG@q1Vz!$Z/I6/#4Q6Nl*rk%_erC_'-K-.D5$qTE[*O[PG9j*-jcvNkM
J3HTMWcBq=WYiB@V39'Ey=LWY`S; path=/; expires=Thu, 30-Apr-2015 06:28:51
 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascrip
t; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:51 GMT..Content-Length:
 128..ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=a
ppnexus&eid=5&id=3338670318734125865", "c":0, "tagtype":"img"});>....<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.gEVt4ZDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A1ayPjNzA7(Wd.tOM4dW[al3hTyg ?RnH4g/7C!qYX'Hl>e%1t(90tT9k O$)/MG@q1Vz!$Z/I6/#4Q6Nl*rk%_erC_'-K-.D5$qTE[*O[PG9j*-jcvNkMJ3HTMWcBq=WYiB@V39'Ey=LWY`S


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:2
8:51 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Conte
nt-Type: text/html; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:51 GMT
..Content-Length: 0......


GET /getuid?http://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=$UID HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/QF7TG]DgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaB[VG#E5J3grZSnV!bO@6VZMs7GC ]5_>h7oXL %6nALNI?G]c6K[8z@)(@VsBQKW`HfVWI5!d-qZ#CGCtb#x6#GAcl?R%xHlIa0MhRDwd$sQhAu0Ti3w!@wRRKJ*w(


HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=3338670318734125865

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma
: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="ht
tp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo 
OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set
-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 0
6:28:51 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; 
expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Lo
cation: hXXp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_
pid=1&axd_fuid=3338670318734125865..Content-Type: text/html; charset=u
tf-8..Date: Fri, 30 Jan 2015 06:28:51 GMT..Content-Length: 0...
...


GET /setuid?entity=254&code=6110017589072035866 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*fnQ=8e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?OsNf5Uuf T)yn*c*_Y.<ZUI

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*fnQ=8e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?OsNf5Uuf T)yn*c*_Y.<ZUI; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:52 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333867031873412
5865; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28
:52 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*fnQ=8e
6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjb
Ceh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6
tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?O
sNf5Uuf T)yn*c*_Y.<ZUI; path=/; expires=Thu, 30-Apr-2015 06:28:52 G
MT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: ima
ge/gif..Date: Fri, 30 Jan 2015 06:28:52 GMT..GIF89a.............!.....
..,[email protected]..;....
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/zDYedUDgEREg(Pm?gvnX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#vHB0ibY9r7MIKRz6:Tu.5UNSw3`E?yHb%ULN>]JjZ3 jA!G^fWG0I-w4..]g0>.VDs!]t)MduM3A


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40eEVb'XDgEREg(Pm?gvnX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#v$>EsN9sv<uY`CtTJN5u(HH:kU52HK1JF*y`HTMY/v!aHq[<qqYJP3SQFSzivGEEMCcz62Nd)%Qs!1p'#?C0`x; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Length: 102
ANX_async_load({"url":"hXXp://sync.apnx.zenoviaexchange.com/usersync2/
apnx", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-sto
re, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:
00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", C
P="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA P
RE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; path=
/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly.
.Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:55 GMT; do
main=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40eEVb'XDgEREg(Pm?gv
nX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jN
zA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h
-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#v$
>EsN9sv<uY`CtTJN5u(HH:kU52HK1JF*y`HTMY/v!aHq[<qqYJP3SQFSzivGE
EMCcz62Nd)%Qs!1p'#?C0`x; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT
; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; c
harset=utf-8..Date: Fri, 30 Jan 2015 06:28:55 GMT..Content-Length: 102
..ANX_async_load({"url":"hXXp://sync.apnx.zenoviaexchange.com/usersync
2/apnx", "c":9, "tagtype":"img"});....
<<< skipped >>>

GET /setuid?entity=227&code=ZU01v04-9561478d62191c1b11d185ac951f145d HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DF7B:ZDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL8==?f?km.p)Ym$v*<V`bGrsL2)r]x:/)'3_(TDnhIpJI?N1bg99(q(5uJwB2/ksEZrpm[(]`yKliIN(jtK8%@/xEegOr'nlNmKTrsQj%cqTCnd8zpBo$_T5RDh>b.CnY4ifpx='

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:56 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DF7B:ZDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL8==?f?km.p)Ym$v*<V`bGrsL2)r]x:/)'3_(TDnhIpJI?N1bg99(q(5uJwB2/ksEZrpm[(]`yKliIN(jtK8%@/xEegOr'nlNmKTrsQj%cqTCnd8zpBo$_T5RDh>b.CnY4ifpx='


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.FDYedUDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL8==?f?km.p)Ym$v*<V`bGrsL2)r]x:/)'3_(TDnhIpJI?N1bg99(q(5uJwB2/kr:_r=y.4`]7v#Oq3Zwd5 d%]NRHU@E!MKRDvXzda:0hRk4`#h!'XPTrSMoo`^xJO.jYyO gzVtu.bs; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 117
ANX_async_load({"url":"hXXp://idsync.rlcdn.com/379828.gif?partner_uid=
3338670318734125865", "c":8, "tagtype":"img"});HTTP/1.1 200 OK..Cache-
Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 
15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/pol
icy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS CO
M NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=33386703187
34125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs
.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 0
6:28:56 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.FDY
edUDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1
PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iH
J0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL8==?f?km.p)Ym$v*<V`bGrsL2)r]
x:/)'3_(TDnhIpJI?N1bg99(q(5uJwB2/kr:_r=y.4`]7v#Oq3Zwd5 d%]NRHU@E!MKRDv
Xzda:0hRk4`#h!'XPTrSMoo`^xJO.jYyO gzVtu.bs; path=/; expires=Thu, 30-Ap
r-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly..Content-Type: applic
ation/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:56 GMT..
Content-Length: 117..ANX_async_load({"url":"hXXp://idsync.rlcdn.com/37
9828.gif?partner_uid=3338670318734125865", "c":8, "tagtype":"img"});font>....<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M41$E:EvWDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC3)rP7zEH4mf5!$exy^8Q7G#fRKj?9[*Ay^t.:'1PV$=>M*3Myq4gM-J6E2M4hA%_G<9Z>LHm8'JY5fUOlzBaMYAvX#EVPK9k PkrgIYg?dvnN1`sKYQ.*:)F/?c<5ar.%O[93<VmL2L?5h>SAIauNb%U$QLTkXl*_f9Gu.])WlZ  #9JW?yCuvBDk%`ii[l@?7:QojOn@i*qf5Ux#F!$>fftpduskuycd56pz9'Ey=Xm$'%


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*h/DI8e6AqeU2k_YVvO89>7^wr%UwBz8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htb$d^#Ly]cDcT4%(R_J6L)31uQ ZxMO>r%i?p=5(@'T.@Vv2Czxii`j6p-J:vFTSyAjSG6XtQCD*qSdW/%bgdGw7_o4%*E#rPZ5$Zm:7/SZMrax@(Fd6)<wQ0hVvSTHGi5(%j:3]q?5V2IpJI?N1bfY9(tR6KKBRiV*W4i>$nxxP]Gm3r`_kean(cZ/HrIG6K)pZOx$2ch^`hy-CYqK%`$dTRKiA^#l*Lu@DuI>)h@LG6$Hh<!3 G3TU4`e; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 133
ANX_async_load({"url":"hXXp://global.ib-ibi.com/image.sbmx?go=242840&p
id=260&xid=3338670318734125865&id1=", "c":7, "tagtype":"img"});HTTP/1.
1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache
..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.a
dnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo 
UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: u
uid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GM
T; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sa
t, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: 
anj=dTM7k!M40*h/DI8e6AqeU2k_YVvO89>7^wr%UwBz8yhe@@av*yQ)dC)/^r13.=n
Z:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htb$d^#Ly]cDcT4%(R_J6L)31uQ Zx
MO>r%i?p=5(@'T.@Vv2Czxii`j6p-J:vFTSyAjSG6XtQCD*qSdW/%bgdGw7_o4%*E#r
PZ5$Zm:7/SZMrax@(Fd6)<wQ0hVvSTHGi5(%j:3]q?5V2IpJI?N1bfY9(tR6KKBRiV*
W4i>$nxxP]Gm3r`_kean(cZ/HrIG6K)pZOx$2ch^`hy-CYqK%`$dTRKiA^#l*Lu@DuI
>)h@LG6$Hh<!3 G3TU4`e; path=/; expires=Thu, 30-Apr-2015 06:28:56
 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascrip
t; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:56 GMT..Content-Length:
 133..ANX_async_load({"url":"hXXp://global.ib-ibi.com/image.sbmx?go=24
2840&pid=260&xid=3338670318734125865&id1=", "c":7, "tagtype":"img"});<
/font>....<<< skipped >>>

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*d<S1 e6AqeU2k_YVvO89>7^wr=0D/e8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*Z5Ol#xb!I#CG)KbsRZ*<cH9vXhK8LXJ8rMw2KYJaht63>kX 6!^qUFAC'0$*bdXu!_4s?


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/Ah/DI8e6AqeU2k_YVvO89>7^wr=0D/e8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*Z5Ol#xb!I#CG)KbsRZ*<cH9vXqZpDOUdekNmKTrsQj(PqTCnd8zpBo$_T5RDh>b.CnY56m%Sas; path=/; expires=Thu, 30-Apr-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:57 GMT

Content-Length: 119
ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=captify&ui
d=3338670318734125865", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cach
e-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat
, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/p
olicy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS 
COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333867031
8734125865; path=/; expires=Thu, 30-Apr-2015 06:28:57 GMT; domain=.adn
xs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015
 06:28:57 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/A
h/DI8e6AqeU2k_YVvO89>7^wr=0D/e8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r
)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=
n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d
>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-P
SOu(Td@#`ynDglCyQ%*Z5Ol#xb!I#CG)KbsRZ*<cH9vXqZpDOUdekNmKTrsQj(PqTCn
d8zpBo$_T5RDh>b.CnY56m%Sas; path=/; expires=Thu, 30-Apr-2015 06:28:
57 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascr
ipt; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:57 GMT..Content-Lengt
h: 119..ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=ca
ptify&uid=3338670318734125865", "c":6, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/Ah/DI8e6AqeU2k_YVvO89>7^wr=0D/e8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*Z5Ol#xb!I#CG)KbsRZ*<cH9vXqZpDOUdekNmKTrsQj(PqTCnd8zpBo$_T5RDh>b.CnY56m%Sas


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40mf5Ki2e6AqeU2k_YVvO89>7^wr1o1eD8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*P#)A1dA!2<R1NeW3h95G`!Ir@H1]YYG6[BNOdHada:0hRk4`#RJ32kTrSMoo`^xJO.jYyO gzV >(sl; path=/; expires=Thu, 30-Apr-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:58 GMT

Content-Length: 141
ANX_async_load({"url":"hXXp://ib.adnxs.com/getuid?hXXp://r.casalemedia
.com/rum?cm_dsp_id=46&external_user_id=$UID", "c":5, "tagtype":"img"})
;....


GET /getuid?hXXp://r.casalemedia.com/rum?cm_dsp_id=46&external_user_id=$UID HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40mf5Ki2e6AqeU2k_YVvO89>7^wr1o1eD8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*P#)A1dA!2<R1NeW3h95G`!Ir@H1]YYG6[BNOdHada:0hRk4`#RJ32kTrSMoo`^xJO.jYyO gzV >(sl


HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://r.casalemedia.com/rum?cm_dsp_id=46&external_user_id=3338670318734125865

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:58 GMT

Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma
: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="ht
tp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo 
OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set
-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 0
6:28:58 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; 
expires=Sat, 31-Jan-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly..Lo
cation: hXXp://r.casalemedia.com/rum?cm_dsp_id=46&external_user_id=333
8670318734125865..Content-Type: text/html; charset=utf-8..Date: Fri, 3
0 Jan 2015 06:28:58 GMT..Content-Length: 0......


GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40mf5Ki2e6AqeU2k_YVvO89>7^wr1o1eD8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*P#)A1dA!2<R1NeW3h95G`!Ir@H1]YYG6[BNOdHada:0hRk4`#RJ32kTrSMoo`^xJO.jYyO gzV >(sl


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40Lcw7'*e6AqeU2k_YVvO89>7^wr1o1eD8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d3C>6E9u?]c:To8URD9ZD)/MG@Q2<Zd#?U6-(P :-8sV=GcaPbbY1cY1h'zYd1%g3`26GOeC3O g7hJ'ruYwdO3'B*84vQ'hgze?LHKDc^PzOxSRek#sXwZEJIzWIOlcASf-CYqK%`$dTRKj`-#l*Lu@DuI>)h@LG6$Hh<!(7InvBcOv; path=/; expires=Thu, 30-Apr-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:58 GMT

Content-Length: 121
ANX_async_load({"url":"hXXp://loadm.exelator.com/load/?p=204&g=013&bi=
3338670318734125865&j=0", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Ca
che-Control: no-store, no-cache, private..Pragma: no-cache..Expires: S
at, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c
/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BU
S COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670
318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:58 GMT; domain=.a
dnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-20
15 06:28:58 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4
0Lcw7'*e6AqeU2k_YVvO89>7^wr1o1eD8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.
4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@Bxb
K=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o
#d3C>6E9u?]c:To8URD9ZD)/MG@Q2<Zd#?U6-(P :-8sV=GcaPbbY1cY1h'zYd1%
g3`26GOeC3O g7hJ'ruYwdO3'B*84vQ'hgze?LHKDc^PzOxSRek#sXwZEJIzWIOlcASf-C
YqK%`$dTRKj`-#l*Lu@DuI>)h@LG6$Hh<!(7InvBcOv; path=/; expires=Thu
, 30-Apr-2015 06:28:58 GMT; domain=.adnxs.com; HttpOnly..Content-Type:
 application/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:5
8 GMT..Content-Length: 121..ANX_async_load({"url":"hXXp://loadm.exelat
or.com/load/?p=204&g=013&bi=3338670318734125865&j=0", "c":4, "tagtype"
:"img"});....
<<< skipped >>>

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40Lcw7'*e6AqeU2k_YVvO89>7^wr1o1eD8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d3C>6E9u?]c:To8URD9ZD)/MG@Q2<Zd#?U6-(P :-8sV=GcaPbbY1cY1h'zYd1%g3`26GOeC3O g7hJ'ruYwdO3'B*84vQ'hgze?LHKDc^PzOxSRek#sXwZEJIzWIOlcASf-CYqK%`$dTRKj`-#l*Lu@DuI>)h@LG6$Hh<!(7InvBcOv


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/be8OM/e6AqeU2k_YVvO89>7^wrGIUR.8yhe@@av*yQ)dC)/^r13.=nZ:`B.t<Iw:`aEF3-94h?f`_H-5l6UQPAq1GGt/7bDs3>Js(Wyd/6IwAa<$<*EI1vsk6OZrpe!A>XJ?hFSCRWScTq)Uh@/7g3.4:J]F5pdI=mp4LxkwXs F'u:%4r*6?JjUEZ8z$ df<oOJQj<FQq5$KY%?OY4.eF5^rgIYg?dvnN1`sKYQ.*:)F/?c<5ar.%#sN/sJ]]l*6Wu=1cphLk.RPj-bCz@F=b!`GZO*QNdwxJ*uN1Mp2dKJhC3Op< nU5o))/JktK8%@/xEegP!MFM(HL`8%.exVeWbs!^CXEw#FJ#G/Bex0Q4uVNN/t[Sq9#c`; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:59 GMT

Content-Length: 152
ANX_async_load({"url":"hXXp://idpix.media6degrees.com/orbserv/hbpix?pi
xId=4138&pcv=33&ptid=9&tpuv=01&tpu=3338670318734125865", "c":3, "tagty
pe":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, privat
e..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: poli
cyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM P
SAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protectio
n: 0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-A
pr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1;
 path=/; expires=Sat, 31-Jan-2015 06:28:59 GMT; domain=.adnxs.com; Htt
pOnly..Set-Cookie: anj=dTM7k!M4/be8OM/e6AqeU2k_YVvO89>7^wrGIUR.8yhe
@@av*yQ)dC)/^r13.=nZ:`B.t<Iw:`aEF3-94h?f`_H-5l6UQPAq1GGt/7bDs3>J
s(Wyd/6IwAa<$<*EI1vsk6OZrpe!A>XJ?hFSCRWScTq)Uh@/7g3.4:J]F5pdI
=mp4LxkwXs F'u:%4r*6?JjUEZ8z$ df<oOJQj<FQq5$KY%?OY4.eF5^rgIYg?dv
nN1`sKYQ.*:)F/?c<5ar.%#sN/sJ]]l*6Wu=1cphLk.RPj-bCz@F=b!`GZO*QNdwxJ*
uN1Mp2dKJhC3Op< nU5o))/JktK8%@/xEegP!MFM(HL`8%.exVeWbs!^CXEw#FJ#G/B
ex0Q4uVNN/t[Sq9#c`; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; dom
ain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charse
t=utf-8..Date: Fri, 30 Jan 2015 06:28:59 GMT..Content-Length: 152..ANX
_async_load({"url":"hXXp://idpix.media6degrees.com/orbserv/hbpix?pixId
=4138&pcv=33&ptid=9&tpuv=01&tpu=3338670318734125865", "c":3, "tagtype"
:"img"});....
<<< skipped >>>

GET /setuid?entity=25&code=st6099ce4pic HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/be8OM/e6AqeU2k_YVvO89>7^wrGIUR.8yhe@@av*yQ)dC)/^r13.=nZ:`B.t<Iw:`aEF3-94h?f`_H-5l6UQPAq1GGt/7bDs3>Js(Wyd/6IwAa<$<*EI1vsk6OZrpe!A>XJ?hFSCRWScTq)Uh@/7g3.4:J]F5pdI=mp4LxkwXs F'u:%4r*6?JjUEZ8z$ df<oOJQj<FQq5$KY%?OY4.eF5^rgIYg?dvnN1`sKYQ.*:)F/?c<5ar.%#sN/sJ]]l*6Wu=1cphLk.RPj-bCz@F=b!`GZO*QNdwxJ*uN1Mp2dKJhC3Op< nU5o))/JktK8%@/xEegP!MFM(HL`8%.exVeWbs!^CXEw#FJ#G/Bex0Q4uVNN/t[Sq9#c`

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40Lhh![:e6AqeU2k_YVvO89>7^wrGIUR.8yhe@@av*yQ)dC)/^r13.=nTAop0yw#]>je@o>YN·ziRf#KJi9zm5oJnB5qtp]iv*s6R[to*kPwgo_[%<ptx:_#/BPeDR$^nPM!yt<pZq!*b sUH.iT>H[:0-37EQh:iHJ0hUc0Riu_@:U3h-oT*FLnCYq=bZ9Nxv KSXGtp*]7c%j.Qm7)v67E9k QAlus$RZMrax@(Fd6)<wQ0hVvSTHGi5(%ko8lq?5V2IpJI?N1bfY9(tR6KKBRiV*W4i>$nxxP]Gm3r`_keB0VkTb%VUR5b/Hc001kZpv1![=9yOR%d?[v.ll>M)9Ov1Qsi_!Cfqas%-*$j<#bu=).8'y!!@676C?C ; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:59 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40Lhh![:e6AqeU2k_YVvO89>7^wrGIUR.8yhe@@av*yQ)dC)/^r13.=nTAop0yw#]>je@o>YN·ziRf#KJi9zm5oJnB5qtp]iv*s6R[to*kPwgo_[%<ptx:_#/BPeDR$^nPM!yt<pZq!*b sUH.iT>H[:0-37EQh:iHJ0hUc0Riu_@:U3h-oT*FLnCYq=bZ9Nxv KSXGtp*]7c%j.Qm7)v67E9k QAlus$RZMrax@(Fd6)<wQ0hVvSTHGi5(%ko8lq?5V2IpJI?N1bfY9(tR6KKBRiV*W4i>$nxxP]Gm3r`_keB0VkTb%VUR5b/Hc001kZpv1![=9yOR%d?[v.ll>M)9Ov1Qsi_!Cfqas%-*$j<#bu=).8'y!!@676C?C


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M416e8OM/e6AqeU2k_YVvO89>7^wrGIUR.8yhe@@av*yQ)dC)/^r13.=nTAop0yw#]>je@o>YN·ziRf#KJi9zm5oJnB5qtp]iv*s6R[to*kPwgo_[%<ptx:_#/BPeDR$^nPM!yt<pZq!*b sUH.iT>H[:0-37EQh:iHJ0hUc0Riu_@:U3h-oT*FLnCYq=bZ9Nxv KSXGtp*]7c%j.Qm7)v67E9k QAlus$RZMrax@(Fd6)<wQ0hVvSTHGi5(%ko8lq?5V2Ia/z$gdVZ@p2:@o)e6Lb'izp)6a^lnb$O2>($3RCm lXO_xeO-JN5u(HH:ku@34ZDiXgv<UPwx'*LZ=q9^SQv0l6q?*Sw5!cQ_Ak)6'zXS%IoU0Ti3w!@wSr)0x4Q; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:59 GMT

Content-Length: 119
ANX_async_load({"url":"hXXp://apnx-match.dotomi.com/appnexus/match?nui
d=3338670318734125865", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cach
e-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat
, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/p
olicy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS 
COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333867031
8734125865; path=/; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adn
xs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015
 06:28:59 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M416
e8OM/e6AqeU2k_YVvO89>7^wrGIUR.8yhe@@av*yQ)dC)/^r13.=nTAop0yw#]>j
e@o>YN·ziRf#KJi9zm5oJnB5qtp]iv*s6R[to*kPwgo_[%<ptx:_#/BPeDR$^n
PM!yt<pZq!*b sUH.iT>H[:0-37EQh:iHJ0hUc0Riu_@:U3h-oT*FLnCYq=bZ9Nx
v KSXGtp*]7c%j.Qm7)v67E9k QAlus$RZMrax@(Fd6)<wQ0hVvSTHGi5(%ko8lq?5V
2Ia/z$gdVZ@p2:@o)e6Lb'izp)6a^lnb$O2>($3RCm lXO_xeO-JN5u(HH:ku@34ZDi
Xgv<UPwx'*LZ=q9^SQv0l6q?*Sw5!cQ_Ak)6'zXS%IoU0Ti3w!@wSr)0x4Q; path=/
; expires=Thu, 30-Apr-2015 06:28:59 GMT; domain=.adnxs.com; HttpOnly..
Content-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan
 2015 06:28:59 GMT..Content-Length: 119..ANX_async_load({"url":"http:/
/apnx-match.dotomi.com/appnexus/match?nuid=3338670318734125865", "c":2
, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M416e8OM/e6AqeU2k_YVvO89>7^wrGIUR.8yhe@@av*yQ)dC)/^r13.=nTAop0yw#]>je@o>YN·ziRf#KJi9zm5oJnB5qtp]iv*s6R[to*kPwgo_[%<ptx:_#/BPeDR$^nPM!yt<pZq!*b sUH.iT>H[:0-37EQh:iHJ0hUc0Riu_@:U3h-oT*FLnCYq=bZ9Nxv KSXGtp*]7c%j.Qm7)v67E9k QAlus$RZMrax@(Fd6)<wQ0hVvSTHGi5(%ko8lq?5V2Ia/z$gdVZ@p2:@o)e6Lb'izp)6a^lnb$O2>($3RCm lXO_xeO-JN5u(HH:ku@34ZDiXgv<UPwx'*LZ=q9^SQv0l6q?*Sw5!cQ_Ak)6'zXS%IoU0Ti3w!@wSr)0x4Q


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/ID>nsXDgEREg(Pm?gvnX.Zf1(w'4tQWXM'F1]0r/Oe3/4R(m!-W(0Ml_IuZQy!^NnD2*jo9#a!yFf2yn7FLmD IcI2XK.]HGw3g^:@LN)s:0 Om@#[KxMxd!U2Wg2:OZrpe!A>XJ?hFSCRWScTq)[email protected]<ZZO#wlxfA6PJKHHM5JJG^-*%^Nytl9n92QtCBWsg%[2>.9(jXH17k:hc!FP2s>U6o#d3C>6E9u?]c:To8URD9ZD)/MG@Q2<Zd#?U6-(P :-8sV? caPbbY1cW]l$hr=4shnY*/5O<'ti`w5sMDjff?Eqr])=yC `2MFqu%TW%2Stm6wK@(bPWz-7*xk9@GVop?OtzaNL P7%Kgr*`ES- w>>6%]2xp[eonW1TRnjI'mTS!!)Ex1d^qd; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:29:00 GMT

Content-Length: 107
ANX_async_load({"url":"hXXp://user-disp.tidaltv.com/user?p=2b4fd3fbe1d
8cdc4&r=1", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: n
o-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 200
8 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xm
l", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM 
STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; 
path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; Http
Only..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:29:00 GM
T; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/ID>nsXDgER
Eg(Pm?gvnX.Zf1(w'4tQWXM'F1]0r/Oe3/4R(m!-W(0Ml_IuZQy!^NnD2*jo9#a!yFf2yn
7FLmD IcI2XK.]HGw3g^:@LN)s:0 Om@#[KxMxd!U2Wg2:OZrpe!A>XJ?hFSCRWScTq
)[email protected]<ZZO#wlxfA6PJKHHM5JJG^-*%^Nytl9n92QtCBWsg%[2>.9(jXH17k:hc!
FP2s>U6o#d3C>6E9u?]c:To8URD9ZD)/MG@Q2<Zd#?U6-(P :-8sV? caPbbY
1cW]l$hr=4shnY*/5O<'ti`w5sMDjff?Eqr])=yC `2MFqu%TW%2Stm6wK@(bPWz-7*
xk9@GVop?OtzaNL P7%Kgr*`ES- w>>6%]2xp[eonW1TRnjI'mTS!!)Ex1d^qd; 
path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; Http
Only..Content-Type: application/javascript; charset=utf-8..Date: Fri, 
30 Jan 2015 06:29:00 GMT..Content-Length: 107..ANX_async_load({"url":"
hXXp://user-disp.tidaltv.com/user?p=2b4fd3fbe1d8cdc4&r=1", "c":1, "tag
type":"img"});....
<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/ID>nsXDgEREg(Pm?gvnX.5fJ2EUwMNC)(b20gYicFf_5 7)HJ2=!Gd8sK6wcmPgSBtr)yEsY0S:mjpO4'S_-Q-.]1wAhXxyzgnJN]6MZmnItjfQ$Z]98brVr>`Ncp0iwSk-#MiI5[VG#QHQ!fk=OerzVN3IEn#WeG)QUhedth_*85>lOJJ<cjXp4TKV`W*m`J'E]7p/5R6[zpZdFX2nXRJ't#EVP:o(Xm?X.91EV@1Sa)YpLx%[BEC5KKeWQINOZ(a83B$ZJbiM(OI`006C0J$/(3i%p`Z*kF[ [bMi6C3O g7r6l^bkm@/j=>>?b%U(VA7 dB=yN2xndn*(AaIa/])6vr iZ`d%SncP.1k/8Jc7o*H_')P]a?Tp2S)>S*sAak*c*_YmF#2o


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NDvO.ZDgEREg(Pm?gvnX.5fJ2EUwMNC)(b20gYicFf_5 7)HJ2=!Gd8sK6wcmPgSBtr)yEsY0S:mjpO4'S_-Q-.]1wAhXxyzgnJN]6MZmnItjfQ$Z]98brVr>`Ncp0iwSk-#MiI5[VG#QHQ!fk=OerzVN3IEn#WeG)QUhedth_*85>lOJJ<cjXp4TKV`W*m`J'E]7p/5R6[zpZdFX2nXRJ't#EVP:o(Xm?gQPrJafa(pHe!`Llpa?K51<i$VeQDd:<X._*Ioyb* 6L5e4'=`1*XSEUBPQS9pfqkDODc5wFSE@KKBRiV*R_3o4e!]iAu@FWSSI!^pbh`i(kpz*kARkfB'Nu2XfzhLBbNhWY8t5`/b'?JN7dUc]<%Na#Nzr[nK2RXI=e_%S?>f!x#Wz4)DV[; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:29:00 GMT

Content-Length: 125
ANX_async_load({"url":"hXXp://bh.contextweb.com/bh/rtset?do=add&pid=54
5979&ev=3338670318734125865", "c":0, "tagtype":"img"});HTTP/1.1 200 OK
..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expire
s: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com
/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTR
o BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333
8670318734125865; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domai
n=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Ja
n-2015 06:29:00 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7
k!M4.NDvO.ZDgEREg(Pm?gvnX.5fJ2EUwMNC)(b20gYicFf_5 7)HJ2=!Gd8sK6wcmPgSB
tr)yEsY0S:mjpO4'S_-Q-.]1wAhXxyzgnJN]6MZmnItjfQ$Z]98brVr>`Ncp0iwSk-#
MiI5[VG#QHQ!fk=OerzVN3IEn#WeG)QUhedth_*85>lOJJ<cjXp4TKV`W*m`J'E]
7p/5R6[zpZdFX2nXRJ't#EVP:o(Xm?gQPrJafa(pHe!`Llpa?K51<i$VeQDd:<X.
_*Ioyb* 6L5e4'=`1*XSEUBPQS9pfqkDODc5wFSE@KKBRiV*R_3o4e!]iAu@FWSSI!^pbh
`i(kpz*kARkfB'Nu2XfzhLBbNhWY8t5`/b'?JN7dUc]<%Na#Nzr[nK2RXI=e_%S?>
;f!x#Wz4)DV[; path=/; expires=Thu, 30-Apr-2015 06:29:00 GMT; domain=.a
dnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-
8..Date: Fri, 30 Jan 2015 06:29:00 GMT..Content-Length: 125..ANX_async
_load({"url":"hXXp://bh.contextweb.com/bh/rtset?do=add&pid=545979&ev=3
338670318734125865", "c":0, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.NDvO.ZDgEREg(Pm?gvnX.5fJ2EUwMNC)(b20gYicFf_5 7)HJ2=!Gd8sK6wcmPgSBtr)yEsY0S:mjpO4'S_-Q-.]1wAhXxyzgnJN]6MZmnItjfQ$Z]98brVr>`Ncp0iwSk-#MiI5[VG#QHQ!fk=OerzVN3IEn#WeG)QUhedth_*85>lOJJ<cjXp4TKV`W*m`J'E]7p/5R6[zpZdFX2nXRJ't#EVP:o(Xm?gQPrJafa(pHe!`Llpa?K51<i$VeQDd:<X._*Ioyb* 6L5e4'=`1*XSEUBPQS9pfqkDODc5wFSE@KKBRiV*R_3o4e!]iAu@FWSSI!^pbh`i(kpz*kARkfB'Nu2XfzhLBbNhWY8t5`/b'?JN7dUc]<%Na#Nzr[nK2RXI=e_%S?>f!x#Wz4)DV[


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:29:01 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:29:01 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:29:01 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:2
9:01 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Sat, 31-Jan-2015 06:29:01 GMT; domain=.adnxs.com; HttpOnly..Conte
nt-Type: text/html; charset=utf-8..Date: Fri, 30 Jan 2015 06:29:01 GMT
..Content-Length: 0..

GET /cookie/?dmp=1&xxx=104&c=100315090728510000&userid=6110017589072035866 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: sync.active-agent.com


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:52 GMT

Set-Cookie: userid=6110017589072035866;Path=/;Domain=.active-agent.com;Expires=Wed, 29-Jul-2015 06:28:52 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=14&axd_fuid=6110017589072035866

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCC0gVOkA+hgL HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:50:30 GMT

Expires: Sat, 31 Jan 2015 03:50:30 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268697

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010340Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.- T.........20150127010340Z....20150203010340Z0...*.H................
..4.kr.Y..r2...\.A..*......?=bN.u.eMr.......7...s(....6Z..y;r>.cG..
..~......U..{.w. 8..z..H...2..O.R...{e..U....-..=.&..d .../.N.,..?.X..
gm..8?..#C"./..^....f..@]-{..<.`..~........Y.K>._w.2./(..Ds.....
...........}.2...j.*c.>q.h.-.N..tj........}..<....!.....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCC0gVOkA+hgL HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:50:30 GMT

Expires: Sat, 31 Jan 2015 03:50:30 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268697

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010340Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.- T.........20150127010340Z....20150203010340Z0...*.H................
..4.kr.Y..r2...\.A..*......?=bN.u.eMr.......7...s(....6Z..y;r>.cG..
..~......U..{.w. 8..z..H...2..O.R...{e..U....-..=.&..d .../.N.,..?.X..
gm..8?..#C"./..^....f..@]-{..<.`..~........Y.K>._w.2./(..Ds.....
...........}.2...j.*c.>q.h.-.N..tj........}..<....!.HTTP/1.1 200
 OK..Content-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 0
3:50:30 GMT..Expires: Sat, 31 Jan 2015 03:50:30 GMT..Server: ocsp_resp
onder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-O
ptions: SAMEORIGIN..Age: 268697..Alternate-Protocol: 80:quic,p=0.02..C
ache-Control: public, max-age=345600..0..........0..... .....0......0.
..0......J......h.v....b..Z./..20150127010340Z0k0i0A0... ..........j..
...p.I.#z...(~d..J......h.v....b..Z./..- T.........20150127010340Z....
20150203010340Z0...*.H..................4.kr.Y..r2...\.A..*......?=bN.
u.eMr.......7...s(....6Z..y;r>.cG....~......U..{.w. 8..z..H...2..O.
R...{e..U....-..=.&..d .../.N.,..?.X..gm..8?..#C"./..^....f..@]-{..<
;.`..~........Y.K>._w.2./(..Ds................}.2...j.*c.>q.h.-.
N..tj........}..<....!.....
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCG1HMsB+XmUO HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:50:01 GMT

Expires: Sat, 31 Jan 2015 03:50:01 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268726

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010706Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.mG2.~^e.....20150127010706Z....20150203010706Z0...*.H.............rK5
.%....z.(..*V.......5~......#\Y....og..F....f8[.?M)B....j........D}.K.
....r...HN.0cZ....Q9.&..|..8.1o.9.H......... 0.....3.N.4..D...G.....Ey
|)2..b.1v..{5.......`[email protected].=....]...uWw|.../.M........9D1_s..<..=B=
F..Z.....:.J....F...}A*...g..2....!.m..._5..$.....


GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCG1HMsB+XmUO HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:50:01 GMT

Expires: Sat, 31 Jan 2015 03:50:01 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268726

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010706Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.mG2.~^e.....20150127010706Z....20150203010706Z0...*.H.............rK5
.%....z.(..*V.......5~......#\Y....og..F....f8[.?M)B....j........D}.K.
....r...HN.0cZ....Q9.&..|..8.1o.9.H......... 0.....3.N.4..D...G.....Ey
|)2..b.1v..{5.......`[email protected].=....]...uWw|.../.M........9D1_s..<..=B=
F..Z.....:.J....F...}A*...g..2....!.m..._5..$.HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 03:50:01 GMT.
.Expires: Sat, 31 Jan 2015 03:50:01 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 268726..Alternate-Protocol: 80:quic,p=0.02..Cache-Control
: public, max-age=345600..0..........0..... .....0......0...0......J..
....h.v....b..Z./..20150127010706Z0k0i0A0... ..........j.....p.I.#z...
(~d..J......h.v....b..Z./..mG2.~^e.....20150127010706Z....201502030107
06Z0...*.H.............rK5.%....z.(..*V.......5~......#\Y....og..F....
f8[.?M)B....j........D}.K.....r...HN.0cZ....Q9.&..|..8.1o.9.H.........
 0.....3.N.4..D...G.....Ey|)2..b.1v..{5.......`[email protected].=....]...uWw|.../
.M........9D1_s..<..=B=F..Z.....:.J....F...}A*...g..2....!.m..._5..
$...<<< skipped >>>

GET /banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=79&wi=1733047328&ac=2&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597666820190

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 5235
document.write('\x3Cdiv style="position:absolute;width:160px;height:0p
x">\x3Cdiv id="obaButton_6110017597666820190">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_160x600_grey {\n    width:160px;.\n    height:600px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a,\n.paoffer_0kRa2RNR3aG3NRNa 
h2,\n.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\
n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3
NRNa a {\n.display:block;\n.float:left;.\n.background:transparent url(
hXXp://imagesrv.adition.com/banners/270/files/00/00/b7/09/000000046857
.png) no-repeat top left;\n.padding:1px;\n.text-decoration:none !impor
tant;\n.color:#000 !important;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a:hover,
\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3aG3NRNa a:foc
us  {\n.background-position:left bottom;\n}\n \n.paoffer_0kRa2RNR3aG3N
RNa a:hover,\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3a
G3NRNa a:focus,\n.paoffer_0kRa2RNR3aG3NRNa a:hover span  {\n.text-deco
ration:underline;\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .pa
offer-inner_0kRa2RNR3aG3NRNa {\n.position:relative;.\n    display:bloc
k;\n.width:160px;\n.height:195px;\n.overflow:hidden;\n. \n.text-de<<< skipped >>>

GET /ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3170539322&ipr=y HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0.02..GIF89a.............!.......,...........D.;.
.

GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif?meta=appNexus HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dps.bing.com

DNT: 1

Connection: Keep-Alive

Cookie: SRCHD=MS=3187714&SM=1&D=3093912&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MUID=1785AC2FD94664211AC0A9A6DD466620


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 42

Content-Type: image/gif

Expires: 10:28:45 PM

Server: Microsoft-IIS/8.5

TrackingId: b5acede1-262a-4ecb-8aed-f91c45c000f4

X-Powered-By: ASP.NET

X-MSEdge-Ref: Ref A: 2D193504958942D994ED9BE1DC51BC95 Ref B: 591B9C2EE0BF4BD21065D850D25D7925 Ref C: Thu Jan 29 22:28:50 2015 PST

Date: Fri, 30 Jan 2015 06:28:49 GMT

GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Contr
ol: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 10
:28:45 PM..Server: Microsoft-IIS/8.5..TrackingId: b5acede1-262a-4ecb-8
aed-f91c45c000f4..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: 2D193504
958942D994ED9BE1DC51BC95 Ref B: 591B9C2EE0BF4BD21065D850D25D7925 Ref C
: Thu Jan 29 22:28:50 2015 PST..Date: Fri, 30 Jan 2015 06:28:49 GMT..G
IF89a.............!.......,...........L.;..

GET /banner?sid=3097401&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1219206&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58695_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc3=10039qjg3AAGmJMtU


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601967030329

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc3=10039atA2AAGmJMtUbdA2AAGzMstUqjg3AAGmJMtU; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 4593
document.write('\x3Cdiv style="position:absolute;width:300px;height:0p
x">\x3Cdiv id="obaButton_6110017601967030329">\x3C/div>\x3C/d
iv>\n\x3Cnoscript>\n\x3Ca href="%clickurl&hXXp://servedby.flasht
alking.com/click/2/43305;1078532;0;209;0/?ft_width=300&ft_height=250&u
rl=6388781" target="_blank">\n\x3Cimg border="0" src="hXXp://served
by.flashtalking.com/imp/2/43305;1078532;205;gif;QuismaDE;2399192447418
2218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstation
AwarenessExpandURL1/?cachebuster=6110017601967030329">\x3C/a>\n\
x3C/noscript>\n\x3Cscript language="Javascript1.1" type="text/javas
cript">\nvar ftClick = "http://c13.w3hoster.de/adsc.php?s
w3=14046_a_cw3=58695_a_gpr=AA==_a_w3hr=73_a%
5Fw3hurl=http%3A%2F%2Fad2.adfarm1.adition.com%2Fredi*lid%3
D6110017601967030329%2Fsid%3D3097401%2Fkid%3D1219206%2Fbid%2
53D3987699%2Fc%3D15610%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%
253D";\nvar ftExpTrack_1078532 = "";\nvar ftX = "";\nvar ftY = "";\nva
r ftZ = "";\nvar ftOBA = 1;\nvar ftContent = "";\nvar ftCustom = "";\n
var ft300x250_OOBclickTrack = "";\nvar ftRandom = Math.random()*100000
0;\nvar ftBuildTag1 = "\x3Cscr";\nvar ftBuildTag2 = "\x3C/";\nvar ftCl
ick_1078532 = encodeURIComponent(ftClick);\nif(typeof(ft_referrer)=="u
ndefined"){var ft_referrer=(function(){var r="";if(window==top){r=wind
ow.location.href;}else{try{r=window.parent.location.href;}catch(e){}r=
(r)?r:document.referrer;}while(encodeURIComponent(r).length>100<<< skipped >>>

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:40 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=d26838c2215684bd31828617f7d40945d1422599260; expires=Sat, 30-Jan-16 06:27:40 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 29 Jan 2015 22:17:29 GMT

Expires: Tue, 03 Feb 2015 06:27:39 GMT

ETag: "e4ad2f2a4eb2bfb6fd886113a3e4ac3575ac4864"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9ae15edc0485-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0129221729Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150129221729Z....20150202221729Z."0 0..
. .....0......20140129221729Z0...*.H..............}%....M...s3."....u.
..a....Ih."^.[...&..P..cB1..r.aW..../F..FLh{.#.A?C... ...A-.....<.{
.=.x....D...b.....:7.....'..1..1..zh.h.=..Ng..._.......#Iy*....*._.^..
$d/AT..*...X5z2m......[*$..1"T.!..... ....w.0.....l.~(%.......7.....7.
.l2.H.S..@.."0F....<....`.v.....0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQxsL2eHTbKwjJcY2gHLbXTx2GdSQQUp6KDuzRFQD381TBPErk+oQGf9tsCEAKOMv/kt6CYURxbwlEF3S8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: tb.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1365

content-transfer-encoding: binary

Cache-Control: max-age=408147, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 23:47:24 GMT

Expires: Tue, 3 Feb 2015 23:47:24 GMT

Date: Fri, 30 Jan 2015 06:28:54 GMT

Connection: keep-alive
0..Q......J0..F.. .....0.....70..30........T..I\....zk.v.*4.8..2015012
7234724Z0s0q0I0... ........1....6..2\ch.-...a.I......4E@=..0O..>...
......2.....Q.[.Q../....20150127234724Z....20150203234724Z0...*.H.....
........C0q...H.9.N!.v.a.(......7.{...E.......mwH6..F...O]..Of.O...}R.
.u."E.B.......a..S.$.A...[.4.Z.p.Q..B....).....P.$...5_..w...,c..../O.
..R./O..I&v....|[.....e<.....Y2.1$.z..WR.,.d\p...1........G`a....A.
v..6.g.GI `}.4...a5...>.....x.0Yw....|...^p......f^...L">...z0..
[email protected]...*.H........0<1.0...U....US1.0..
.U....Thawte, Inc.1.0...U....Thawte SSL CA0...141204000000Z..150304235
959Z0H1.0...U....US1.0...U....Thawte, Inc.1"0 ..U....Thawte SSL OCSP R
esponder0.."0...*.H.............0...........1nD.D....f.!F..-..D...w.r.
^...'..n;.s#.9]Yc..Kx.....L......E...z...\..g.35a4S......E..v t..g....
.:..q.'..............Y/.)"....5..S....f.(]b...2e... ...Z..i`..qO..G..d
.x d5.at.1\.>.O...D./..=?..{^..........T...M8.......a. y.b,..KH....
)B.ph.........*A..........d0b0...U....0.0...U.%..0... .......0...U....
....0... .....0......0"..U....0...0.1.0...U....TGV-B-24610...*.H......
.......y.....0.PU..>f...>...s..........*..^.U...N.y'?nt.-..H..o.
.....A...1H......|....:(..l$l:......g....Z...d.nn.....P....t.g.M./....
.6f..N>.}[email protected]..../.....Wm$U.?.....u.|.....j..)0..k..,.(.....9..
%p.........'a_*..J&.a......lv.....~..O./.......R.|......(V.W....<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion3.gif HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT

Content-Type: image/gif

Content-Length: 79037

Accept-Ranges: bytes

X-Varnish: 2052674707 2052327401

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:26 GMT

Date: Fri, 30 Jan 2015 06:26:26 GMT

Connection: keep-alive
GIF89a|.=.................u..f...^.v..i.Q..3..Ku..W....o...........Vho
/g...S.n.e.-f..h..F......R{......&...j.W.....0...R......W........d...(
............H........F....F..............9UgQ..3.....u..3u.......%...-
^....s....U..5..G........x...]...3.....4.......mOk........"..x.."...x.
..,p...B....*V./JY....d........J........6.$...Y.l........L...vS......G
...........0...3..I...... .w.....Y....r)W...S..3...Y.I.........{......
...........!'w...T.>dye.....u............2.j"$`r....x.....)R.....X.
g..G...U.....G.7..X...k..I.g........E......Z.......:}.K...............
..t...4=...R...~|wR=x.........ok......................................
......................................................................
................................................~........ .c1J........
..............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="...
" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:m
eta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 
       "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-s
yntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="http:
//ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://nsm4......Z......O
...*..:.LV.7..UVU..{..j....G..d.[....X.1.Rk2_.b.m.y..2...K...nx.......
#.........D..iC."...L......,..GVM.QJb.px.w.0.^M.k.d[.1W..KlZ...v.p.G2.
%K{r.y.l-.....m.1GF.......:#..k?../..G......o..3.t..Q.9...I$QY/)..^..1
.V]...e.}..j.ef.o..w...m..&.M..-.i|.0....._fn....h...].....b..5.....d.
..s.T..#i..NZ....b. .........1........K..w7...[z.....-.-.y...g|P..<<< skipped >>>

GET /adview.php?tz=1422599315415646&pid=789&kid=4&wmid=4178&sid=4&nvc=1&swid=3826&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.5

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /free/frg/products/616550/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 25 Jan 2009 14:27:28 GMT

Content-Type: image/jpeg

Content-Length: 30153

Accept-Ranges: bytes

X-Varnish: 2052680191 2052042272

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!.1".A..Q2#aB.q.3$..RbC4%...r..&........................!1
..AQa.q..."......2.BR..br.......#3..Cs$Td%&.c..4t5............?....}..
.~P.............pj.^jq...Qt..B.1.R.....4L>._#f.......z.....36.8...8
..E(I...:/Y..z....W..g....h.'.@..;.7..WT=.]...QY...9].;v..0....|.c....
...........9..p....~L....\...xP..Z.qw.."...&..MG.W..f.Vp...w.....d.t..
-..#oE....]..!.....Mc}.RHh..}.y7m-SB.>..z...U.$....o..9...1......X.
..&9..d#....w.l.^u.9o.s....R....U.~..C~.V?.8....O.D...G5.9....Ja......
..c........U...c ..wy{.....m...zWs-@..?..W.5...2...6...^...1.....T.|.z
o5..-.y.m.Q.M...}A..Hy..d.^.M.H.^......E.M...j ..66...^Rh....[Kq.hE.H.
RC...&...ut]5#y.......Z..v..~}...`-..J..p.C).................G..jZ..wm
8..P./.9....,.<..T.!.Y...}[email protected]^. ..l^{i.|..."...u.m..r...
2........VT "t.,..D........EuKM&.S........X....q6....2Zd...wkm!.wR..@.
.zd|[....K$..\^[email protected]'..M
G.V.0*hE.7.....s.l.F..K.i...i.BWy.}..>....U.O.N=..C.......4.U....mk
/*M..);.....k..'...m.V.a.Bn,........{..>,l..I=.jFA.9<..<.?!..
.. L....3jV.]<..q.;^7]...V.r3h...U...bsZ.!.A...t.]..>....].*.&o.
......q.V-.M.Z....re................ ....zz..0Ck.m.\.60.I%1....&w...G.
.,.yS...Xq~-.Y).5...1...5..#7..q.x\....../E~.XKp#......T........R.<<< skipped >>>

GET /free/frg/products/633350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive



.U8UA}..u.la"k.G..=..<..l.........2 2.9.C..H..(A.)....v...[,..c....
.j*a.....Tp._.d0.kL;.b..Ci\.iXR.Y...o..Q...57P......T..*....<b..m..
.D.K R*...........F&.._M..{.n.......6.e..<..(...u/).....h>......
..M-:B...Gz...&....V.i.8.A.....PV.^.g..."...d[\.S.....6.P.*[email protected].
...)..6.M.wE...*....1..._..h.V .P.O.Zl...).^)@.f....(x...P...x6.dd>
N.d..?.P....-...-..>......s...\os.:..}.?$..*..5Gn{...:Y...!.r. 9.;.
..;..ys.C..O.D..o...)f.2J....}8.~:`.V..%....$.(...G......$..g.s..qq...
...[.F..Y...Rh..*.~..?..m.....o...A...?eK....[..@94.>=......3...7i7
%BJxFi.Z.R...N..)^.......j....$...[t....LjFJI...*..j.. enW..T.TjjJ..Mz
......K.waS8.cB.......K.b..q.(...9L.[J1.p,...H..n.m..US....D6.<...e
j..RM7.j..#*...Pq8PVO.a...rLz...N...........R}...]...\>>.V....{k
.\.....18.....La.......^.o~..m...<.E..E[.<..W.Z..GU.u..f.p3F..P.
(..F..V_On..m..!.92N......w.8.:.hC.A(M..>Z..\l..*.v=:j.d..<)..&g
t;.^.d...6.Q...q..o.t.n.n..P.q.U....{.....~}......-$..F....w.m..2....`
{.v..j....F!/..r{.......8vp|....e...K.#.....O.v..6k]..l...........SN.4
...).GXu%......Vr....G....W.r../i.f*.....%....lb.k.6...._..DO....|...I
 .B...8.*.....iW....<..I[.......u..6.,..r..........D.R.....S....iK}
./..q`r..X.........?...T..]\...?..g.|xwU...4ow.a...'4 #.k...m....AP$..
.M|u...q..YT......V.8..=1.je$.[..)...O.pZc$.}........M.o_...... 9....j
....N.y... K....E.M..~.....p.[@.*..~....>...[..C....G.U..t.Vc.x./&g
t;..kkv.......oi......M....e...;..uy..L.o.5'.....Q....i....ca.%JmBS|.b
@=}f.....~5.V{..:d...W..e....n.....l..i..........l-..f4.......6...<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: application/ocsp-response

Content-Length: 1514

Connection: keep-alive

Set-Cookie: __cfduid=de614560aa8bb606638267935193eab6e1422599333; expires=Sat, 30-Jan-16 06:28:53 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Thu, 29 Jan 2015 16:30:16 GMT

X-Powered-By: Servlet/3.0; JBossAS-6

ETag: 7b29ae1b1bb3659ef51be7354d0197767ef2663d

Expires: Sat, 31 Jan 2015 06:28:52 GMT

Cache-Control: public, max-age=86399

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9cac0de301b1-FRA
0..........0..... .....0......0...0......"... H([email protected]|.`......2015012
9163016Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K.
......./N.E.....20150129163016Z....20150130163016Z0...*.H............d
x4D3.&;X2....3w........m.c.Zh.....kl.n.S.o.R2k....G[..4..^..V..(.L....
.`,n...9..._...M...5.;..hD.{.x&.X.Wu4m&S.|.4./.=..*2f&...c....b."....j
/....)....C..%..~.|.......L...2........"`v.jY....-R..'K.r.Z.`.3.~.6.Y/
.............TF.m.F._...}..P7....o...J..B.......0...0...0..........E..
...i..y... 0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA0...150106000000Z..150331
000000Z0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign
 OCSP for Root R1 - Branch 10.."0...*.H.............0.........V-...b.%
.q.A$..D..2wh..5.......}o..rB.s.....jj........cO...q.......8r?.F(....S
....?!......F-.F(.EEe.\(mF...E...[.3.6.Z.h.q.?g..L....Gb.9h...(n......
..{-.....U$.N.;.Qx.a..n..YQ.*).....Sl..t.6........2..W....4?...5sb..8.
.>.,. ..^.y>..@%..ql.[.....1.!..$...5........0..0...U...........
0...U.%..0... .......0...U.......0.0...U......"... H([email protected]|.`....0...
U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._
0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.........
.....Cz.$8.....^l.Z...[..X.7].Ig.......b.s{.M m.....wp..{w..`.1..*....
9e......@B,Z.....G.W...g  .-b.....#.....H&&.8.}.K1a...~L?....0Y*rhg..!
..i..\sl...5.o...^.k..M.....J.......{8....8/.......L.1.hT.>.....WG.
......5.[.9.'.....*............W......X....UA..9.#w)...<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=5711106&cr=58415&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEGwkCSV07gf3g5QOsqmf+MY= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=486988, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 21:47:43 GMT

Expires: Wed, 4 Feb 2015 21:47:43 GMT

Date: Fri, 30 Jan 2015 06:31:15 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015012
8214743Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.l$.%t...............20150128214743Z....20150204214743Z0...*.H........
.....ETI..}..0.5yi.W...v.ln..I..G.3i.......{.....Y.o..4......./..=..K%
...%..^..[L.q..c.....K.>..(...QHl...(<..N..a.l.9.MC?x.u.>.u.t
.|..A(.G.VK.l ...3.......q...UNj...[.O.;2...U.a..acxT/...?....3!....|.
..e...*z.-g}.V...[s..P."......KT..).QE.mQ...x..h.=.pi.}uaz.....#0...0.
..0..........<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U
....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of
 use at hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 
Code Signing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US
1.0...U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2T
erms of use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSig
n Class 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.
........{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk...
.(..........p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..
~QG.d.}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<
.l....(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0
...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.v
erisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS i
ncorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...
U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...<<< skipped >>>

GET /cookie.php?url=http://dsp.active-agent.com/cookie/?dmp=1&userid=%COOKIE%&xxx=104&c=100315090728510000 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dsp.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:52 GMT

Set-Cookie: UserID1=6110017589072035866;Path=/;Domain=.adition.com;Expires=Wed, 29-Jul-2015 06:28:52 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://sync.active-agent.com/cookie/?dmp=1&xxx=104&c=100315090728510000&userid=6110017589072035866

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /ThawtePremiumServerCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.thawte.com


HTTP/1.1 200 OK

Server: Apache

ETag: "5af11a746f5fb34628565e60758afc00:1422566442"

Last-Modified: Thu, 29 Jan 2015 21:20:42 GMT

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Length: 12067

Connection: keep-alive

Content-Type: application/pkix-crl
0./.0...0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U.
...Cape Town1.0...U....Thawte Consulting cc1(0&..U....Certification Se
rvices Division1!0...U....Thawte Premium Server CA1(0&..*.H........pre
[email protected]!....f....p..
........100129104213Z0!....l.C`..L.%|\.T...130819183955Z0!....T..W...p
.[..%...100322161038Z0!....hx.....k...7....130919164724Z0!....$#.R|..$
.....j..130926101045Z0!...!P..6{[email protected]!...Da\v.....
.....%..130920062728Z0!...>.e..-...s[.2I...140418142220Z0!....dU...
(...=...*..140801114607Z0!........d.{#E..9`...130926061856Z0!....6..q.
'tT..1.Q...130926062249Z0!.....cXzF..(O0.|.N..131002103626Z0!.........
...>..i....130528164218Z0!..........#.P.......130716072254Z0!.....W
........JH....130924125316Z0!.....%.......R......100801221434Z0!.....M
..HK.....x....130926060355Z0!....k."..z......64..130919082450Z0!...N..
D...0....`H2..130829152308Z0!......Q..m...A..j...100226190909Z0!.....-
...k......h...130930085951Z0!...... ...7. .UA.I..130927152007Z0!.....}
.L....\/..$^..100407191443Z0!....1....c...s.>9t..100215170304Z0!...
W..._....%..I....130926063253Z0!..._._~gq.I.)[email protected]!...
..=X>...][email protected]!.............U.<....100318180248
Z0!... .(........n.S...130923202627Z0!.....k(....k4.......130919073042
Z0!....rF..O..#^.......100312081338Z0!.....:...B..=]Hsx_..130920011556
Z0!....uJdm..'...\G....130523054519Z0!....]h..g.o....@\ ..100107184454
Z0!...z..1).Ht.........100323155426Z0!.... ....z.i.a.nl...10031221<<< skipped >>>

GET /sync/img?mt_exid=13&mt_exuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: sync.mathtag.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Type: image/gif

Content-Length: 0

Connection: keep-alive

Keep-Alive: timeout=360

X-Echo-set-stash JSON-URI: "/sync/img?mt_exid=13&mt_exuid=3338670318734125865"

X-Echo-set-stash JSON-REFERER: "hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html"

Cache-Control: no-cache

Set-Cookie: uuid=dbf254cb-24a3-4e00-920d-6f1d855c1a7b; domain=.mathtag.com; path=/; expires=Sat, 30-Jan-2016 06:28:51 GMT

Location: hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3338670318734125865&mm_bnc&mm_bct

X-Echo-set-stash JSON-USER-AGENT: "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Server: mt2/2.11.1.rc7 ce1fa6b stats-refactor2 Sep 29 2014 14:10:14 cdg-pixel-x8 pid 0x2cf0 11504

Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sun, 01-Mar-2015 06:28:51 GMT

Set-Cookie: uuidc=oZWUsz7rTFAjIZbTcEREjf3UWy  BhzzN8KVwsJzR6qN4jo6/pp/O45mRb0JVox/5pZN0Qe54gbmxeyJgmAeBw==; Expires=Sat, 30-Jan-16 06:28:51 GMT; Domain=.mathtag.com; Path=/

Expires: Fri, 30 Jan 2015 06:28:50 GMT

....

GET /sync/img?mt_exid=13&mt_exuid=3338670318734125865&mm_bnc&mm_bct HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: sync.mathtag.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid=dbf254cb-24a3-4e00-920d-6f1d855c1a7b; mt_misc=; uuidc=oZWUsz7rTFAjIZbTcEREjf3UWy  BhzzN8KVwsJzR6qN4jo6/pp/O45mRb0JVox/5pZN0Qe54gbmxeyJgmAeBw==


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

Keep-Alive: timeout=360

X-Echo-set-stash JSON-URI: "/sync/img?mt_exid=13&mt_exuid=3338670318734125865&mm_bnc&mm_bct"

X-Echo-set-stash JSON-REFERER: "hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html"

Cache-Control: no-cache

Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sun, 01-Mar-2015 06:28:51 GMT

X-Echo-set-stash JSON-USER-AGENT: "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Server: mt2/2.11.1.rc7 ce1fa6b stats-refactor2 Sep 29 2014 14:10:14 cdg-pixel-x8 pid 0x2611 9745

Expires: Fri, 30 Jan 2015 06:28:50 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Fri,
 30 Jan 2015 06:28:51 GMT..Content-Type: image/gif..Content-Length: 43
..Connection: keep-alive..Keep-Alive: timeout=360..X-Echo-set-stash JS
ON-URI: "/sync/img?mt_exid=13&mt_exuid=3338670318734125865&mm_bnc&mm_b
ct"..X-Echo-set-stash JSON-REFERER: "hXXp://partners.freeridegames.com
/banners/default/300x250_INT_ROS_tribel.html"..Cache-Control: no-cache
..Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sun, 01-M
ar-2015 06:28:51 GMT..X-Echo-set-stash JSON-USER-AGENT: "Mozilla/5.0 (
compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)"..P3P: CP="
NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA".
.Server: mt2/2.11.1.rc7 ce1fa6b stats-refactor2 Sep 29 2014 14:10:14 c
dg-pixel-x8 pid 0x2611 9745..Expires: Fri, 30 Jan 2015 06:28:50 GMT..G
IF89a.............!.......,...........D..;..<<< skipped >>>

GET /rum?cm_dsp_id=46&external_user_id=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: r.casalemedia.com


HTTP/1.1 200 OK

Server: Apache

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"

Content-Type: image/gif

Expires: Fri, 30 Jan 2015 06:28:58 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:58 GMT

Content-Length: 43

Connection: keep-alive

Set-Cookie: CMID=VMskqsAoJ2kAAGW09u8AAAD4;domain=casalemedia.com;path=/;expires=Sat, 30 Jan 2016 06:28:58 GMT

Set-Cookie: CMPS=296;domain=casalemedia.com;path=/;expires=Thu, 30 Apr 2015 06:28:58 GMT

Set-Cookie: CMST=VMskqlTLJKoA;domain=casalemedia.com;path=/;expires=Sat, 31 Jan 2015 06:28:58 GMT

Set-Cookie: CMSC=VMskqg**;domain=casalemedia.com;path=/;

Set-Cookie: CMDD=;domain=casalemedia.com;path=/;expires=Sat, 31 Jan 2015 06:28:58 GMT

Set-Cookie: CMRUM3=2e54cb24aa27603338670318734125865;domain=casalemedia.com;path=/;expires=Sat, 30 Jan 2016 06:28:58 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Ap
ache..P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS
 UNI"..Content-Type: image/gif..Expires: Fri, 30 Jan 2015 06:28:58 GMT
..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date
: Fri, 30 Jan 2015 06:28:58 GMT..Content-Length: 43..Connection: keep-
alive..Set-Cookie: CMID=VMskqsAoJ2kAAGW09u8AAAD4;domain=casalemedia.co
m;path=/;expires=Sat, 30 Jan 2016 06:28:58 GMT..Set-Cookie: CMPS=296;d
omain=casalemedia.com;path=/;expires=Thu, 30 Apr 2015 06:28:58 GMT..Se
t-Cookie: CMST=VMskqlTLJKoA;domain=casalemedia.com;path=/;expires=Sat,
 31 Jan 2015 06:28:58 GMT..Set-Cookie: CMSC=VMskqg**;domain=casalemedi
a.com;path=/;..Set-Cookie: CMDD=;domain=casalemedia.com;path=/;expires
=Sat, 31 Jan 2015 06:28:58 GMT..Set-Cookie: CMRUM3=2e54cb24aa276033386
70318734125865;domain=casalemedia.com;path=/;expires=Sat, 30 Jan 2016 
06:28:58 GMT..GIF89a.............!.......,...........D..;..<<< skipped >>>

GET /idsync/appnexus/receivethenpush?adnxs_uid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.tapad.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: nginx/1.4.1

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 0

Connection: keep-alive

P3P: policyref="hXXp://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Set-Cookie: TapAd_TS=1422599336689;Expires=Tue, 31 Mar 2015 06:28:56 GMT;Path=/;Domain=.tapad.com

Set-Cookie: TapAd_DID=44b72611-a849-11e4-a895-005056a2376a;Expires=Tue, 31 Mar 2015 06:28:56 GMT;Path=/;Domain=.tapad.com

Location: hXXp://ib.adnxs.com/setuid?entity=45&code=44b72611-a849-11e4-a895-005056a2376a
HTTP/1.1 302 Found..Server: nginx/1.4.1..Date: Fri, 30 Jan 2015 06:28:
56 GMT..Content-Length: 0..Connection: keep-alive..P3P: policyref="htt
p://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR AD
M PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..Set-Cookie: 
TapAd_TS=1422599336689;Expires=Tue, 31 Mar 2015 06:28:56 GMT;Path=/;Do
main=.tapad.com..Set-Cookie: TapAd_DID=44b72611-a849-11e4-a895-005056a
2376a;Expires=Tue, 31 Mar 2015 06:28:56 GMT;Path=/;Domain=.tapad.com..
Location: hXXp://ib.adnxs.com/setuid?entity=45&code=44b72611-a849-11e4
-a895-005056a2376a..

GET /do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599348429 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: player.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: JSESSIONID=49C83FF2E975AF303626693D6FF75A1F; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com; geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:46 GMT

Server: Apache

Set-Cookie: JSESSIONID=933D9B0C403D42238F30536FF30B6F09; Path=/; HttpOnly

Content-Length: 313

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
updateClientCookies( [{name:'143_CAMPAIGN_SERIAL_ID',value:'Default-FR
G_Website',expire:'7776000'},{name:'143_UDOM',value:'partners.freeride
games.com',expire:'7776000'},{name:'143_TURNKEY',value:'Default-481422
599182472568',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Defau
lt-MSIE 7.0',expire:'7776000'}]);HTTP/1.1 200 OK..Date: Fri, 30 Jan 20
15 06:28:46 GMT..Server: Apache..Set-Cookie: JSESSIONID=933D9B0C403D42
238F30536FF30B6F09; Path=/; HttpOnly..Content-Length: 313..P3P: CP="ID
C CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3,
 max=800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-
8859-1..updateClientCookies( [{name:'143_CAMPAIGN_SERIAL_ID',value:'De
fault-FRG_Website',expire:'7776000'},{name:'143_UDOM',value:'partners.
freeridegames.com',expire:'7776000'},{name:'143_TURNKEY',value:'Defaul
t-481422599182472568',expire:'7776000'},{name:'143_FIRST_BROWSER',valu
e:'Default-MSIE 7.0',expire:'7776000'}]);..

GET /beacon.js HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: b.scorecardresearch.com

Connection: Keep-Alive

Cookie: UID=120c9bfd-194.221.64.106-1384780341; UIDR=1384780341


HTTP/1.1 200 OK

Content-Type: application/x-javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Expires: Fri, 13 Feb 2015 06:26:24 GMT

Date: Fri, 30 Jan 2015 06:26:24 GMT

Content-Length: 1140

Connection: keep-alive

Cache-Control: private, no-transform, max-age=1209600
..........mU...6.}......CF.l/.4..k4.<.h. i.\..(.bK.....".{.e..M..".
3...sF..(_[3;...J..._..)A.m?).. <..U.V....ce.......R........J......
.$........{q.|...x#...;.[,.7....r'.p....p.6......7....K.A.Jv:....eJ..V
...vb...q.5..$!.........M.(b...=.q...sZ.6:...t<.Rj".0.X"#.Dd...f.5.
n....E0.*.E..tRy.>i`..\.......`!.Ed.^.....}..".~.l.?.9..6....s.1...
z?....e.K >..0....W,nd...k.....N.g.G?^:..(.cS0c<..V...P#Bjo....M
.....0..o...,....A.p.....\...Z'2T5.........^[email protected].....
........l`y..1.,.h.N......d.......< z<....c.g..G.f..M....._..M.3
=.|... .r.{-.. [email protected]..]G.<"..R/j........U.F.\..Q.c.A..u)....6_.=?..
....~q1I0.l....K^...$......f..R..j..A %J4Ip.....L;..m..i...~(......_..
A..z..Be .b'.....r..8".i.t&.......a.~..8..C....P&d.....*.M......'[email protected].
.b...Yp..v/l,.3G9.......2I..[....]`.X8.q..>%n..t..nW....!.. ...M...
...,.%.....>#k.g.A.jf..sC`S ..v.{[....$~F...|..zr!..hK}U.....N..S&d
"...v?$..|.V.4QWy.....T)K2.T.'........Ee.j<Ml:f@...{....i..7...d..Y
.7 .;.y..zmz\9.a.....Y..E.,.I....-e/V.%......Z.........../Y....)..O.6.
....h...G.8../.9.VzU.....C....P...s....Q..e.;.....>*.k._kd...9.qJ..
8.L........o......J-.P&.RY#.l}. ............g...g...".Al.......


GET /b?c1=2&c2=6035233&ns__t=1422599206452&ns_c=windows-1252&c8=&c7=http://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html&c9= HTTP/1.1

Accept: */*

Referer: hXXp://dts1.freeridegames.com/freeride_marketing/SDM/SDM_standard/header.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: b.scorecardresearch.com

Connection: Keep-Alive

Cookie: UID=120c9bfd-194.221.64.106-1384780341; UIDR=1384780341


HTTP/1.1 204 No Content

Content-Length: 0

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:26:24 GMT

Connection: keep-alive

Set-Cookie: UID=120c9bfd-194.221.64.106-1384780341; expires=Thu, 19-Jan-2017 06:26:24 GMT; path=/; domain=.scorecardresearch.com

Set-Cookie: UIDR=1422599184; expires=Thu, 19-Jan-2017 06:26:24 GMT; path=/; domain=.scorecardresearch.com

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC"

Expires: Mon, 01 Jan 1990 00:00:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
HTTP/1.1 204 No Content..Content-Length: 0..Pragma: no-cache..Date: Fr
i, 30 Jan 2015 06:26:24 GMT..Connection: keep-alive..Set-Cookie: UID=1
20c9bfd-194.221.64.106-1384780341; expires=Thu, 19-Jan-2017 06:26:24 G
MT; path=/; domain=.scorecardresearch.com..Set-Cookie: UIDR=1422599184
; expires=Thu, 19-Jan-2017 06:26:24 GMT; path=/; domain=.scorecardrese
arch.com..P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND C
OM STA OTC"..Expires: Mon, 01 Jan 1990 00:00:00 GMT..Cache-Control: pr
ivate, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate..

GET /ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3601037774&ipr=y HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0.02..GIF89a.............!.......,...........D.;.
.

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: eu-gmtdmp.gd1.mookie1.com

DNT: 1

Connection: Keep-Alive

Cookie: id=3025970665045060; mdata=1|3025970665045060|1422599330; OAX=IAz1ClTLJKIAATbP


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=3025970665045060; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Set-Cookie: mdata=1|3025970665045060|1422599330; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Connection: close

GIF89a.............!.......,...........D..;..

GET /js?wp_id=2566322&&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

If-None-Match: 14365455

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 14365457

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1105
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2566322);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad4.adfarm1.adition.com/banner?sid=2566322&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac
=' (  ad_count) '&screen_res=' screen_res '&wpt=J&clickurl=http:/%
2Fc13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr
=AA==_a_w3hr=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=6149992&cr=58700&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:49:59 GMT

Expires: Sat, 31 Jan 2015 03:49:59 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268601

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010212Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150127010212Z....20150203010212Z0...*.H.............@K.
.O.4....0"...j....5rR.@H&....z....`y.....X.:..{U.x..]K.W7.Dr.e=Qy.$D..
..o,....y.{.^.....0.Nt.y"....D.......5..4....*,T.....$..\]....<P.C@
.t.....|.......M=.\..%s6......w.....^ .....A1...8....ZJ.......o.,..l.&
gt;.n..p.. .6.>.L.$.....C...x.k]5..3....G......C.HTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 03:49:5
9 GMT..Expires: Sat, 31 Jan 2015 03:49:59 GMT..Server: ocsp_responder.
.Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options
: SAMEORIGIN..Age: 268601..Alternate-Protocol: 80:quic,p=0.02..Cache-C
ontrol: public, max-age=345600..0..........0..... .....0......0...0...
...J......h.v....b..Z./..20150127010212Z0k0i0A0... ..........j.....p.I
.#z...(~d..J......h.v....b..Z./....2.S.......20150127010212Z....201502
03010212Z0...*[email protected]"...j....5rR.@H&....z....`y..
...X.:..{U.x..]K.W7.Dr.e=Qy.$D....o,....y.{.^.....0.Nt.y"....D.......5
..4....*,T.....$..\]....<[email protected].....|.......M=.\..%s6......w.....^ 
.....A1...8....ZJ.......o.,..l.>.n..p.. .6.>.L.$.....C...x.k]5..
3....G......C...<<< skipped >>>

GET /appnexus/match?fpc=2366&pnid=1982&nuid=3338670318734125865&trid=574502685977146491&fpctok=1&nuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dtm.gap.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 204 No Content

Server: nginx/1.6.2

Date: Fri, 30 Jan 2015 06:29:00 GMT

Content-Length: 0

Connection: close

Cache-Control: max-age=0, no-store

GET /banner/asm_flashme.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn5.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6bb9; accado_ex=


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Type: application/javascript

Content-Length: 5013

Connection: keep-alive

ETag: "662801316"

Last-Modified: Sat, 23 Aug 2014 11:50:31 GMT

Expires: Mon, 09 Feb 2015 06:28:52 GMT

Cache-Control: max-age=864000

Strict-Transport-Security: max-age=31536000; includeSubdomains

X-Frame-Options: DENY

Accept-Ranges: bytes
function asm_docwrite(s){ document.write(s); }..if(typeof(asm_fid) == 
'undefined' || typeof(asm_fid) == 'null'){ var asm_rnd = Math.round((M
ath.random()*10000) 1000); }..else{ var asm_rnd = (asm_fid); }..if(typ
eof(asm_ShockMode) == 'undefined' || typeof(asm_ShockMode) == 'null').
. {.. var asm_ShockMode = 0;.. var asm_ShockVer = 0;.. .. if (navigato
r.plugins && navigator.plugins.length).. {..  if (navigator.plugins["S
hockwave Flash"])..  {..   asm_ShockMode = 1;..   if(navigator.plugins
["Shockwave Flash"].description)..   {..    var asm_d = navigator.plug
ins["Shockwave Flash"].description;..    asm_d = asm_d.substr(0,asm_d.
indexOf("."));..    asm_ShockVer = parseInt(asm_d.substr(asm_d.lastInd
exOf(' '),999));..   }..  }..  else..  {..   asm_ShockMode = 0;..  }..
  if (navigator.plugins["Shockwave Flash 2.0"])..  {..   asm_ShockMode
 = 1;..   asm_ShockVer = 2;..  }.. }.. else if (navigator.mimeTypes &&
 navigator.mimeTypes.length).. {..  if (navigator.mimeTypes['applicati
on/x-shockwave-flash'] && navigator.mimeTypes['application/x-shockwave
-flash'].enabledPlugin)..  {  asm_ShockMode = 1; }.. }.. else.. {..  a
sm_ShockMode = 0;..  asm_ShockVer = 0;..  asm_docwrite('<script lan
guage=VBScript>'   '\n'  ..    'asm_ShockMode = false\n'  ..    'as
m_ShockVer = ' 22   '\n'  ..    'Do'   '\n'  ..     'On Error Resume N
ext'   '\n'  ..     'asm_ShockMode = (IsObject(CreateObject(\"Shockwav
eFlash.ShockwaveFlash.\" & asm_ShockVer & \"\")))'   '\n'  ..     'If 
asm_ShockMode = true Then Exit Do'   '\n'  ..     'asm_ShockVer = <<< skipped >>>

GET /banner/accado/333/2014-12-23/0_OtrivinNight_160x600_GER.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn5.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; accado_ex=


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Type: image/gif

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"1664897724"

Last-Modified: Tue, 23 Dec 2014 12:45:49 GMT

Expires: Mon, 09 Feb 2015 06:28:52 GMT

Cache-Control: max-age=864000

Strict-Transport-Security: max-age=31536000; includeSubdomains

X-Frame-Options: DENY

Content-Encoding: gzip
400a.............zUS......."....-.C6.Cpw......`qw....AB..d..=....\v...
.H.......b...o..s.......,..z......wx;[email protected].....= %.
........u...Wf..}b....../t.....s..b..$..8W2s.7.....W2.4..*z.m..:...zK.
jk]>.....4{Z[..Yq.....t...J........Eg.8U8...<C{..A..............
H.K....=.../..G@.*..i..e..18...........~_.W.?...?....L.t....u....)...n
[.(l.x8=Po9...t&fs.......G.,...G.......iE..I4..D..s6.....X...P .&.TC..
k.......}x.....=......~.~.....e..e.*X..fZ.mG..,_.Un.!j.....3q.......d.
?...(...Y.U......2..v.S.Awo;..6.0.DtP..........&...P."3k.I-Z .d.......
..!k..Dr"s....?.h%........e....M..........J..(..`....c1....5......!!0.
....Q."..,[email protected]....\:.G...3.:.G..."Ul).Jc$...t;
...6........._....}...2.o....(..l4.z.=[..%...y.....v.....y06.....P.L.m
....&...{..}..)...r%j..r......j....B|g.Qm...A.p.i..B..z....$*e.^]W..J.
......u.>T.?.j..%:i...<~....p...`oL2M..5..;X(SN.P.-......m......
..8 ...^X...........r........O.....u...x.d..l......&M.!..)..._.YE..!a.
^.F..}.".2..ST..X#.B..Q.8.X...k.4..\\..t......_.Ye..p.B....|R...Fc....
 .a.TTb.E.p.....s.^".l..\r?..H.e..q....2.2..r.YB.f3..).....}".@..(...%
..B...B...W?"[email protected]....:D\g.2..IN....8..b..;............l(.V..dd.j.
u=NW...Rc....@. .Q.(@.!7......t...QJ...d>K.,.E*...O2<R...)...u.*
..AD."../p.........=J.....I...c$e0.x5.....l..h.4c...4....-.c9...&...c.
.$.3.t..X. .....q]is....R..D(.i.S..;-]'....8....L..2.O. .W.bQ.....}...
.".1.EK..D....... a.4X.S)..R..Q...me.~.....LEP.c.._...F.....].x..^w..$
...;.J...r...:....{.K..E.$.'.j.Uv.UL...v........bA#x...........s.[<<< skipped >>>

GET /banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=9&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601960738910

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 5947
document.write('\x3Cdiv style="position:absolute;width:300px;height:0p
x">\x3Cdiv id="obaButton_6110017601960738910">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_300x250_grey {\n    width:300px;.\n    height:250px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0k
Ra2RNR3aG3NRNa a,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoff
er_0kRa2RNR3aG3NRNa h2,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey 
.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\n}\n.
paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa 
a {\n.display:block;\n.float:left;.\n.background:transparent url(http:
//imagesrv.adition.com/banners/270/files/00/00/b6/f2/000000046834.png)
 no-repeat top left;\n.padding:1px;\n.text-decoration:none !important;
\n.color:#000 !important;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250
_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3N
RNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer-block_0
kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:focus  {\n.ba
ckground-position:left bottom;\n}\n\n.paoffer-block_0kRa2RNR3aG3NRNa_3
00x250_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kR<<< skipped >>>

GET /banner?sid=3097401&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1221897&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58697_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc3=10039atA2AAGmJMtUbdA2AAGzMstUqjg3AAGmJMtU


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601968603193

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc3=1003954gqAAGjx81UatA2AAGmJMtUbdA2AAGzMstUqjg3AAGmJMtU; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 4366
document.write('\x3Cdiv style="position:absolute;width:300px;height:0p
x">\x3Cdiv id="obaButton_6110017601968603193">\x3C/div>\x3C/d
iv>\n\x3Cnoscript>\n\x3Ca href="%clickurl&hXXp://servedby.flasht
alking.com/click/2/43305;1078532;0;209;0/?ft_width=300&ft_height=250&u
rl=6388781" target="_blank">\n\x3Cimg border="0" src="hXXp://served
by.flashtalking.com/imp/2/43305;1078532;205;gif;QuismaDE;2399192447418
2218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstation
AwarenessExpandURL1/?cachebuster=6110017601968603193">\x3C/a>\n\
x3C/noscript>\n\x3Cscript language="Javascript1.1" type="text/javas
cript">\nvar ftClick = "http://c13.w3hoster.de/adsc.php?s
w3=14046_a_cw3=58697_a_gpr=AA==_a_w3hr=73_a%
5Fw3hurl=http%3A%2F%2Fad2.adfarm1.adition.com%2Fredi*lid%3
D6110017601968603193%2Fsid%3D3097401%2Fkid%3D1221897%2Fbid%2
53D3994439%2Fc%3D22107%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%
253D";\nvar ftExpTrack_1078532 = "";\nvar ftX = "";\nvar ftY = "";\nva
r ftZ = "";\nvar ftOBA = 1;\nvar ftContent = "";\nvar ftCustom = "";\n
var ft300x250_OOBclickTrack = "";\nvar ftRandom = Math.random()*100000
0;\nvar ftBuildTag1 = "\x3Cscr";\nvar ftBuildTag2 = "\x3C/";\nvar ftCl
ick_1078532 = encodeURIComponent(ftClick);\nif(typeof(ft_referrer)=="u
ndefined"){var ft_referrer=(function(){var r="";if(window==top){r=wind
ow.location.href;}else{try{r=window.parent.location.href;}catch(e){}r=
(r)?r:document.referrer;}while(encodeURIComponent(r).length>100<<< skipped >>>

GET /banner/twiago/815/2014-12-23/0_z010_300x169.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; accado_ex=


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: image/jpeg

Content-Length: 31684

Connection: keep-alive

Last-Modified: Tue, 23 Dec 2014 10:59:15 GMT

X-Age: 2530017

X-Cache: HIT

Accept-Ranges: bytes

X-Edge-IP: 46.234.105.122

X-Edge-Location: Ricany, CZ
......JFIF..............Exif..II*................C....................
................................................C.....................
....................................................,.................
............................T...........................!.1."AQ..aq.2.
#B...4Rbr..$3t.568su....%7..&CSTcv....................................
.....C.........................!1AQ.."aq.....2#B......3Rbr$5...6s...St
.............?..sv....j.VV.2....!...Ak6..~Pv........W..c.....am...'..f
j.i..MM..[.*:gBun.Ql.]..d.{.y@$.N.cd.v...5.X].....]E..9...$...0.r3,.jn
?p...z.$m..7"......s.8(.t.3P.3.).(..fu.1...."ZZ.....7.@}...1O.........
K..'U......R...o.a.P...M.....A.A....2....m).l...`..A.W..8......R{...pi
....A....r..\...(.wy7..........O.,rX.:...W.Y.?)k.$......#....CQ0....Ga
......[!...9)!.lO<...#...)..n.weZ...#....Y.yiJBJO.X...3'.G4.r..h...
...J9..Fz..H(....im)Z...Y6.. ...8.,|n.......z(..Lk...{......[.........
...r.O..p..TSo\;7.*...Urtq.NI.y..E.....k...LC..8.X.....&..Q...U_.^8.\.
R..V...sNN.......%.J.T.f(...$..7...i....% ....B..'.KGT.....T....r....3
).=1g2...Y......c._..m..B....),..@....&TK.....%..r....fI...N.l..r ....
.."-T.;....(eM8........1.....(..Q ..q^...v...X.....!.j].}.....z.1....1
b c ...E..[..OI.q.0.9..].?Gcoj..<...Xe,..d-....]J..Jp.....N.?. ?...
.............`.\.M.W.|..j.U..`...Y....j.......U..5.?6....4zDr.U.......
..}...M_..d.dUP.[|......./...u..53^..4.*......:.[|Ly..cP./.B.B........
.....4.}.w~..q......V.....&.IL|.I.31K...1M.-].......H .7..~.8X.h.i..Gk
.....W.jNa9.....*;g....|.Jn..,.....y...M..$7..w..;..<z\...M.2.g<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=1869630&cr=58588&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /request.php?zone=kw470o566d2z&nw=33&renderingType=javascript&namespace=e124e8caee&subid=&uid=undefined&screenSize=1716x901&screenSizeAvail=1716x857&clientSize=728x90&scrollPos=0x0&extData[]=&redirectClick=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=http%3A%2F%2Fadfarm1.adition.com%2Fredi*lid%3D6110017597666427860%2Fsid%3D65567%2Fkid%3D1221974%2Fbid%3D3994675%2Fc%3D3001%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%3D&documentReferer=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&ancestorOrigins=null&random=1275017335058&isIframe=1&container=&adPos=0x1970&adPosCheck=1x1971&adtagId=undefined HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad.ad-srv.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: Apache

Cache-Control: no-store, no-cache, must-revalidate, max-age=0

Expires: Fri, 30 Jan 2015 06:28:51  0100

Pragma: no-cache

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Set-Cookie: uid=27e21e2c0ada99f8; expires=Thu, 30-Apr-2015 06:28:51 GMT; path=/; domain=.ad.ad-srv.net

Location: request.php?zone=kw470o566d2z&nw=33&renderingType=javascript&namespace=e124e8caee&subid=&uid=undefined&screenSize=1716x901&screenSizeAvail=1716x857&clientSize=728x90&scrollPos=0x0&extData[]=&redirectClick=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=http%3A%2F%2Fadfarm1.adition.com%2Fredi*lid%3D6110017597666427860%2Fsid%3D65567%2Fkid%3D1221974%2Fbid%3D3994675%2Fc%3D3001%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%3D&documentReferer=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&ancestorOrigins=null&random=1275017335058&isIframe=1&container=&adPos=0x1970&adPosCheck=1x1971&adtagId=undefined&uidRedirect=1

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 20

Connection: close

Content-Type: text/html

......................

GET /free/frg/products/450950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 20 Oct 2014 07:51:32 GMT

Content-Type: image/jpeg

Content-Length: 20812

Accept-Ranges: bytes

X-Varnish: 966703145 962291246

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....rhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c02
1 79.154911, 2013/10/29-11:47:16        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BDA5FEE1539911E4B
9BF9495C72A21A3" xmpMM:DocumentID="xmp.did:53B056B0582E11E4821DA82208F
C3854" xmpMM:InstanceID="xmp.iid:53B056AF582E11E4821DA82208FC3854" xmp
:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:90f586ed-1e0b-4f48-88e9-c003dd237a75" stRef:
documentID="xmp.did:BDA5FEE1539911E4B9BF9495C72A21A3"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
......................................................................
.............................................!.1..A".Q.aq2..B#...b3$..
R.r....Cs4T.........................!..1AQa".q2..........B#..$.3Rbr...
...........?...UA\.T...MTO.$.'....../).$..4O..J.../:.i.#...?...a.(....
.e<.q)...#...R*..............}...m.......#a.Nb.r........e...!.X..$|
.=.O2.^KhPTw~;.@J...?.3.%U.#}-..}[email protected]<<< skipped >>>

GET /free/frg/products/563750/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/719950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/619350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 16 Dec 2013 13:51:05 GMT

Content-Type: image/jpeg

Content-Length: 16168

Accept-Ranges: bytes

X-Varnish: 2052680395 2052312899

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
......................................................................
......................................................................
..........!.1..A"Qa..q.2B...#.b.R3$..r...%..C..F......................
!1..AQa"2...q.....B..R..b#.r$...3............?..H{.........M....5J$..4
V..Q.Q...1\On.#R$........xE......5* .4.W6TD...g..-........L ~]....J.X.
s...:tI...T..C........yZG....X.R.A.N......0...%w..............P./ k&..
............~:..{?'qb>>......c{.R.:4..7o..4..|m..~>._.y;rG..I
.....-...,.~.. .....I..8..z|j..M..)....:.Y.2.82P".v.TS.........9..."..
#.T..v..X.......7l....n......`......J.'....F..=.../..B.^....{j..z.@>
;_..k..H.......cC.....!..u..iC.o]..Z..]...a.[r.|}.....H..|..........u.
SB}..Y...:...gh..#..w.^......{f.......?...Q....'*7H...|.no...$r.nc.:..
...IYD7....%....E]......l..&m.q....B..&...F.........3.....X...h.<R.
..PF.d...!_KDD..N.....9f....._...$.L.x..vN1..Ui.Y..b"..k..i$.......YT.
...]..,$..b.B.".......U.......&......)..._.7..V.D.G.U(._J.qM.k...U.Y.]
.j..r....K.... ..8!{.........X....S....=& x....={.'...7k.k....d.}...5.
}..[...zn=.B.0..W.X.r..-Jn.*....0.nE3..(.x.p...u)..,....y........uN|..
SO...G4....bE..#.RG..q.T....$.65>.6.]............o.."$..JM#..T..Y..
..h....#../.M5..[L.!H...)c**.t.#.......I>Q...<.[...W &H(.EQN.H*.
.Nco........s...q......c........J.....;-.o...\.\ZPN.F.%Hp.....*.'.....
.n...cou..)..J.R...j=cY....r..x..q,w.'.....R...Z...,B.s.........{.<<< skipped >>>

GET /free/frg/products/642550/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 08 Dec 2009 12:23:38 GMT

Content-Type: image/jpeg

Content-Length: 26784

Accept-Ranges: bytes

X-Varnish: 322100436 321487768

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!.1AQ"...a2#.q.B..R3....bC$rSc%.s4.......................
.!1..AQ.aq.".....2.....BR#.b3..r.C..S$............?....Wf........."...
...H..Oj.../....Ulg.r,xVOOd......].....UE.uB.E.....t.....E[.I*J....7.x
w...zhe.D^.|."..$...jj_.6S.)..).SV...H..t.....^JUK....`.h.M<*.6j...
*.....u...E...C...$<...).E......l!-;....z....|.4..|..a9Z..... .&.h.
.H...}W....\.Eu..1..Z7......U...%.N......}:....U......mU...6d(..h..&..
.w.D.TM:"..b.....yG..7.......`..#5"....__...u....r_....}........%. dpl
.....#4.P!!#1T5.vMSN...../.....R.&...U76..fN.m..nd....mlR..("........w
s..cF.D..Zj..aY.VU.Y..nI...qeGQ.s@......]QQv't.^..X............]K..U.w
Y5~B.....H.C......nWD#..h..It]Wr.u..#........7....*.-^O..2{.b.lG...9H.
.:%.d..m.&.%_....].^..;u.....e...a...}.W.......].jd2. .q....M....zh ..
5.6.8..n.m..B..>......y5...]S.t..VO.h....c ..$A.Zz/.owF.m.^r...3O..
.....:...........Lw.).n.....&.f.....* ...Z.z.m........_p..a....V......
..rNK..HWe.......N...:.v......c.8...Y~...up:t..{..?..D.Q.......F`i....
......O..C..=....G. ?...J9[......./0.~C~K.H..WT.h:.0...... ...U:..6.n.
..>X...{V.&..^.E..H.....d..B.....H.11.F.GM...1..&...........\......
P...-.2....1)y.:.X].........4...6j..$.....P...]?....7..o...sct.o..m.7.
..2q. Vy..0..5<l..(........A..G.9-.D...5M...i.^.`.=..... ..p.KK<<< skipped >>>

GET /free/frg/products/748750/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 19 Apr 2012 14:10:40 GMT

Content-Type: image/jpeg

Content-Length: 30665

Accept-Ranges: bytes

X-Varnish: 2052680405 2052021599

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......^......Adobe.d....................
......................................................................
......................................................................
......................................................................
.................."#.2B3..RbC$.!rS.1.cs.4%.AQaq....D&..T5.......d'....
..t...e......................."....2B#..Rbr3......C.!1Aa..Ss$4..Qqc..%
....D......T.5......t..............?..!.MEx..x?.^0.....k....&!#tM-....
.qS..u...I.h.$..~........n..hq.....8...~..}h.L.=.[gdf..1...E.n....].D.
...~W.'...t.dn.E..Z<."(..rN7|..!S..9..~`.6.[}W~..^.....u.}c..W...*.
."........."?\.u*j.....~..G...7..;"..s..C7_).t.<..~1..W......1f....
..S.<A..b....J.F......W'>E.xYC.....)t.......F.....u.............
...f..g.A.0k.f....'..._70.l.......y.p.~B....,1.(.eR........-h....9....
...pE..O$f.e.Rn.....^.F../....}.......IC#....n5..q...IwhJ<..|D/..k.
...|.X......8..'..0.9..k....6../#.$e..P....!...VMAk........d{>t..7`
g........../~8.....b....../~8.....kt,K.......}./....'...{..G.'...k*...
....2?..Q......e....ip...[..w..T{...G>K'...yq.>G..1../...g.....y
r..'.......EzK.L..v....K.\.Cj4.T.i1p.`..7.....t~z...a.|oJ....z#..f}C#R
 ..;..#7.Z.......>.. .N.4Q...O.>.&".!.?....}~....7...=O........O
.....h.VzW..~,.n....V.55_.9NB...m.3.}].8a.%..v.[..Q/.D....8....Z......
[.....~.wK..:V..h..u.r....js....F... g..\...9....:.p......mR.z.N.2D.S.
#.........0....P...UO.....f. ..]....../.....5.u}l<d}B...p...A:<E
.I....Ki....3M..3.(........e].k...~h..z..............P...V...q....<<< skipped >>>

GET /tags/FreeRideGames/ROWROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: tags.expo9.exponential.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:26:40 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 4408853015460759652

Expires: Fri, 30 Jan 2015 07:26:40 GMT

Cache-Control: max-age=3600, public

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 2305

Connection: keep-alive
...........Y.o.F..L...~(.Z.d..h.p..)` >.....3.....R$.\Y.]....7..s.)
@L..kg.3;.|.%a.?.t.....x...]....m..j|t.M.y....7./,... S.1.._.e?...i..l
)...a.F\..,..?..dAB. X..V..tJ.M6g.$cs?"G.....Bhw..I.p._..b .67O.".;.L 
.YB..,.I.......5......3.G.c..u..V#Y..........B.....k...R.}...>P...k
"".{1....)Z.#h.d...N..a.. !.(..d...<.......x.'9"4i/.......%.].....i
......\`R]}.)o.VR16....c..</..(~ge....s.t.........\..)(.<\.....T
.<_...M(.|.7.,..........L.....P.....W2.)3..8/F..O...i........6...pk
....bS.`...D...;...U-...H.2t..y.`.n2.b.@h..<.7kt....2|.>[email protected].
@lvMT.YK.0:.r.)..|.b..p......._*...O,..:.!...e.]K...T.`..:$..(`..$.x.b
..'..0v6%C.{r"..E..V =v[....O..U...,...8.f1...~..U.t...`T{.....e"tt.T.
F)..(..........d>I.9..q..."...#. "..p..vH.;...."|.3..k`p.|..x.?..k&
lt;..#f#.."Mx.C"..O1y.hk.....IS %r....^.x.....a........|.I.jQ.3.|WrK..
.eo.....b.r.;S.........R.~.. n..(<{.8....r...E.a..4....i.IS..!{.9..
..?mf ..~.....#:..t.........s8..Oc.....~.......u...'....{..Y...YJ.?}..
.~...>........kZ..L.m:$4M....g.O..\)..*..xx..B....3....y.B-6.r.....
[email protected]*...E.._.....'8 ...gd...\.Y ._......m.....v.....)&>.
..gp.K>..^.g......q.}.]......$.-l..D...T=..6..g.z...i.S\C.dP..p.~..
T...,..}-...cW'J...lq..[.....`Y..;...C..n.8. .Z .!...g...b..~.X....A..
f.7..)L|.c~d...".W;.qK.N[[email protected][..s.W."...Z.u...$~ c.M.m
jh...Z.......,...4.....ad.{.T.L........zQ.1...M..,S~c.......<.LZ.:P
.e......xu.1<w..n.>...d.9l.`..3..........<.?......o.....G....
l..gt....4............u.S..akt7..Y.le..........c2.T.....5}........<<< skipped >>>

GET /sync.ashx?partner=2591&psid=A1001&puid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.ad.mlnadvertising.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Expires: Fri, 30 Jan 2015 06:28:49 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:49 GMT

Location: hXXp://pixel.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A1001&puid=3338670318734125865

Server: Microsoft-IIS/7.5

P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"

X-AspNet-Version: 4.0.30319

Set-Cookie: uuid=RVNWQS1QRENLMDU6YzIzNmYyN2YtYmFkYi00ZWQwLTlmODYtZDQ0NDVlZjdkODVmOjE0MjI1OTkzMjkuMzE4OTM6MA; domain=ad.mlnadvertising.com; expires=Sat, 30-Jan-2016 06:28:49 GMT; path=/

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 230
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://pixel
.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A10
01&puid=3338670318734125865">here</a>.</h2>..</b
ody></html>......


GET /sync.ashx?cktst=1&partner=2591&psid=A1001&puid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.ad.mlnadvertising.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid=RVNWQS1QRENLMDU6YzIzNmYyN2YtYmFkYi00ZWQwLTlmODYtZDQ0NDVlZjdkODVmOjE0MjI1OTkzMjkuMzE4OTM6MA


HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Length: 43

Content-Type: image/gif

Expires: Fri, 30 Jan 2015 06:28:49 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:49 GMT

Server: Microsoft-IIS/7.5

P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 06:28:48 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Pragma: no-cache..Content-Length: 4
3..Content-Type: image/gif..Expires: Fri, 30 Jan 2015 06:28:49 GMT..La
st-Modified: Fri, 30 Jan 2015 06:28:49 GMT..Server: Microsoft-IIS/7.5.
.P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI
 DEV PSA PSD IVA PVD OTP OUR OTR IND OTC" ..X-AspNet-Version: 4.0.3031
9..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 06:28:48 GMT..GIF89a.
............!.......,...........D..;..

GET /bk/8640634?t=1422599352912&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t4ft.de

DNT: 1

Connection: Keep-Alive

Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=


HTTP/1.1 200 OK

X-Powered-By: PHP/5.5.19-1~dotdeb.1

Set-Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=; expires=Sat, 30-Jan-2016 06:28:51 GMT; Max-Age=31536000; path=/; domain=.t4ft.de

Content-Length: 102

Content-Type: text/javascript

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Pragma: no-cache

Expires: Fri, 31 Dec 1999 23:00:00 GMT

P3P: policyref="hXXp://t4ft.de/p3p.xml", CP="NOI DSP PSAa PSDa IVAa IVDa OUR NOR UNI COM NAV INT CNT"

Connection: close

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws-0401
window.ftgs_8640634(1, "", {"aid":1211,"otp":"1211\/5101070\/8640138\/
8640196\/8640634","otfp":null});..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEEES5jLHsYoCmjofrIA6uJ8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=578523, public, no-transform, must-revalidate

Last-Modified: Thu, 29 Jan 2015 23:10:33 GMT

Expires: Thu, 5 Feb 2015 23:10:33 GMT

Date: Fri, 30 Jan 2015 06:31:18 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015012
9231033Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
.A..2.....:...:......20150129231033Z....20150205231033Z0...*.H........
.....pVD...&.`...[..x_].....WR...o...D.%.....;......b.....aMa^........
2&..5BF......L......n.....Pqn3......;...;..jE........^..";...%..Q';6..
]i.m...=.)~..GL ].0am....c.....z6.dD....a..L.D.8!.k....r&.....k.d.g#. 
....o....K*.F.......j..dq....r/.]C...eS..2|.....RL....#0...0...0......
....<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....VeriS
ign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at h
ttps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code Sign
ing 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...U..
..VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of u
se at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Class 3
 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.........{
(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(.......
...p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.}..
.r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....(n.
.i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U....0
.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisign.c
om/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp. by
 reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U........
0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H......<<< skipped >>>

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=9717048-12146311

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: Apache/2.4.4 (Win64)

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Accept-Ranges: bytes

Content-Type: application/x-msdownload

Expires: Fri, 30 Jan 2015 06:26:24 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:26:24 GMT

Content-Range: bytes 9717048-12146311/12146312

Content-Length: 2429264

Connection: keep-alive
Y......).la.a~{..vP..)4.f....<TZ..3m.... .#....{..:!.f,I....8.L.(..
l....wf.s2..6.... yt........W.....2...g.........?...n%....<..(@...w
0:.,.h.d.....W8G..1..,[email protected]]t...v......d..'....
.' .\O#f8...r...>..`...xV|..?...7..N.95g16.0Bs>..9...B.Y..3i.4.S
.b.!.......P*I.C..Q..z_._.....n.?q.<...SVE...#....... ........^....
..e...........;x..|..,,w..n.6..w.N<..S?>.l......G.w..,....W....U
.{..S.A..$#..$...t.. 7&..........Zy-..^~l..f.d/..F.P..#.}.*.?3.(..F..l
[email protected],..h....*!.&.........g*a.XnPQi.J..7..rG,.(.'.EE._*
..c0.`...._r'^.?.....-.....C.P.hy`~....Y=;8....Y.[/....:...|...j]<.
..5........>wA...l.>7<.O5.}......j.......k8e.R!.... .]<OD.
..\..yI.......#..`.S.E.........;..#H.bs=/<.....R....R.Ygn5Bf.1#.JE.
....-92....Y.....u.6.......e.d&a..,.9.y.......^....NY9C.W5.....Y....XC
.....E..|W....3..5.......{.....Hn~....Ny/...Jos....Bv.q.....s.L0 .KL.W
....8.=.<.....r........h.=!^..#3k.U.B!>........P..L.............
w......@n.@}.y..|.8.. ..o..um..it.5.9%.).J.d.-....p'q.........~.....c.
z..Z....N\...n.....C.7rg:...~....r.u~..f...$....U..".F.w..H....J....{.
f..$.. ..U&p4i"..(..8.brsHl?...tL.{..!As......z.U.2zw./>.J..%z.....
"jQS.?;?G..=.4....I1>ah....<b..kH../uB.?."<...9m.O......h....
..f......f..u...#...W.oi.9..........8.....V..]..)...Q..zs..UA....@ .Q&
gt;.....>.../.F-.F..&.........Y..."......{I`s.F,.......3..7...3....
.%..7{..!....]$...!x.$..I.[...L..H..J?...lmq......j.....*..!in3....w..
J.sR.r......8Q.L.O......B...jr.....V.Q...U...Am.......k,x.6..V....<<< skipped >>>

GET /adview.php?tz=1422599332779175&pid=2344&kid=333&wmid=7152&nvc=1&target=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: accado.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6bb9; accado_ex=


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 46.163.123.42

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; expires=Sun, 01-Mar-2015 06:28:52 GMT; domain=.adspirit.de; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=7287786-9717047

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: Apache/2.4.4 (Win64)

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Accept-Ranges: bytes

Content-Type: application/x-msdownload

Expires: Fri, 30 Jan 2015 06:26:24 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:26:24 GMT

Content-Range: bytes 7287786-9717047/12146312

Content-Length: 2429262

Connection: keep-alive
...bK..h...ss...KA....&.uId..d..xf.[..PLDa... n.............T..T.7.z._
!.-...P54......#ti.Y:k.;..}.Xja..cFa|3.;....Q.=^C3.....u.`...8..p.....
..`~zoR..w(..A^...~.$.>A.q...N..D0gtO.\...\.)....,n)X.|....Z...N..m
....$.v..694....9wM...K....I..De.s....8W.../1l........-mW.kC.\.sK...Z.
.......i.by.......X.........K.........`.&...I&....$....3>.'.[zu.s.n
......4:...".....z...= ._..t..s>..&/(.Co.y.f....Gj(..z......OZ.mF.l
.Jc..\%vu..'z.5J.P..4._0......(...^i...^..>!42]~.EQ\9........zMT...
o-..D....2.,1..%..$#.n...-_hN...Ni..j........mU.......`...k....WV.....
."..R.j.......uc..qW.../...J.}j.]..g...F.f.U`._.".9..-..1....l....A..]
 ...cW..Z.,.........%.g....k.t....7(B(...&.......oS([email protected]
.gk../.......H.5>.O...B)..-.]..x>q.~..M...gD..4..Vn<..H.H.p..
.0yl.<0c0m....V.{....L.4..rp......Cz.t...`...8...6 Jj..F]#&.<@.2
...l.....ssK...K.m....d....."7..U././.Jo.....d. .v.....}K~i".9.-J.!.o.
....,.@,.G.T.\...#.u....n2]Wx..y.}.-.{3..N..i>S/..G.!...=...|.....Y
,...... .....F..d....>$...W..L..K.....BC.....efO0DK....-3....jd..D.
......d.v...f4.....d....T.a...3..A.E.Y.......^izv.J^.K.J.#..]).{.m....
=".D...Y.$..x..(.o3Z......g.l..rv.."[email protected]...........(d.
.S......J.T."...!8........B.....!....fe..D.n..J.l..".\~.E..=3G.z./.Oj.
.D#.w]Z..L..F.T..A.i...)].........MQ&y...$..*........./.R.|.QG........
S......Q... .,.....'.....X-[..........h......t .`.W.:..V:.. #..<.u.
...D].......!...-..:..u.>....]<7t.}[email protected]?.t|.>..
...SpiEBE...<M.._25.. .St...!.:)...D...2.1....=K....v..........<<< skipped >>>

GET /w/1.0/sd?id=537072399&val=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: us-u.openx.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Set-Cookie: i=5b119fb5-f5e3-4c30-6291-67d07cce8928|1422599330; Version=1; Expires=Sat, 30-Jan-2016 06:28:50 GMT; Max-Age=31536000; Domain=.openx.net; Path=/

Server: OXGW/10.89.3

P3P: CP="CUR ADM OUR NOR STA NID"

Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3338670318734125865

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 0

Connection: close

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=813322910071 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1025

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........Vms.6..._....pcl......&wM...I..K:.*.(G.."Nz.....c..=....G..
....|.....| .o......l..cD..{...l..H.....K$.rF4...}.?..VC..D.....6.I7..
............3........3#..u..|..y........8....r..}_...q.m..d......KA...
..Q.H.S.....9..T...}i...h...[H[..-.w....I.U......Y...=..Y.W.vWf_%...jd
.j.......`.8.S..dg'Dw.`2?8.L.1..&..O..^..E..L>.. )`".w..........?..
../..^^.....?......,.b~.).O...(d..||.o<q.;....-.h^X.T.,U.YJ......&.
[email protected].{AV......aDc_.g.{'.nY......
{ *..R.\,....s.h.C.Mtt.\.=#...p.u.....'....v..........>......s...b.
.i.w.f...XR0.... -p.s.l.f...T.)..U.0..Wlx..m{...Y.^..F'..oc.....y..7:.
Z..4....&K.vD........$....oH..pu4...FF....,.#.B&......m&......O.aW....
...7.I.-..r9ze-..KC.5E#$.C......:.xcUXo....%w]....u}.&.....Y.oP.....[@
.,:...J..Qr..e0.r>..L\.G..x.2..ru8a...>..hqT...4y.K..I......).8y
......!.B....\..........a...Ku.^.N..b........ERFgiQ5..........u).d.~..
B>%.........Y.<Xi.>......d.-.. @.. %...k..bC.F..._[j.p-'*.aI.
7.P..=..^....;}([email protected]...?.#..G....
.

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7acd48572967 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1053

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.F.~...<.8..!.l..rR;....k7u/.....k# ."......"$./}.<
;;..7...,k.I.........5,]{f...c.I.......... .f4...K.Z*..r..]..{.H....9O
...]....z.z..$....#NV.uf4..l.,D...[.*c.t....!.....).J..H...&....&.!.(.
.Y.,B5.6.Qa.I...y..3<J..]VX........`O.m..;[email protected]~Ry.
......].....^w._...^w.^...^w.z{/.~ ..K........_b.5''GH...y..oN....]...
{.J.jG...n...g.T...?<.......?}....._./~..........=..!...Vq.~e......
.csb......n .....n..$.*..8..&}kL.D2....:u)I. .,[email protected]...[
,.s.xIY. .uS....;L<...T.5.N.2.z.".. e..B..nA..M`(Y.4.K.&.Kj...vCcm.
'.7......Kl.5..M^..3.......=mX..`j.v..v.$.eD.n..-.p..Z[..V...H.....(..
'b.31.9....-.....D..>..}...F.tK..h#..<..Fx..V..0....t.%......H.o
.....H...|Eb>b.'..V=.....7..'.\LT.|.-..a.o.6.z EQ..E.4.\..Y..Q.....
.o.*..O%..<....]....`[email protected](c..9.=...m|KG.....R.0..5.&Q...-..
.H..G.X....N.W.48,.5......y......<..'..'..t0./.../......e....!Lr...
K..... .-,,.N.~9...$..Cnn......l..`..U..R..".d....wo.$&....UP.....,Q..
........H.;zue..x......H%...H.1....9d.F.1...a...{..N.s. ..H.b../O..[.*
.C|1..Os......(.Vs:.l.....u........

GET /ping_match.gif?st=ADEX&rurl=http://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=6&axd_fuid=_wfivefivec_ HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: i.w55c.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Jetty(6.1.22)

Set-Cookie: wfivefivec=7052af40-cf8f-45f7-952e-25f4ab050d93;Path=/;Domain=.w55c.net;Expires=Sun, 29-Jan-2017 06:28:52 GMT

P3P: policyref="hXXps://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM INT STA OTC STP OUR CUR TAIo COR DSP NOI"

Cache-Control: no-cache, must-revalidate

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Content-Length: 0

X-Version: DataXu Pixel Tracker v3.8 20130813

Location: hXXp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=6&axd_fuid=7052af40-cf8f-45f7-952e-25f4ab050d93

Via: 1.1 sjc061101 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive

HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:52 GMT..Server: Jetty
(6.1.22)..Set-Cookie: wfivefivec=7052af40-cf8f-45f7-952e-25f4ab050d93;
Path=/;Domain=.w55c.net;Expires=Sun, 29-Jan-2017 06:28:52 GMT..P3P: po
licyref="hXXps://cts.w55c.net/ct/p3p_policy_ref.xml", CP="UNI PUR COM 
INT STA OTC STP OUR CUR TAIo COR DSP NOI"..Cache-Control: no-cache, mu
st-revalidate..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GM
T..Content-Length: 0..X-Version: DataXu Pixel Tracker v3.8 20130813..L
ocation: hXXp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd
_pid=6&axd_fuid=7052af40-cf8f-45f7-952e-25f4ab050d93..Via: 1.1 sjc0611
01 (MII-APC/2.4)..Keep-Alive: timeout=2..Connection: Keep-Alive..

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1856

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA2wAZAMUelAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:03 GMT

Server: Apache

Set-Cookie: JSESSIONID=B524542C5D8775EF809251ED0EAE5341; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=813ab6358216 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1116

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........W[[email protected]...=9T......$...w....'.......7
3.../m&e..z.D#.#-ah.cC....$Y.:..X......f4.........smn/.bz&K..0.s...4..
=....v(.Q8...F.-.y.U.y2..".V.Mg.>1...9....].-F.4......:.........(.K
Y.,@%.........6p..'x....$3.....[...}p46...M....3.|@...QX)....7I.....[.
.F.v...{..*v.kO.[.nr.V...7i_!...M...o..I....b7....Y.....8f....|.1.1.._
~...M./>f@.&....#.#......A....C.)%..H.]gt|x4:0...7aWv.D.. 'J...#...
...}....w..?;....~........>.~......b...O.w."..O,..2...o8...`|xt.j.k
.i..."4.q..i..\.>W&D"..cR;.2.(........FoJC..c..q...ze..a.X...r.<
.A..*...mv.9.=.SUU.2......H...!.SI/..y._9z..H..d*........h.5....A.@_[`
...j...k.|lX...4../*..hLI^.....D..H.%F....w......U.EJ1....D.v..g|f..Zh
}..|.lt....r.>I.O..uK.....=. .#<ea]....n.G. ..-6.7(!...*...#AN..
......0FX.8...%...3q`c...Sl..4.{.o~J.$....7....]. .pQ........H....ku.D
.[r.Eur..,.......o.`ur..z....F.....|.,D.E%O.N..I.D......AJH8..........
..a1(q..VJ..A......!..4$N..A...B.t....h.z.g}C...N.k....B.........j./.A
...I..........j.f.r..'.......C.A...0....N..._..;.X...8.......HV...r/..
] V...=E..,F".^..o..C%..Yq9..\..=F6"].U.*.x*va./.U..~...WlY.Q.g......]
.X.5 .b.. .........<<< skipped >>>

GET /pki/crl/products/MicCodSigPCA_08-31-2010.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 28 Jan 2015 06:05:55 GMT

Accept-Ranges: bytes

ETag: "75565c7ac03ad01:0"

Server: Microsoft-IIS/8.5

VTag: 438880325400000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 554

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 06:31:18 GMT

Connection: keep-alive

0..&0......0...*.H........0y1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1#0!..U....Microsoft Code Si
gning PCA..150127173215Z..150428055215Z.a0_0...U.#..0..........X..7.3.
..L...0... .....7.........0...U......Y0... .....7......150427174215Z0.
..*.H......................YIw.. ..(..y..O.G].B.."?.@...[1.}.X...]...e
.J....pP.I....!6...%.D.k...>c.|R.?.i..yt.z..B.........b....n..m5...
0....2..I!)v....z....y.#pXz.DO.....mF...e.'e...@.%...6./.bPZ...=....bp
[email protected]..@.. ...M....z....Q...{u. .W....

GET /bk/8640634?t=1422599352480&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&r=&f=1&cb=ftgs_8640634&x= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t4ft.de

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

X-Powered-By: PHP/5.5.19-1~dotdeb.1

Set-Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=; expires=Sat, 30-Jan-2016 06:28:50 GMT; Max-Age=31536000; path=/; domain=.t4ft.de

Content-Length: 102

Content-Type: text/javascript

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Pragma: no-cache

Expires: Fri, 31 Dec 1999 23:00:00 GMT

P3P: policyref="hXXp://t4ft.de/p3p.xml", CP="NOI DSP PSAa PSDa IVAa IVDa OUR NOR UNI COM NAV INT CNT"

Connection: close

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: ws-0410
window.ftgs_8640634(1, "", {"aid":1211,"otp":"1211\/5101070\/8640138\/
8640196\/8640634","otfp":null});..

GET /user?p=2b4fd3fbe1d8cdc4&r=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: user-disp.tidaltv.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

Cache-control: no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:29:00 GMT

Expires: Fri, 30 Jan 2015 06:29:00 GMT

P3P: CP="NOI ADM DEV CUR"

X-Handled-By: usvalurh04/127.0.0.1

Set-Cookie: tidal_ttid=7a2cf647-d25d-47ba-990a-3855845d6dbe; Domain=.tidaltv.com; Expires=Sat, 30-Jan-2016 06:29:00 GMT; Path=/

Location: hXXp://secure.adnxs.com/pxj?bidder=10&seg=269711&action=store_my_setuid('7a2cf647-d25d-47ba-990a-3855845d6dbe')

Content-Length: 0

HTTP/1.1 302 Found..Server: Apache-Coyote/1.1..Cache-control: no-cache
, no-store..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:29:00 GMT..Exp
ires: Fri, 30 Jan 2015 06:29:00 GMT..P3P: CP="NOI ADM DEV CUR"..X-Hand
led-By: usvalurh04/127.0.0.1..Set-Cookie: tidal_ttid=7a2cf647-d25d-47b
a-990a-3855845d6dbe; Domain=.tidaltv.com; Expires=Sat, 30-Jan-2016 06:
29:00 GMT; Path=/..Location: hXXp://secure.adnxs.com/pxj?bidder=10&seg
=269711&action=store_my_setuid('7a2cf647-d25d-47ba-990a-3855845d6dbe')
..Content-Length: 0..

GET /r/bd?ddc=1&pid=54&cver=1&uid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: r.turn.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0

Pragma: no-cache

Set-Cookie: uid=8421858850629738035; Domain=.turn.com; Expires=Wed, 29-Jul-2015 06:28:51 GMT; Path=/

Content-Type: image/gif

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:51 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Ap
ache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa
 PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=0, no-ca
che, no-store, private, must-revalidate, s-maxage=0..Pragma: no-cache.
.Set-Cookie: uid=8421858850629738035; Domain=.turn.com; Expires=Wed, 2
9-Jul-2015 06:28:51 GMT; Path=/..Content-Type: image/gif..Content-Leng
th: 43..Date: Fri, 30 Jan 2015 06:28:51 GMT..GIF89a.............!.....
..,...........D..;..

GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBQmECJms4f7i5EbxtN7NbzQCBwAdAQUUa8kJpz0aCJXgCYrO0ZiFXsezKUCE1oAAHevvgBk+xJc0C0AAQAAd68= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.msocsp.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:40 GMT

Content-Type: application/ocsp-response

Content-Length: 1757

Connection: keep-alive

Set-Cookie: __cfduid=dd9a4a2df6adb7b3c1eb4b4ede75a10541422599260; expires=Sat, 30-Jan-16 06:27:40 GMT; path=/; domain=.msocsp.com; HttpOnly

Last-Modified: Thu, 29 Jan 2015 22:17:29 GMT

Expires: Tue, 03 Feb 2015 06:27:39 GMT

ETag: "e4ad2f2a4eb2bfb6fd886113a3e4ac3575ac4864"

Cache-Control: public, max-age=345599

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9ae1567b15bf-FRA
0..........0..... .....0......0...0..........<.|[email protected]|..2015
0129221729Z0..0..0L0... ........&."f........{5.....t..Q.$&..h"W.& ;Fb.
{.....Z..w...d..\.-....w.....20150129221729Z....20150202221729Z."0 0..
. .....0......20140129221729Z0...*.H..............}%....M...s3."....u.
..a....Ih."^.[...&..P..cB1..r.aW..../F..FLh{.#.A?C... ...A-.....<.{
.=.x....D...b.....:7.....'..1..1..zh.h.=..Ng..._.......#Iy*....*._.^..
$d/AT..*...X5z2m......[*$..1"T.!..... ....w.0.....l.~(%.......7.....7.
.l2.H.S..@.."0F....<....`.v.....0...0...0..........Z..~..M..<ZYJ
....~.0...*.H........0..1.0...U....US1.0...U....Washington1.0...U....R
edmond1.0...U....Microsoft Corporation1.0...U....Microsoft IT1.0...U..
..Microsoft IT SSL SHA20...141229205745Z..150314205745Z0!1.0...U....Sh
ould be ignore by CA0.."0...*.H.............0...........&!(..$.K...."=
f....x.d.._s.....j....9`..l.Z..............^f..u......-e.&.bG.(i.Q....
.......bEy...^7A...A..c....CF-&...e.7..7F....."..w...y.:..`.w{~..D.x*.
......x3Os......q...... S.fB .ig.....L..3......4E..}..7...M....e ...6.
M.O.....<5:......r.....]..A.5........0..0...U..........<.|7...@N
6p.I.e|0...U.#..0...Q.$&..h"W.& ;Fb.{...0...U...........0...U.%..0... 
.......0... .....7....0.0... .......0... .....0......0...*.H..........
........sa....^`.U.h.....(c[..j.|. ..#....3.5.?..L.....Z....J......*.w
...w.$.z..Y.d.....l.....G#.....o.\t.......(.B =..P..T....0./P.....z.3.
...L.O3....z...Wxo..~.OeH....c.i.@."..?d.......=v(.....m..LN..PP....&l
t;.}T.X......K.&e.S...|....% ...(F.=k..~.j..C......4.....c...._p..<<< skipped >>>

GET /banner?sid=2566327&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=4&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58416_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597669441630

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 5866
document.write('\x3Cdiv style="position:absolute;width:728px;height:0p
x">\x3Cdiv id="obaButton_6110017597669441630">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_728x90_grey {\n    width:728px;.\n    height:90px;\n}\n.paof
fer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa {\n.f
loat:left;\n.margin-bottom:2px;\n.margin-right:0px;\n.font-family:Taho
ma, Geneva, sans-serif !important;.\n.font-size:11px !important;.\n.te
xt-align: left !important;\n    line-height:14px !important;.\n}\n.pao
ffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa a,\n
.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa 
h2,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3
NRNa span {\n    cursor:pointer !important;\n}\n.paoffer-block_0kRa2RN
R3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa a {\n.display:block;\n
.float:left;.\n.background:transparent url(hXXp://imagesrv.adition.com
/banners/270/files/00/00/b7/16/000000046870.png) no-repeat top left;\n
.padding:1px;\n.text-decoration:none !important;\n.color:#000 !importa
nt;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR
3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffe
r_0kRa2RNR3aG3NRNa a:active,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_g
rey .paoffer_0kRa2RNR3aG3NRNa a:focus  {\n.background-position:left bo
ttom;\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RN
R3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .p<<< skipped >>>

GET /ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=595483633 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: NID=67=vOr3KMkRgKzKK96sxJpxyEczA3umKOcncI--3SgTGRoblhdA9puvOrwBffL0b0Jj_CIR-FG07pJNcRIPtOc-BQNOTfg9OdWidnppEWcEVE_ZiWA-bcBNJCiwTSNfkqdd

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com


HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=595483633&ipr=y

Cache-Control: private, max-age=43200

Date: Fri, 30 Jan 2015 06:26:40 GMT

Expires: Fri, 30 Jan 2015 06:26:40 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 385

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/1057751771/?fmt
=3&num=1&cv=7&frm=0&url=http://partners.freeridegame
s.com/my_games?gameId=659050&random=595483633&ipr=y">he
re</A>...</BODY></HTML>..HTTP/1.1 302 Found..Locatio
n: hXXp://VVV.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&cv=
7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=65
9050&random=595483633&ipr=y..Cache-Control: private, max-age=43200..Da
te: Fri, 30 Jan 2015 06:26:40 GMT..Expires: Fri, 30 Jan 2015 06:26:40 
GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: n
osniff..Server: adclick_server..Content-Length: 385..X-XSS-Protection:
 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..<HTML><HE
AD><meta http-equiv="content-type" content="text/html;charset=ut
f-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>
.<H1>302 Moved</H1>.The document has moved.<A HREF="htt
p://VVV.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&c
v=7&frm=0&url=http://partners.freeridegames.com/my_games?g
ameId=659050&random=595483633&ipr=y">here</A>...<
;/BODY></HTML>....<<< skipped >>>

GET /pki/crl/products/microsoftrootcert.crl HTTP/1.1

Cache-Control: max-age = 812

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 23 Oct 2014 05:05:32 GMT

If-None-Match: "a2f3ff97eeecf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Wed, 07 Jan 2015 06:02:43 GMT

Accept-Ranges: bytes

ETag: "88c4768d3f2ad01:0"

Server: Microsoft-IIS/8.5

VTag: 791607156900000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 813

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 06:27:10 GMT

Connection: keep-alive
0..)0......0...*.H........0_1.0.....&...,d....com1.0.....&...,d....mic
rosoft1-0 ..U...$Microsoft Root Certificate Authority..150106214825Z..
150407100825Z0.0...a......../..100208014912Z._0]0...U.#..0......`@V'..
%..*..S.Y..0... .....7.......0...U......(0... .....7......150406215825
Z0...*.H..............vQ..r..L.Q.N..=#.......V;..r../\.m..<.."...F/
U....(:.....xm.....P.e.F..BE8......=...G....6t:...?...L..B.v..p.M.....
...z..Q.%J.6..I.......8...U. .g..=T=K....L..$w...^....y~..-a.'...*s#N.
o..Qs.$h..:duV'~....8.6..w..b3.... .~)...|.I.y".>R.nJq.ws...3.....f
}.E)\......EB.d\.2.....h...lMjT.7..lj.'lj.b....".L.Os6{[email protected].|7z
.. ......>..Q...([email protected]\]#..Y.*.......T. .C.....A'..
5FW.ETDvX..tE.....g5.....&..&.....x.^H;...../7..'9.t.I&<[.HX.j....Q
w......}...qy3..q`<.....LB.9w|....;..Qw..a ..=.C.:.........


GET /pki/crl/products/WinPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Mon, 06 Oct 2014 05:06:02 GMT

If-None-Match: "3e1c83923e1cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Sun, 21 Dec 2014 06:03:02 GMT

Accept-Ranges: bytes

ETag: "d2e35dc7e31cd01:0"

Server: Microsoft-IIS/8.5

VTag: 79125357800000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 561

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 06:27:10 GMT

Connection: keep-alive
0..-0......0...*.H........0..1.0...U....US1.0...U....Washington1.0...U
....Redmond1.0...U....Microsoft Corporation1 0)..U..."Microsoft Window
s Verification PCA..141220223154Z..150321105154Z._0]0...U.#..0.......p
............<.J0... .....7.......0...U......30... .....7......15032
0224154Z0...*.H.............h.~oH#i.J.vh_.....A'B..g...........F....9c
.{[email protected].^ 4.r..Wv.Q.0.w..j....c9..w....I..%.~.l..F.......xo....
_...o...7BR.;<..\R/ .....b.(....~..]|.v.u.i.X.B....I......./*...P..
A..fi.}& .x.v{TFP[.G......A......L.o...)R.......V.u..V.../.Q..(L.]....
.uki~......


GET /pki/crl/products/MicrosoftTimeStampPCA.crl HTTP/1.1

Cache-Control: max-age = 900

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Sat, 04 Oct 2014 05:06:12 GMT

If-None-Match: "58cddbea90dfcf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.microsoft.com


HTTP/1.1 200 OK

Content-Type: application/pkix-crl

Last-Modified: Fri, 19 Dec 2014 06:02:00 GMT

Accept-Ranges: bytes

ETag: "9a9a44d511bd01:0"

Server: Microsoft-IIS/8.0

VTag: 79181643600000000

P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"

X-Powered-By: ASP.NET

Content-Length: 550

Cache-Control: max-age=900

Date: Fri, 30 Jan 2015 06:27:10 GMT

Connection: keep-alive
0.."0......0...*.H........0w1.0...U....US1.0...U....Washington1.0...U.
...Redmond1.0...U....Microsoft Corporation1!0...U....Microsoft Time-St
amp PCA..141218221600Z..150319103600Z._0]0...U.#..0...#[email protected].. .
.5..0... .....7.......0...U......10... .....7......150318222600Z0...*.
H............./..0Q~.r.}.E....&\....F.Z.C..#..F.s........<&\..9G..-
....j..N... .C.Fk....;l.....2.K5D.........-.>...(...g.0.S.[?...T4q&
gt;[email protected].('..e...Y..Bo..q..........I....'....i>
..y:.eH@h`..\...UA.m#.~.. ;.3..d..;..<..........p..s..J..N `Az.....
[email protected]/1.1 200 OK..Content-Type: application/pkix-crl..Last-Modifie
d: Fri, 19 Dec 2014 06:02:00 GMT..Accept-Ranges: bytes..ETag: "9a9a44d
511bd01:0"..Server: Microsoft-IIS/8.0..VTag: 79181643600000000..P3P: C
P="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SA
Mo CNT COM INT NAV ONL PHY PRE PUR UNI"..X-Powered-By: ASP.NET..Conten
t-Length: 550..Cache-Control: max-age=900..Date: Fri, 30 Jan 2015 06:2
7:10 GMT..Connection: keep-alive..0.."0......0...*.H........0w1.0...U.
...US1.0...U....Washington1.0...U....Redmond1.0...U....Microsoft Corpo
ration1!0...U....Microsoft Time-Stamp PCA..141218221600Z..150319103600
Z._0]0...U.#..0...#[email protected].. ..5..0... .....7.......0...U......10.
.. .....7......150318222600Z0...*.H............./..0Q~.r.}.E....&\....
F.Z.C..#..F.s........<&\..9G..-....j..N... .C.Fk....;l.....2.K5D...
......-.>...(...g.0.S.[?...T4q>[email protected].('..e..
.Y..Bo..q..........I....'....i>..y:.eH@h`..\...UA.m#.~.. ;.3..d<<< skipped >>>

GET /PositiveSSLCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1287

Last-Modified: Mon, 18 Sep 2006 00:00:00 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes
0...0..........L.J.[E.!.../. Qq0...*.H........0..1.0...U....US1.0...U.
...UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U.
...hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0...060918
000000Z..200530104838Z0q1.0...U....GB1.0...U....Greater Manchester1.0.
..U....Salford1.0...U....Comodo CA Limited1.0...U....PositiveSSL CA0..
"0...*.H.............0.........OyX"..(>R../.. ..-U.......*..^...X.T
....A...U.... .E.&. .=...1.!\y.y.$.\V...............S..F...$.b...^ Z..
.P...(*M..HO....O......?....,......p..i..<......?n...-..].........~
....}..:=.r.y%.......V^...Z..b4 (H2.........f.....iM....]..7b........~
.jR.................n0..j0...U.#..0....r_&.(.C.].7....K..E0...U.......
....1y......*..5.1.0...U...........0...U.......0.......0{..U...t0r08.6
.4.2hXXp://crl.comodoca.com/UTN-USERFirst-Hardware.crl06.4.2.0hXXp://c
rl.comodo.net/UTN-USERFirst-Hardware.crl0.... ........z0x0;.. .....0..
/hXXp://crt.comodoca.com/UTNAddTrustServerCA.crt09.. .....0..-hXXp://c
rt.comodo.net/UTNAddTrustServerCA.crt0...*.H..................H]..Z...
.....l.I..1.1\...d.....Z-..;>[email protected]....&=[!.....=.<
...._.S........NI}.......e....1w..*....j-.e..g.m.J.f..2M.B#..EAjv.....
n..>.Q......P*...o."6...F....;}.....2 .....@..$..]..........KS}.(.V
=..gI...... LG..L.D...c..{[1.&a.y...N..P{...<<< skipped >>>

GET /edn/1/info?_referrer=&sType=view&nCampaignId=2&nBannerId=2&nJs=1&_ignore=88126221955592050&nIframe=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: uip.semasio.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

X-Forwarded-Host: 77.66.11.196

Connection: close

Location: /edn/1/info2?_referrer=&sType=view&nCampaignId=2&nBannerId=2&nJs=1&_ignore=88126221955592050&nIframe=1

UIP-Response-Status: Ok

Frontend-ID: 4

Set-Cookie: SEUNCY=C0E0D4BAFA15155D; Expires=Wed, 29 Jul 2015 06:28:55 GMT; Path=/; Domain=.semasio.net; HttpOnly

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Expires: Sat, 01 Jan 2011 12:00:00 GMT

P3P: policyref="hXXp://uip.semasio.net/w3c/p3p.xml", CP="NOI PSAa PSDa OUR IND UNI CNT"

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Length: 0

Routing-Server-ID: 4

Access-Control-Allow-Origin: *

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:49:59 GMT

Expires: Sat, 31 Jan 2015 03:49:59 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268601

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010212Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150127010212Z....20150203010212Z0...*.H.............@K.
.O.4....0"...j....5rR.@H&....z....`y.....X.:..{U.x..]K.W7.Dr.e=Qy.$D..
..o,....y.{.^.....0.Nt.y"....D.......5..4....*,T.....$..\]....<P.C@
.t.....|.......M=.\..%s6......w.....^ .....A1...8....ZJ.......o.,..l.&
gt;.n..p.. .6.>.L.$.....C...x.k]5..3....G......C.HTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 03:49:5
9 GMT..Expires: Sat, 31 Jan 2015 03:49:59 GMT..Server: ocsp_responder.
.Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options
: SAMEORIGIN..Age: 268601..Alternate-Protocol: 80:quic,p=0.02..Cache-C
ontrol: public, max-age=345600..0..........0..... .....0......0...0...
...J......h.v....b..Z./..20150127010212Z0k0i0A0... ..........j.....p.I
.#z...(~d..J......h.v....b..Z./....2.S.......20150127010212Z....201502
03010212Z0...*[email protected]"...j....5rR.@H&....z....`y..
...X.:..{U.x..]K.W7.Dr.e=Qy.$D....o,....y.{.^.....0.Nt.y"....D.......5
..4....*,T.....$..\]....<[email protected].....|.......M=.\..%s6......w.....^ 
.....A1...8....ZJ.......o.,..l.>.n..p.. .6.>.L.$.....C...x.k]5..
3....G......C...<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7ef43f358967e0e4 HTTP/1.1

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Thu, 03 Jul 2014 23:34:12 GMT

If-None-Match: "0b2464b1797cf1:0"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ctldl.windowsupdate.com


HTTP/1.1 304 Not Modified

Content-Type: application/octet-stream

Last-Modified: Thu, 03 Jul 2014 23:34:12 GMT

ETag: "0b2464b1797cf1:0"

Cache-Control: max-age=86400

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive

GET /cookie.php?url=http://dsp.active-agent.com/cookie/?ssp=1&userid=%COOKIE% HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dsp.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:52 GMT

Set-Cookie: UserID1=6110017589072035866;Path=/;Domain=.adition.com;Expires=Wed, 29-Jul-2015 06:28:52 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://sync.active-agent.com/cookie/?ssp=1&userid=6110017589072035866

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /serving/cookie/match/?party=3&id=3338670318734125865&mt=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c1.adform.net

DNT: 1

Connection: Keep-Alive

Cookie: uid=5393689920369647502; C=1; cid=5393689920369647502,0,0,0,0


HTTP/1.1 200 OK

Cache-Control: private

Access-Control-Allow-Origin: *

Set-Cookie: cid=5393689920369647502,0,0,0,0; expires=Tue, 31-Mar-2015 05:28:57 GMT; path=/

Set-Cookie: uid=5393689920369647502; domain=adform.net; expires=Tue, 31-Mar-2015 05:28:57 GMT; path=/

P3P: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"

Date: Fri, 30 Jan 2015 06:28:57 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: private..Access-Control-Allow-Origin: 
*..Set-Cookie: cid=5393689920369647502,0,0,0,0; expires=Tue, 31-Mar-20
15 05:28:57 GMT; path=/..Set-Cookie: uid=5393689920369647502; domain=a
dform.net; expires=Tue, 31-Mar-2015 05:28:57 GMT; path=/..P3P: CP="NOI
 DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"..Date: Fri
, 30 Jan 2015 06:28:57 GMT..Content-Length: 0..

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 494

Last-Modified: Fri, 30 Jan 2015 05:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0.....0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U.
...AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..
150130053254Z..150203053254Z.00.0...U.#..0......z4.&...&T....$.T.0...U
........0...*[email protected]..*..: ..../.5....a]..-q...}.s4..Q...
.....X.m..3I!.....G4.;*[email protected].,R.B..F9..........
.T......L.^..kDPv."..QA.z0CNm..T...r...NO...'.R5!.o}..<q.....x.$Ol.
EL..d...xy.0..N...*...2.q..4&\.b=6u_..?.v...._.O}...&...8'..@.\.......
.q ......

GET /gsorganizationvalg2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBReGXQV/tqUV3SNMRE+s25eR/vhjwQUXUayjcRLdBy77fVztjq3OI91nn4CEhEhsdKok21jslbiISkSn7ME6Q== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: application/ocsp-response

Content-Length: 1499

Connection: keep-alive

Set-Cookie: __cfduid=dd2b8210ebbe5432a2fd7b7f0ba22242c1422599333; expires=Sat, 30-Jan-16 06:28:53 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: b4925491c4fa563b81fe34d05f3a704f7bad5d28

Expires: Sat, 31 Jan 2015 06:28:52 GMT

Last-Modified: Thu, 29 Jan 2015 07:40:14 GMT

Cache-Control: public, max-age=86399

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9cad4c64046d-FRA
0..........0..... .....0......0...0........1..aq.....P%]....<..2015
0129074014Z0u0s0K0... ........^.t....Wt.1.>.n^G.....]F...Kt....s.:.
8.u.~...!....mc.V.!).........20150129074014Z....20150130074014Z0...*.H
...........$."...*.......(r(2.........J..l........V(.......H8.f..RJe._
........2... .\.?.z....!>...0O.^.H......:i..O....{......t_?4uk...`&
gt;.v...aK[(..j.........;..0d.........Y.`.;.K}..../[email protected] t.T...
-92.).......iC\z.R.(....S8-...O.......y....]Nn..*....Cj5..{>.......
0...0...0...........!m...Oq....-d)..#0...*.H........0]1.0...U....BE1.0
...U....GlobalSign nv-sa1301..U...*GlobalSign Organization Validation 
CA - G20...141212164309Z..150312164309Z0..1.0...U....BE1.0...U....Glob
alSign nv-sa1F0D..U...=GlobalSign Organization Validation CA - G2 OCSP
 responder - 11.0...U....201412121742000.."0...*.H.............0......
....{`D|L.......T..Sfj..[8....\...!...k..@>...H..T,...K.vI.v.kZ....
...'.^....4.d....dx.X......>X...O9>.p.....=..d#;@.......x.].#.$.
..I...5Z|z:....tY..6o2 7.......7X#.....c.......Z~|...Zk..c.o(.z.*,..y}
.....w.......72.25.!.K.}.......vc..?...Y.........S.M._..[........0..0.
..U....0.0...U...........0...U.%..0... .......0... .....0......0...U..
......1..aq.....P%]....<0...U.#..0...]F...Kt....s.:.8.u.~0...*.H...
...............YJ....KU1... g...N.a.?"Z......>O..o .G~..U.H......k.
.7.(nz/......"u..#. .m!.k.HjZ.3..G.J.9....i.................i.....4>
;...!.c..U...Du...x...0.....6..@u....&.......4<./..[...M.f....o.<
;.....o6.s"w.L....#..4~./.u..v.i.y.=.gR_=.sm.;iK.0.w..g......oq..)<<< skipped >>>

GET /fr/u.php?m=2821299455705972228&p=328546547221502&t=2592000 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.facebook.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: public, max-age=0

Expires: Thu, 29 Jan 2015 22:28:52 PST

Date: Thu, 29 Jan 2015 22:28:52 PST

X-XSS-Protection: 0

Content-Type: image/gif

X-Content-Type-Options: nosniff

Pragma: public

X-UA-Compatible: IE=edge,chrome=1

Vary: Accept-Encoding

Content-Encoding: gzip

X-FB-Debug: SbWrY1d3av5g7Tv4rWFVYlr0092NlRE6zLfO4E6DC99vXm0v46ziJrxUwF0aorSQuagMZpl5FiCiewJb7Aiwog==

Transfer-Encoding: chunked

Connection: keep-alive

2f............r.t..Ldd`dh`....,. Z.D.d...\...........a....v.h. .....0.
.HTTP/1.1 200 OK..Cache-Control: public, max-age=0..Expires: Thu, 29 J
an 2015 22:28:52 PST..Date: Thu, 29 Jan 2015 22:28:52 PST..X-XSS-Prote
ction: 0..Content-Type: image/gif..X-Content-Type-Options: nosniff..Pr
agma: public..X-UA-Compatible: IE=edge,chrome=1..Vary: Accept-Encoding
..Content-Encoding: gzip..X-FB-Debug: SbWrY1d3av5g7Tv4rWFVYlr0092NlRE6
zLfO4E6DC99vXm0v46ziJrxUwF0aorSQuagMZpl5FiCiewJb7Aiwog==..Transfer-Enc
oding: chunked..Connection: keep-alive..2f............r.t..Ldd`dh`....
,. Z.D.d...\...........a....v.h. .....0..

GET /Security.xml HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 404

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/xml;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:39 GMT

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive
<wl:whitelist xmlns:wl="hXXp://VVV.exent.com/EXEtender/WhiteList"&g
t;...<wl:general>....<wl:urls>.....<wl:url>hXXp://pa
rtners.freeridegames.com</wl:url>....</wl:urls>...</wl:
general>...<Signature Value="UWyEE6aHdzxjS0-NmcpRe2Ya8OzGKCOjRoh
PMGEuR5equoDUJip2l.e6h4qBxgdBc0p6kKQEPeL98HS-eVi.Whk7NrC11fcoLJHfRWLyd
-6fg9dp6l6OIoAs1ybJTsHXw-TKFPIexWAakG5nlf022XIPbeSVpi2fbgN74OxxUHo*" I
D="Server"/></wl:whitelist>......


GET /static/marketing/main/img/hover_elements_sheet.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 29426

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:39 GMT

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive
.PNG........IHDR.......A.....'.V.....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /banners/default/300x250_INT_ROS_tribel.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0; geoCountryCode=UA; gfad_300x250={"refreshCount":1,"sessionRefreshCount":0,"lastRefreshTime":1422599221435}


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 205

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:39 GMT

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........P=..@..%.?.7..%..>G.Ipp>..#p\.F._...........&..].:.s.
ffh.0.ZT.Tu....k.,.......h.VD8...%.).......C.2.o.?[,.p.]....7..... .N.
.[.....6.....e..".......... T$E..C.Rp...Y.M.h...E~..Z..2a9~..7..z.....
.HTTP/1.1 200 OK..Server: Apache..Content-Type: text/html;charset=UTF-
8..Content-Encoding: gzip..Content-Length: 205..Cache-Control: max-age
=86400..Expires: Sat, 31 Jan 2015 06:26:39 GMT..Date: Fri, 30 Jan 2015
 06:26:39 GMT..Connection: keep-alive..Vary: Accept-Encoding..........
...P=..@..%.?.7..%..>G.Ipp>..#p\.F._...........&..].:.s.ffh.0.ZT
.Tu....k.,.......h.VD8...%.).......C.2.o.?[,.p.]....7..... .N..[.....6
.....e..".......... T$E..C.Rp...Y.M.h...E~..Z..2a9~..7..z........

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 02:24:03 GMT

Expires: Sat, 31 Jan 2015 02:24:03 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 273757

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
6190213Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150126190213Z....20150202190213Z0...*.H................
...2..f......:.ge..oBA.l..`\...F.-%o..z9-...."g.2.5s#.K.[.........\...
W..j..^d..f.Yl.hL..".[..d.u..{....>1k.|Jj.L"...Z..yJ.e..I.......[\.
FZ...U....'.....m......f.$dv..S5.....|N.G.w.XK.Z.E.8.?....k..e.f(.[. .
h........-A`[S)...CL/.|.I........v..g'a.F.e.gDHTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 02:24:03 GMT.
.Expires: Sat, 31 Jan 2015 02:24:03 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 273757..Alternate-Protocol: 80:quic,p=0.02..Cache-Control
: public, max-age=345600..0..........0..... .....0......0...0......J..
....h.v....b..Z./..20150126190213Z0k0i0A0... ..........j.....p.I.#z...
(~d..J......h.v....b..Z./....2.S.......20150126190213Z....201502021902
13Z0...*.H...................2..f......:.ge..oBA.l..`\...F.-%o..z9-...
."g.2.5s#.K.[.........\...W..j..^d..f.Yl.hL..".[..d.u..{....>1k.|Jj
.L"...Z..yJ.e..I.......[\.FZ...U....'.....m......f.$dv..S5.....|N.G.w.
XK.Z.E.8.?....k..e.f(.[. .h........-A`[S)...CL/.|.I........v..g'a.F.e.
gD..<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2560

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA2wA-ADoilAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:43 GMT

Server: Apache

Set-Cookie: JSESSIONID=EA08E9D458D7A40EA1045F115A036E3D; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /serving/cookie/match/?party=1010&adx_id=104 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c1.adform.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=utf-8

Location: hXXp://c1.adform.net/serving/cookie/match/?CC=1&party=1010&adx_id=104

Access-Control-Allow-Origin: *

Set-Cookie: C=1; expires=Sat, 28-Feb-2015 06:28:52 GMT; path=/

P3P: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Length: 194
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://c1.ad
form.net/serving/cookie/match/?CC=1&party=1010&adx_id=104">
here</a>.</h2>..</body></html>......


GET /serving/cookie/match/?CC=1&party=1010&adx_id=104 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c1.adform.net

DNT: 1

Connection: Keep-Alive

Cookie: C=1


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=utf-8

Location: hXXp://dmp.theadex.com/d/104/i/2.gif?axd_pid=2&axd_fuid=5393689920369647502

Access-Control-Allow-Origin: *

Set-Cookie: cid=5393689920369647502,0,0,0,0; expires=Tue, 31-Mar-2015 05:28:52 GMT; path=/

Set-Cookie: uid=5393689920369647502; domain=adform.net; expires=Tue, 31-Mar-2015 05:28:52 GMT; path=/

P3P: CP="NOI DSP COR NID CURa ADMa DEVa TAIa PSAa PSDa OUR LEG NAV INT"

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Length: 196
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://dmp.t
headex.com/d/104/i/2.gif?axd_pid=2&axd_fuid=5393689920369647502"&g
t;here</a>.</h2>..</body></html>..HTTP/1.1 302
 Found..Cache-Control: private..Content-Type: text/html; charset=utf-8
..Location: hXXp://dmp.theadex.com/d/104/i/2.gif?axd_pid=2&axd_fuid=53
93689920369647502..Access-Control-Allow-Origin: *..Set-Cookie: cid=539
3689920369647502,0,0,0,0; expires=Tue, 31-Mar-2015 05:28:52 GMT; path=
/..Set-Cookie: uid=5393689920369647502; domain=adform.net; expires=Tue
, 31-Mar-2015 05:28:52 GMT; path=/..P3P: CP="NOI DSP COR NID CURa ADMa
 DEVa TAIa PSAa PSDa OUR LEG NAV INT"..Date: Fri, 30 Jan 2015 06:28:52
 GMT..Content-Length: 196..<html><head><title>Object
 moved</title></head><body>..<h2>Object moved 
to <a href="hXXp://dmp.theadex.com/d/104/i/2.gif?axd_pid=2&axd_
fuid=5393689920369647502">here</a>.</h2>..</body>
</html>....<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=245175&cr=55818&sc=14076&re=hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

HEAD /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: Apache/2.4.4 (Win64)

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Accept-Ranges: bytes

Content-Length: 12146312

Content-Type: application/x-msdownload

Expires: Fri, 30 Jan 2015 06:26:23 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:26:23 GMT

Connection: keep-alive

....

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=0-2429261

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: Apache/2.4.4 (Win64)

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Accept-Ranges: bytes

Content-Type: application/x-msdownload

Expires: Fri, 30 Jan 2015 06:26:23 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:26:23 GMT

Content-Range: bytes 0-2429261/12146312

Content-Length: 2429262

Connection: keep-alive

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......d... ... ...
 .......5...O...(.......4...O...i......./... .......&...*.......!...Ri
ch ...........PE..L...>.J=.................0...0...............@...
.@....................................................................
.....hI..........(...........8C..P....................................
[email protected]$.....
..0.................. ..`.rdata.......@... ...@..............@[email protected]
...dn...`...@...`[email protected]...(..........................
.@..@.................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................

<<< skipped >>>

GET /usersync2/apnx HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: sync.apnx.zenoviaexchange.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

set-cookie: _zdeuuid={"zde_uuid":"XU01v04-48220862-5c1e-4510-864c-37ad5dca4c93","zdxidn":1425}; path=/; expires=Sun, 29 Jan 2017 06:28:55 GMT; domain=.zenoviaexchange.com; httponly

Location: hXXp://sync.mathtag.com/sync/img?mt_exid=28&redir=http://sync.zenoviaexchange.com/usersync3/mediamath/1425/[MM_UUID]?zderedir=&zcc=1
0..HTTP/1.1 302 Moved Temporarily..Server: nginx..Date: Fri, 30 Jan 20
15 06:28:55 GMT..Content-Type: text/html..Transfer-Encoding: chunked..
Connection: keep-alive..set-cookie: _zdeuuid={"zde_uuid":"XU
01v04-48220862-5c1e-4510-864c-37ad5dca4c93","zdxidn":1425}
; path=/; expires=Sun, 29 Jan 2017 06:28:55 GMT; domain=.zenoviaexchan
ge.com; httponly..Location: hXXp://sync.mathtag.com/sync/img?mt_exid=2
8&redir=http://sync.zenoviaexchange.com/usersync3/mediamath%
2F1425/[MM_UUID]?zderedir=&zcc=1..0..

GET /js?wp_id=2659948 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: aa.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 11282745515801077923

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589071970330; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 962
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('0');}catch(e){h
5=new Array('','')}var screen_res;try{screen_res=Adition_ResId();}catc
h(e){screen_res=''}var fvers;try{fvers=Adition_Flash();}catch(e){fvers
=''}var prfstr;try{prfstr=Adition_Prfstr(2659948);}catch(e){prfstr=''}
document.write('<script type=\'text/javascript\' src=\'hXXp://aa.ad
farm1.adition.com/banner?sid=2659948&adjsver=' adjsver '' prfstr '&co=
1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=' os '&browser=' br
owser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac=' (  ad_count) '&s
creen_res=' screen_res '&wpt=J&clickurl=\'></script>');..

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnqkc= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:27:40 GMT

Last-Modified: Thu, 29 Jan 2015 19:47:05 GMT

Server: ECS (ams/D1C2)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015012
9184609Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.G....20141203203511Z....20150428204011Z0...*.H.............4..}.8.
.)....l..JcW.a..i.2....i.:...9`...K .#..x...2........x...U....._.....K
]..k8....*4...H4.K.d9?G.*.Y..e.\.y.....d.........L~._R...&.i...qLM5...
.EL.......3.....P9....6....'....'........j.4.q..e.vcI.$v....W]z......5
tQ.c ....X..hXiA......x.8%...Ez.......U....0...0...0...........'..0...
*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTrust1"0
 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229Z0G1.0
...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-20110.
."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...04..I..
....C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8..........h8GM
..*.4.MP..../[email protected]....
$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j.\.>
;.O....G.A........0..0... .....0......0...U.......0.0...U...........0.
..U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`;.l.uZ
..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....j.t%..
e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..ud.....
CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&....q.[
z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?....E....
.......'>..O.._..<<< skipped >>>

GET /cm?in=1&pub=345&userid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: p.rfihub.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: nginx/1.5.3

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Length: 0

Connection: keep-alive

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Set-Cookie: e=ad;Path=/;Domain=.rfihub.com;Expires=Tue, 18-Jul-2017 06:28:52 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Set-Cookie: ruds=H4sIAAAAAAAAAOMSNjQwsTCyMDa0MDYzMDQ0sDS0sBTiM9RNDSlNdNHNcQnRLSgEAKZ0-mclAAAA;Path=/;Domain=.rfihub.com

Set-Cookie: eud=H4sIAAAAAAAAABMSNjY2tjAzNzA2tDA3NjE0MrUwM43iNTQxMjK1tDQ2NjI0NpzFiMoHAJP-G5w0AAAA;Path=/;Domain=.rfihub.com;Expires=Tue, 18-Jul-2017 06:28:52 GMT

Set-Cookie: euds=H4sIAAAAAAAAABMSNjY2tjAzNzA2tDA3NjE0MrUwMwUA_IJIqxUAAAA;Path=/;Domain=.rfihub.com

Set-Cookie: rud=H4sIAAAAAAAAAOMSNjQwsTCyMDa0MDYzMDQ0sDS0sBTiM9RNDSlNdNHNcQnRLSiU4jU0MTIytbQ0NjYyNDYEAM_UeoQ0AAAA;Path=/;Domain=.rfihub.com;Expires=Tue, 18-Jul-2017 06:28:52 GMT

Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0sowP9owMtLV19DSND_YuB7EcHZ2Cq3I9PIN9bQFazEPzIwAAAA;Path=/;Domain=.rfihub.com;Expires=Tue, 18-Jul-2017 06:28:52 GMT

Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('1048283183601109189','');&redir=
HTTP/1.1 302 Found..Server: nginx/1.5.3..Date: Fri, 30 Jan 2015 06:28:
52 GMT..Content-Length: 0..Connection: keep-alive..P3P: CP="NOI CURa A
DMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: e=ad;Path=/;Do
main=.rfihub.com;Expires=Tue, 18-Jul-2017 06:28:52 GMT..Expires: Thu, 
01 Jan 1970 00:00:00 GMT..Set-Cookie: ruds=H4sIAAAAAAAAAOMSNjQwsTCyMDa
0MDYzMDQ0sDS0sBTiM9RNDSlNdNHNcQnRLSgEAKZ0-mclAAAA;Path=/;Domain=.rfihu
b.com..Set-Cookie: eud=H4sIAAAAAAAAABMSNjY2tjAzNzA2tDA3NjE0MrUwM43iNTQ
xMjK1tDQ2NjI0NpzFiMoHAJP-G5w0AAAA;Path=/;Domain=.rfihub.com;Expires=Tu
e, 18-Jul-2017 06:28:52 GMT..Set-Cookie: euds=H4sIAAAAAAAAABMSNjY2tjAz
NzA2tDA3NjE0MrUwMwUA_IJIqxUAAAA;Path=/;Domain=.rfihub.com..Set-Cookie:
 rud=H4sIAAAAAAAAAOMSNjQwsTCyMDa0MDYzMDQ0sDS0sBTiM9RNDSlNdNHNcQnRLSiU4
jU0MTIytbQ0NjYyNDYEAM_UeoQ0AAAA;Path=/;Domain=.rfihub.com;Expires=Tue,
 18-Jul-2017 06:28:52 GMT..Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0sowP9owM
tLV19DSND_YuB7EcHZ2Cq3I9PIN9bQFazEPzIwAAAA;Path=/;Domain=.rfihub.com;E
xpires=Tue, 18-Jul-2017 06:28:52 GMT..Location: hXXp://ib.adnxs.com/px
j?bidder=18&seg=378601&action=setuids('1048283183601109189','');&redir
=..<<< skipped >>>

GET /js?wp_id=3097401&kid=1221897&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58697_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc3=10039


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 24377737

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1083
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(3097401);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad2.adfarm1.adition.com/banner?sid=3097401&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&kid=1221897&scre
en_res=' screen_res '&wpt=J&clickurl=http://c13.w3hoster.de/ad
sc.php?sw3=14046_a_cw3=58697_a_gpr=AA==_a_w3hr
=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /real/tags/FreeRideGames/Germany_ROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:28:47 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 29940672511492546

Expires: Fri, 30 Jan 2015 07:28:47 GMT

Cache-Control: max-age=3600, private

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 13564

Connection: keep-alive
...........}.w.........@.{ .Vd9........m.l...;...Z.,.2.KR~4...a.......
...H...`0......b...8.O.j......09Z.M.........'....e.6.%.l6c.<I.Y.&..
..t..Y...xU..o..>...#....0.X..& ..../23>.CS...J4.eZ,....b..;..Hc
..o.ev...8...8.....w.~0.l~HK>.....(.N..i...)........a...7v.6..d.i..
....z.^.'......E....p.3....O.wvo....ae\.............8.y.c{.c.7..J9.*m.
U.8.)|.....XV.(...<...d..r.9.G'..|3.1.............8....(9..1T=^V...
[email protected];..G..|9H....I..$.uc.X..@....(*6....l2..>a.W..4?m.....P
[email protected]...:Z..I..1.....Iz.v1...?dO...9...Q
.Od.y....q]..f..W..x.q...|P.5..M....UQ:c..@q^[email protected]
R.....&.z.......T.;....r..... ....\.A.^[email protected].....
. ..?..D....%.h.....,[...Zk.:.O6.O.....M.P.p....C.c`........./..l.~...
 ..y.uZ..rB.6..Ev.7E5._.....L..q..L....Mq..RQ.L!.Y.,..KV....H..).*..K.
...........t7.7i..tu.`....'.....#=..?..8b@.@....?..u.W.-".$....q."...#
,....S9....<\>.....2..#kA...D..g.h.%1..G...[S..o ...w..C.4.>,
..8......&.&..3.SA........DS o.l......1..........~.,.G.....eI.....I?..
..!...w..U|^r.R..u..s(....f.%.=x8..W...F.'..b....P.l.5..PK#.1..O&.["N.
...I$.~.K. B.7.....J.1.g.#R.c:...........>........4../?...Vmj..F...
.n<a..|.)V..y.A...zT....lF.$!.z........^...S"....5.M....aU..<...
.6...M..}d.GCWy......f..9..%... ...).........6?..v.*......r...v7.. P..
d$ Y(..;\....vl|........."...J..,..M..Xr.....up..G..)...UI...k..H....t
......|U.i.:..,.Y...(N.....*..j...au...7...ph.(F.#.....CE"..D.1.R....*
...6[...........y.O...*.-.RI!......-/...*j.2......;...t7......sX..<<< skipped >>>

GET /j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=germany_ros&center=1&env=display&size=728x90&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19281807&a=3&adContainerId=richmedia_4&rnd=19279832 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive

Cookie: ANON_ID=aDnpe3rwZayq7XwrURW9cSYtrt9g0C6xGPDUx7uXKyfR5fSAyC8A8


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 101

X-Reuse-Index: 2

Pragma: no-cache

Cache-Control: private, no-cache, no-store, proxy-revalidate

Set-Cookie: ANON_ID=aNnsAGyg6ANFA7u8QGkxJ7a6Za7H55ZabDB8Ory0hUR3BoF62mXwuT8FKVu80ytO72QijgZbkKFZdQxcKilin1pT; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-2015 06:28:47 GMT;

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 226

Expires: 0

Connection: keep-alive

..........%.MO.@.....'.V...j..,F.m0...K..f...6.4.m..k.:...n.S...=..7..
.1xOVi..%...0..(......4..Br.r..y..7.XTQe.rQ.k.e....s.g...W..._..w..j..
{....`B.G"$....'D2..T......5...[[email protected]...$Y&
lt;N.hz.r..0.......HTTP/1.1 200 OK..P3P: CP="NOI DEVo TAIa OUR BUS"..X
-Function: 101..X-Reuse-Index: 2..Pragma: no-cache..Cache-Control: pri
vate, no-cache, no-store, proxy-revalidate..Set-Cookie: ANON_ID=aNnsAG
yg6ANFA7u8QGkxJ7a6Za7H55ZabDB8Ory0hUR3BoF62mXwuT8FKVu80ytO72QijgZbkKFZ
dQxcKilin1pT; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-20
15 06:28:47 GMT;..Content-Type: application/x-javascript..Content-Enco
ding: gzip..Vary: Accept-Encoding..Content-Length: 226..Expires: 0..Co
nnection: keep-alive............%.MO.@.....'.V...j..,F.m0...K..f...6.4
.m..k.:...n.S...=..7...1xOVi..%...0..(......4..Br.r..y..7.XTQe.rQ.k.e.
...s.g...W..._..w..j..{....`B.G"$....'D2..T......5...[.B......3..@n...
..........yQX.1a...$Y<N.hz.r..0.........

GET /adview.php?tz=1422599315415646&pid=789&kid=4&wmid=3348&sid=4&nvc=1&swid=3826&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 46.163.81.36

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /PositiveSSLCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1287

Last-Modified: Mon, 18 Sep 2006 00:00:00 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0..........L.J.[E.!.../. Qq0...*.H........0..1.0...U....US1.0...U.
...UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U.
...hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0...060918
000000Z..200530104838Z0q1.0...U....GB1.0...U....Greater Manchester1.0.
..U....Salford1.0...U....Comodo CA Limited1.0...U....PositiveSSL CA0..
"0...*.H.............0.........OyX"..(>R../.. ..-U.......*..^...X.T
....A...U.... .E.&. .=...1.!\y.y.$.\V...............S..F...$.b...^ Z..
.P...(*M..HO....O......?....,......p..i..<......?n...-..].........~
....}..:=.r.y%.......V^...Z..b4 (H2.........f.....iM....]..7b........~
.jR.................n0..j0...U.#..0....r_&.(.C.].7....K..E0...U.......
....1y......*..5.1.0...U...........0...U.......0.......0{..U...t0r08.6
.4.2hXXp://crl.comodoca.com/UTN-USERFirst-Hardware.crl06.4.2.0hXXp://c
rl.comodo.net/UTN-USERFirst-Hardware.crl0.... ........z0x0;.. .....0..
/hXXp://crt.comodoca.com/UTNAddTrustServerCA.crt09.. .....0..-hXXp://c
rt.comodo.net/UTNAddTrustServerCA.crt0...*.H..................H]..Z...
.....l.I..1.1\...d.....Z-..;>[email protected]....&=[!.....=.<
...._.S........NI}.......e....1w..*....j-.e..g.m.J.f..2M.B#..EAjv.....
n..>.Q......P*...o."6...F.....

GET /adscript.php?pid=789&ord=6110017601960017977&rdclick=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Last-Modified: Fri, 30 Jan 2015 06:28:51 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 46.163.81.36

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

Content-Length: 5145

Connection: close

Content-Type: text/javascript; charset=iso-8859-1
 var adspirit_pid = "789"; document.write('<scr' 'ipt type="text/ja
vascr' 'ipt" language="JavaScr' 'ipt">\n <' '!' '--\nfunction as
m_cmpback(e,t){return e.substr(e.length-t.length,t.length)==t}function
 asm_udc(e){var t="0123456789ABCDEFabcdef";var n="";var r=0;while(r<
;e.length){var i=e.charAt(r);if(i==" "){n =" ";r  }else if(i=="%"){if(
r<e.length-2&&t.indexOf(e.charAt(r 1))!=-1&&t.indexOf(e.charAt(r 2)
)!=-1){n =unescape(e.substr(r,3));r =3}else{n ="";r  }}else{n =i;r  }}
return n}var asmref=document.location.toString();var asmdl=0;var asmwi
n=self;var asmcr=true;if(top!=self&&typeof(location.ancestorOrigins)==
"object"){asmref=location.ancestorOrigins[location.ancestorOrigins.len
gth-1];if(document.referrer.substr(0,asmref.length)==asmref){asmcr=tru
e}else{asmcr=false}}if(asmcr){while(asmwin&&asmwin!=top&&asmdl<100&
&asmwin.parent){var asmcw=asmwin;asmwin=asmwin.parent;if(asmwin.locati
on){try{asmref=asmwin.location.toString()}catch(e){if(asmcw!=top){if(a
smcw.document){asmref=typeof(asmcw.document.referrer)=="string"&&asmcw
.document.referrer!=""?asmcw.document.referrer:asmref}else{asmref=type
of(asmcw.referrer)=="string"&&asmcw.referrer!=""?asmcw.referrer:asmref
}}break}}asmdl  }}if(self==top||asmref==undefined||asmref==""||asmref=
="-"||asmref=="undefined"||typeof(asmref)=="undefined"){asmref=self==t
op?location.href:(typeof(document.referrer)=="string"?document.referre
r:"")}var asmrefhost=String(asmref).toLowerCase();if(asmrefhost.substr
(0,7)=="hXXp://"){asmrefhost=asmrefhost.substr(7,9999)}if(asmrefho<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/tinybox.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Content-Length: 2616

Connection: keep-alive
............io..... .....V.....1f..&..d..bgQ..Y.#%..Z......{....I.....
..nr......s6......................?.}c....]...~...........v.Y...>"~
T.(g.R.2`^....FE(s... VK................r%w,..^"......,[..L..i0?...(.g
*..<..G6....Z..B...^...<....v..f.U.....CU^#.../.^.KG3..<....2
[email protected].<.A..f.]s<.r.:.W.mg.k...R@.........^...\..R...
s..E.........8..Q..RSBc"5B..}_..R..E...T.3.kV [email protected] ..T.2W.
V..*.B.(.t~lD.dz.....'A..v. ...#q...}..*.).....5j..#.m...B|.yyr..,....
../Z&9...%{....{..Jfi..L.''=M.`z.7.%...z..^..3.vI...^&..L2QoL..&H..A..
".l.%.*...x..4..=.q/....."...~./.4?Q0.,.'..Be..Q1...e<..L....2..qPF
[email protected].*.M....K(...."D..<.&FG........J .]
..yA~.%.l ...3a..$/...T.*.\...eo!f..(M.....B.wP}...k......2..`...y.eK.
.~)e.'....c...|.K...l...B.5.(|jNs.<.^.....(......} ..W2Re{e....*.D,
. r......k.s..M^.&'..L.`P.....N.k.kW..:...:[k_...b..n.q.<..s..`.Y?U
.....Af.Y.. .0......}.t.....w.y..K...a!0X.....E.T......d8....fp.D..V..
c..I.W.R0Q....L.>.Os.0.0/..%..E?......W.0U.r1....V&..}f.Vs....N}..K
j..}.$4.\.;q..f...@....^X..%[..Bo..:E!e.L.A.zO./..I[.h.xvfx.@.........
l..=..f....5..k...d.....V..q......l..]A.fN.....9.~.r...Nv.l..}...x...<
/font>....<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/notifications.jsp?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Fri, 30 Jan 2015 06:26:37 GMT

Content-Length: 2522

Connection: keep-alive
............ks.H.3....s{F.....-..E..K..> w.uu...`k#$V..}6....!.....
.GH.=.=....o....V@.~.....9....y&.."........z...>.?....%.C......~..c
.7....z...S......}:E.)ZK.Z.9.S....Cl....|o..)...g.........].*F.v.D...:
C...............m..o4.....R..l.1.F...3...'...._.&....[..v...(.D...hL..
A.........:.../......3#....t:.[..yy!.......$..2.$st.{[email protected].}p..&
gt;..G.....b"F.TF....I-..^D..X.T...ZR...X.\r.C...;3...'.."CF...0....I.
.....%...kfF...U.V..%E..............CM{..PC.zx.........j..<!..Sep..
..A..._...........F....rC*UC.....D.I...x....b.. N.6.\.,...}.*6F.......
...#u!CU3...p..|o...."%...G..........R....G....`.=..yt!E...X.3W"T..t..
.0..y.p...M.U7...l#).k..^6-...Rb.A...O.....F..h ..2. ..&R....[.~.r.YP.
.T...Gs.(~.i..;%!M...H.L;.b.Swl.|..*[email protected].)V.M.X"l....4...0y....N...1
zri..ej.Z....K9mX._K.?.........h .E....3IX.UUj.~.....l......o=......i.
....z=.2_@#K..*].*X..G.# ...N".U.'..:......C-h0.....B=.YM...d%K.g.7.9E
..p..J.R&......-...Z.._..Y.6.J.t...0%...Y;..........2#.P..`.r.3...|s.y
.G %r...R......>..f>..0.y.._.yi..<....<.9..ex..9.*.N"u..ae
.>...!.....|.#..0.U......S..V...Q....c...."..0.a....b%....f/.....i.
.r5.$..>...........V.R{.`.....s../.z..<.'il.....Q.\%.z....|.ueB.
....Q3Q_<.......g.eU*g.'....0.o.I..cLS.J.(.......}LP..Fw..v.w0u\...
i....a....Z...5...*.9G`.L]j....LGK.[...|...N....{a...W.K..K.!M..".b.f.
.`c....wn.,%.^...<F...1......h.8...........j*.....T......6k....O.h.
.V.EG....U.-5%...vK>..y........a..$.g..Bi.....R.s.[.5...Q.....:}a&g
t;p#|.f<..&EQp..H[..`..\.M...Y.........h..Q.%~....l.oW..0q5...w<<< skipped >>>

GET /static/marketing/header/css/header.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1821

Cache-Control: max-age=15123

Expires: Fri, 30 Jan 2015 10:38:40 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........Yko.6.......i....Bn..m.'[email protected]............._IrN.Tj........N
...N/5.*X_.....i....^...D....UX}e_...=.%Uz.>.x .?....I[../.6. .b.H 
. .H..b`..,.......*.a.ZJTVw.....c...k..EoP......V...:j.(.....Z\8b....#
Uy..)F.....P.R`....&%%....r>.bP.i.1.hp..A.>........R./....*s...G
.#o.f<....sX.k....gf..Zn.7.V..M...5w.s..(.......SL.!.....6o..3.p.}4
..f..... ].0#5..)Y....7...s.MF0.Y...|....a.b.S...........T.<gQ`..9.
..'.}G)...Q...y..0*.! .....`.=..O.!..<....9...D....d....s.~.,.sP..q
.k_.ok}C1_)...$....]..H..x...=..v.7J./#.M.....<==.s..2R6OUY........
....bTV-M....N.xB..y..|.RV.gX...`.f..tcf.........&.jk......fSW.q...\l.
;&....u.(........t.}.d....D.....$....<.....MV...)I7..l..E.A@Z......
DO.Z.CAz...IBZ]-..X....%?a...L.I........C...d.......D.2.....@..){T....
8....t......ieUT.H..|nJ.#Pa......i...\......0.q.....n.......gP.s..u.D.
Y........dg....s..h7t.{.0..lbF..1:...Cz.me.EgV...t>x .\.E.1.|<..
..F....0.(................t<...[. Gm.u...L>....xxE.u.....Uvz....
..X...n....w.....W..[k97Y.]......e. ........j..9..s......c.....;. '.s.
de...... t....9).....".Y..9.....(...&...._.* O7.6..C...*.N...k.Y...^..
^.............6;A.........m.(..1..:!...u...@(%g...nh.....dO.....h.)k..
8..`<.Q....9.\..b.wEws..*{...j...j.V.!.D.u..$V...Y....iQCXNK.l.3...
...F..2.....y..?T.{...x..w.!...7^*.... *...Hd..NH.....A......P)F...^%.
..............3(c8..=|..bO4.0.........M.....k.9RW ...z!....T5yH....Y?.
Z.....s.&G......6y......Y4B....(<s...c......F.>.@...%.a$......R.
...6y......a.......H.G.((...K....V........ .G......c...q.fB...3X'\<<< skipped >>>

GET /static/marketing/header/js/header.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1812

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........Xms.F......x".`.~I:.r..:....L...0B...I.H'....w.N...1i....t.
.... .Cc..4..0..:..c...`<4..J.rhh...4..g....oi\$.V*@%<........x.
.x........^[.[gM....:...Ub^.OI.9.c... .... X..G<J#.N<~gH....Ibh&
gt;...N...MrD...wl*<.l......[8=6.F~..d?y...d..L.`.*....v,......h.G.
.<>._.Zgo.S.N...uy,]y..!..YH5......i:'.g..8!.!.g=.....W...ub....
..Q.......&.#D.&)D...(...".q..}....:!..>...:1...Xb.e>Zs*z>...
.......J>.\.....<....J,(..`I..T...Yn.?. .([email protected].".-.>
.tL.S..D.-........%QJ.4wQ..2.I.S)..4.4.E5S...T.J.7..........v?...!....
.......6...~...8......r..%.x.*...Yn.P....b..P...bg..".M.K L....1.i.;qJ
%-..Z:.9.......g.....;.........2O)...2q_mL...}.........4In...."..en...
.F....P.T.Zg.i..b..D...b....&.....(O.Q.)...g..:....B.tnRB7....M....:.l
..5..fC..Y.bEJ...XL.V..0...<.%d.....6.}..]>....r...>....\..*s
No...I .a.`D......"..,..4..H(W...P.&.Z..dYC;.5GK..bU..ac...:.P..4..2).
..X@$s.l..r. y..d..6Y{<}C.......sb.U........(E.C.........a.. ......
T..j.Q...$B(0"8..F.G.*.|&.....'....[.}8.(i-F_......(r[>.....OPU. *.
.veg.N.OF.(..?.=t..F.A....d..wP....y.a!U.tE.[..a6.........A.S...T....Y
Y..;...1.Vw.Uih...l.^T..&6Ys`....$.K....N..z.^.....ON@..>.#E.~.....
G..]..xK'..$?0e.b....5....h,.Z.a.pT....GJK....6.d...M2.11P...m......x.
..R....`_.Y..s....\...<9r....G.UP...t..J.....fY...D5w.~Bs.].p..\n..
v.3.....rQW...K..h.....!.e{..k......g.7..._j5T^[email protected]... .a..
W.......Y..i,..p............Lb..=!..F..,(.8...1.)..y.:.4u.S-.>.| .I
`}..zc..DNxY ..P......h.QKX..R..|'Yl..R?....S.h... 3c..g.|...g...j<<< skipped >>>

GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/css/myGames_gameBox.extension.css?version=38 HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1052

Cache-Control: max-age=18575

Expires: Fri, 30 Jan 2015 11:36:12 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........X...:.}.J....J=RC..\.SO......p.U..13.F... !..!.y......^....
..\....aD.lS.....6..K.T/n..8..8~...Ls.O..>|Sw{B..LW...yC%.,....>
..XaQP..G.n%WK.>~..&.AI..i.}..mx.J......K.8#SI~.&..J%y....%..ti...(
..!..y......`if..b.K..G...nm....\.A.. e.t.AS.....8....&)..4.A*L...HZ..
h/O&.K.....R.*u.X.)...........e.P.@o!..St...G.r.F.....G.z0...i........
M.M<hgi.L.]x.......K.jBiQ..QWG..P.....k........0t...3.....;n>D..
.S)....~.`|.....&..N..S.\.%j..N....P3..U..e...d..T]Q..Xt........._..U.
...7.).........(.{.........&... O........ ......V.\.73..j........;.v..
.Nrf.l.7...........q..a..M....(.....2..Y."4.$.u.......j.jN].6....?..=.
n.....x...0d..k.-.~...,.u\q..%@.{z...D.{....^.g|........F..{S...on....
0....?..A....W..|.Q-7. ......v....G[....).C..*<.....}..&..0._}.8...
.eJ..E.W%[email protected];..J.A.3.......'..zE..'........
..R..U.*..<..........v.............=s{[email protected].]..]......n
.P._C...Pr.md..ti.b....Q%..?..a6j..L..D..............U'.........i..4.T
...mI.y.....O..7.U^....sA...L=.8...9...!.jV|..0>..&X:S{.;'....wv.;|
e ...J*Kr...O^......I.l...HTTP/1.1 200 OK..Server: Apache..P3P: CP="ID
C CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Type: text/css
;charset=UTF-8..Content-Encoding: gzip..Content-Length: 1052..Cache-Co
ntrol: max-age=18575..Expires: Fri, 30 Jan 2015 11:36:12 GMT..Date: Fr
i, 30 Jan 2015 06:26:37 GMT..Connection: keep-alive..Vary: Accept-Enco
ding.............X...:.}.J....J=RC..\.SO......p.U..13.F... !..!.y.....
.^......\....aD.lS.....6..K.T/n..8..8~...Ls.O..>|Sw{B..LW...yC%<<< skipped >>>

GET /static/marketing/main/css/download_assist.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 217

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
..........}[email protected][email protected]..:........[..OW....f...3;q...j..6.0X
. .V.......B.*.........2] .V..F...%.:...........y ...%l..^mU,...b3..G.
........`...M..>...&...8.DqV;5.....{8k..G.H..d.u...%.YBg..=...:..@.
~.Bdq.........


GET /static/marketing/main/img/containers/yellow_right_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1244

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D90AF3B556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8D90AF3A556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................d.....................................
.......................2r....6....................1q..2.B.3...........
...?...`S..4d.!s....m.|>\.N..h..L.........
<<< skipped >>>

GET /static/marketing/main/img/containers/green_right_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1232

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=16683

Expires: Fri, 30 Jan 2015 11:04:41 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F85E1ABB556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F85E1ABA556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................^.....................................
.....................q..3....6...................1..2B.............?..
.%D @......U.0...#\...........
<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_top_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1242

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=15276

Expires: Fri, 30 Jan 2015 10:41:14 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8D7B2B6E556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8D7B2B6D556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................b.....................................
.....................a.....V.....................!....S..T............
.?.....D.F.......c."Y.i...2Jp...........
<<< skipped >>>

GET /static/marketing/main/img/containers/green_corners.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 2157

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:408B6E0A556411E18557BC153AD
0475B" xmpMM:InstanceID="xmp.iid:408B6E09556411E18557BC153AD0475B" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5E231C124755E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
..................I...................................................
...................................!1A.q.Q...".a..2B$.#3...T..V.......
................!1..A.aq..."2.Q.....Rr..S............?..Q2w&V.9q..a..2
$.A.8%QC.*..f ..I>.\iB.NMl.s.C.....2 . ......q........4n?.]...og.`.
7.._.;.;.......1.Ts.^....fS~T<....s..@...";.....%A.np..Pga..).0...#
.......$2!.q..u..e....I......"E"..`Lu.............2.....?..m...2Jn<<< skipped >>>

GET /real/tags/FreeRideGames/ROWROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:28:47 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 11957204031009994980

Expires: Fri, 30 Jan 2015 07:28:47 GMT

Cache-Control: max-age=3600, private

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 13558

Connection: keep-alive
...........}.w.........@.{ .Vd9........m.l...;...Z.,.2.KR~4...a.......
...H...`0......b...8.O.j......09Z.M........=N..7...l.K..l..y...<M..
/..8.......N....}..3F...~al...MV..!._df|.....).h...X.y...*ewx... b.~..
..Uq.].q\..k7...`0....|.....Q\.......Sv.=.........o.4m............z.*O
../O/...I....g...........=.......y3x.7.q..Iq..|.. .ho2..r.U....q.S.p..
]:...P...yZ...*..ts(.N>&.f.c"SS]...3..,y.qD/.MQrj.c.z....v...a..~.M
.N.vN..8..r.B....".H.....zq.<..kQTl.....d..}.4..Wi~.,.....* ......9
...S....d..=.g..ns.e.@G....*.t.B....c..7.=....b..{......s.!N......4[A}
..\e. *........?..8j.9.... ..t......\7i....MSe'...].o....=.....c..9M..
..5......w...i../[email protected] .H.|.Z....6.4.d.)....t5.........;...]A.......
..7J@.>...,Y.&4...~u..l<...?...(....:.......7..7...O_...<...1
W......:<...m....4n.j..rq.Sq.V.......d...$[..2.Bv.rY.......O.|.SDUd
..:[.}9...7g.U.n6n.......*...O.gyq.Gz..~.1p.........L..4.8[D.I>.?..
.En..GX .9..r...;x.|[email protected]}X..q
B..k..L.M>.g...t..Y..I...V.V.vc....c..#.U....].8X..6......f.3.s.~L.
.eCf...........n..|..P6.k#..K.z.p2(.v.>..O<_.........k....F.c...
L".D.f....Hd.n..V.<n..../..b~.0G...t.E.=.....#.}2......4i.`_~.m....
>..T_e7.x.....S.|..B.8.....?....fIB..._....3..|%..D*.-.k..........y
...)m.#...........h5....."Bs.&K<.iA4..S.q..5... l~*a.`UR....J...-.n
[email protected]...}..........^.."...J..,..M..Xr.....up..G..)...UI...k..
H....t......|U.i.:..,.Y...(N.....*..j...au...7...ph.(F.#.....CE"..D.1.
R....*...6[...........y.O...*.-.RI!......-/...*j.2......;...t7....<<< skipped >>>

GET /displayAd.js?dver=0.4&th=8608858615 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 153

X-Reuse-Index: 2

Date: Fri, 30 Jan 2015 06:28:47 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

Expires: Thu, 30 Apr 2015 06:28:47 GMT

Set-Cookie: ANON_ID=aDnpe3rwZayq7XwrURW9cSYtrt9g0C6xGPDUx7uXKyfR5fSAyC8A8; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-2015 06:28:47 GMT;

Cache-Control: private

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 157

Connection: keep-alive
..........u....0....)~o..{);..7...t.j.v.......C0.@..|..#X.u.=GES....hX
b....a.......,............:c...o.?.........Z.;..X-.77.x..eq.U..Z.z..[.
......T..;.f.........


GET /j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=rowros&center=1&env=display&size=300x250&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19281807&a=1&adContainerId=richmedia_2&rnd=19279289 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive

Cookie: ANON_ID=aDnpe3rwZayq7XwrURW9cSYtrt9g0C6xGPDUx7uXKyfR5fSAyC8A8


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 101

X-Reuse-Index: 3

Pragma: no-cache

Cache-Control: private, no-cache, no-store, proxy-revalidate

Set-Cookie: ANON_ID=axnsAGsKBRmrmDqU7pexF4ZdPQSfXCdbUjQqbX3eUcREEMm1HXUuG0ICGYKPjGi6QmqKiPUWt1QCF3XH5mAh1; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-2015 06:28:47 GMT;

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 227

Expires: 0

Connection: keep-alive
..........%[email protected].~..Ek.....(..B....f....2.:...cZ.|.loNr..m}j.:.....q
x...%.4..........."/a....}..e.s.r..<N..`,...a9/............f. m....
.;wx1Z......aD.G"$.'D2.?U....{.5...[[email protected]]M...(..p?..
.$Y<4.h<y.....c.....HTTP/1.1 200 OK..P3P: CP="NOI DEVo TAIa OUR 
BUS"..X-Function: 101..X-Reuse-Index: 3..Pragma: no-cache..Cache-Contr
ol: private, no-cache, no-store, proxy-revalidate..Set-Cookie: ANON_ID
=axnsAGsKBRmrmDqU7pexF4ZdPQSfXCdbUjQqbX3eUcREEMm1HXUuG0ICGYKPjGi6QmqKi
PUWt1QCF3XH5mAh1; path=/; domain=.tribalfusion.com; expires=Thu, 30-Ap
r-2015 06:28:47 GMT;..Content-Type: application/x-javascript..Content-
Encoding: gzip..Vary: Accept-Encoding..Content-Length: 227..Expires: 0
..Connection: keep-alive............%[email protected].~..Ek.....(..B....f....2.
:...cZ.|.loNr..m}j.:.....qx...%.4..........."/a....}..e.s.r..<N..`,
...a9/............f. m.....;wx1Z......aD.G"$.'D2.?U....{.5...[.B......
[email protected]]M...(..p?...$Y<4.h<y.....c.......

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2560

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA2wAtAKADlAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:24 GMT

Server: Apache

Set-Cookie: JSESSIONID=6A4CFBB7BB540606A30C0FDD3626B9A4; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRNDpBTXFXL4hq1AIFFLZkDOqgNdgQUuMoR6QYxedvDlMboGSq8uzUWMaQCEQCuH3DgeG4oxuqQCCTRf5D9 HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Thu, 29 Jan 2015 23:55:24 GMT

Expires: Mon, 02 Feb 2015 23:55:24 GMT

ETag: B116DBB1792D70115110AB40FDEBEE6A6AE1743D

Cache-Control: max-age=321393,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp9

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0...........1y......*..5.1...2015012
9235524Z0t0r0J0... ........M..S\U......E-..:..v.......1y......*..5.1..
....p.xn(....$........20150129235524Z....20150202235524Z0...*.H.......
......\.!.d.=.n..#..W&..y.'..#.oq..;.5........s....&./@...H.......Nr..
..x.....D..U.o....@`J.R...y. .YM.<.....N....J....].X...e.M.J\UGF...
.:.[.N......xc....p..T.....r..........,....,..oy6.{5P.Vb.;<.X.m..v.
......m..F.............,DjF>0.....;^HoF....H.,>.-s(.#."/(...

GET /only.php?skrel=1&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw== HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

refresh: 0.1;url=hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 20

Connection: close

Content-Type: text/html

......................

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=455915, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 13:01:57 GMT

Expires: Wed, 4 Feb 2015 13:01:57 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015012
8130157Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150128130157Z....20150204130157Z0...*.H............
.t.L~...vz..h.22..lK.iK...'ec...FR.... ....!..q*......1E..5r*,...]M..|
'..`e.UJ..S.._.jnGy......tT~.f..8.N.g0.V....!3........E...]b..........
d..6.......z?.........Y....6........a%......T|...-]D.2[.......4.%.A.w.
...................2. Jsa.Jb.R,.f.....>J....6o.....0...0..}0..e....
....:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 30.."0...*.H.............0............
\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd....
.x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x.....
.........6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o
...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0.
.0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .....
..0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830..
.*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a.
..nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7..
.=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v...
..\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%...
.<<< skipped >>>

GET /PublicSureServerSV.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=864000

Content-Type: application/x-pkcs7-crl

Date: Fri, 30 Jan 2015 06:28:47 GMT

Etag: "2b001f-47061-a00e2fc0"

Expires: Mon, 09 Feb 2015 06:28:47 GMT

Last-Modified: Fri, 30 Jan 2015 03:59:03 GMT

Server: ECS (ams/49B3)

X-Cache: HIT

Content-Length: 290913

0..p\0..oC...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybe
rtrust Public SureServer SV CA..150130034345Z..150209034345Z0..n.0....
..... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I
..101116165848Z0.........,U./...101116173007Z0.........,U.h...10111617
2944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0....
.....,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z
..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..10111619
5619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0....
.....-..4...110315204303Z0........../P....120206141831Z0..........I..@
..120124180322Z0..........JP....110222182509Z0..........Jf/Y..12021314
2815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0....
......YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu.
..120220131416Z0..........^..^..111007192320Z0..........`.w...12021314
4727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0....
......hlG...120213145015Z0..........h.....120130140408Z0............j.
..120110213653Z0...........}....110406160143Z0............$...11040100
5006Z0................110401005536Z0............W...120308151704Z0....
.........h..120228141105Z0................110314145902Z0............`.
..110322142311Z0................110322142551Z0............lb..12011021
3802Z0.............0..130201130700Z0............OB..110321165802Z0....
.........o..110321172720Z0...........g.:..120221183148Z0...........Ud.
..110516131110Z0............h5..120229174140Z0................1202

<<< skipped >>>

GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.yahoo.com

DNT: 1

Connection: Keep-Alive

Cookie: B=52qa5ah9dvsod&b=3&s=ur; RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; ih="b!!!!#!C'Wg!!!!#>[b?c"


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:49 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Sun, 29-Jan-2017 06:28:49 GMT

Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com

Location: hXXp://ib.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC

Cache-Control: private

Content-Length: 0

Content-Type: text/plain; charset=utf-8

Age: 0

Connection: keep-alive

Server: ATS
HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:49 GMT..P3P: policyre
f="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI
 PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY
 ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"..Set-Coo
kie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Sun, 29-Jan-201
7 06:28:49 GMT..Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; 
expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com..Location: ht
tp://ib.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC..Cache-Control:
 private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..
Age: 0..Connection: keep-alive..Server: ATS..

GET /bk/8640634?t=1422599352774&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t4ft.de

DNT: 1

Connection: Keep-Alive

Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=


HTTP/1.1 200 OK

X-Powered-By: PHP/5.5.19-1~dotdeb.1

Set-Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=; expires=Sat, 30-Jan-2016 06:28:51 GMT; Max-Age=31536000; path=/; domain=.t4ft.de

Content-Length: 102

Content-Type: text/javascript

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Pragma: no-cache

Expires: Fri, 31 Dec 1999 23:00:00 GMT

P3P: policyref="hXXp://t4ft.de/p3p.xml", CP="NOI DSP PSAa PSDa IVAa IVDa OUR NOR UNI COM NAV INT CNT"

Connection: close

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws-0409
window.ftgs_8640634(1, "", {"aid":1211,"otp":"1211\/5101070\/8640138\/
8640196\/8640634","otfp":null});..

GET /load/?p=204&g=013&bi=3338670318734125865&j=0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: loadm.exelator.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: nginx/1.4.2

Date: Fri, 30 Jan 2015 06:28:58 GMT

Content-Type: image/gif

Content-Length: 0

Connection: close

X-Powered-By: Undertow/1

Set-Cookie: DNT="DNT2"; Domain=.exelator.com; Path=/; Max-Age=2147483647; Expires=Wed, 17-Feb-2083 04:43:05 EST;

P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Location: hXXp://load.s3.amazonaws.com/pixel.gif

P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

GET /scripts/au1107.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Content-MD5: OJUB vkxG3ve6mufLm5kfA==

Last-Modified: Tue, 30 Dec 2014 16:10:45 GMT

x-ms-request-id: d852ba98-0001-004e-5933-50d3cf000000

x-ms-version: 2009-09-19

x-ms-lease-status: unlocked

x-ms-blob-type: BlockBlob

Server: NetDNA-cache/2.2

Expires: Sat, 31 Jan 2015 06:28:48 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
16f.............RQk.0.~v......Fb...*..`...*.EJL...ii.L......a........|
wA..bx{.. v./..@.....&..TI...|.....6u.S.....X....]..9.....w ...I..`.z0
...z.rw...Q%.&R.;..(L..4.dQ...M.h..w....l..[...ID..uA..jJD.....?.K....
.....__.M....E./a).....P.RhA.q...w.3...K.E%..<.a2......m8.|R..K.:..
NkLO!.P...... .c.)*.D;....j.g..7....r}.U...l.Rr..9a......k.Y........sY
E.vN..gy{2...p{s_u.^Xz.....0......


GET /scripts/1/adnl.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Content-MD5: EHHAdvEjgoimR0CMRq 8Dg==

Last-Modified: Wed, 28 Jan 2015 08:37:53 GMT

x-ms-request-id: ac42dd22-0001-006b-6923-519f25000000

x-ms-version: 2009-09-19

x-ms-lease-status: unlocked

x-ms-blob-type: BlockBlob

Server: NetDNA-cache/2.2

Expires: Sat, 31 Jan 2015 06:28:48 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
600a..............{[.H.>.......3.....[...(..x...W ..!.!.h.~.w..TR.T
..3..k..T...j..{...|..../.h.\.,}G=E7}.hX.G........S5...R..G.....'.i...
.VuY.?.~..x......|T....N..../_....'.!h.'... ..%.[.L.I./?>.........O
7L..tU].....%.......g........j..._......-T%.........Ox&.C....w.t..~...
............. ..b.&.....v#O.q..^..{......k0...OMI.(F.g~...*..[L..X....
..)..4..,.A...%..o....i......$R.<.#bu.....j..UwZ?.C...J........|Z..
..v.. i...`.L........MZr...!..`4.*..:R......>..~....._.|..|......3.
. .....W!...U..5...(.|T?}..h..`....LE...Q.).f..2.4...8.".......2r...4.
}....x..F&.&....p_..-...1V&&..W...H...O......c.w.Z)8..x*9...s5...M.(a 
..iN.6.,`..Y.... ......0o..B.5.f....Y.eR..N.l....{.....`.<..uV.....
........S ..f%.Q..7t.....T..U...AX/.D....v..(#c.|[O.......0....g..<
Na&..C....,I.8.S.h.....c...5E........>...i....<.....\]..-....B..
...g=.......l........B..D..p.u......Tku....>..*.A....e}.....)..`.&l
t;./)......)..7.g5...k...@ .}....bx:.T3...G.pGB...Gc... <..........
4t1~.n...f*..{.p".)....9..6..........'.(|.h...."....q./_./v.@R<.TXe
O......V...h.....}....1..L%............h|rF.=p~UC.98........_4.`zP...q
.,3Z.LnF..}.C^..tz...~.p[...V1...&p... [email protected]%.5......w.Yi...cI;A...3.
'..).7....!.l.3Q`..M.#7..v&...r...2~S.7...\.....N.......LX.{.NaD.J..U.
4...z.....".. N,J"..........NJ..-..*.r......... ..}0S....%l...)...b...
........... j...fvm.1..p|.B_..cg.,..;P...bmC^ZM.gN...l..*ll..y...R\...
.Iy.......q...A.u.0...b.P........y..0.y8.T.......~.W.....-.gFH.=.zp...
...n&..>:$..X....0v.....1X<..1X..Dy......~.g#.&..>glj<<<< skipped >>>

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Content-Length: 29648

Date: Fri, 30 Jan 2015 06:28:48 GMT
if(!Adition_Environment){var Adition_Environment=function(){var _this=
{};var env={ref:false,os:false,browser:false,screen_res:false,flash:fa
lse,prf:false,iframe:false,cb_initialized:false};var brs=navigator.use
rAgent.toLowerCase();var fallback_json_parse=function(){'use strict';v
ar at,ch,escapee={'"':'"','\\':'\\','/':'/',b:'\b',f:'\f',n:'\n',r:'\r
',t:'\t'},text,error=function(m){throw{name:'SyntaxError',message:m,at
:at,text:text};},next=function(c){if(c&&c!==ch)error("Expected '" c "'
 instead of '" .ch "'");ch=text.charAt(at);at =1;return ch},number=fun
ction(){var number,string='';if(ch==='-'){string='-';next('-')}while(c
h>='0'&&ch<='9'){string =ch;next()}if(ch==='.'){string ='.';whil
e(next()&&ch>='0'&&ch<='9')string =ch}if(ch==='e'||ch==='E'){str
ing =ch;next();if(ch==='-'||ch===' '){string =ch;next()}while(ch>='
0'&&ch<='9'){string =ch;next()}}number= string;if(!isFinite(number)
)error('Bad number');else return number},string=function(){var hex,i,s
tring='',uffff;if(ch==='"')while(next())if(ch===.'"'){next();return st
ring}else if(ch==='\\'){next();if(ch==='u'){uffff=0;for(i=0;i<4;i =
1){hex=parseInt(next(),16);if(!isFinite(hex))break;uffff=uffff*16 hex}
string =String.fromCharCode(uffff)}else if(typeof escapee[ch]==='strin
g')string =escapee[ch];else break}else string =ch;error('Bad string')}
,white=function(){while(ch&&ch<=' ')next()},word=function(){switch(
ch){case 't':next('t');next('r');next('u');next('e');return true;case 
'f':next('f');next('a');next('l');next('s');next('e');return false<<< skipped >>>

GET /js/acb/uid.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/html

Accept-Ranges: bytes

ETag: "626933837"

Last-Modified: Mon, 30 Apr 2012 09:53:27 GMT

Content-Length: 2611

Date: Fri, 30 Jan 2015 06:28:48 GMT
<!DOCTYPE html>.<html>.<head>.<meta http-equiv="C
ontent-Type" content="text/html; charset=UTF-8">.<title></
title>.</head>.<body>.<script type="text/javascript"
>.      var key ='ad_uid';.      .      var IdWs=new function(){fun
ction g(c,a){var b;void 0!==a&&document.getElementById(a)?b=document.g
etElementById(a):(b=document.createElement(c),b.id=a);b.style.visibili
ty="hidden";b.style.position="absolute";document.body.appendChild(b);r
eturn b}function e(c,a){var b=null;try{return b="function"!=typeof c?t
his[c].apply(this,a):c.apply(this,a)}catch(d){return null}}var f=windo
w.location.host.replace("VVV.","");this.getUElem=function(c){var a=g("
div","userdata_el");a.style.behavior="url(#default#userData)";.a.load(
"id");return a.getAttribute(c)};this.setUElem=function(c,a){var b=g("d
iv","userdata_el");b.style.behavior="url(#default#userData)";b.load("i
d");b.setAttribute(c,a);b.save("id")};this.getGVal=function(c){return 
globalStorage[f][c]};this.setGVal=function(c,a){globalStorage[f][c]=a}
;this.getWName=function(c){var a=window.name,c=RegExp(" " c "=(\\w*);"
);return(c.test(a)?c.exec(a):["",""])[1]};this.setWName=function(c,a){
var b=window,d;d=window.name;var e=RegExp(" " c "=\\w*;"),g=e.test(d),
f=" " .c "=" a ";";g?d=d.replace(e,f):(";"!=d.charAt(d.length)&&(d =";
"),d =f);b.name=d};this.storeKey=function(c,a){e.call(window.localStor
age,"setItem",[c,a]);e.call(this,"setWName",[c,a]);e.call(this,"setGVa
l",[c,a]);e.call(this,"setGVal",[c,a]);e.call(this,"setUElem",[c,a<<< skipped >>>

GET /banners/533/oba_priv.sjs?oba=&domId=obaButton_6110017589091237945&btr=true&pos=top-right&cid=12452&aid=54647 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-type: text/html

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:49 GMT
61b..var oba= 0,.    info = {.                    title: "Advertising 
Alliance AG",.                    text: "Nutzungsbasierte Online-Werbu
ng",.                    url: "hXXp://VVV.advertising-alliance.de/opt-
out.html",.                    linkText: "mehr Infos & deaktivieren". 
                   },    domId = "obaButton_6110017589091237945",.    
position = "top-right"||'top-right';..   if (info != null || oba != 0)
 {.     if (typeof $ADP == 'object') {   .       try {.        $ADP&&$
ADP.Registry&&function() {..          if (!oba) { oba = $ADP.Registry.
generateId(); }..          if (info!=null) { $ADP.Registry.register(ob
a,info);}..          if (domId) {.            $ADP.Registry.createPlay
er(oba,{.                 domId: domId,.                 position: pos
ition.            });.          }.        }();.        }catch(e) {}   
.     } else {.        var infostr = info!=null?'&title=Advertising Al
liance AG&text=Nutzungsbasierte Online-Werbung&url=http://VVV.ad
vertising-alliance.de/opt-out.html&linkText=mehr Infos & deaktivie
ren':'';.        var proto = ((window.location.protocol.match(/http/i)
)?window.location.protocol:"http:");.        var oba_script = document
.createElement('script');.        oba_script.setAttribute('type','text
/javascript');.        oba_script.setAttribute('charset','utf-8');.   
     oba_script.setAttribute('src',proto '//imagesrv.adition.com/js/ad
player/adplayer_privacy.sjs?oba=' oba '&domId=' domId infostr '&pos=' 
position);.        document.getElementsByTagName('head')[0].append<<< skipped >>>

GET /js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_6110017589091237945&title=Advertising Alliance AG&text=Nutzungsbasierte Online-Werbung&url=http://VVV.advertising-alliance.de/opt-out.html&linkText=mehr Infos & deaktivieren&pos=top-right HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-type: text/javascript

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:49 GMT
4c90..var proto = ((window.location.protocol.match(/http/i))?window.lo
cation.protocol:"http:");.var playercss = document.createElement("link
");.playercss.setAttribute("rel", "stylesheet");.playercss.setAttribut
e("type", "text/css");.playercss.setAttribute("href", proto "//imagesr
v.adition.com/js/adplayer/adplayer.min.css");.document.getElementsByTa
gName("head")[0].appendChild(playercss);...if(!window.$ADP){$ADP={}}$A
DP.Registry=$ADP.Registry||{data:{},translationFile:false,wait:2000,LA
ST:"LAST",MAIN:"MAIN",POPUP:"POPUP",FRIENDLY_IFRAME:"FRIENDLY_IFRAME",
FOREIGN_IFRAME:"FOREIGN_IFRAME",POSTMESSAGE_SEARCH:"POSTMESSAGE_SEARCH
",publisherInfo:undefined,register:function(b,a){this._register(b,a,fa
lse)},_register:function(e,c,b){if(!c){c={}}if(!this.data[e]){this.dat
a[e]={items:[]}}var d={};for(var a in c){switch(a){case"domId":this.da
ta[e][a]=c[a];break;case"header":case"footer":case"title":case"text":c
ase"url":case"linkText":case"usePopup":case"renderCloseButton":d[a]=c[
a];break;default:break}}if(!b){this.data[e].items.push(d)}else{this.da
ta[e].items.unshift(d)}$ADP.Util.log('Registered item with title "' c.
title '" for ID ' e)},unregister:function(a){if(!this.data[a]){return}
delete this.data[a]},getById:function(b){var a=[];if(this.data[b]){a=t
his.data[b].items||[]}return a},pullById:function(b){var a=this.getByI
d(b);this.unregister(b);return a},getDOMId:function(a){if(this.data[a]
){return this.data[a].domId}},hasId:function(a){return this.data[a]?tr
ue:false},setPublisherInfo:function(a){if(typeof this.publisherInf<<< skipped >>>

GET /js/adplayer/adplayer.min.css HTTP/1.1

Accept: text/css

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/css

Accept-Ranges: bytes

ETag: "1471831326"

Last-Modified: Tue, 30 Oct 2012 15:33:13 GMT

Content-Length: 3560

Date: Fri, 30 Jan 2015 06:28:49 GMT
/*.   ----------------------------------------------------------------
---------------------------.   AdPlayer v2.0.3.FINAL (FINAL.103012).  
 Authors: [email protected].            felix.ritter@adtec
h.com.            [email protected].            marius.n
[email protected].            [email protected].          
  [email protected].            [email protected].        
    .   --------------------------------------------------------------
-----------------------------.  .   This file is part of AdPlayer v2.0
.3.FINAL (FINAL.103012)..   AdPlayer is free software: you can redistr
ibute it and/or modify.   it under the terms of the GNU General Public
 License as published by.   the Free Software Foundation, either versi
on 3 of the License, or.   (at your option) any later version.. .   Ad
Player is distributed in the hope that it will be useful,.   but WITHO
UT ANY WARRANTY; without even the implied warranty of.   MERCHANTABILI
TY or FITNESS FOR A PARTICULAR PURPOSE.  See the.   GNU General Public
 License for more details.. .   You should have received a copy of the
 GNU General Public License.   along with AdPlayer.  If not, see <h
ttp://VVV.gnu.org/licenses/>..  .  --------------------------------
------------------------------------------------------------.*/.body.a
dp-popup{margin:0;padding:10px;background-color:#FFF;color:#000;}.adp-
top-right{top:0;right:0;}.adp-top-left{top:0;left:0;}.adp-bottom-right
{bottom:0;right:0;}.adp-bottom-left{bottom:0;left:0;}.adp-wrapper{<<< skipped >>>

GET /js/adplayer/oba_icon.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/png

Accept-Ranges: bytes

ETag: "1455054096"

Last-Modified: Tue, 30 Oct 2012 15:33:13 GMT

Content-Length: 3262

Date: Fri, 30 Jan 2015 06:28:49 GMT
.PNG........IHDR..............D.,....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:49 GMT

HTTP/1.1 304 Not Modified..Access-Control-Allow-Origin: *..Content-Typ
e: application/javascript..Accept-Ranges: bytes..ETag: "1035523256"..L
ast-Modified: Tue, 09 Dec 2014 09:34:51 GMT..Date: Fri, 30 Jan 2015 06
:28:49 GMT......

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

....

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

....

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

....

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Connection: close

Date: Fri, 30 Jan 2015 06:28:50 GMT

GET /r/dt/id/L21rdC80L21waWQvMjMwNjY2NTM/mpuid/3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.p-td.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: Apache-Coyote/1.1

P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0

Pragma: no-cache

Set-Cookie: uid=9189877810963858557; Domain=.p-td.com; Expires=Wed, 29-Jul-2015 06:28:54 GMT; Path=/

Location: hXXp://ib.adnxs.com/seg?add=

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:54 GMT
77..<html><body><p>Redirecting to <a href="http:/
/ib.adnxs.com/seg?add=">hXXp://ib.adnxs.com/seg?add=</a></
p></body></html>..0..HTTP/1.1 302 Moved Temporarily..Se
rver: Apache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa D
EVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=
0, no-cache, no-store, private, must-revalidate, s-maxage=0..Pragma: n
o-cache..Set-Cookie: uid=9189877810963858557; Domain=.p-td.com; Expire
s=Wed, 29-Jul-2015 06:28:54 GMT; Path=/..Location: hXXp://ib.adnxs.com
/seg?add=..Transfer-Encoding: chunked..Date: Fri, 30 Jan 2015 06:28:54
 GMT..77..<html><body><p>Redirecting to <a href="
hXXp://ib.adnxs.com/seg?add=">hXXp://ib.adnxs.com/seg?add=</a>
;</p></body></html>..0..

GET /c.gif?anx_uid=3338670318734125865&Red3=MSAN_pd HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c.bing.com

DNT: 1

Connection: Keep-Alive

Cookie: SRCHD=MS=3187714&SM=1&D=3093912&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MUID=1785AC2FD94664211AC0A9A6DD466620


HTTP/1.1 302 Redirect

Cache-Control: private, no-cache, proxy-revalidate, no-store

Pragma: no-cache

Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Fri, 30-Jan-2015 10:28:49 GMT; path=/;

Set-Cookie: MUID=1785AC2FD94664211AC0A9A6DD466620; domain=.bing.com; expires=Sun, 29-Jan-2017 06:28:49 GMT; path=/;

Set-Cookie: MR=0; domain=c.bing.com; expires=Wed, 29-Jul-2015 06:28:49 GMT; path=/;

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 0
HTTP/1.1 302 Redirect..Cache-Control: private, no-cache, proxy-revalid
ate, no-store..Pragma: no-cache..Location: hXXp://ib.adnxs.com/pxj?bid
der=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620
|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")..Server: 
Microsoft-IIS/8.0..X-Powered-By: ASP.NET..P3P: CP="BUS CUR CONo FIN IV
Do ONL OUR PHY SAMo TELo"..Set-Cookie: ANONCHK=1; domain=c.bing.com; e
xpires=Fri, 30-Jan-2015 10:28:49 GMT; path=/;..Set-Cookie: MUID=1785AC
2FD94664211AC0A9A6DD466620; domain=.bing.com; expires=Sun, 29-Jan-2017
 06:28:49 GMT; path=/;..Set-Cookie: MR=0; domain=c.bing.com; expires=W
ed, 29-Jul-2015 06:28:49 GMT; path=/;..Date: Fri, 30 Jan 2015 06:28:49
 GMT..Content-Length: 0..

GET /UTN-USERFirst-Hardware.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 4376

Last-Modified: Fri, 30 Jan 2015 04:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt
 Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertr
ust.com1.0...U....UTN-USERFirst-Hardware..150130043254Z..150203043254Z
0...0!..^....t..30...{C...060927070327Z0"....}...G,..x6vcX& ..10011522
0539Z0!..V...1.pj.u...r<...100128214246Z0!..S..W.....,....v...10020
1155305Z0"....x....G0..X*.<.R..100209213528Z0".....}w.Z..H'r...&...
100301205223Z0".....`...*F......SS..100301222500Z0"....].>?'K...\..
>....100330175849Z0!..|.R..gge/...Kj....100405140057Z0".....'A.....
-eB?8.F..100407141829Z0"........hG.o..}A.....100505184113Z0".....l....
..^...b.'..100506202534Z0"......Mi.A...Q..-....100511230708Z0!..Zg...v
.:..\<?.....100525185217Z0"....Q....K........p..100526081011Z0!...}
....v..\...!.a..100528120357Z0".....m...3du>OP.mm7..100608151048Z0"
....9.........O..|O..100609180604Z0".....%.MD....J.z Q...100611122131Z
0!..<..........&......100629140452Z0!..w(...M.......Q5...1007141745
48Z0"....KG...#.OD.:U.....100723145923Z0"......)...p.u".......10072608
1911Z0"....r..X..Pr. .).....100805203159Z0!..:S1..:Uo.Z.....P..1008172
04713Z0!..8.....{..g........100820194555Z0!..U.\.i`............1008201
94711Z0!.._...z)....ym.   ..100825153759Z0!...M...OT.E......1..1009210
61635Z0!..j....O...,.|~.8...100922022250Z0!..o~..(..j_...c..E..1009271
73105Z0!...n(.&X.."...7$.S..101004174308Z0!....].......hM......1010181
42346Z0!..:....O..q..T......101019043227Z0".......=...R.6...q...101019
122714Z0!..I..l........Z.....101021135958Z0"[email protected]. ..1

<<< skipped >>>

GET /do/conversionTracking?conversionName=PlayerInstallationCompleted&format=fullHtml&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: player.freeridegames.com

Connection: Keep-Alive

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; __utmc=1; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:28 GMT

Server: Apache

Content-Length: 95

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
 ..........<html>.<head>.<title></title>.</
head>.<body>.....   .....</body>.</html>..HTTP/1.
1 200 OK..Date: Fri, 30 Jan 2015 06:26:28 GMT..Server: Apache..Content
-Length: 95..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"
..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Content-Type
: text/html;charset=ISO-8859-1.. ..........<html>.<head>.&
lt;title></title>.</head>.<body>.....   .....<
/body>.</html>......


POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallFinished&sdmVersion=01.51.00.51&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; __utmc=1; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:29 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 30 Jan 2015 06:26:29 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Conten
t-Type: text/html..

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRNDpBTXFXL4hq1AIFFLZkDOqgNdgQUuMoR6QYxedvDlMboGSq8uzUWMaQCEQCuH3DgeG4oxuqQCCTRf5D9 HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Thu, 29 Jan 2015 23:55:24 GMT

Expires: Mon, 02 Feb 2015 23:55:24 GMT

ETag: B116DBB1792D70115110AB40FDEBEE6A6AE1743D

Cache-Control: max-age=321393,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp9

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0...........1y......*..5.1...2015012
9235524Z0t0r0J0... ........M..S\U......E-..:..v.......1y......*..5.1..
....p.xn(....$........20150129235524Z....20150202235524Z0...*.H.......
......\.!.d.=.n..#..W&..y.'..#.oq..;.5........s....&./@...H.......Nr..
..x.....D..U.o....@`J.R...y. .YM.<.....N....J....].X...e.M.J\UGF...
.:.[.N......xc....p..T.....r..........,....,..oy6.{5P.Vb.;<.X.m..v.
......m..F.............,DjF>0.....;^HoF....H.,>.-s(.#."/(...

GET /do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599219446 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: player.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:37 GMT

Server: Apache

Set-Cookie: JSESSIONID=49C83FF2E975AF303626693D6FF75A1F; Path=/; HttpOnly

Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; Expires=Sat, 30-Jan-2016 06:26:37 GMT; Path=/

Content-Length: 243

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
updateClientCookies( [{name:'143_CAMPAIGN_SERIAL_ID',value:'Default-FR
G_Website',expire:'7776000'},{name:'143_TURNKEY',value:'Default-481422
599182472568',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Defau
lt-MSIE 7.0',expire:'7776000'}]);HTTP/1.1 200 OK..Date: Fri, 30 Jan 20
15 06:26:37 GMT..Server: Apache..Set-Cookie: JSESSIONID=49C83FF2E975AF
303626693D6FF75A1F; Path=/; HttpOnly..Set-Cookie: 143_CAMPAIGN_SERIAL_
ID=Default-FRG_Website; Expires=Sat, 30-Jan-2016 06:26:37 GMT; Path=/.
.Content-Length: 243..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI
 COM NAV"..Keep-Alive: timeout=3, max=800..Connection: Keep-Alive..Con
tent-Type: text/html;charset=ISO-8859-1..updateClientCookies( [{name:'
143_CAMPAIGN_SERIAL_ID',value:'Default-FRG_Website',expire:'7776000'},
{name:'143_TURNKEY',value:'Default-481422599182472568',expire:'7776000
'},{name:'143_FIRST_BROWSER',value:'Default-MSIE 7.0',expire:'7776000'
}]);....


GET /do/gateway?sId=FRG_Website&subId=&actid=&udom=partners.freeridegames.com HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: player.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: JSESSIONID=49C83FF2E975AF303626693D6FF75A1F; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; geoCountryCode=UA; gfad_300x250={"refreshCount":1,"sessionRefreshCount":0,"lastRefreshTime":1422599221435}


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:39 GMT

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Length: 38

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
({"gateway replay":"{'status':'ok'}"})HTTP/1.1 200 OK..Date: Fri, 30 J
an 2015 06:26:39 GMT..Server: Apache..P3P: CP="IDC CURa ADMa DEVa TAIa
 OUR BUS IND UNI COM NAV"..Content-Length: 38..Keep-Alive: timeout=3, 
max=799..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8
859-1..({"gateway replay":"{'status':'ok'}"})..

GET /js/plusone.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: apis.google.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: application/javascript; charset=utf-8

X-UA-Compatible: IE=edge, chrome=1

Timing-Allow-Origin: *

ETag: "2bc54eaaf030ad835785a8ae24245318"

Expires: Fri, 30 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Cache-Control: private, max-age=1800

Content-Encoding: gzip

Transfer-Encoding: chunked

Set-Cookie: NID=67=vOr3KMkRgKzKK96sxJpxyEczA3umKOcncI--3SgTGRoblhdA9puvOrwBffL0b0Jj_CIR-FG07pJNcRIPtOc-BQNOTfg9OdWidnppEWcEVE_ZiWA-bcBNJCiwTSNfkqdd;Domain=.google.com;Path=/;Expires=Sat, 01-Aug-2015 06:26:37 GMT;HttpOnly

P3P: CP="This is not a P3P policy! See hXXp://VVV.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info."

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-XSS-Protection: 1; mode=block

Server: GSE

Alternate-Protocol: 80:quic,p=0.02
3283.............}iw....w..[.&R(...t"Y.&v..N..;..U..%B`!Om.....JB`r...
}.:mjR..v..*.2...I.].i8..W.......}.O.4..<.ydZ. .O..R...H.<...u{.
....4..../o....8..\...._z...(...........{.e.F....l..Ea...Y..D$.0Z..-..
.KS......"K7...L"..o\..<CN&Q....$4....a....#.]G.!~"u......gd.$.Ad._
(..i .8..Pf...!=.y...(."..e..R.q....y....9zI.....1FJ.......M_....'I57.
.....!...|..`..(.$1.x........qN .o.|.!9...8.'....a...1% ...K.Gr..Ri1.)
...0..C....\[email protected]_...z.P.....!.x.V.].b.k...-...hC..............
W..G..H....U&X.s5h../.6.c...}Y..At [email protected].~..K|p1.%u..3~.c...Mr
.a|.e.r.... ...%..zu>.:/{....'d6....\...M.7.........,.g8/(.. .....c
.z......$.".a.M.....W.Z..o,W.\[email protected]?..h.......TV8.o...E.t..$..j....
...=.....F....6.<.V..t..bZoy.."I......l:I...f.Y1.[k@.{p...V.....THk
......h6w..C..8...;.....x_..u;.....v*k.........y.g6...c...m.hDC.^...h.
X.......Y|.y....z!.........=.g9.r.k.'..r...M.b.pO..!.`0F.Y.s.-/.......
.z^T....C.....#....3~....~.....>~O...;....=.P..&G.....e.\.>SnP..
P..b\..)...Sd...............U.}[email protected].=..D...\.{.hX
...n(..W.Q6.DY~...6s.u........ ..Z...<...m...jR..0....%.b7NV...2_/V
....w........v.*.<...../rt.$2q*.;.r.....aX...}6..A2.!n.ju..9..D...%
.........g?...c.u.nxf.G.....@w.._i.........h....K.....)....[ 9d.......
......s......lS.f..$.......)q.!..9......../8......N.....^.C.{N....=..G
[email protected]!....B....-...
.....y..H@.*..Z......@.*@....._@[email protected]*N........~.O......0.
...{>`.L.<....A.%|.i.........*./.KD:'.M.M....ag .F.v..Q.....<<< skipped >>>

GET /if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ams1.ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 9486557

Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 302
<!-- Bannercommunity Vermarktung (bannercommunity.de) -->..<s
cript type="text/javascript" src="hXXp://imagesrv.adition.com/js/aditi
on.js"></script><script type="text/javascript" src="http:/
/aa.adfarm1.adition.com/js?wp_id=2659948"></script>..<!-- 
// Bannercommunity Vermarktung (bannercommunity.de) -->..

GET /zone/kw470o566d2z?subid=&redirectClick=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=http%3A%2F%2Fadfarm1.adition.com%2Fredi*lid%3D6110017597666427860%2Fsid%3D65567%2Fkid%3D1221974%2Fbid%3D3994675%2Fc%3D3001%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%3D HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad.ad-srv.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: Apache

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 2197

Connection: close

Content-Type: text/html
............ko.8.......h$.."...ZQ.l........voQ..-.6.E.Q..7....C....&..
.Er.....%3.6.&.....e...'.c.o..a-...H.#..........I.H.....rp..ev..X!j...
..........N:.....(NX..>(V..g.....i...$.....* .4..5...b.......k.[.n.
......3j.I..k.$.....-.Z ..m...;.........v..0&.i.O.hsQ..1.-u.;......]..
^.p..N.....y..r...?...]....r..4.y.<....V..R......X]..'i ....~....6.
.......tKn(..1........S........w... p...X.%_.E..M/.._....H......%!.YJs
Y>8.GxA*K.rx...S9..GJ.$.e.J._q.x.RU.$.....?J9F`$xm\R.6v./.4.YJA<
.".k..1..G.pb....#..R...W.u.e...eC....X.k.l..6T...0........ei..cWR..$.
..f...;..[..P....`h&.86..I}.gk....7 ..i\......|...QF4l....6W.........i
pI7|.....o Z.#m.....{}...7...qp .=....k.`m ./DE{#.(d`.Y [email protected].....
a..U$k^..rb!g..Q[..Io..*......S.Y.w...(Kc..t...~...1..x'.)KyV:...$SV..
v'L...m.<?M........#;[.....".{%..B.....H..E2f.(./.0..?..}.),.FN....
(...<?;...-.BzF.`.....R..V..V.......I.....}.3.AY.;......EPo...v.G\.
]b..w...*=.".c.;O`......m..\wB....Z...........a.B..C`.P.. f.k.G.....i.
.[._.'...7(...|9%Qc.....Q...\......Bw8.P.d/r...jI....L^X;..E|.~F.5. ..
;...JR...>Z....y..$...~.9*........5(...#...........7 [email protected].. Y..d
..J.H2....|..W).......qB.7.......V.;....;!.....U.'..7......X...P 2r.Q_
... ..O.(......%[y..8}..........i....%..Y'.E#..(...zh.......V..\..~.C.
...Y.O.....QJ1.`........{[email protected].....].#......4....I..\..Cj...;Xo.
.V.K.........[8.8M.-..d..x...:.qx(.X....#P...3..-$..Q....i]i..D..'....
."..v4;......mbhfD5...{_V.1...j......s~..a......3..C..y2.....SF..Vk..~
......M.4^2....y. Q...,...ZB... .o.c...*......!WW`.9.*..uOS...4.1.<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=4186957&cr=58636&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /bk/8640634?t=1422599352825&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t4ft.de

DNT: 1

Connection: Keep-Alive

Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=


HTTP/1.1 200 OK

X-Powered-By: PHP/5.5.19-1~dotdeb.1

Set-Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=; expires=Sat, 30-Jan-2016 06:28:51 GMT; Max-Age=31536000; path=/; domain=.t4ft.de

Content-Length: 102

Content-Type: text/javascript

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Pragma: no-cache

Expires: Fri, 31 Dec 1999 23:00:00 GMT

P3P: policyref="hXXp://t4ft.de/p3p.xml", CP="NOI DSP PSAa PSDa IVAa IVDa OUR NOR UNI COM NAV INT CNT"

Connection: close

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws-0410
window.ftgs_8640634(1, "", {"aid":1211,"otp":"1211\/5101070\/8640138\/
8640196\/8640634","otfp":null});..

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=813e73699780 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130

x......

GET /imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?167021385 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: servedby.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Jetty(6.1.22)

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Content-Length: 0

Location: hXXp://cdn.flashtalking.com/xre/107/1078532/922460/image/922460.gif

Access-Control-Allow-Origin: *

Via: 1.1 ttn061011 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive

HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:53 GMT..Server: Jetty
(6.1.22)..P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo 
OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:
00:00 GMT..Content-Length: 0..Location: hXXp://cdn.flashtalking.com/xr
e/107/1078532/922460/image/922460.gif..Access-Control-Allow-Origin: *.
.Via: 1.1 ttn061011 (MII-APC/2.4)..Keep-Alive: timeout=2..Connection: 
Keep-Alive..

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=4&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597668393054

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 19
document.write('');..

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=64&wi=652539272&ac=2&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597667016798

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 19
document.write('');..

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 494

Last-Modified: Fri, 30 Jan 2015 05:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0.....0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U.
...AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..
150130053254Z..150203053254Z.00.0...U.#..0......z4.&...&T....$.T.0...U
........0...*[email protected]..*..: ..../.5....a]..-q...}.s4..Q...
.....X.m..3I!.....G4.;*[email protected].,R.B..F9..........
.T......L.^..kDPv."..QA.z0CNm..T...r...NO...'.R5!.o}..<q.....x.$Ol.
EL..d...xy.0..N...*...2.q..4&\.b=6u_..?.v...._.O}...&...8'..@.\.......
.q ......

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=455928, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 13:01:57 GMT

Expires: Wed, 4 Feb 2015 13:01:57 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015012
8130157Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150128130157Z....20150204130157Z0...*.H............
.t.L~...vz..h.22..lK.iK...'ec...FR.... ....!..q*......1E..5r*,...]M..|
'..`e.UJ..S.._.jnGy......tT~.f..8.N.g0.V....!3........E...]b..........
d..6.......z?.........Y....6........a%......T|...-]D.2[.......4.%.A.w.
...................2. Jsa.Jb.R,.f.....>J....6o.....0...0..}0..e....
....:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 30.."0...*.H.............0............
\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd....
.x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x.....
.........6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o
...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0.
.0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .....
..0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830..
.*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a.
..nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7..
.=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v...
..\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%...
.<<< skipped >>>

GET /Security.xml HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: __utmc=2252849; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0; __utma=2252849.2023569898.1422599221.1422599221.1422599221.1; __utmb=2252849.2.10.1422599221; __utmz=2252849.1422599221.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}


HTTP/1.1 200 OK

Server: Apache

Content-Length: 404

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/xml;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:28:46 GMT

Date: Fri, 30 Jan 2015 06:28:46 GMT

Connection: keep-alive
<wl:whitelist xmlns:wl="hXXp://VVV.exent.com/EXEtender/WhiteList"&g
t;...<wl:general>....<wl:urls>.....<wl:url>hXXp://pa
rtners.freeridegames.com</wl:url>....</wl:urls>...</wl:
general>...<Signature Value="UWyEE6aHdzxjS0-NmcpRe2Ya8OzGKCOjRoh
PMGEuR5equoDUJip2l.e6h4qBxgdBc0p6kKQEPeL98HS-eVi.Whk7NrC11fcoLJHfRWLyd
-6fg9dp6l6OIoAs1ybJTsHXw-TKFPIexWAakG5nlf022XIPbeSVpi2fbgN74OxxUHo*" I
D="Server"/></wl:whitelist>..HTTP/1.1 200 OK..Server: Apache.
.Content-Length: 404..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI
 COM NAV"..Content-Type: text/xml;charset=UTF-8..Cache-Control: max-ag
e=86400..Expires: Sat, 31 Jan 2015 06:28:46 GMT..Date: Fri, 30 Jan 201
5 06:28:46 GMT..Connection: keep-alive..<wl:whitelist xmlns:wl="htt
p://VVV.exent.com/EXEtender/WhiteList">...<wl:general>....<
;wl:urls>.....<wl:url>hXXp://partners.freeridegames.com</w
l:url>....</wl:urls>...</wl:general>...<Signature Va
lue="UWyEE6aHdzxjS0-NmcpRe2Ya8OzGKCOjRohPMGEuR5equoDUJip2l.e6h4qBxgdBc
0p6kKQEPeL98HS-eVi.Whk7NrC11fcoLJHfRWLyd-6fg9dp6l6OIoAs1ybJTsHXw-TKFPI
exWAakG5nlf022XIPbeSVpi2fbgN74OxxUHo*" ID="Server"/></wl:whiteli
st>......


GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: __utmc=2252849; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0; __utma=2252849.2023569898.1422599221.1422599221.1422599221.1; __utmb=2252849.2.10.1422599221; __utmz=2252849.1422599221.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}


HTTP/1.1 200 OK

Server: Apache

Content-Length: 3330

Content-Type: image/png;charset=UTF-8

X-Pad: avoid browser bug

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:28:46 GMT

Date: Fri, 30 Jan 2015 06:28:46 GMT

Connection: keep-alive
.PNG........IHDR...1...).............tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.di
d:4E25B844FBE211E19D22C37B1A58EBB1" xmpMM:InstanceID="xmp.iid:4E25B843
FBE211E19D22C37B1A58EBB1" xmp:CreatorTool="Adobe Photoshop CS5 Windows
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:18547691F077E111
8511BC5C7C940756" stRef:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754
F5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>?.u.....IDATx..Y]l\G.>g.......IJ.4)..J...
KS..P.!Q.......'$........Q.*H..Z.F.ETi..RZJ..B,...sl.....zw..{...s83.n
.(?..I.e...{=w.|s..3c$"._o....m..-.^...< wZ.....ZU..........`...I..
.@E...........".7.._#[email protected]...(.
...mKV...Tx.. .Xz......(.]yaB..*K.%......0G..e...jA#=?..8[rE......}r..
Z||n.T...ul...y....I....T.MA.Mq.....[.*.7.....D...k........\.;..LN~..?
4.Z.....n.M....xL.e.e....-.<..../0...F.... ...K......}....!.M..<<< skipped >>>

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=812ba9779386 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1053

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.F.~...<.8.1.`;Y<....6.%M.n..{r.0.$..a0I7...p16!.&
gt;..H.H.$...L*.O.v.Lg m....f...PB..8.....b..J..M...R.V.'...v7n.^)R.0.
[email protected].#N..uf4..l.,E....|U.....\.......6.*.."....Lg3k2..
qD.M..."T{..5*.0.8a#......0}...2..=.r.0.....r.>J..)f>...Cs..r...
.U.$...W...Zw=............u.. k.[.........g..:........./999B.......9..
...a.n.%k...5.2.!w...S%......O...|...?..|...........?...G. ..7.:N./,..
....wlN,{:.......?.....Mb.....9......H....F.N%.y...F.Cf...I#X{[email protected].
..v.. ../)s.....0...>$.y.U...S.|.b....U.2.r)Mj.p...a(Y..XH.&.Kj...v
....O.oN.......0k......g.C}I...{.x......[3.y.H...{.j.4.........*P.....
&`.KO..glv..........u..~.s.>HEH#...E......5.....%.<....$.E.v....
2.......0..%8_......c.U.#..LB...I#...(_F ce.....Z..(..#k.F...!..>..
R.....U)....:........Ni.V........~..Ai.?.q....h.;<JeMD........C.%..
.......x....Iy.tq.O...P.....Q.G..}.M.cxq..x2.A...Bo......!zQf}I=..$...
qt.....B.....t..Y..'qV6........l..`..UY.R..".d.B....q..G^..:(.....K...
'.:..\..)z.....=..Y].}l......<.9...CX..z.Y.....6....H.DW......._...
v.UT..bd...<.-?..PL..t...5.?vDA*......

GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif?meta=appNexus HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dps.bing.com

DNT: 1

Connection: Keep-Alive

Cookie: SRCHD=MS=3187714&SM=1&D=3093912&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MUID=1785AC2FD94664211AC0A9A6DD466620


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 42

Content-Type: image/gif

Expires: 10:28:45 PM

Server: Microsoft-IIS/8.5

TrackingId: 6158707e-fdfc-44be-bc83-16a0c5e18422

X-Powered-By: ASP.NET

X-MSEdge-Ref: Ref A: 7C525CAAD816425C90E64185BDD30225 Ref B: 2827D701097486F0EACC7A7065FCC3D5 Ref C: Thu Jan 29 22:28:50 2015 PST

Date: Fri, 30 Jan 2015 06:28:49 GMT

GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Contr
ol: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 10
:28:45 PM..Server: Microsoft-IIS/8.5..TrackingId: 6158707e-fdfc-44be-b
c83-16a0c5e18422..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: 7C525CAA
D816425C90E64185BDD30225 Ref B: 2827D701097486F0EACC7A7065FCC3D5 Ref C
: Thu Jan 29 22:28:50 2015 PST..Date: Fri, 30 Jan 2015 06:28:49 GMT..G
IF89a.............!.......,...........L.;..

GET /banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=8&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601959493726

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 5947
document.write('\x3Cdiv style="position:absolute;width:300px;height:0p
x">\x3Cdiv id="obaButton_6110017601959493726">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_300x250_grey {\n    width:300px;.\n    height:250px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0k
Ra2RNR3aG3NRNa a,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoff
er_0kRa2RNR3aG3NRNa h2,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey 
.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\n}\n.
paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa 
a {\n.display:block;\n.float:left;.\n.background:transparent url(http:
//imagesrv.adition.com/banners/270/files/00/00/b6/f2/000000046834.png)
 no-repeat top left;\n.padding:1px;\n.text-decoration:none !important;
\n.color:#000 !important;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250
_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3N
RNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer-block_0
kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:focus  {\n.ba
ckground-position:left bottom;\n}\n\n.paoffer-block_0kRa2RNR3aG3NRNa_3
00x250_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kR<<< skipped >>>

GET /js?wp_id=2554279&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 24377616

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:47 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1286
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2554279);}c
atch(e){prfstr=''}document.write('<iframe allowtransparency=\'true\
' scrolling=\'no\' frameborder=0 border=0 width=728 height=90 marginwi
dth=0 marginheight=0 name=\'Adition_Frame\' background-color=\'transpa
rent\' src=\'hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver
=' adjsver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' re
f '&os=' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_w
id '&ac=' (  ad_count) '&screen_res=' screen_res '&wpt=H&clickurl=http
://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid
=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0
/clickurl=\'></iframe>');..<<< skipped >>>

GET /js?wp_id=2813375&kid=1211553 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad3.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:53  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 15661310990003969446

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:52 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 959
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2813375);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad3.adfarm1.adition.com/banner?sid=2813375&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&kid=1211553&scre
en_res=' screen_res '&wpt=J&clickurl=\'></script>');..

GET /orbserv/hbpix?pixId=4138&pcv=33&tpu=3338670318734125865&ptid=9&tpuv=01&cckz=true HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: idpix.media6degrees.com

DNT: 1

Connection: Keep-Alive

Cookie: cckz=1niz8ob


HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

P3P: CP="COM NAV INT STA NID OUR IND NOI"

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: clid=2niz8ob01170st6099ce4pic000000010u010501101; Domain=media6degrees.com; Expires=Wed, 29-Jul-2015 06:28:59 GMT; Path=/

Set-Cookie: sglst=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: rdrlst=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: ipinfo=2niz8ob0zijysn0000u03k1acm7052555555HN7Xunexbi8VCPbzYgq00; Domain=media6degrees.com; Expires=Wed, 29-Jul-2015 06:28:59 GMT; Path=/

Set-Cookie: adh=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: acs=013020k0n1niz8obxzt10xzt10; Domain=media6degrees.com; Expires=Wed, 29-Jul-2015 06:28:59 GMT; Path=/

Set-Cookie: lbh=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: cckz=""; Domain=media6degrees.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Location: hXXp://ib.adnxs.com/setuid?entity=25&code=st6099ce4pic

Content-Length: 0

Date: Fri, 30 Jan 2015 06:28:58 GMT

Connection: close

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=-1&h5s=0&wi=652539272&ac=1&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597664657502

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 19
document.write('');..

GET /ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 0
....


GET /bounce?/ttj?id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=4197282237715168703; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 1063
!function(){function n(n){try{if(!window.location.ancestorOrigins)retu
rn;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r  )n.c
all(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}func
tion r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch
(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==
window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.docu
ment.referrer||null,location:n.location.href||null,isTop:n===window.to
p})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top}
)}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,
l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].refe
rrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l
==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c=
"&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="ht
tp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5
ZFPG0.' c '&id=1430847&referrer=freeridegames.com&ext_inv_code=TribalF
usion"></scr' 'ipt>')}();....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=4197282237715168703; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 14996232

Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 287
document.write('<iframe src=\"hXXp://cdn.castplatform.com/scripts/a
u1107.html\" FRAMEBORDER=\"0\" MARGINWIDTH=\"0\" MARGINHEIGHT=\"0\" SC
ROLLING=\"NO\" WIDTH=\"300\" HEIGHT=\"250\" ></iframe>');docu
ment.write('<scr'   'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersy
nc.js"></scr' 'ipt>');HTTP/1.1 200 OK..Cache-Control: no-stor
e, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:0
0:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP
="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PR
E"..X-XSS-Protection: 0..Set-Cookie: uuid2=4197282237715168703; path=/
; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..
Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; dom
ain=.adnxs.com; HttpOnly..Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUQ
oMmspgUYAA..; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.a
dnxs.com; HttpOnly..X-Creative-ID: 14996232..Set-Cookie: anj=dTM7k!M4.
NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 3
0-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..Content-Type: ap
plication/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:48 G
MT..Content-Length: 287..document.write('<iframe src=\"hXXp://cdn.c
astplatform.com/scripts/au1107.html\" FRAMEBORDER=\"0\" MARGINWIDTH=\"
0\" MARGINHEIGHT=\"0\" SCROLLING=\"NO\" WIDTH=\"300\" HEIGHT=\"250\" &
gt;</iframe>');document.write('<scr'   'ipt src="hXXp://cdn.a
dnxs.com/ANX_async_usersync.js"></scr' 'ipt>');...
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.FDYRWSDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/SHKDc^PfPZpsQhBj).8'y!!@8vS[`i/


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.CwKyvPkDi2)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?W KdC; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 158
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=ap
pnexus1&google_sc&google_hm=MzMzODY3MDMxODczNDEyNTg2NQ==", "c":9, 
"tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, 
private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P
: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR
 ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Pro
tection: 0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu
, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: s
ess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.co
m; HttpOnly..Set-Cookie: anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.CwKyvPkD
i2)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?W KdC
; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; Ht
tpOnly..Content-Type: application/javascript; charset=utf-8..Date: Fri
, 30 Jan 2015 06:28:49 GMT..Content-Length: 158..ANX_async_load({"url"
:"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&goo
gle_hm=MzMzODY3MDMxODczNDEyNTg2NQ==", "c":9, "tagtype":"img"});ont>....<<< skipped >>>

GET /pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.CwKyvPkDi2)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?W KdC

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.PLv]@UwMNC)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?WA>qU; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:49 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.PLv]@UwMNC)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?WA>qU


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.gDunaTDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw<Bh>bvRiM4DQLfHq#H':[4NRk4^POYh1**c*_Y[.rtq; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 150
ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86af
cfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":6, "tagtype
":"img"});....


GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.gDunaTDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw<Bh>bvRiM4DQLfHq#H':[4NRk4^POYh1**c*_Y[.rtq


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41$CxrEQDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw7v>oKgP/DrPb.EK<-KPeofC<R1P9OO>fg:Q3_QnJ!7 !!% A4x_1'; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 145
ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=/
/ib.adnxs.com/mapuid?member=364&user=[MOOKIE]", "c":8, "tagtype":"im
g"});....


GET /ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M41$CxrEQDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw7v>oKgP/DrPb.EK<-KPeofC<R1P9OO>fg:Q3_QnJ!7 !!% A4x_1'

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 0
....


GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M41$CxrEQDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw7v>oKgP/DrPb.EK<-KPeofC<R1P9OO>fg:Q3_QnJ!7 !!% A4x_1'


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Prov
ider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif
?meta=appNexus", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Contr
ol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 No
v 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p
3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV
 DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125
865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com;
 HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:
49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*eTF>
 e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>
;K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<; path=/; ex
pires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly..Cont
ent-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan 201
5 06:28:49 GMT..Content-Length: 182..ANX_async_load({"url":"hXXp://dps
.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52A
C15EB7D4/User/3338670318734125865/gif?meta=appNexus", "c":5, "tagtype"
:"img"});....
<<< skipped >>>

GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4N/xEe59::j$P)Zu/w2MKsQ4uVNN/t]SL>( D; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.plat
formID=AN&src.visitorID=3338670318734125865", "c":4, "tagtype":"img"})
;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: 
no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http
://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OU
Ro SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-C
ookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:
28:50 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; ex
pires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Set-
Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)5
0[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4N/xEe59
::j$P)Zu/w2MKsQ4uVNN/t]SL>( D; path=/; expires=Thu, 30-Apr-2015 06:
28:50 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/java
script; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..Content-Le
ngth: 141..ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sy
nc?src.platformID=AN&src.visitorID=3338670318734125865", "c":4, "tagty
pe":"img"});....
<<< skipped >>>

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/bdWIy(e6AqeU2k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nYqJi!T:oRXyhPj/WWIyJLfW#ze'?uVl!*0Y3%QF'8-LtlBN0C@Xc([2X$-7M=RCup_x`Mg89pk!$:(B>G8a)bro3 jBkpjyCW.Q`x[V<9uh


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M416epbG-e6AqeU2k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5^()<YQK02H(V#f(*JoK51j?mh5p'lM#`xo'$bjcmJJy3#Fa*Y=>saUG344H^ta?sTqJCY1:EGQ*$H6!^!-ka:G(j89; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 177
ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=b
z0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338670318
734125865", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: n
o-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 200
8 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xm
l", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM 
STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; 
path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; Http
Only..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GM
T; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M416epbG-e6AqeU2
k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh
5^()<YQK02H(V#f(*JoK51j?mh5p'lM#`xo'$bjcmJJy3#Fa*Y=>saUG344H^ta?
sTqJCY1:EGQ*$H6!^!-ka:G(j89; path=/; expires=Thu, 30-Apr-2015 06:28:50
 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascrip
t; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..Content-Length:
 177..ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?v
code=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338
670318734125865", "c":3, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40uCy@^UDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$R[?:Eh_6Pg-pR%Tg_ *(?xr gopqeR'hVvSTHGi5(3o3Yzjyf:HFP='pmP_--61?dm`'zpGapuKimcFH9AC'0$*bbQME^F *


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/zDYwpWDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s Zq!)VjNzA7(a84V1fl)I7DIe09]C^6.kRN`9k O$VoNs>h%AMI/)'3_([3pK-7M=RCup_x`Mg7_Q_(/L=9yOR%`$dTRQAl[OsH`E!@@n(GozIg; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=ap
pnexus&google_cm&google_sc&uid=3338670318734125865", "c":2, "tagtype":
"img"});....


GET /setuid?entity=101&uid=3338670318734125865&code=CAESEOtIY_p5x_ubAlShQqSV770&google_cver=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/zDYwpWDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s Zq!)VjNzA7(a84V1fl)I7DIe09]C^6.kRN`9k O$VoNs>h%AMI/)'3_([3pK-7M=RCup_x`Mg7_Q_(/L=9yOR%`$dTRQAl[OsH`E!@@n(GozIg

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/zDYwpWDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s Zq!)VjNzA7(a84V1fl)I7DIe09]C^6.kRN`9k O$VoNs>h%AMI/)'3_([3pK-7M=RCup_x`Mg7_Q_(/L=9yOR%`$dTRQAl[OsH`E!@@n(GozIg; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:50 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/zDYwpWDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s Zq!)VjNzA7(a84V1fl)I7DIe09]C^6.kRN`9k O$VoNs>h%AMI/)'3_([3pK-7M=RCup_x`Mg7_Q_(/L=9yOR%`$dTRQAl[OsH`E!@@n(GozIg


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40eD>[gVDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/Y80@ZS`Hx0>T_Y49tMfoNxz?y/#4Q6Nl*te#_cLub#x4P4n B0:QTd)6P=@r:QpD#udz^x).8'y!!@6X1[bm:; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 123
ANX_async_load({"url":"hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_
exuid=3338670318734125865", "c":1, "tagtype":"img"});....


GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40eD>[gVDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/Y80@ZS`Hx0>T_Y49tMfoNxz?y/#4Q6Nl*te#_cLub#x4P4n B0:QTd)6P=@r:QpD#udz^x).8'y!!@6X1[bm:


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DDv<yXDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lgQ.*9LhVvSTHGi5(IO?9d]`yKliAh-ebzBj>Vntg:X'nLv-Bf7$FUVdFCpCbK!=w6e^U.^); path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 169
ANX_async_load({"url":"hXXp://dis.criteo.com/dis/usersync.aspx?r=7&p=1
9&cp=apx&eid=3338670318734125865&url=hXXp://ib.adnxs.com/seg?add=67361
4", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store,
 no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:
00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="
NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; path=/; 
expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Se
t-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domai
n=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40DDv<yXDgEREg(Pm?gv
nX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4i
yG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lgQ.*9LhVvSTHGi5(I
O?9d]`yKliAh-ebzBj>Vntg:X'nLv-Bf7$FUVdFCpCbK!=w6e^U.^); path=/; exp
ires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Conte
nt-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan 2015
 06:28:51 GMT..Content-Length: 169..ANX_async_load({"url":"hXXp://dis.
criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3338670318734125865&u
rl=hXXp://ib.adnxs.com/seg?add=673614", "c":4, "tagtype":"img"});t>....<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DDv<yXDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lgQ.*9LhVvSTHGi5(IO?9d]`yKliAh-ebzBj>Vntg:X'nLv-Bf7$FUVdFCpCbK!=w6e^U.^)


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.FCy@^UDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A1ayPjNzA7(Wd.tOM4dW[al3hTyg ?RnH4g/7C!qYX'Hl>e%1t(90tT9k O$VoNs>J_rBF(a83B$kZPP-7M=RCup_x`Mg7_QN`vg=9yOR%`$dTRQAl[OsH`E!@Al*NdG *; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 128
ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexu
s&eid=5&id=3338670318734125865", "c":0, "tagtype":"img"});HTTP/1.1 200
 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Exp
ires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.
com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo 
OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=
3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; do
main=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31
-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=d
TM7k!M4.FCy@^UDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVI
uK((VePyRW1PlGm@/s A1ayPjNzA7(Wd.tOM4dW[al3hTyg ?RnH4g/7C!qYX'Hl>e%
1t(90tT9k O$VoNs>J_rBF(a83B$kZPP-7M=RCup_x`Mg7_QN`vg=9yOR%`$dTRQAl[
OsH`E!@Al*NdG *; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain
=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=u
tf-8..Date: Fri, 30 Jan 2015 06:28:51 GMT..Content-Length: 128..ANX_as
ync_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexus&eid=
5&id=3338670318734125865", "c":0, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.gEVt4ZDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A1ayPjNzA7(Wd.tOM4dW[al3hTyg ?RnH4g/7C!qYX'Hl>e%1t(90tT9k O$)/MG@q1Vz!$Z/I6/#4Q6Nl*rk%_erC_'-K-.D5$qTE[*O[PG9j*-jcvNkMJ3HTMWcBq=WYiB@V39'Ey=LWY`S


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 0
....


GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.gEVt4ZDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A1ayPjNzA7(Wd.tOM4dW[al3hTyg ?RnH4g/7C!qYX'Hl>e%1t(90tT9k O$)/MG@q1Vz!$Z/I6/#4Q6Nl*rk%_erC_'-K-.D5$qTE[*O[PG9j*-jcvNkMJ3HTMWcBq=WYiB@V39'Ey=LWY`S


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/QF7TG]DgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaB[VG#E5J3grZSnV!bO@6VZMs7GC ]5_>h7oXL %6nALNI?G]c6K[8z@)(@VsBQKW`HfVWI5!d-qZ#CGCtb#x6#GAcl?R%xHlIa0MhRDwd$sQhAu0Ti3w!@wRRKJ*w(; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 117
ANX_async_load({"url":"hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=
3338670318734125865", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-
Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 
15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/pol
icy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS CO
M NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=33386703187
34125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs
.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 0
6:28:51 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/QF7
TG]DgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1
PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaB[VG#E5J3grZSnV!bO@6VZMs7GC ]5_>h7o
XL %6nALNI?G]c6K[8z@)(@VsBQKW`HfVWI5!d-qZ#CGCtb#x6#GAcl?R%xHlIa0MhRDwd
$sQhAu0Ti3w!@wRRKJ*w(; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; 
domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; cha
rset=utf-8..Date: Fri, 30 Jan 2015 06:28:51 GMT..Content-Length: 117..
ANX_async_load({"url":"hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=
3338670318734125865", "c":3, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/QF7TG]DgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaB[VG#E5J3grZSnV!bO@6VZMs7GC ]5_>h7oXL %6nALNI?G]c6K[8z@)(@VsBQKW`HfVWI5!d-qZ#CGCtb#x6#GAcl?R%xHlIa0MhRDwd$sQhAu0Ti3w!@wRRKJ*w(


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*fnQ=8e6AqeU2k_YVvO89'^:30Do#`$8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?OsNf5Uuf T)yn*c*_Y*:Pl.; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 113
ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3338
670318734125865", "c":2, "tagtype":"img"});....


GET /pxj?bidder=18&seg=378601&action=setuids('1048283183601109189','');&redir= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*fnQ=8e6AqeU2k_YVvO89'^:30Do#`$8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?OsNf5Uuf T)yn*c*_Y*:Pl.


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*fnQ=8e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?OsNf5Uuf T)yn*c*_Y.<ZUI; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:52 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*fnQ=8e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?OsNf5Uuf T)yn*c*_Y.<ZUI


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/Ah/ib=e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ.m%8QTg4@eR%_atF[ `mS#Ls-80p2:@o)WCROHKDc^Pt.v@iXd^^P)w$Uq. i.j<g#?QJNx2'P v@!?(AO?C0`x; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Length: 122
ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3338670
318734125865&na_pid=2684", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..C
ache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: 
Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3
c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo B
US COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333867
0318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.
adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2
015 06:28:52 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M
4/Ah/ib=e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r
)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>
r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ.m%8QTg4@eR%_atF[ `mS#Ls-80p2:@o)WCROH
KDc^Pt.v@iXd^^P)w$Uq. i.j<g#?QJNx2'P v@!?(AO?C0`x; path=/; expires=
Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly..Content-Ty
pe: application/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:2
8:52 GMT..Content-Length: 122..ANX_async_load({"url":"hXXp://e.nexac.c
om/e/xrefid.xgi?na_exid=3338670318734125865&na_pid=2684", "c":1, "tagt
ype":"img"});....
<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*fnQ=8e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1=mnkG2QwW^'xAW['VK8h6tq<M44@LzVbbCzQpH=C2odxH24@oXUU]B@).8]W%pm]55@g?nVb=PeHd`y)3%*?sp?OsNf5Uuf T)yn*c*_Y.<ZUI


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/Ah/ib=e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ.m%8QTg4@eR%_atF[ `mS#Ls-80p2:@o)WCROHKDc^Pt.v@iXd^^P)w$Uq. i.j<g#?QJNx2'P v@!?(AO?C0`x; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Length: 122
ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3338670
318734125865&na_pid=2684", "c":0, "tagtype":"img"});....


GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/Ah/ib=e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ.m%8QTg4@eR%_atF[ `mS#Ls-80p2:@o)WCROHKDc^Pt.v@iXd^^P)w$Uq. i.j<g#?QJNx2'P v@!?(AO?C0`x


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:52 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:2
8:52 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Sat, 31-Jan-2015 06:28:52 GMT; domain=.adnxs.com; HttpOnly..Conte
nt-Type: text/html; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:52 GMT
..Content-Length: 0......


GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/Ah/ib=e6AqeU2k_YVvO89Rj)e])0P5*8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ.m%8QTg4@eR%_atF[ `mS#Ls-80p2:@o)WCROHKDc^Pt.v@iXd^^P)w$Uq. i.j<g#?QJNx2'P v@!?(AO?C0`x


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40mgO1O:e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oPD 6#xbW>AaI_kY 8R*_ %TDapuKimcFH9AC'0$*b`uA]Qy8C; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Length: 106
ANX_async_load({"url":"hXXp://cm.adgrx.com/bridge?AG_SETCOOKIE&AG_PID=
appnexus", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no
-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008
 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml
", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM S
TA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; p
ath=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpO
nly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:53 GMT
; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40mgO1O:e6AqeU2k
_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqo
K[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg
3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oPD 6#xbW>
;AaI_kY 8R*_ %TDapuKimcFH9AC'0$*b`uA]Qy8C; path=/; expires=Thu, 30-Apr
-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly..Content-Type: applica
tion/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:53 GMT..C
ontent-Length: 106..ANX_async_load({"url":"hXXp://cm.adgrx.com/bridge?
AG_SETCOOKIE&AG_PID=appnexus", "c":9, "tagtype":"img"});....
<<< skipped >>>

GET /setuid?entity=94&code=42a09b72-a849-11e4-a60c-78e7d1f6c9c0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40mgO1O:e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oPD 6#xbW>AaI_kY 8R*_ %TDapuKimcFH9AC'0$*b`uA]Qy8C

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40mgO1O:e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oPD 6#xbW>AaI_kY 8R*_ %TDapuKimcFH9AC'0$*b`uA]Qy8C; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:53 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40mgO1O:e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oPD 6#xbW>AaI_kY 8R*_ %TDapuKimcFH9AC'0$*b`uA]Qy8C


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40Lcw]A/e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oPD 6#xbW>AaI_kY 8R*_ %TDb%ULN>]JjZ3 j@ugHGv-9'Ey=kPeLa; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Length: 116
ANX_async_load({"url":"hXXp://d.agkn.com/pixel/2605/?che=022311&puid=3
338670318734125865", "c":8, "tagtype":"img"});HTTP/1.1 200 OK..Cache-C
ontrol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 1
5 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/poli
cy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM
 NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333867031873
4125865; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.
com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06
:28:53 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40Lcw]
A/e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6Cb
VjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#
vB8jo@@Epg3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oP
D 6#xbW>AaI_kY 8R*_ %TDb%ULN>]JjZ3 j@ugHGv-9'Ey=kPeLa; path=/; e
xpires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly..Con
tent-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan 20
15 06:28:53 GMT..Content-Length: 116..ANX_async_load({"url":"hXXp://d.
agkn.com/pixel/2605/?che=022311&puid=3338670318734125865", "c":8, "tag
type":"img"});....
<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40Lcw]A/e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@`?q1qfH4`]j=OerzL%@D1>!NLd>r%hZ?#vB8jo@@Epg3Z1gtx$KX.91EQ?8[VOw2^(NqJVm=g[K]/3vq19zJT*9Pm_4f1!dQ*kC80oPD 6#xbW>AaI_kY 8R*_ %TDb%ULN>]JjZ3 j@ugHGv-9'Ey=kPeLa


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/be8tf3e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@p$>1^f>21!G5jRj)Ylwa<Pwi6Kg'TRVlp>U/M#X$:E`@2DVVMf3Xp^))h4zN( gtHARD9Zm)/MG@Q2<Zd#?U6-(P :-8sUd($biV@_'-K-FP1^dTE[*O[PG9j*-jcvNkMJ3HTMY/v!aHq[<qqY)]S@66$Hh<!!Z2nb Zl5; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Length: 112
ANX_async_load({"url":"hXXp://dpm.demdex.net/ibs:dpid=358&dpuuid=33386
70318734125865", "c":7, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Contr
ol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 No
v 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p
3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV
 DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125
865; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com;
 HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:
53 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/be8tf3e6
AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbC
eh5wqoK[[bBQK/) htap*Vt._/@p$>1^f>21!G5jRj)Ylwa<Pwi6Kg'TRVlp&
gt;U/M#X$:E`@2DVVMf3Xp^))h4zN( gtHARD9Zm)/MG@Q2<Zd#?U6-(P :-8sUd($b
iV@_'-K-FP1^dTE[*O[PG9j*-jcvNkMJ3HTMY/v!aHq[<qqY)]S@66$Hh<!!Z2nb
 Zl5; path=/; expires=Thu, 30-Apr-2015 06:28:53 GMT; domain=.adnxs.com
; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date:
 Fri, 30 Jan 2015 06:28:53 GMT..Content-Length: 112..ANX_async_load({"
url":"hXXp://dpm.demdex.net/ibs:dpid=358&dpuuid=3338670318734125865", 
"c":7, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/be8tf3e6AqeU2k_YVvO89Rj)e]?bsym8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@p$>1^f>21!G5jRj)Ylwa<Pwi6Kg'TRVlp>U/M#X$:E`@2DVVMf3Xp^))h4zN( gtHARD9Zm)/MG@Q2<Zd#?U6-(P :-8sUd($biV@_'-K-FP1^dTE[*O[PG9j*-jcvNkMJ3HTMY/v!aHq[<qqY)]S@66$Hh<!!Z2nb Zl5


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M416g2mF9e6AqeU2k_YVvO89Rj)e]4IbWL8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@p$>1^f>21!G5jRj)Ylwa<Pwi6Kg'TRVlp>U/M#X$:E`@2DVVMf3Xp^))h4zN( gtHARD9Zm)/MG@Q2<Zd#?U6-(P :-8sUd($biV@_'-K-FP1^dTE[*O[PG9j*-jcvNkMJ3HTMY/v!aHq[<qqYJP3SQFSzivGEEMCcz62Nd)%Qs!2Yhu)ea79; path=/; expires=Thu, 30-Apr-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:54 GMT

Content-Length: 155
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=ac
cordant_dmp&google_cm&google_ck=1&APN=3338670318734125865", "c":6, "ta
gtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, pri
vate..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: p
olicyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR AD
M PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protec
tion: 0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 3
0-Apr-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess
=1; path=/; expires=Sat, 31-Jan-2015 06:28:54 GMT; domain=.adnxs.com; 
HttpOnly..Set-Cookie: anj=dTM7k!M416g2mF9e6AqeU2k_YVvO89Rj)e]4IbWL8yhe
@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@
p$>1^f>21!G5jRj)Ylwa<Pwi6Kg'TRVlp>U/M#X$:E`@2DVVMf3Xp^))h4
zN( gtHARD9Zm)/MG@Q2<Zd#?U6-(P :-8sUd($biV@_'-K-FP1^dTE[*O[PG9j*-jc
vNkMJ3HTMY/v!aHq[<qqYJP3SQFSzivGEEMCcz62Nd)%Qs!2Yhu)ea79; path=/; e
xpires=Thu, 30-Apr-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly..Con
tent-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan 20
15 06:28:54 GMT..Content-Length: 155..ANX_async_load({"url":"hXXp://cm
.g.doubleclick.net/pixel?google_nid=accordant_dmp&google_cm&google_ck=
1&APN=3338670318734125865", "c":6, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M416g2mF9e6AqeU2k_YVvO89Rj)e]4IbWL8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htap*Vt._/@p$>1^f>21!G5jRj)Ylwa<Pwi6Kg'TRVlp>U/M#X$:E`@2DVVMf3Xp^))h4zN( gtHARD9Zm)/MG@Q2<Zd#?U6-(P :-8sUd($biV@_'-K-FP1^dTE[*O[PG9j*-jcvNkMJ3HTMY/v!aHq[<qqYJP3SQFSzivGEEMCcz62Nd)%Qs!2Yhu)ea79


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/IF7B:ZDgEREg(Pm?gvnX.f%CLA 'eidXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#v`oOuA9wTx^pv/DAd_e(ita?sTlDA/1apuKimws`WBP>Pv@Vu]g>pCLBOsH`E!@GMxf_tm.; path=/; expires=Thu, 30-Apr-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:54 GMT

Content-Length: 130
ANX_async_load({"url":"hXXp://d.p-td.com/r/dt/id/L21rdC80L21waWQvMjMwN
jY2NTM/mpuid/3338670318734125865", "c":5, "tagtype":"img"});HTTP/1.1 2
00 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..E
xpires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnx
s.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNR
o OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid
2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:54 GMT; 
domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 
31-Jan-2015 06:28:54 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj
=dTM7k!M4/IF7B:ZDgEREg(Pm?gvnX.f%CLA 'eidXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkf
VIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>
H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?
nQqqso^ej$H!s1Je.J*/1uQYD#v`oOuA9wTx^pv/DAd_e(ita?sTlDA/1apuKimws`WBP&
gt;Pv@Vu]g>pCLBOsH`E!@GMxf_tm.; path=/; expires=Thu, 30-Apr-2015 06
:28:54 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/jav
ascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:54 GMT..Content-L
ength: 130..ANX_async_load({"url":"hXXp://d.p-td.com/r/dt/id/L21rdC80L
21waWQvMjMwNjY2NTM/mpuid/3338670318734125865", "c":5, "tagtype":"img"}
);....
<<< skipped >>>

GET /seg?add= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/IF7B:ZDgEREg(Pm?gvnX.f%CLA 'eidXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#v`oOuA9wTx^pv/DAd_e(ita?sTlDA/1apuKimws`WBP>Pv@Vu]g>pCLBOsH`E!@GMxf_tm.


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/IF7B:ZDgEREg(Pm?gvnX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#v`oOuA9wTx^pv/DAd_e(ita?sTlDA/1apuKimws`WBP>Pv@Vu]g>pCLBOsH`E!@Grxf`U:4; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:55 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/IF7B:ZDgEREg(Pm?gvnX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#v`oOuA9wTx^pv/DAd_e(ita?sTlDA/1apuKimws`WBP>Pv@Vu]g>pCLBOsH`E!@Grxf`U:4


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/zDYedUDgEREg(Pm?gvnX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#vHB0ibY9r7MIKRz6:Tu.5UNSw3`E?yHb%ULN>]JjZ3 jA!G^fWG0I-w4..]g0>.VDs!]t)MduM3A; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Length: 186
ANX_async_load({"url":"hXXp://ib.adnxs.com/getuid?hXXps://p.adsymptoti
c.com/d/px?_pid=11272&_psign=cc9e6108df5584f8b2442f78e2d3c78d&_puuid=3
338670318734125865", "c":4, "tagtype":"img"});....


GET /getuid?hXXps://p.adsymptotic.com/d/px?_pid=11272&_psign=cc9e6108df5584f8b2442f78e2d3c78d&_puuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/zDYedUDgEREg(Pm?gvnX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#vHB0ibY9r7MIKRz6:Tu.5UNSw3`E?yHb%ULN>]JjZ3 jA!G^fWG0I-w4..]g0>.VDs!]t)MduM3A


HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly

Location: hXXps://p.adsymptotic.com/d/px?_pid=11272&_psign=cc9e6108df5584f8b2442f78e2d3c78d&_puuid=3338670318734125865

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma
: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="ht
tp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo 
OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set
-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 0
6:28:55 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; 
expires=Sat, 31-Jan-2015 06:28:55 GMT; domain=.adnxs.com; HttpOnly..Lo
cation: hXXps://p.adsymptotic.com/d/px?_pid=11272&_psign=cc9e6108df558
4f8b2442f78e2d3c78d&_puuid=3338670318734125865..Content-Type: text/htm
l; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:55 GMT..Content-Length:
 0......


GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40eEVb'XDgEREg(Pm?gvnX.Zf1(w6Aw4-XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxz['SBn[PWNyJBalEy!:5.C5^r?nQqqso^ej$H!s1Je.J*/1uQYD#v$>EsN9sv<uY`CtTJN5u(HH:kU52HK1JF*y`HTMY/v!aHq[<qqYJP3SQFSzivGEEMCcz62Nd)%Qs!1p'#?C0`x


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DF7B:ZDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL8==?f?km.p)Ym$v*<V`bGrsL2)r]x:/)'3_(TDnhIpJI?N1bg99(q(5uJwB2/ksEZrpm[(]`yKliIN(jtK8%@/xEegOr'nlNmKTrsQj%cqTCnd8zpBo$_T5RDh>b.CnY4ifpx='; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 155
ANX_async_load({"url":"hXXp://an.pxl.ace.advertising.com/cfcm.ashx?pro
viderId=1006&appnexus_uid=3338670318734125865&$extMatch=1", "c":3, "ta
gtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, pri
vate..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: p
olicyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR AD
M PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protec
tion: 0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 3
0-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess
=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; 
HttpOnly..Set-Cookie: anj=dTM7k!M40DF7B:ZDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F
1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYa
J!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv
 KSXGsL8==?f?km.p)Ym$v*<V`bGrsL2)r]x:/)'3_(TDnhIpJI?N1bg99(q(5uJwB2
/ksEZrpm[(]`yKliIN(jtK8%@/xEegOr'nlNmKTrsQj%cqTCnd8zpBo$_T5RDh>b.Cn
Y4ifpx='; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs
.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..D
ate: Fri, 30 Jan 2015 06:28:56 GMT..Content-Length: 155..ANX_async_loa
d({"url":"hXXp://an.pxl.ace.advertising.com/cfcm.ashx?providerId=1006&
appnexus_uid=3338670318734125865&$extMatch=1", "c":3, "tagtype":"img"}
);....
<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.FDYedUDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL8==?f?km.p)Ym$v*<V`bGrsL2)r]x:/)'3_(TDnhIpJI?N1bg99(q(5uJwB2/kr:_r=y.4`]7v#Oq3Zwd5 d%]NRHU@E!MKRDvXzda:0hRk4`#h!'XPTrSMoo`^xJO.jYyO gzVtu.bs


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/0D>IZTDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj5p%r55ps`O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR]k=b!`GD_mpWc>2rJP#gxh:Qn[spqwF%s`#T@9@GVop?OtzR]sv7OkYoh:U8/ANq]7x[l7e]%7O_a-#5q[!04XyA=(A%; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 135
ANX_async_load({"url":"hXXp://pixel.tapad.com/idsync/appnexus/receivet
henpush?adnxs_uid=3338670318734125865", "c":2, "tagtype":"img"});HTTP/
1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cac
he..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn
.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAM
o UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie:
 uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 
GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=
Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie
: anj=dTM7k!M4/0D>IZTDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(
0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%R
HRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj
5p%r55ps`O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR]k=b!`GD_mpWc>2rJP#
gxh:Qn[spqwF%s`#T@9@GVop?OtzR]sv7OkYoh:U8/ANq]7x[l7e]%7O_a-#5q[!04XyA=
(A%; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com;
 HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: 
Fri, 30 Jan 2015 06:28:56 GMT..Content-Length: 135..ANX_async_load({"u
rl":"hXXp://pixel.tapad.com/idsync/appnexus/receivethenpush?adnxs_uid=
3338670318734125865", "c":2, "tagtype":"img"});....
<<< skipped >>>

GET /setuid?entity=45&code=44b72611-a849-11e4-a895-005056a2376a HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>IZTDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj5p%r55ps`O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR]k=b!`GD_mpWc>2rJP#gxh:Qn[spqwF%s`#T@9@GVop?OtzR]sv7OkYoh:U8/ANq]7x[l7e]%7O_a-#5q[!04XyA=(A%


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/0D>IZTDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj5p%r55ps`O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR]k=b!`GD_mpWc>2rJP#gxh:Qn[spqwF%s`#T@9@GVop?OtzR]sv7OkYoh:U8/ANq]7x[l7e]%7O_a-#5q[!04XyA=(A%; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:56 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>IZTDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj5p%r55ps`O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR]k=b!`GD_mpWc>2rJP#gxh:Qn[spqwF%s`#T@9@GVop?OtzR]sv7OkYoh:U8/ANq]7x[l7e]%7O_a-#5q[!04XyA=(A%


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.gF7B:ZDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj5p%r55ps`O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR_H-Wzh1JGA^a:QReH6ZP0PR'[Z)rpm[(]`yKli?8BatK8%@/xEegOr'nlNmKTrsQj%cqTCnd8zpBo$_T5RDh>b.CnY4jf:^q%; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 129
ANX_async_load({"url":"hXXp://c1.adform.net/serving/cookie/match/?part
y=3&id=3338670318734125865&mt=1", "c":1, "tagtype":"img"});HTTP/1.1 20
0 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Ex
pires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs
.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo
 OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2
=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; d
omain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 3
1-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=
dTM7k!M4.gF7B:ZDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfV
IuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H
[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj5p%r55ps`
O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR_H-Wzh1JGA^a:QReH6ZP0PR'[Z)rpm[
(]`yKli?8BatK8%@/xEegOr'nlNmKTrsQj%cqTCnd8zpBo$_T5RDh>b.CnY4jf:^q%;
 path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; Htt
pOnly..Content-Type: application/javascript; charset=utf-8..Date: Fri,
 30 Jan 2015 06:28:56 GMT..Content-Length: 129..ANX_async_load({"url":
"hXXp://c1.adform.net/serving/cookie/match/?party=3&id=333867031873412
5865&mt=1", "c":1, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4.gF7B:ZDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC 9px(AYaJ!yt<pZq!*bW%RHRiT>H[:0-37EQh:iHJ0hUc0U([_@:U3h-oT*FLnCYq=bZ9Nxv KSXGsL*]7c%j.Qxj5p%r55ps`O=R`G90J1Bu(UMnI:BX%I#`xmN1-4wDdzeGFYFR_H-Wzh1JGA^a:QReH6ZP0PR'[Z)rpm[(]`yKli?8BatK8%@/xEegOr'nlNmKTrsQj%cqTCnd8zpBo$_T5RDh>b.CnY4jf:^q%


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41$E:EvWDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC3)rP7zEH4mf5!$exy^8Q7G#fRKj?9[*Ay^t.:'1PV$=>M*3Myq4gM-J6E2M4hA%_G<9Z>LHm8'JY5fUOlzBaMYAvX#EVPK9k PkrgIYg?dvnN1`sKYQ.*:)F/?c<5ar.%O[93<VmL2L?5h>SAIauNb%U$QLTkXl*_f9Gu.])WlZ  #9JW?yCuvBDk%`ii[l@?7:QojOn@i*qf5Ux#F!$>fftpduskuycd56pz9'Ey=Xm$'%; path=/; expires=Thu, 30-Apr-2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 149
ANX_async_load({"url":"hXXp://i.w55c.net/ping_match.gif?ei=AN&rurl=htt
p://ib.adnxs.com/setuid?entity=17&code=_wfivefivec_", "c":0, "tagtype"
:"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..
Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyr
ef="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo
 PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 
0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-
2015 06:28:56 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pa
th=/; expires=Sat, 31-Jan-2015 06:28:56 GMT; domain=.adnxs.com; HttpOn
ly..Set-Cookie: anj=dTM7k!M41$E:EvWDgEREg(Pm?gvnX.Zf1(w#ZD_OXM'F1]0r/O
e3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s MvN:@jNzA7(a:LLC3)rP7zEH4mf5!$
exy^8Q7G#fRKj?9[*Ay^t.:'1PV$=>M*3Myq4gM-J6E2M4hA%_G<9Z>LHm8'J
Y5fUOlzBaMYAvX#EVPK9k PkrgIYg?dvnN1`sKYQ.*:)F/?c<5ar.%O[93<VmL2L
?5h>SAIauNb%U$QLTkXl*_f9Gu.])WlZ  #9JW?yCuvBDk%`ii[l@?7:QojOn@i*qf5
Ux#F!$>fftpduskuycd56pz9'Ey=Xm$'%; path=/; expires=Thu, 30-Apr-2015
 06:28:56 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/
javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:56 GMT..Conten
t-Length: 149..ANX_async_load({"url":"hXXp://i.w55c.net/ping_match.gif
?ei=AN&rurl=hXXp://ib.adnxs.com/setuid?entity=17&code=_wfivefivec_", "
c":0, "tagtype":"img"});....
<<< skipped >>>

GET /setuid?entity=17&code=7052af40-cf8f-45f7-952e-25f4ab050d93 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*h/DI8e6AqeU2k_YVvO89>7^wr%UwBz8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) htb$d^#Ly]cDcT4%(R_J6L)31uQ ZxMO>r%i?p=5(@'T.@Vv2Czxii`j6p-J:vFTSyAjSG6XtQCD*qSdW/%bgdGw7_o4%*E#rPZ5$Zm:7/SZMrax@(Fd6)<wQ0hVvSTHGi5(%j:3]q?5V2IpJI?N1bfY9(tR6KKBRiV*W4i>$nxxP]Gm3r`_kean(cZ/HrIG6K)pZOx$2ch^`hy-CYqK%`$dTRKiA^#l*Lu@DuI>)h@LG6$Hh<!3 G3TU4`e

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*d<S1 e6AqeU2k_YVvO89>7^wr=0D/e8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*Z5Ol#xb!I#CG)KbsRZ*<cH9vXhK8LXJ8rMw2KYJaht63>kX 6!^qUFAC'0$*bdXu!_4s?; path=/; expires=Thu, 30-Apr-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:57 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*d<S1 e6AqeU2k_YVvO89>7^wr=0D/e8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5wqoK[[bBQK/) ht[]*<zcZ/#.(M/Mp`goHgB oZg8WL1<@BxbK=n0y7[XTIOrlcpG[ZPOL1frmwqNVzUB'm__7p6#<AsKR/[u>8Ko=v#[htk%YU6o#d>T_Y4JT]NBOw2N!NqJVm=g[K]/3vq19zJT*97?7$.9q`I%%-`A_'-K-40uv6PRkP%-PSOu(Td@#`ynDglCyQ%*Z5Ol#xb!I#CG)KbsRZ*<cH9vXhK8LXJ8rMw2KYJaht63>kX 6!^qUFAC'0$*bdXu!_4s?


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:57 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:2
8:57 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Sat, 31-Jan-2015 06:28:57 GMT; domain=.adnxs.com; HttpOnly..Conte
nt-Type: text/html; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:57 GMT
..Content-Length: 0..

GET /banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=5&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597670883422

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 5235
document.write('\x3Cdiv style="position:absolute;width:160px;height:0p
x">\x3Cdiv id="obaButton_6110017597670883422">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_160x600_grey {\n    width:160px;.\n    height:600px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a,\n.paoffer_0kRa2RNR3aG3NRNa 
h2,\n.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\
n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3
NRNa a {\n.display:block;\n.float:left;.\n.background:transparent url(
hXXp://imagesrv.adition.com/banners/270/files/00/00/b7/09/000000046857
.png) no-repeat top left;\n.padding:1px;\n.text-decoration:none !impor
tant;\n.color:#000 !important;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a:hover,
\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3aG3NRNa a:foc
us  {\n.background-position:left bottom;\n}\n \n.paoffer_0kRa2RNR3aG3N
RNa a:hover,\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3a
G3NRNa a:focus,\n.paoffer_0kRa2RNR3aG3NRNa a:hover span  {\n.text-deco
ration:underline;\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .pa
offer-inner_0kRa2RNR3aG3NRNa {\n.position:relative;.\n    display:bloc
k;\n.width:160px;\n.height:195px;\n.overflow:hidden;\n. \n.text-de<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:49:59 GMT

Expires: Sat, 31 Jan 2015 03:49:59 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268601

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010212Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150127010212Z....20150203010212Z0...*.H.............@K.
.O.4....0"...j....5rR.@H&....z....`y.....X.:..{U.x..]K.W7.Dr.e=Qy.$D..
..o,....y.{.^.....0.Nt.y"....D.......5..4....*,T.....$..\]....<P.C@
.t.....|.......M=.\..%s6......w.....^ .....A1...8....ZJ.......o.,..l.&
gt;.n..p.. .6.>.L.$.....C...x.k]5..3....G......C.HTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 03:49:5
9 GMT..Expires: Sat, 31 Jan 2015 03:49:59 GMT..Server: ocsp_responder.
.Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options
: SAMEORIGIN..Age: 268601..Alternate-Protocol: 80:quic,p=0.02..Cache-C
ontrol: public, max-age=345600..0..........0..... .....0......0...0...
...J......h.v....b..Z./..20150127010212Z0k0i0A0... ..........j.....p.I
.#z...(~d..J......h.v....b..Z./....2.S.......20150127010212Z....201502
03010212Z0...*[email protected]"...j....5rR.@H&....z....`y..
...X.:..{U.x..]K.W7.Dr.e=Qy.$D....o,....y.{.^.....0.Nt.y"....D.......5
..4....*,T.....$..\]....<[email protected].....|.......M=.\..%s6......w.....^ 
.....A1...8....ZJ.......o.,..l.>.n..p.. .6.>.L.$.....C...x.k]5..
3....G......C...<<< skipped >>>

GET /pagead/viewthroughconversion/1018863546/?random=1422599221884&cv=7&fst=1422599221884&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3601037774

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/101886354
6/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_g
ames?gameId=659050&random=3601037774..Content-Type: image/gif..X-C
ontent-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-
Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a.
............!.......,...........D.;..

GET /image.sbmx?go=242840&pid=260&xid=3338670318734125865&id1= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: global.ib-ibi.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: private

Content-Type: text/html; charset=utf-8

Location: hXXp://ib.mookie1.com/image.sbmx?go=242840&pid=260&xid=3338670318734125865&id1=

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

p3p: CP="DSP COR ADM DEV PSA PSD OUR"

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Length: 208
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://ib.mo
okie1.com/image.sbmx?go=242840&pid=260&xid=3338670318734125865
&id1=">here</a>.</h2>..</body></html>..
HTTP/1.1 302 Found..Cache-Control: private..Content-Type: text/html; c
harset=utf-8..Location: hXXp://ib.mookie1.com/image.sbmx?go=242840&pid
=260&xid=3338670318734125865&id1=..Server: Microsoft-IIS/7.5..X-AspNet
-Version: 4.0.30319..X-Powered-By: ASP.NET..p3p: CP="DSP COR ADM DEV P
SA PSD OUR"..Date: Fri, 30 Jan 2015 06:28:56 GMT..Content-Length: 208.
.<html><head><title>Object moved</title></h
ead><body>..<h2>Object moved to <a href="hXXp://ib.m
ookie1.com/image.sbmx?go=242840&pid=260&xid=333867031873412586
5&id1=">here</a>.</h2>..</body></html>.
...

GET /reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-435101647 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:53 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:53 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:53 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1..

GET /free/frg/products/450950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 20 Oct 2014 07:51:32 GMT

Content-Type: image/jpeg

Content-Length: 20812

Accept-Ranges: bytes

X-Varnish: 966703145 962291246

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....rhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c02
1 79.154911, 2013/10/29-11:47:16        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BDA5FEE1539911E4B
9BF9495C72A21A3" xmpMM:DocumentID="xmp.did:53B056B0582E11E4821DA82208F
C3854" xmpMM:InstanceID="xmp.iid:53B056AF582E11E4821DA82208FC3854" xmp
:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:90f586ed-1e0b-4f48-88e9-c003dd237a75" stRef:
documentID="xmp.did:BDA5FEE1539911E4B9BF9495C72A21A3"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
......................................................................
................^z.,.,.98........Y.Fj@qe.(.y.H..(......A......J...D..t
-...W....[.t.V#G..R.......-....So`.R.}..f.6.../$...H.S.Z.y.........T..
9.G.t.Z.......M.r.\-..........."".E[~..e|...l.*...A......,...E......S0
%...e.^*...........`.cm.k~T........rD.O..[Z.JP...T....m.s..u.......q..
.G.7... 0......G......ZZ..B..s.H..........f. .,.....w....9...Y.Aq.<<< skipped >>>

GET /free/frg/products/558350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 06 Dec 2010 09:43:23 GMT

Content-Type: image/jpeg

Content-Length: 25436

Accept-Ranges: bytes

X-Varnish: 322100293 321464524

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!.1.A".Qa2#....q.R.$....B.3S.%..rC4..b.cs.T.5U'..........
.............!1..AQaq."......2...BR..b#.r..3..CS...$4%............?...
....\....l....)(.*J......oK...F...@..)....^r..uD...Q1...&3h.....Z N.D.
....:..}.}$e..9....U.-(..KpR8R..M.$.xsT4..<@8*...P...-k.....2.Q5D..
.O...we=..L..u..}.. .....pp....}B......"|.<.'tr.X.YO....gm).S.1....
&m..:.*....zN8\.].h...Vd..)..D......."4..l2~........h&...-.&...Li.-...
.5..e.ql...... ...7.(=E"k..c........;-..D...W.U.y.U..UN8...Q....^.../L
].m...u.<[email protected].....[h....../.62......8.)# ...Fa...lv|..y..>..[..f
...#."z...;.........V.\[email protected]..?6.......XY.b."L. .b.b...T./
.M[?.c...0.P8.!<@....$..r.O...^....l.^A.!.3\SbI.;.....f:..Dj....%%.
.....'.. ..[l^.........5<.....T....8...z.z\UW.O..'...8..s......d...
a.M...N".!8.. ..N...:.%d.f..M.}'...x.FBwDT......Z]h._}....Y.\9....R...
.z\y..=...e.y.&...Ui.N...Wp..[.....!p.4..^.Z.'.L;j$.=.q.l..\J%.)%.)..u
.....O.9.:..R.........h....K.".Cs...5.!........3.}/..I,.....c..>U..
y8f'....l...)...5v?..8...!.=e....a.c...n....&..C.z.7<..m..8.....T..
.........P.........0(!.9...K.4...8..nc....'....rn_.j.e.`...j.. Q...-7.
...H........M.....fG..f..0..`....#........f..np...y..2|jIA...P....w.wE
Y.fp............"E..! }lR...6.`....".@HJ*......w.8...o.....S...!L.<<< skipped >>>

GET /free/frg/products/674750/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 30 May 2010 12:08:35 GMT

Content-Type: image/jpeg

Content-Length: 13779

Accept-Ranges: bytes

X-Varnish: 322100378 321526198

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......W......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............#.."23CS..BRbcs$..!.4Qr....DT.a.......t&.q..d..5e.....
....U6.........................#3.."2BbRrC..1..S$4......A.c..T%&7.....
........?......t..Z..[.n....j.9.H.R. R.d%_.....2N..I..8.I..a....m..X..
.U?W.A..`../...E.V.~..Z.....5..EQ.rxd.........>U.x)>Q.v....f..R7
.xJ.P.=$.!.{?#..]aY...\8..t.O6.u.....U...F%S.).4.....@..<y..5......
k.dG.ZM&Au9...Ov.J....M.c!.....\......Q;z.~.y.....vt.....B.w$=....-..f
.v..O..Z..........S8%ot....z......P.......!..F.u..:0....*,zA.1..R....w
.y5 ...C..a`...wb.V..p......:.....w....L@.$].=6\m......*;99M..x..U#.k.
O...Vv....../.k......T .#.z.t.F.\...Q<.......'.&....u....E.m7..d..,
....^....3..tN.R.......!..*."%v.2.1.T.U...Q.p.P.......y.y...H.E.l....k
U.n<[.R....H.]uO.71.~>.;Z.....0...n..P.:i...wmN.R.ZF2H.B5......k
......U..g....q...I.SoC"..It.I.'.}z..^..Nd.`.....?a.$`.i./.).r?.D.....
PB.{........,.B..?....T...F..^...o*...h?>..D.G..aZv....i.3.ke\...B.
..FBhP5.......a.4#..x.......c.&....:.W..*[email protected]*
....(....d.|..rb..<.Y.^K..Z..`(.:{A. &M..b...D..Vxr...[@..X..K^.)6i
..>...'...;H..........U#0.=..\.JE"UI.''.jI...._.2../....-95.R.cSV..
Z[..i.B.r.y.k..O.:...{.s%...I...B....(...g.'....a..:.p.r<.#..n....!
..../-..hJ<.a\3..C.....V.k.y...r.....Uv..4.3..A..".._...#BB)...<<< skipped >>>

GET /adview.php?tz=1422599315949108&pid=789&kid=4&wmid=3826&sid=4&nvc=1&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

X-Powered-By: PHP/5.3.3

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 46.163.81.36

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=595483633&ipr=y HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0.02..GIF89a.............!.......,...........D.;.
.

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X++hEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECEGVSJuGyLhjhWQ8phawi51w= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1453

content-transfer-encoding: binary

Cache-Control: max-age=428038, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 05:22:19 GMT

Expires: Wed, 4 Feb 2015 05:22:19 GMT

Date: Fri, 30 Jan 2015 06:31:13 GMT

Connection: keep-alive
0..........0..... .....0......0...0......T3t.%..O.E..~..F.=....2015012
8052219Z0s0q0I0... ........H.dI.....3..^B...d6Q....ZL%."..1.m..._)..a.
.eR&.....Y.)..".\....20150128052219Z....20150204052219Z0...*.H........
......q._#...U...Z..0.^..E..Q&j.%^..{[o..:Cd...A..*eM.d.....C..R.S....
j......1..5.eB$ n.........q_C.<xs...f;z...m<..Q.....F..2.G..(.n.
&iMR.f...H...C.....XC<o.}y..........A....{................@..$1..D.
...a....Y.![f.0..[.,..K..e....d..ZrZ..3..;JP2.M'...........L....0...0.
..0..3......./...b.v..-....l}0...*.H........0_1.0...U....US1.0...U....
VeriSign, Inc.1705..U....Class 3 Public Primary Certification Authorit
y0...141202000000Z..151216235959Z0..1.0...U....US1.0...U....Symantec C
orporation1.0...U....Symantec Trust Network1?0=..U...6Symantec Class 3
 PCA - G1 OCSP Responder Certificate 30.."0...*.H.............0.......
...'......Y..x.3B1.7..Q..`..d.. ....s..t.$a.....j2R.{ ,*..c{.3.....H..
3-; ).....0._...*..9M..V...... ...{m...-.......)..tR..{D....~...M...T.
.pS.p..^|o....S..v.).)[email protected]#qh...u1T.].G0.]E..
.=._...... ........TE...Sa.s4........r...3.............0..0...U....0.0
l..U. .e0c0a..`.H...E....0R0&.. .........hXXp://VVV.symauth.com/cps0(.
. .......0...hXXp://VVV.symauth.com/rpa0...U.%..0... .......0...U.....
...0... .....0......0!..U....0...0.1.0...U....TGV-B-2730...*.H........
.....$..H......oU....Y!.z{*.V.M..u.._z..3>.. 0....3..m.....e.......
a..D...........e..F6:.y.....di.......<y.Z.......x}..q.2....UZ1 :,font>....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSpuCE3aK3GivZPzGQJ6L5BRyZofwQUl9BrqCZwyKE/lB8ILcQ1m6ShHvICEAxNF3PJUX7iAOhAP2oGxcI= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1790

content-transfer-encoding: binary

Cache-Control: max-age=517463, public, no-transform, must-revalidate

Last-Modified: Thu, 29 Jan 2015 06:12:33 GMT

Expires: Thu, 5 Feb 2015 06:12:33 GMT

Date: Fri, 30 Jan 2015 06:31:13 GMT

Connection: keep-alive
0..........0..... .....0......0...0........6?s....V....OlL".O..2015012
9061233Z0s0q0I0... ..........!7h....O.d...AG&h.....k.&p..?...-.5......
..M.s.Q~...@?j.......20150129061233Z....20150205061233Z0...*.H........
.......H `._pIsjnQ...........{ .........&t.26OO.....[........-u-.1G...
....Es.....P..B.K,a=a6..i8.!.f...l.-.] .....:..`.40H.'p....4g]sJ`.n$..
.._P.t.t....E..u...T7U..X..*y.o I.l..S...X..L<..&.....y.m.4. ZB.(.t
:0...5C%.x7..o.Z..._/.X]h:D.D^_...O....@.....$.m..95hu...#0...0...0...
.......<o&S.-S..}...e.30...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use a
t hXXps://VVV.verisign.com/rpa (c)09100...U...'VeriSign Class 3 Code S
igning 2009-2 CA0...141205000000Z..150305235959Z0..1.0...U....US1.0...
U....VeriSign, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms o
f use at hXXps://VVV.verisign.com/rpa (c)091<0:..U...3VeriSign Clas
s 3 Code Signing 2009-2 OCSP Responder0.."0...*.H.............0.......
..{(..t....2.Vf.....&;6).i*[email protected]._p.E.6.|.mk....(....
......p...........X.DF....^0N....b9.:..J. ZK.".^..\..p.'.$..JA..~QG.d.
}...r...gv... f...z.#..}..J...r9h.........LI-..^.......PUD.h<.l....
(n..i.....E.....2....^./Y......Y.m...'...hz..y..E..........0...0...U..
..0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.verisig
n.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS incorp.
 by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0...U.....
...0... .....0......0"..U....0...0.1.0...U....TGV-B-24710...*.H...<<< skipped >>>

GET /ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3170539322 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: NID=67=vOr3KMkRgKzKK96sxJpxyEczA3umKOcncI--3SgTGRoblhdA9puvOrwBffL0b0Jj_CIR-FG07pJNcRIPtOc-BQNOTfg9OdWidnppEWcEVE_ZiWA-bcBNJCiwTSNfkqdd

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com


HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3170539322&ipr=y

Cache-Control: private, max-age=43200

Date: Fri, 30 Jan 2015 06:26:40 GMT

Expires: Fri, 30 Jan 2015 06:26:40 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 386

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt
=3&num=1&cv=7&frm=0&url=http://partners.freeridegame
s.com/my_games?gameId=659050&random=3170539322&ipr=y">h
ere</A>...</BODY></HTML>..HTTP/1.1 302 Found..Locati
on: hXXp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&cv
=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=6
59050&random=3170539322&ipr=y..Cache-Control: private, max-age=43200..
Date: Fri, 30 Jan 2015 06:26:40 GMT..Expires: Fri, 30 Jan 2015 06:26:4
0 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options:
 nosniff..Server: adclick_server..Content-Length: 386..X-XSS-Protectio
n: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..<HTML><
HEAD><meta http-equiv="content-type" content="text/html;charset=
utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY&g
t;.<H1>302 Moved</H1>.The document has moved.<A HREF="h
ttp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&
;cv=7&frm=0&url=http://partners.freeridegames.com/my_games%3
FgameId=659050&random=3170539322&ipr=y">here</A>...
</BODY></HTML>....<<< skipped >>>

GET /banner?sid=2990114&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1210582&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc3=10039


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601960017977

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc3=10039qjg3AAGmJMtU; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 2876
document.write('\x3Cdiv style="position:absolute;width:160px;height:0p
x">\x3Cdiv id="obaButton_6110017601960017977">\x3C/div>\x3C/d
iv>\x3Cscript src="hXXp://a.twiago.com/adscript.php?pid=789&ord=611
0017601960017977&rdclick=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_c
w3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.aditio
n.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582
/bid=3952316/c=24754/keyword=/sr=0/clickurl=" type
="text/javascript" language="JavaScript">\x3C/script>\n\x3Cnoscr
ipt>\n \x3Ca href="hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=
58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.c
om/redi*lid=6110017601960017977/sid=2990114/kid=1210582/
bid=3952316/c=24754/keyword=/sr=0/clickurl% = \'obaBut
ton_6110017601960017977\',oba=\'\',btr = \'false\',position= \'top-rig
ht\'||\'top-right\';\n  if (oba != \'\' || btr == \'true\') {\n    var
 oba_script = document.createElement(\'script\');\n    oba_script.setA
ttribute(\'type\',\'text/javascript\');\n    oba_script.setAttribute(\
'charset\',\'utf-8\');\n          oba_script.setAttribute(\'src\', \'h
ttp://imagesrv.adition.com/banners/533/oba_priv.sjs?oba=\' oba \'&domI
d=\' domId \'&btr=\' btr \'&pos=\' position \'&cid=&aid=59145\');\n   
 \n    document.getElementsByTagName(\'head\')[0].appendChild(oba_scri
pt);\n\n  }\n  })();\n\x3C/script>');..<<< skipped >>>

GET /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t.mookie1.com

DNT: 1

Connection: Keep-Alive

Cookie: id=3025970665045060; mdata=1|3025970665045060|1422599330; OAX=IAz1ClTLJKIAATbP


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.3 (Red Hat)

Location: //ib.adnxs.com/mapuid?member=364&user=3025970665045060

Connection: close

Content-Type: text/plain; charset=UTF-8

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ac955129660 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1024

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.F.~.... ..#..d)x...I.&u]..{[email protected]....,=H...vf.
........`...r...T..L....RUw0hU..C.P...\ ..S... .[...O.Tp.(...[..G...(.
.o.t6u......;..BA.wgO.b9.=...=.....d....Y!(.......Gy.._,1...3..n|.'..l
.r.s..>.A.?...Z*[email protected]...,.T...Ys\\.........,C.....,C..... C..
B..@...>..3g...S.....D........3....]xi..IXs.  ./..Rp.D...G..?.xr...
O?..r....o............Q.n.$wi....(......-.C....a......,Keh....gi^..}kE
.D...igt.T.R..Ei...[o..n....85....p 8...8v...E:...a...?...Nh.0t......@
dz5...X .9..5.5.....!rt...6<....^....&..{.......g...|.]."..g.Y.E...
8.nM.........wWZ.z.:.X.VU..HS..U.01. 6.......m.Q..`..M..1..3Z.,....v.M
h..Xw9.%O;........Q......HA.p.....#%A..w4.#NC.9.....6.<......S..^N.
..iFo`..[ ..r..Z....b*.FH........u.......Y..K..d.v....M..K#m.......]..
.6Xt.5..aCD.5......(K2~..hB..Ji:..rLs..}\...|.48h.V.$-...i.M)Sxq.....A
.C..^.}....#zYe}....$7..Ru_.N(.b...Jw...<)......n..fd..V...LPM=.Q!.
.X....y.o.,[email protected]}xi......<.%Y..CN....
....~....nD....,.|!.p.o.4.k.*kCC9..........&'Vw{.l...?..._9.....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRsif7263KedmR2MLuYKv9+WQCtWAQU1A1lP3q9NMb+R+dMDcC98t4Vq3ECECVRccvD8Qb29B4D63fPT+k= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1396

content-transfer-encoding: binary

Cache-Control: max-age=443736, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 09:42:20 GMT

Expires: Wed, 4 Feb 2015 09:42:20 GMT

Date: Fri, 30 Jan 2015 06:31:20 GMT

Connection: keep-alive
0..p......i0..e.. .....0.....V0..R0...............w/.|`....a...2015012
8094220Z0s0q0I0... ........l....r.vdv0..*.~Y..X....e?z.4..G.L.......q.
.%Qq.........w.O.....20150128094220Z....20150204094220Z0...*.H........
..........>Y.Z...f.'G...._y(...].....W..M...!.....11pMR*...CZF...;.
.I..\.L....K.X. .v....x..xi...w?[Q.......RK..R12...B?#.../c"...#/.r.].
0....H6.SU.n...QE$..].<...L..(........a.D.y..8.....ST.^.fb?...~.Q..
....3L....^.l.2{.."..Y........MQ.=....y..|.....S..mJ..q$B....0...0...0
[email protected]...*.H........0J1.0...U....US1.0...U....Tha
wte, Inc.1$0"..U....Thawte Code Signing CA - G20...141210000000Z..1503
10235959Z0Y1.0...U....US1.0...U....Thawte, Inc.1301..U...*Thawte Code 
Signing CA - G2 OCSP Responder0.."0...*.H.............0..........P....
.].8?e...8.0.. ...-.uP.3....pQ......mi..wVt.......<....{d.?..9..z%.
?..}.N`.V.........I.X...E#...*.f...X.;...75......%...n.%..#..T.<...
..fEQ.\\.f.{M.H...M..u...9~..C....B.o..........dc...V..,.........{...j
.9.xw?D..ooNf&=......D|.R..../.....So....*-5.......d0b0...U....0.0...U
.%..0... .......0...U........0... .....0......0"..U....0...0.1.0...U..
..TGV-B-25170...*.H.....................2.).xO...].6..R.k...H =d...L..
.(o0#.......<O#.;[email protected]...^.q.Y...}....S(syt&...$..L..7<...nb|.
..]2c..q..Q.L.3,.............n>....tND..fJ.&. .....%7.....f.31.>
..d...ET.E.~.x...]N...*.......n......HI..*M..t.......:.=.:..(2M".S....
.&....................<<< skipped >>>

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=455915, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 13:01:57 GMT

Expires: Wed, 4 Feb 2015 13:01:57 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015012
8130157Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150128130157Z....20150204130157Z0...*.H............
.t.L~...vz..h.22..lK.iK...'ec...FR.... ....!..q*......1E..5r*,...]M..|
'..`e.UJ..S.._.jnGy......tT~.f..8.N.g0.V....!3........E...]b..........
d..6.......z?.........Y....6........a%......T|...-]D.2[.......4.%.A.w.
...................2. Jsa.Jb.R,.f.....>J....6o.....0...0..}0..e....
....:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 30.."0...*.H.............0............
\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd....
.x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x.....
.........6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o
...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0.
.0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .....
..0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830..
.*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a.
..nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7..
.=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v...
..\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%...
.<<< skipped >>>

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: gmtdmp.mookie1.com

DNT: 1

Connection: Keep-Alive

Cookie: id=3025970665045060; mdata=1|3025970665045060|1422599330; OAX=IAz1ClTLJKIAATbP


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=3025970665045060; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Set-Cookie: mdata=1|3025970665045060|1422599330; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Keep-Alive: timeout=1, max=9567

Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Fri,
 30 Jan 2015 06:28:50 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR
 STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id
=3025970665045060; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28
:50 GMT; Path=/..Set-Cookie: mdata=1|3025970665045060|1422599330; Doma
in=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/..Cache-
Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 
30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43.
.Keep-Alive: timeout=1, max=9567..Connection: Keep-Alive..GIF89a......
.......!.......,...........D..;..

GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif?meta=appNexus HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dps.bing.com

DNT: 1

Connection: Keep-Alive

Cookie: SRCHD=MS=3187714&SM=1&D=3093912&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MUID=1785AC2FD94664211AC0A9A6DD466620


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 42

Content-Type: image/gif

Expires: 10:28:45 PM

Server: Microsoft-IIS/8.5

TrackingId: c27c3649-5807-434b-bbb5-3166cdb74dac

X-Powered-By: ASP.NET

X-MSEdge-Ref: Ref A: D98760C3950F4A649BB90954CEFF48AC Ref B: 3C6B76037802F430C7CF50C5FEBB8971 Ref C: Thu Jan 29 22:28:50 2015 PST

Date: Fri, 30 Jan 2015 06:28:49 GMT

GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Contr
ol: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 10
:28:45 PM..Server: Microsoft-IIS/8.5..TrackingId: c27c3649-5807-434b-b
bb5-3166cdb74dac..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: D98760C3
950F4A649BB90954CEFF48AC Ref B: 3C6B76037802F430C7CF50C5FEBB8971 Ref C
: Thu Jan 29 22:28:50 2015 PST..Date: Fri, 30 Jan 2015 06:28:49 GMT..G
IF89a.............!.......,...........L.;..

GET /free/frg/products/659050/boxshot_sm.jpg HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: img.exent.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 11 Apr 2011 13:25:20 GMT

Content-Type: image/jpeg

Content-Length: 2764

Accept-Ranges: bytes

X-Varnish: 1237757069

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:24 GMT

Date: Fri, 30 Jan 2015 06:26:24 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......:......Adobe.d....................
............................................          ................
                                                 ......<.3.........
......................................................................
.........s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt
....&.......EF..V.U(........eu........fv........7GWgw........8HXhx....
....)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2.
......#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu.
.......FVfv........GWgw........8HXhx........9IYiy........*:JZjz.......
.............?......u....../...*.4,M...6.rpF......>..~it>e.dc...
.*.\.UT9j....|....(.\..y3H...5X...&I....kuK....$...fQV.......{....a...
.[.f.]:..f.~d.g._LT.8N).......\ ....*.T.5...7Qo..N...-5.{.kLW....K.W..
...".....!N.-.c.u#.#..l.......Gr.=_.|K..."{...%...&.g<......|K...a.
DY1...<..ob. ..r&.`/....G....rj..Y...o....$,H.*.U.3g..............[
F#.....u6.j....S...MTJ.\0.G^A.R.e...9{RU........./....'..&)F....u*.X..
m.....2.. ..f.........d...iK/.1.......s..9f'!.d........=$...../..\0 ..
.2.o8..........z.....S..|y...w...c.s.#...u....].5.....2.V. ...'..U.aL.
0Fg~N^...i.F=.)D.y....;o.olt.k ......2Im.R.1..........2......N.7...yN1
[email protected].*r........7....
&.e{....$:L............8r$.....(..\=>.8.......W..A....?.f..G.n.U...
M.G.t..*.Q.7....F... .jg......=.Vn..~....W[6.(t......r ......X..j...~i
..i_S. _[...zc.:zt.z......4..V ~..|..2yQ....wl.E.............=..O.<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRNDpBTXFXL4hq1AIFFLZkDOqgNdgQUuMoR6QYxedvDlMboGSq8uzUWMaQCEQCuH3DgeG4oxuqQCCTRf5D9 HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Thu, 29 Jan 2015 23:55:24 GMT

Expires: Mon, 02 Feb 2015 23:55:24 GMT

ETag: B116DBB1792D70115110AB40FDEBEE6A6AE1743D

Cache-Control: max-age=321393,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp9

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0...........1y......*..5.1...2015012
9235524Z0t0r0J0... ........M..S\U......E-..:..v.......1y......*..5.1..
....p.xn(....$........20150129235524Z....20150202235524Z0...*.H.......
......\.!.d.=.n..#..W&..y.'..#.oq..;.5........s....&./@...H.......Nr..
..x.....D..U.o....@`J.R...y. .YM.<.....N....J....].X...e.M.J\UGF...
.:.[.N......xc....p..T.....r..........,....,..oy6.{5P.Vb.;<.X.m..v.
......m..F.............,DjF>0.....;^HoF....H.,>.-s(.#."/(...

GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: vassg141.ocsp.omniroot.com


HTTP/1.1 200 OK

Server: nginx

Content-Type: application/ocsp-response

Content-Length: 1765

Last-Modified: Fri, 30 Jan 2015 06:06:33 GMT

ETag: "dc03c23f8eb330db9ddad1bd8952209aff112f47"

Cache-Control: public, no-transform, must-revalidate, max-age=339456

Expires: Tue, 03 Feb 2015 04:44:16 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive

0..........0..... .....0......0...0..........[us..Ni......f....2015013
0060633Z0w0u0M0... ...........]d...N....P5....0...l.|[email protected]./...
.j3."d..Ii...............20150130060633Z....20150203060633Z0...*.H....
.........6..r...[.Ktp..i........$...Y...&D`..M..v.@.....%...a..m.$...J
.)..s.........J3Q......B....>a.}.KyyH....83....a.r....2....K..$0...
........(<J, ..W......6..U....D?#..!ux....xW..vM/s.I...n...v.9.!.n.
...h.n..>.S....y...`X.8Q...gA.>".N..<<."ob.9...-...0....l{
.F.....0...0...0...........=......Ri..\..(.{..0...*.H........0..1.0...
U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0.
..U....Cybertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA10...1
40410115548Z..150410115548Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U
....Verizon Enterprise Solutions1.0...U....Cybertrust1806..U.../Verizo
n Akamai SureServer CA G14-SHA1 Responder0.."0...*.H.............0....
.....f..).1.............Z.45..l. IB..r`...f....h.....h..._i'...J....|.
c....E.D0bg.b.v..........:Q....W._U.w..3....i...k........t.....m.CO$..
j@.....>..Q.m......1/Z.r......L..a.n..;..KoIY.......fk{..c..d...IU.
......zy.X...zp...F.1..F......b...Z...=9.o...N.fL.%Z.........H0..D0...
 .....0......0L..U. .E0C0A.. .....>..0402.. ........&hXXps://secure
.omniroot.com/repository0~.. ........r0p06.. .....0..*hXXps://cacert.a
.omniroot.com/vassg141.crt06.. .....0..*hXXps://cacert.a.omniroot.com/
vassg141.der0...U...........0...U.%..0... .......0...U.#..0....l.|..2.
[email protected]./..0...U..........[us..Ni......f..0...*.H.............Fk:

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEG7MeqWnAyAJuM689OlS1JE= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1762

content-transfer-encoding: binary

Cache-Control: max-age=381759, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 16:27:13 GMT

Expires: Tue, 3 Feb 2015 16:27:13 GMT

Date: Fri, 30 Jan 2015 06:28:55 GMT

Connection: keep-alive

0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..2015012
7162713Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..n.z... ......R......20150127162713Z....20150203162713Z0...*.H.....
...............A....H...#...At.(..lE.........W..s.U......UV;..?.).)p.j
M........#.K:P..#YN%....Q.5r.].I...9.(}.....C.qS]!.n..ZO@..~:_.L..e..H
X0...#3k.q..N8..>....._..9.. ...d..FGw......PW.%..V.?J..B..]5..{...
"j...%.,%.h.]..k6/...6.5..%Yu...7...z2]......8.WS...Y.l.e....0...0...0
...........2...'U.BM...g.B0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriS
ign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publ
ic Primary Certification Authority - G50...141202000000Z..151216235959
Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tr
ust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certifi
cate 30.."0...*.H.............0...............2&..PL...,..2....:..tH..
.`JG.%..*...s.c%[email protected]"1.5?..s.....
3[...u......]...R0..Z}....l..I.Y.....j\H.q...#.uw.4qz.#.J.....@2$"..$l
.B.......D.ye..(..2.........@...... ...."... E..0M,..b{.^..s'....f.6.p
r4.J........'j..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R
0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.sym
auth.com/rpa0...U.%..0... .......0...U...........0... .....0......0!..
U....0...0.1.0...U....TGV-B-2760...U......;O}a.!..u...au..eUNp0...U.#.
.0.....e......0..C9...3130...*.H.............(.&..Dgr.Ve..#...5.N.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEChTiL6sps8WmjYtXlOSTfM= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1730

content-transfer-encoding: binary

Cache-Control: max-age=378227, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 15:31:48 GMT

Expires: Tue, 3 Feb 2015 15:31:48 GMT

Date: Fri, 30 Jan 2015 06:28:55 GMT

Connection: keep-alive
0..........0..... .....0......0...0......P).Niz5............?..2015012
7153148Z0s0q0I0... ..........)8t..).~.5bRd.S......D\.SD..~. .%..c..y..
.(S.......6-^S.M.....20150127153148Z....20150203153148Z0...*.H........
.....^......^.35.~...#.S..B.-V...;.....?..v3.b...K....&..@..^rQ4gXk...
..aE...r.X.......bU.8..P.f./AZF.3.......0..Q..m....C.v.......4|Q.t.g,.
.z.......sP/ ....ISjL...e.......r.....q... ..mH.]..Ww".:"..X.{.9.U.Y..
../.C.3........EsA....$pc|6nvn..U_.-|...w*P..iC..U.....0...0...0......
....]../g.0.h.....$C0...*.H........0..1.0...U....US1.0...U....VeriSign
, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at http
s://VVV.verisign.com/rpa (c)101/0-..U...&VeriSign Class 3 Secure Serve
r CA - G30...141204000000Z..150304235959Z0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1>0<..U...5VeriSign
 Class 3 Secure Server CA - G3 OCSP Responder0.."0...*.H.............0
............Q..>.]....b...........G[..sz_:.eM.J..m)....J.KV..W....e
.M...C.......8.|...^...S./[email protected]...:S4....R..&"...
...l.....1&..nY..p.....4...L`.g...E#t....Mw....1.O.....i..e.b.qa...p..
...$...b...V....#.M3......|..B.R..:@UtY@:s..h.........me..........0...
0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.
verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS 
incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0..
.U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24570...*.H
.............y.boc.....2<.-..O...ehR.............. .....n....'c<<< skipped >>>

GET /reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-166351247 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:53 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:53 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:53 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1..

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=8&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601960214622

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 19
document.write('');..

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=5&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601958576222

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 19
document.write('');..

GET /appnexus/match?nuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: apnx-match.dotomi.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: nginx/1.6.2

Date: Fri, 30 Jan 2015 06:28:59 GMT

Content-Length: 0

Connection: close

Set-Cookie: dtm_test=236c4565ef5118a4; Expires=Fri, 30 Jan 2015 06:29:29 GMT; Domain=.dotomi.com

Location: /appnexus/match?dtm_test=236c4565ef5118a4&nuid=3338670318734125865

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=455927, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 13:01:57 GMT

Expires: Wed, 4 Feb 2015 13:01:57 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015012
8130157Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150128130157Z....20150204130157Z0...*.H............
.t.L~...vz..h.22..lK.iK...'ec...FR.... ....!..q*......1E..5r*,...]M..|
'..`e.UJ..S.._.jnGy......tT~.f..8.N.g0.V....!3........E...]b..........
d..6.......z?.........Y....6........a%......T|...-]D.2[.......4.%.A.w.
...................2. Jsa.Jb.R,.f.....>J....6o.....0...0..}0..e....
....:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 30.."0...*.H.............0............
\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd....
.x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x.....
.........6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o
...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0.
.0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .....
..0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830..
.*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a.
..nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7..
.=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v...
..\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%...
.<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=4775489&cr=58414&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /adscript.php?&ref=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&vis=0&pid=789&ord=6110017601960017977&rdclick=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.3

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814b55; expires=Sun, 01-Mar-2015 06:28:52 GMT; domain=a.twiago.com; path=/

x-oread: 1422599332.4483

Set-Cookie: deuxesse_ex=; expires=Sat, 30-Jan-2016 06:28:52 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:52 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_ex=; expires=Sat, 30-Jan-2016 06:28:52 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:52 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; expires=Sat, 30-Jan-2016 06:28:52 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:52 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_ex=; expires=Sat, 30-Jan-2016 06:28:52 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:52 GMT; domain=a.twiago.com; path=/

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript; charset=iso-8859-1
3286.. if(typeof(document.asm_excl) == "undefined"){ document.asm_excl
 = new Array(); } document.asm_excl = document.asm_excl.concat(String(
"586|579|580|585|582|583|446|447|449|450|451|452|453|454|564|566|567|5
68|569|570|571|584|462|581|623|624|680|681|679|671|625|730").split("|"
)); .. var asm_ex = false;. var asm_ex_all = false;. for(var asm_i=0; 
asm_i<document.asm_excl.length; asm_i  ) { if(document.asm_excl[asm
_i] == "4"){asm_ex = true; break;}}. for(var asm_i=0; asm_i<documen
t.asm_excl.length; asm_i  ) { if(document.asm_excl[asm_i] == "w210" ||
 document.asm_excl[asm_i] == "p789"){asm_ex_all = true; break;}}. if(a
sm_ex_all){}. else if(!asm_ex ). {.   var adspirit_pid = "789"; docume
nt.write('<div class="asmbeacon asmmain" style="position:absolute; 
left:0px; top:0px;"><img border="0" style="border:0px white soli
d !important;" width="1" height="1" alt="" src="hXXp://a.twiago.com/ad
view.php?tz=1422599332803860&pid=789&kid=4&wmid=3826&sid=4&nvc=1&targe
t1=-" /></div><style>\r\n#twiago_bx.tw_sky_160x600 { fo
nt-family: Arial; }\r\n#twiago_bx.tw_sky_160x600 * { margin: 0; paddin
g: 0; -moz-hyphens: auto; -webkit-hyphens: auto; hyphens: auto; word-w
rap: break-word; font-family: Arial!important; }\r\n#twiago_bx.tw_sky_
160x600 img { border:  none; }\r\n#twiago_bx.tw_sky_160x600 a { text-d
ecoration: none; }\r\n#twiago_bx.tw_sky_160x600 h2 {}\r\n\r\n#twiago_b
x.tw_sky_160x600 {\r\n.width: 160px;\r\n.height: 600px;\r\n.overflow: 
hidden;\r\n.position: relative;\r\n}\r\n\r\n#twiago_bx.tw_sky_160x<<< skipped >>>

GET /ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3601037774 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: NID=67=vOr3KMkRgKzKK96sxJpxyEczA3umKOcncI--3SgTGRoblhdA9puvOrwBffL0b0Jj_CIR-FG07pJNcRIPtOc-BQNOTfg9OdWidnppEWcEVE_ZiWA-bcBNJCiwTSNfkqdd

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com


HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3601037774&ipr=y

Cache-Control: private, max-age=43200

Date: Fri, 30 Jan 2015 06:26:40 GMT

Expires: Fri, 30 Jan 2015 06:26:40 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 386

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt
=3&num=1&cv=7&frm=0&url=http://partners.freeridegame
s.com/my_games?gameId=659050&random=3601037774&ipr=y">h
ere</A>...</BODY></HTML>..HTTP/1.1 302 Found..Locati
on: hXXp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&cv
=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=6
59050&random=3601037774&ipr=y..Cache-Control: private, max-age=43200..
Date: Fri, 30 Jan 2015 06:26:40 GMT..Expires: Fri, 30 Jan 2015 06:26:4
0 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options:
 nosniff..Server: adclick_server..Content-Length: 386..X-XSS-Protectio
n: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..<HTML><
HEAD><meta http-equiv="content-type" content="text/html;charset=
utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY&g
t;.<H1>302 Moved</H1>.The document has moved.<A HREF="h
ttp://VVV.google.com.ua/ads/user-lists/1018863546/?fmt=3&num=1&
;cv=7&frm=0&url=http://partners.freeridegames.com/my_games%3
FgameId=659050&random=3601037774&ipr=y">here</A>...
</BODY></HTML>....<<< skipped >>>

GET /free/frg/products/608450/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Wed, 13 May 2009 07:03:16 GMT

Content-Type: image/jpeg

Content-Length: 26064

Accept-Ranges: bytes

X-Varnish: 322100258 321640614

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P.....&Adobe.d...................-
...E8..e..............................................................
......................................................................
......................................................................
..................................!. ..01"#$A2..@354..................
.....!..1.AQa"2q...B#....Rb3$....r..C....ST.c 4D......................
!.. 1A0Q"[email protected]....#`Br....................!1AQaq....... ...0@....
............................D.bK.eX.U...:..H[z..k......h..mM.8......M.
.U..1ur_....N...q ...j$.x....Y...Ct.c.u.."[email protected]...(...
.9..Y.f.=J.......$X..Xt.....YN..*[email protected]...#......U....EJOE...c.T.4 ....4
.k...x.H..Od.f.C.$z.6..R.9.......^.e.{*Y..2.._....<.5..5.hn.q{"....
X.D...p p.N.\.o.?..V.....\u.6...g].^.....kg.d..A..5.n..9.c..=.A...uX.)
....b..d:..y.Y..._.........z......P@D/..S.`..f....W.O...vr..co.]#..k..
&...6qo..T...X....R....e.tR.$..6..T... v<m...vH.".NX.s.-S>.....K
..to6.g.P.vi..H..c.O.>gi...c0G.....(....|..A.....{~u..... f.;X..w..
=..e.....E..F.j.R.......M...c}-Z......\......Y..m....R..OsFK..........
.....mM..d..s..].]=..............W'..T.#2.1Ku...>....j..cw9.&.CR{..
.P.-^.;]..E..Z..S.N..t.X....J..cdO.r..J..d.)}@r...x&J.T...^..leHP..Z..
@=>X..Lu...I......1P@@T...S..t.....BA.B.7"........../...l} ;eda5".E
H...l.....u..M:3.-...8<!......d....]).k.....Cc.f.*U-#e.... .Cu1.gHW
w,tnjT..C...S...?..T{IsZ...&....j....l)6...ad[...,....=.N.]..5./)z..7F
>.P...r..... .:.....a.......U.j..^Gyc<..]{$...9.L%.{..-...b.<<< skipped >>>

GET /free/frg/products/563750/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 13:28:54 GMT

Content-Type: image/jpeg

Content-Length: 29430

Accept-Ranges: bytes

X-Varnish: 783840551 783233012

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:4CB992A52B3DE2119
55FE55656C7D978" xmpMM:DocumentID="xmp.did:0C1B73D5EA2D11E2A18CEE3F989
F8A24" xmpMM:InstanceID="xmp.iid:0C1B73D4EA2D11E2A18CEE3F989F8A24" xmp
:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:90D37B62E79B11E28D69DE4027E5AE9A" stRef:doc
umentID="xmp.did:90D37B63E79B11E28D69DE4027E5AE9A"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
............................................!..1A"..Q.aq2#...b.....BR.
3...C$4%5........................!1...AQaq...."..2B...Rb.....r#..3.4CS
$............?...%.:..\.......(i.J.J.R..Hm...>.S].hq.=.,.....I.TW3.
"}.Cb.F...3'..R...N.E...3..... O......R..%.DwR[.J@."...}[email protected]
..`do....._..&..fX6D....E...N.9.qZ.HT7....j.6.....U4!.q...,N%...%.<<< skipped >>>

GET /free/frg/products/571950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 02 Apr 2009 12:56:42 GMT

Content-Type: image/jpeg

Content-Length: 17011

Accept-Ranges: bytes

X-Varnish: 2052680375 2052297022

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
...........!.1"..AQa.q.2..b.BR.#...cs$.r...4.v....3C..&7..............
.........!1..AQaq..".....2.B....R...#35.r.b.s.............?...Z$...hB4
!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!.
...F.#B.....hB4!....F....hH..F.#B.....hB4!....F.#B.....|.I.P'm...|....
.......H......).5.E..\....3..).I-............q..y.-.J`q...`.....uQ;8..
......1....Q.[)!E.#......Ihq...r.....J.....,=.Z4!......A.4.IU.H.hJ...L
8r.$...u.....(.}...N...:G84T...xj.H.-b@..).G..%..R.p...Oh)..<N..L.@
..0n(N..-...J.....hJ...4....uM.$I.H.ZI\...?.........P.....Q%y{M2.....E
.~`H.....U......<.maGt...P:...a...by}TgKW5..h.N|;....H .u#.>.c..
.....(T._.0;....N ......J..Z.Nb.i6.-.....h.K.$..8....H...CZ..@..&..#Y$
..T...z.........S.I.$.I%K.6..-....t..Q......%.. ..;|...&..i.[..o.X7%t.
.....e#...I.......a.......V*4....A..W.9-..>.......e..r.............
......h.|....5.!.....c7%...1...\.;....Z...R.7.... .. ....5`~..E...$uJ.
(W.@x.|.....)-{\h. wAth.>..2.q.2..BV.!AH'......5,BF.73].n4......aw.
<F~......m..........(.t0.c8......_.=...^f.?&;.%J..B....qM.....ON...
.y......#.tiWh..hJ..|.3....{.Vq~9.b...YC.............'...$........N.ka
......\....V....of)...4nxyh.8..LE.G..........~Y....L...Eo....z.0^l....
e#..'...F........,.(.C...@.]..G....D....yo..7.>.8........L.v[.u<<< skipped >>>

GET /dpixel?source=appnexus&eid=5&id=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cms.quantserve.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Connection: close

Content-Type: image/gif

Set-Cookie: mc=54cb24a3-75446-74a36-8126a; expires=Sun, 31-Jul-2016 06:28:51 GMT; path=/; domain=.quantserve.com

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"

Cache-Control: private, no-cache, no-store, proxy-revalidate

Pragma: no-cache

Expires: Fri, 04 Aug 1978 12:00:00 GMT

Content-Length: 35

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: QS

GIF89a.......,.................D..;..

GET /js?wp_id=65567&kid=1221974&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 12913686

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1075
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(65567);}cat
ch(e){prfstr=''}document.write('<script type=\'text/javascript\' sr
c=\'hXXp://adfarm1.adition.com/banner?sid=65567&adjsver=' adjsver '' p
rfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=' os '&b
rowser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&kid=1221974&screen_res='
 screen_res '&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php%3
Fsw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_
a_w3hurl=\'></script>');..<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCC0gVOkA+hgL HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:50:30 GMT

Expires: Sat, 31 Jan 2015 03:50:30 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268697

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010340Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.- T.........20150127010340Z....20150203010340Z0...*.H................
..4.kr.Y..r2...\.A..*......?=bN.u.eMr.......7...s(....6Z..y;r>.cG..
..~......U..{.w. 8..z..H...2..O.R...{e..U....-..=.&..d .../.N.,..?.X..
gm..8?..#C"./..^....f..@]-{..<.`..~........Y.K>._w.2./(..Ds.....
...........}.2...j.*c.>q.h.-.N..tj........}..<....!.HTTP/1.1 200
 OK..Content-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 0
3:50:30 GMT..Expires: Sat, 31 Jan 2015 03:50:30 GMT..Server: ocsp_resp
onder..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-O
ptions: SAMEORIGIN..Age: 268697..Alternate-Protocol: 80:quic,p=0.02..C
ache-Control: public, max-age=345600..0..........0..... .....0......0.
..0......J......h.v....b..Z./..20150127010340Z0k0i0A0... ..........j..
...p.I.#z...(~d..J......h.v....b..Z./..- T.........20150127010340Z....
20150203010340Z0...*.H..................4.kr.Y..r2...\.A..*......?=bN.
u.eMr.......7...s(....6Z..y;r>.cG....~......U..{.w. 8..z..H...2..O.
R...{e..U....-..=.&..d .../.N.,..?.X..gm..8?..#C"./..^....f..@]-{..<
;.`..~........Y.K>._w.2./(..Ds................}.2...j.*c.>q.h.-.
N..tj........}..<....!.....
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCG1HMsB+XmUO HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:50:01 GMT

Expires: Sat, 31 Jan 2015 03:50:01 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268726

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010706Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.mG2.~^e.....20150127010706Z....20150203010706Z0...*.H.............rK5
.%....z.(..*V.......5~......#\Y....og..F....f8[.?M)B....j........D}.K.
....r...HN.0cZ....Q9.&..|..8.1o.9.H......... 0.....3.N.4..D...G.....Ey
|)2..b.1v..{5.......`[email protected].=....]...uWw|.../.M........9D1_s..<..=B=
F..Z.....:.J....F...}A*...g..2....!.m..._5..$.HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 03:50:01 GMT.
.Expires: Sat, 31 Jan 2015 03:50:01 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 268726..Alternate-Protocol: 80:quic,p=0.02..Cache-Control
: public, max-age=345600..0..........0..... .....0......0...0......J..
....h.v....b..Z./..20150127010706Z0k0i0A0... ..........j.....p.I.#z...
(~d..J......h.v....b..Z./..mG2.~^e.....20150127010706Z....201502030107
06Z0...*.H.............rK5.%....z.(..*V.......5~......#\Y....og..F....
f8[.?M)B....j........D}.K.....r...HN.0cZ....Q9.&..|..8.1o.9.H.........
 0.....3.N.4..D...G.....Ey|)2..b.1v..{5.......`[email protected].=....]...uWw|.../
.M........9D1_s..<..=B=F..Z.....:.J....F...}A*...g..2....!.m..._5..
$.....
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCUoyoQiZhRO HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:50:40 GMT

Expires: Sat, 31 Jan 2015 03:50:40 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268693

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010508Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.%(.."f.N....20150127010508Z....20150203010508Z0...*.H................
;>..@.......'.N..F....5..V'...O=.w...bX..... .8nN..Y..7b.b..W..}0..
b..\y.P.....Q...CU.8H.j....W.H.!Q.gY.O..0v?....qP.{~t...U....T.lP.YJ..
3....#N.:.<V.........^#T/<o.k...P...0'Z..|c..........m.lj.BFE...
..l"_.......*.....N......>..*u... .......V...?..v.."HTTP/1.1 200 OK
..Content-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 03:5
0:40 GMT..Expires: Sat, 31 Jan 2015 03:50:40 GMT..Server: ocsp_respond
er..Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Opti
ons: SAMEORIGIN..Age: 268693..Alternate-Protocol: 80:quic,p=0.02..Cach
e-Control: public, max-age=345600..0..........0..... .....0......0...0
......J......h.v....b..Z./..20150127010508Z0k0i0A0... ..........j.....
p.I.#z...(~d..J......h.v....b..Z./..%(.."f.N....20150127010508Z....201
50203010508Z0...*.H................;>..@.......'.N..F....5..V'...O=
.w...bX..... .8nN..Y..7b.b..W..}0..b..\y.P.....Q...CU.8H.j....W.H.!Q.g
Y.O..0v?....qP.{~t...U....T.lP.YJ..3....#N.:.<V.........^#T/<o.k
...P...0'Z..|c..........m.lj.BFE.....l"_.......*.....N......>..*u..
. .......V...?..v.."..<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=2017657&cr=58695&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /dc.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stats.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:00:39 GMT

Expires: Fri, 30 Jan 2015 08:00:39 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15931

Cache-Control: public, max-age=7200

Age: 1560

Alternate-Protocol: 80:quic,p=0.02
...........}k[.<[email protected].^.,[email protected]..>
;.......i4...x...7H\..-O.9.d".....`wp=.$2.X...$.%......dv....q."..F..{
...yv.$."9..i*Y...g..;..8M....k.....{[email protected]
C...).o0A*y&.....sX7p........`.......Y.K..{......p..G.`x..........8...
...B.....Z.A6.....!.".1..!>......b<..=.e.k....=.....y...B..?..M.
..H....R...%.....aw.E&]......!D.....t...a.. .......e.{.....q8....c..=.
1..n.\.z...8JG.;......W......]......$....N...&A...X.KCV5.R...<..._|
b..$.l.*3..1P'.....N.k.\.....Z%[email protected]..}.q......7.u.......,
C.PX%.0..<...^[email protected].`..}.;n.....x{.........:.u G.iP
sv.........q......./.6.... .D.k....y&...[5..1..{0z<.8.ot...........
..h.../.....C...2L..;...P.....E.kBur~uY.`.$....z......D.a=...'E..Y.. .
s.7&X...y.....9..2...5.r1q..A.|.e\\P..R..u`iV!.7a...J...VNW7.j...R...U
c....^L..."8l..".........q.!f..V..-.1..G...*5..R..N.{Q.6..(8...j.;.y8.
........N3..<....,|.K.f;...tq....I...Y{[email protected]..)......oa.F..V..
....)......X..z#..X.....}.I.B....d.......N.....*].*..;pd.\.R.. Og5../e
..h^n.....U.B...;B<............j.........Z..H/.Z.,.~..~.3s.5..,.:..
K.L....F.D...2.......Ix....)tc.  ..j[....r.%..%<.[).k.N.v..s......?
."..^.c3....<...mo.7i)M....mQ.7.....p/..*.....:m2L.0%.-.KK:..y....&
lt;.4./..Nyqla...X...... .........<s<B...|......;*RC..n.9.\....J
.^..l......L 4;..4SC3_f0.P.P. p...........VX..I.q...D..p..N..w......-.
..F...A...cX....k..C..n..wZ..*...E..a- [[email protected].^..gE....>..
[email protected]...'...........w...{L.LB.......w.n.P,....H..<<< skipped >>>

GET /__utm.gif?utmwv=5.6.2dc&utms=1&utmn=1711251411&utmhn=partners.freeridegames.com&utmcs=utf-8&utmsr=1716x901&utmvp=1173x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Download free games, Play free games at FreeRide Games&utmhid=80483054&utmr=-&utmp=/my_games?gameId=659050&utmht=1422599221545&utmac=UA-4994835-25&utmcc=__utma=2252849.2023569898.1422599221.1422599221.1422599221.1;+__utmz=2252849.1422599221.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~ HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stats.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 29 Jan 2015 06:00:37 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 87962

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 29 Jan 2015 06:00:37 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 87962..Alternate-Protocol: 80:quic,p=0.02..GIF89a......
.......,...........D..;..

GET /c/de8640634.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c.t4ft.de

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Last-Modified: Wed, 17 Dec 2014 16:10:04 GMT

ETag: "21951253"

Content-Type: application/javascript

Expires: Fri, 30 Jan 2015 07:28:49 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Content-Length: 3764

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: ws-0408
.......T...:.s....._!...a5.$..$........$..q.Uz:............_.|..P..WWW
......g...H......V.E..{..^.....K.w.........E..A.....M[.|r..........g.\
<v'V...X.../..}.&n..."....G.I..<.n..............|Jy.H.uQ....{S..
...NwB3....u......c.K|..d...^.sV...u......~.pw...8.u..Jy...7....1..Cq.
.J....<7.M..My..s....4..!.eRG.?sO...!.@. ....9d[...Y(.rAA........*.
..8N......>Q|..n.~.....O.....Y.".".C...h......C...n.,."...Y.0..5/AS
J/..gl6G^.eq.-...$.W...=.. .M'.9(.......k2J~..,."s..zX..3.V,.`...SmA&g
t;..:5.......>[email protected]..^p...f.b.Hg.`0........P..r.8.
.].U...a8r./.cbO0.w.....s...b.l...."7...........A.....ZE.].A....-e....
<w..XS1.`...F.5.......[..../...%...P...4.w.V.. .l.*M....q....[..?..
_.[t....Y...]...?b..~a.....x:c....$.:.Np1s....<...."O....c.6S.t....
?.U.`I.E.H...S...N'..9..._...^....@..!.!..~..f...(...h.'...I....R.t...
E...?zi..;1..4.NT._3Zd..<.... c%!......oV...;.. ....f.|.....e.6M...
Nj.N.e....5..S-..|.D..Jp&......C<..t)_l..D..mZ...H....,O.h.G....L!y
...XB.b..]..;}.Gw.6....i:.....B.......fT`..V.zp.@...*d...)..H.*.U."...
4..p......./s..l....&.Dp..x.Y....P..r/..../.....c.RA..A..5.hNV..1i....
......hy.w .-r..R....e.G....J^...BFLts.UIw...5./.R.v[..3V...,.[k.!.(..
.;D........u..5.c8I....a..?....I....-.)j~r........j.%....Y..;..R...eP"
j..W..I....D..d.......n.....xO..&..s..i...0G.?...6`.[y.T./....../.Xn..
GQB.Q.....|..j..V!S%@....4..Zu6...). ..1E...e.....$ ...kY.#.J.T.'.h.^.
..K..2NZ...q....N...$.(....6..H;.....M!r.c8C...............0.1.!.<.
..R..h...)......-Z....x.....'.W..r...y..........ETlZWz..]....fS...<<< skipped >>>

GET /adsi-j.php?s=14076&w=728&h=90&t=_blank&gpts=6110017589091237945 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Set-Cookie: W3HUnique=244535336147_142_07_20150130; expires=Wed, 29-Jan-2020 06:28:49 GMT; path=/; domain=.w3hoster.de

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1056

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[W.H.~..`y..0'$4..`..53.......>0..V.`..8....KH0.......E
W=.\..W.x.}.$=..6..a.7...(V..:kpq....dW..:...H1w..'I.Y..>.f......K.
...n.G.......v.`.*74...6. .p2kg.c/r......i....;...t......]9.........!;
f..o.q..f...n......_.'......<....\.=O..z.s.e)..G...\.......=.2.&...
'...."vx...yXf.,[email protected]....^$q...HvKT....h.........M.b..........n
..l....V\.....Y^&.j)..q0.........>...._\^].s......q.....C0ga...$}..
..^.@.`.3.k:..Y....L.&...~..4Q.....H.....V.J.&.@.. ...O%aT........Q.."
..K..Yn..".......6?.]..t...Vi.c...".  ...=.(...N.b.%.J....J/R.2.p.R...
....\.X.@B`X.. ...Cd.......VZ..0..ZjhZ...b"5EP-R.. [email protected]$...
.z.gV...m...7.F%[email protected]]..0/.U..$....zm.Y'..n.:.h..pL.....l~..
.....K....../>G8mc.k...(.......N..u......H.e.7.8.h..uY.1..G........
/.9.j...o.]..)....&.............{1l.mDQ..../.@.]D..j.>..A....&.<
...n$...%....?......E....4.^^......I.qeh...o3......@#.....1C......b.A.
.......j... ..X.....0|q.j..5.4!.e7..d..,...d/?.......{...A...q.c .u...
..WS....Z...x.).....?.)^...Q....a..KF..6....9..tA4....=..... b._.-E.,.
S.w...#..kU.....Z..e..w......<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2564

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA4AAvAeoDlAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:26 GMT

Server: Apache

Set-Cookie: JSESSIONID=F8E7071BDB9712C05192652601850B37; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /pagead/viewthroughconversion/1057751771/?random=1422599221686&cv=7&fst=1422599221686&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=2429367150

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/105775177
1/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_g
ames?gameId=659050&random=2429367150..Content-Type: image/gif..X-C
ontent-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-
Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a.
............!.......,...........D.;..

GET /crls/secureca.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.geotrust.com


HTTP/1.1 200 OK

Server: Apache

ETag: "70b36d5e35299d28cb869a05389fa78d:1422597626"

Last-Modified: Fri, 30 Jan 2015 06:00:26 GMT

Date: Fri, 30 Jan 2015 06:26:39 GMT

Content-Length: 878

Connection: keep-alive

Content-Type: application/pkix-crl

0..j0...0...*.H........0N1.0...U....US1.0...U....Equifax1-0 ..U...$Equ
ifax Secure Certificate Authority..150130054300Z..150209054300Z0..R0..
..X...140427081922Z0....v...140618150003Z0........140429180917Z0......
..140709194633Z0........140416233935Z0........140521155053Z0.....)..14
0617185515Z0....Bf..120627171053Z0.....3..020515130611Z0.....#..140606
204021Z0........100729164439Z0........140606222139Z0....%...0205141811
57Z0....S...140423105438Z0........140725020038Z0........100729164732Z0
....M\..140430000442Z0.....-..140617185011Z0....uU..150118022133Z0....
V...140624123102Z0........120627171025Z0........100301134531Z0........
140618143256Z0........120627171017Z0.....>..140711125531Z0....[...1
00730213120Z0....j...140226123519Z0...*.H............../...J..W.]...,.
*0Q....2......qq.......A..oQ..CI...f ,,T..x....a..,2.T......i.........
.7.....u..7.).g.N5....}....g.D:.....r#..Y..

POST /do/gateway?sId=Default HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:25 GMT

Server: Apache

Set-Cookie: JSESSIONID=D57D834891933CFEEAA2602D53C9848F; Path=/; HttpOnly

Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Apr-2015 06:26:25 GMT; Path=/

Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Apr-2015 06:26:25 GMT; Path=/

Set-Cookie: 143_CT=1; Expires=Fri, 06-Feb-2015 06:26:25 GMT; Path=/

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Length: 38

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
({"gateway replay":"{'status':'ok'}"})....


POST /opTools/clientTracking.jsp?trackEvent=playerinstallationstart HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; JSESSIONID=D57D834891933CFEEAA2602D53C9848F


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:25 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 30 Jan 2015 06:26:25 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=799..Connection: Keep-Alive..Conten
t-Type: text/html......

POST /opTools/clientTracking.jsp?trackEvent=playerinstallationfinished HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; JSESSIONID=D57D834891933CFEEAA2602D53C9848F


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:28 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=798

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 30 Jan 2015 06:26:28 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=798..Connection: Keep-Alive..Conten
t-Type: text/html..

GET /cookie/?ssp=2&type=response HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: dsp.active-agent.com


HTTP/1.1 204 No Content

Date: Fri, 30 Jan 2015 06:28:55 GMT

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /baltimoreroot/MEUwQzBBMD8wPTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom/nYB45SPUEwQU5Z1ZMIJHWMys+ghUNoZ7OrUETfACBAcnpGo= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:26:40 GMT

Last-Modified: Thu, 29 Jan 2015 09:08:42 GMT

Server: ECS (ams/D1C4)

X-Cache: HIT

Content-Length: 1406
0..z......s0..o.. .....0.....`0..\0......`;.l.uZ..k.F..^|A.Tb..2015012
9064609Z0g0e0=0... ........./Ev..Y..].....x.#......Y0.GX....T6.{:..M..
..'.j....20141203203511Z....20150428204011Z0...*.H..............-H.$..
...........^=....G..ai...I...,)vG.D..[R,.G.#(.D.<..Cg,}...;..2J#...
...GX....<b.&UFe'...I... I.o...&'....e..`..6.....`..~#......q.h|...
..C..#:2w..}.......39.EF.....Rj.M.9...^.....c.?Y/Rz...Q.~.2.I...5..,.$
o..U.....cg.H.[.(.....=.(..;.5...[.n....b*.......0...0...0...........'
..0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U....CyberTr
ust1"0 ..U....Baltimore CyberTrust Root0...150114195242Z..160114195229
Z0G1.0...U....US1.0...U....Cybertrust1#0!..U....Cybertrust-Validation-
20110.."0...*.H.............0.........?....(Fb....G... ..=..(L..wK...0
4..I......C...1.Z......U.$b.f..Pa.....S...#..B.........^T..IP8........
..h8GM..*.4.MP..../[email protected]
.x....$..@@....q2...Uby.e......D....lf...C....ZP}O......7...mM..c.g..j
.\.>.O....G.A........0..0... .....0......0...U.......0.0...U.......
....0...U.%..0... .......0...U.#..0.....Y0.GX....T6.{:..M.0...U......`
;.l.uZ..k.F..^|A.Tb0...*.H.............n.h\Ch*G.c..yr..."._....J.-....
j.t%..e.....([email protected]!m...sZH.N..>.S....K..........7wi3..x.D..l..u
d.....CC......<.&.2. ..d...T.......;.S....\... ......m.6......#(.&.
...q.[z.........r..T....W...7ea.}..B.1........al.]i.F...-.0c...y.=?...
.E...........'>..O.._..<<< skipped >>>

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ad179698380 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1052

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[S.6.~..p...........-..z.....:. ...c{e9........,Ly.s...;W.
x.1..?..52.........13$$).;.uk.6..M.1....}F.........we)g.....[]. /$9[O=
.r.&S.....J_.z.^......d.........=.....Vf.Bm.]..P.Y...i:.[.M..r...5.1..
..QC.M{Z.Q.s..>.#9.fQ../md:.3..np9...l1.....Ca.Y.2.1.g..0.\....(@..
!......R...]..\.(@..!..)...#q ....l...g.... ..H.....[.3........?].X.. 
..-..............;9.....:......_?.v....z.`..aD...*I..,.......0-.......
.d7(.,.*L..O..&Y.U.K .%.c/#..m\I.^.d....3.4...........V.[....D.....A..
..).<v...=.PMS........p..T&..%.....I..K.*..H.*=H..<......[.7g..k
..-....Ng....vi Mh~...,j]...?5w.G..9..G..H...\/k]oUY..4.P...H4. :.....
.O...z..[.h.. r.>JeDc.qK.}ic..<R]Fx..>P.qD..O.i.bO4.7('q.-./.
.H...bE.>e$ ..V_GX.R.m..N.{.L...s._.z......R....6.b.'...0..\R..2.Vk
..uTa...........;.(.'.64.'..pG.N<..a.h .^..G...".:......(.SvN.H..EJ
H2....d<r......X48(.NJ..q...['...8iB|..`.A.Lwy..\...zYy}E}.A'71.b.&
gt;A...F..E........O..*r;1`V!..u.Z2..D9.....0.}.....&iB\.at.n}..gf..:'
x..P.N..m........`5.......eH.1.....3......y..z`....tA4....C...7(j..~..
!.hY.S.g....@...;.f.W...>.........

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1860

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA4AAbA-QelAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:05 GMT

Server: Apache

Set-Cookie: JSESSIONID=56BE9676588E1F0C49DCBC712C70F89F; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com


HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 29 Jan 2015 06:15:01 GMT

ETag: "2015b-6ca-50dc46885cd67"

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Connection: Keep-Alive

Date: Fri, 30 Jan 2015 06:30:27 GMT

Content-Length: 1738

0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U..
..CyberTrust1"0 ..U....Baltimore CyberTrust Root..141203203511Z..15042
8204011Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..13
0130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140
212185542Z0....'....141112202254Z0....'....100217174732Z0....'#...1003
03201301Z0....'!...100312202204Z0....''q..100414175202Z0....'L...11022
4181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303
201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..1012081
75749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..11081
5145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...1
20111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....10
0216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100
908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..1012
08175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...11120
7220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012
182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...1301231
62633Z0....'....130904190524Z0....'....131024214319Z0....'....14012917
2435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204
601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...1407091719
30Z0....'/:..141119193302Z0....'k...120111220827Z0....'8...14071619120
3Z0....'....131219195909Z0....'....140219171545Z..0.0...U........0...*
.H.............7.im~...|.....3........]..Cm...Y.[.......c.J[.....^

<<< skipped >>>

GET /p?c1=8&c2=6035746&c3=3054&c15=&cv=2.0&cj=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://a.tribalfusion.com/p.media/awmPwn2FXxoWInYqPx2HbHQG7B2AnJmdiOVd760bM7YUQi0qqnSUnAUb3XTt3UobJnPUrt1TZbs5EFa4qj1mqFGYFfbUWM0nmfZcpGUqmHnJ3Erf2tmq5AnJprvEYcrTXsQYXGbnnEvT5U32VrnZbUAn5PqnXPVvMQd3w1drrWmry2sQ20UZbuhGKINZb/3002246/adTag.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: b.scorecardresearch.com

DNT: 1

Connection: Keep-Alive

Cookie: UID=120c9bfd-194.221.64.106-1384780341; UIDR=1422599184


HTTP/1.1 200 OK

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:48 GMT

Connection: keep-alive

Pragma: no-cache

Expires: Mon, 01 Jan 1990 00:00:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Le
ngth: 43..Content-Type: image/gif..Date: Fri, 30 Jan 2015 06:28:48 GMT
..Connection: keep-alive..Pragma: no-cache..Expires: Mon, 01 Jan 1990 
00:00:00 GMT..Cache-Control: private, no-cache, no-cache=Set-Cookie, n
o-store, proxy-revalidate..GIF89a.............!.......,...........D..;
..

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ad553456474 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1053

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.F.~...<.q..."..Z..vR.I].n.^[email protected]....;.EH._.`yv.
.o...X.....#.]#..HkX..93....$Eq...Z..\...3.r....-.Nn.~.....T..a....ou.
...dl=v=.i...r..' .:...u.T.".^.-^..K.].....w....Q%}W.W.C.t6.Ls8...79..
E.f..5..0.8ac..s..i.........].W....mL...G.. .....1.gUV.".....T.%}u...u
.......].W....].W....].......g..:....1.}......!..=.`o........s7.......
.............x.....'?~.....g.._...........{..Bz}...$..2......'.i......
.#.....n..$.#..q.sU.....d.MI.t.R..W.Yn\[email protected]..
..a.C..&.y.GT.T.N.2.z.".. e..B2k. ....P.Ti>.lU..FMz......7.oL.....K
l.5..M^..3...4...{...........<H$....b.[.......... ......!P.IO..gbvs
.m..-.....D..>..}...F.tK..h#..<T.Fx..V..0...'.8J. ..;....,.o... 
/....|..O.#.z.a...n..O......e........P...E1~........B.......&..U..~*..
.A..O..P... ..N8......8.2&~.....Q...t..Z.. %..A[.a.%.........x....Iy.t
q.O..bQ...{)Q.G..}.L.cxq..x2.A...Ro....L..zQV}I=..$....t.....B...r.t..
.(.N..<......M..fP.F9.).T..]D..Q8 ..m.....s....X~..%J...|..Q^..)ZG.
......XM.}.......:.9..!....!f..<.puc....tN4.T..BLa....ck^Ew./F....3
..#@....N...^u...M........

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=8127c3635412 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1053

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.6.~...<.s.c....X....6.%M.n..{r..... .I..........!.h.
.7.....eRa}...d8.i.Kw>3...!!IQ..`....P4%...\.w)A ..[._...r..)c..!..
[].k7 ...].r..c..c..Z...&|......W|.We...V.z6$.].6.ETI......9..,...qD.M
..d....a.. L2N..#...q.....B.=.gW...{:.... }T..R.|...C.Ve.,B....I.].W..
.^w..O..{.e|e.{{..ze.{{........x...cs6=.O..1....#...g.....=....;wc/Y..
.Q#...rw..<U..o?.}......?.....g.._...........{..Bz}...$..2.o....'.i
.....P....y.E7Ej.....8..*}mL.D2....:u)I. .,7..2.Mm..a.A O...l..1..K..8
^R.".a..0...>$.y.GT.T.N.2.z.".. e..R2k. ....P.Ti..lU..FMz......7.oL
.....Kl.5..m^..3...4...{...........<H$....b.[.......... ......!P.IO
..gbvs.m........D..>..}...F.tK..h#..<T.Fx..V..0...'.8J. ........
..... /....|..O.#.z.a...n..O......e..W.....P...E1~........B.......&..U
..~*...A..O..P... ..N8......8.2&~.....S..wt..Z.. %..A[..$J...%...)!.8.
.#.............!.R.8...........1.d..........p..#.....z<.I.5.b.<B
.........../gQ...Yy.......8.....r2R...... [email protected]..#/.t.......K..:'.:
...<1R..^M.f{....r.8R..m).u.s.{C....C...y.....2....h..........5....
.._.,.S.g..G....U.N7......cn.......

GET /real/tags/FreeRideGames/ROWROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:28:47 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 11957204031009994980

Expires: Fri, 30 Jan 2015 07:28:47 GMT

Cache-Control: max-age=3600, private

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 13558

Connection: keep-alive
...........}.w.........@.{ .Vd9........m.l...;...Z.,.2.KR~4...a.......
...H...`0......b...8.O.j......09Z.M........=N..7...l.K..l..y...<M..
/..8.......N....}..3F...~al...MV..!._df|.....).h...X.y...*ewx... b.~..
..Uq.].q\..k7...`0....|.....Q\.......Sv.=.........o.4m............z.*O
../O/...I....g...........=.......y3x.7.q..Iq..|.. .ho2..r.U....q.S.p..
]:...P...yZ...*..ts(.N>&.f.c"SS]...3..,y.qD/.MQrj.c.z....v...a..~.M
.N.vN..8..r.B....".H.....zq.<..kQTl.....d..}.4..Wi~.,.....* ......9
...S....d..=.g..ns.e.@G....*.t.B....c..7.=....b..{......s.!N......4[A}
..\e. *........?..8j.9.... ..t......\7i....MSe'...].o....=.....c..9M..
..5......w...i../[email protected] .H.|.Z....6.4.d.)....t5.........;...]A.......
..7J@.>...,Y.&4...~u..l<...?...(....:.......7..7...O_...<...1
W......:<...m....4n.j..rq.Sq.V.......d...$[..2.Bv.rY.......O.|.SDUd
..:[.}9...7g.U.n6n.......*...O.gyq.Gz..~.1p.........L..4.8[D.I>.?..
.En..GX .9..r...;x.|[email protected]}X..q
B..k..L.M>.g...t..Y..I...V.V.vc....c..#.U....].8X..6......f.3.s.~L.
.eCf...........n..|..P6.k#..K.z.p2(.v.>..O<_.........k....F.c...
L".D.f....Hd.n..V.<n..../..b~.0G...t.E.=.....#.}2......4i.`_~.m....
>..T_e7.x.....S.|..B.8.....?....fIB..._....3..|%..D*.-.k..........y
...)m.#...........h5....."Bs.&K<.iA4..S.q..5... l~*a.`UR....J...-.n
[email protected]...}..........^.."...J..,..M..Xr.....up..G..)...UI...k..
H....t......|U.i.:..,.Y...(N.....*..j...au...7...ph.(F.#.....CE"..D.1.
R....*...6[...........y.O...*.-.RI!......-/...*j.2......;...t7....<<< skipped >>>

GET /displayAd.js?dver=0.4&th=8608858615 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 153

X-Reuse-Index: 2

Date: Fri, 30 Jan 2015 06:28:47 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

Expires: Thu, 30 Apr 2015 06:28:47 GMT

Set-Cookie: ANON_ID=alnpe3tZdPuvA7SpHoSaFZdDMVZd4lisQtFfl5fZbW1irZaRKEAAyCPGt; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-2015 06:28:47 GMT;

Cache-Control: private

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 157

Connection: keep-alive
..........u....0....)~o..{);..7...t.j.v.......C0.@..|..#X.u.=GES....hX
b....a.......,............:c...o.?.........Z.;..X-.77.x..eq.U..Z.z..[.
......T..;.f.........


GET /j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=rowros&center=1&env=display&size=300x250&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19279864&a=1&adContainerId=richmedia_2&rnd=19283567 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive

Cookie: ANON_ID=alnpe3tZdPuvA7SpHoSaFZdDMVZd4lisQtFfl5fZbW1irZaRKEAAyCPGt


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 101

X-Reuse-Index: 3

Pragma: no-cache

Cache-Control: private, no-cache, no-store, proxy-revalidate

Set-Cookie: ANON_ID=axnsAGsKBRmrmDqU7pexF4ZdPQSfXCdbUjQqbX3eUcREEMm1HXUuG0ICGYKPjGi6QmqKiPUWt1QCF3XH5mAh1; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-2015 06:28:47 GMT;

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 682

Expires: 0

Connection: keep-alive
............_..8....)\....H..3..f..$.l ...h.....(v.....o..U........9..
kZ.'............]0....,..N]...U./....M.b.M..n>..j..o..pb..>..W..
|......o..Q...08.a*/u/-....?.N..h..._...RLM2......`../...s.|O..&......
....0..IG....np.*^.....q..Y..b..o..O_.~.D...3...Z.?.....eW....'.......
2.;.B.....,h6....~.p...t....P.&$6w.'.,.$.B.$......>......S%wS.Y...I
Bfh...7.vD^.H.~4{.4.........w(..m..).."...dQE.S...7..%paB7....$hG0;a.-
.k..c82..{G-..8s......?.u...{.&.........#.......n...`R..I..].......Y^.
r........B.....V........[.E.sy.......o.v..f9.K.-d\..kN..w<..r)(_..x
d.o...7.J.HN...PCT...Q.!LH=..<....r.....<S.,IK.Ub...V..E5lo.Uc..
...&..DJ....Z;%...r.Wr...........z...e......b....q.5....... ..a.e.U...
....


GET /p.media/avmPwnWHFXomUZdmVjnodfB3qni2tym3AZbFpFUZd0GMUYcZbY0VvMmaBS3bYWTFbZaUPv4PEbXSsFtQdFr1drnVA3M2GMYXbZbBUAir2PvcR6bK2Wrt1WBKndTM363Y4VnaUs38Uc78RAFuWd33UFMS5bIqWaMrVTMlQEJKSG3ZdQbesRHnbUVbaeua0Go/2713736/frame.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive

Cookie: ANON_ID=axnsAGsKBRmrmDqU7pexF4ZdPQSfXCdbUjQqbX3eUcREEMm1HXUuG0ICGYKPjGi6QmqKiPUWt1QCF3XH5mAh1


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 102

X-Reuse-Index: 4

Pragma: no-cache

Cache-Control: private, no-cache, no-store, proxy-revalidate

Content-Type: text/html

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 226

Expires: 0

Connection: keep-alive
[email protected])..E...$]..$......)9.s.~....*4..$.w.e
D.D...q...ph'lYzf.6..........@..&.E)..#6=[.o...*..=..h.......&..N5.^.G
V.......".!...E..e.I.^y.w.<...QB.........;..?......L*6..DB6."...^v.
.f.q....r.?........HTTP/1.1 200 OK..P3P: CP="NOI DEVo TAIa OUR BUS"..X
-Function: 102..X-Reuse-Index: 4..Pragma: no-cache..Cache-Control: pri
vate, no-cache, no-store, proxy-revalidate..Content-Type: text/html..C
ontent-Encoding: gzip..Vary: Accept-Encoding..Content-Length: 226..Exp
ires: 0..Connection: [email protected])..E
...$]..$......)9.s.~....*4..$.w.eD.D...q...ph'lYzf.6..........@..&.E).
.#6=[.o...*..=..h.......&..N5.^.GV.......".!...E..e.I.^y.w.<...QB..
.......;..?......L*6..DB6."...^v..f.q....r.?..........

GET /pagead/viewthroughconversion/1057751771/?random=1422599221891&cv=7&fst=1422599221891&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=595483633

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/105775177
1/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_g
ames?gameId=659050&random=595483633..Content-Type: image/gif..X-Co
ntent-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-P
rotection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a..
...........!.......,...........D.;..

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=2429262-4858523

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: Apache/2.4.4 (Win64)

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Accept-Ranges: bytes

Content-Type: application/x-msdownload

Expires: Fri, 30 Jan 2015 06:26:24 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:26:24 GMT

Content-Range: bytes 2429262-4858523/12146312

Content-Length: 2429262

Connection: keep-alive
q..O..E"^...E.B..D.r=^"....R./.....1-^-../...D|....y}.........].-..Qa.
._.'.......[X..<...f..P....z6.y..U-].)....AJ.U..../..fc3.V.....o.'.
.....^..yVb.]..Lh.3dZDT.v...KT.....|..CB...*...T.j...pSq........G..q..
..y....$...._......4.....`.FT..N.w.4.D...O...|......%. ....._>... V
.6.5...-e3.. )......}l.....i..u.P1.....o..>"..ou........[#...6[#. .
.y..|.Y<c.y....(>.Y.%p......YL...d.S......`E.............?...`@.
...^3.`... X..............A>....vN.^.4..V.*...O.P....6n:........lf.
........yN..{.x..%..-l.Wfc....... _.......z.5z..t...:..4l6^.C{Y.$O. ..
4......../....`p.N.....5..&..X...m.4.v..b]9.s..%...C......j.!?..Sz...&
gt;;*....p.v.k.=.:.=.......H.Y..V.l..E./.Q....$...q5....a...~..Vaz.[(.
1.2..[.6p..p.u3e....K..5.g%........3Kd.|......?b.n`-.A....V.H.b<.D.
..9.N...e........hViVn.s.J$...E...`.f._..>z..?./M..........G|a...L|
..a.......%....l......C~>.1w.D.JP.0.IE...a.....\....r.......s......
sG..]..O.ll _@.]`.].cx..."..>[email protected])....!....
N.:g.uXh..........-.Ue0...\...\.c.b.&D5.......T..B......32.yO.g.....'.
.s....u.s.....o...../G.....O.....'.....9....&....qQ.}t....$Xsh`.5g@.].
.A.&8B....Jr..;.$=....6tUw....~..>.......7.......:@o.a.]...:.....Dk
.O.Zm..5."#.5l.p....ShH-|...#.;.mx..Q.o.......P._XH...W.....u=...U..F.
Q.ukr.)...D.x.2'...:..:.[M.?....!C..e...2.h.%.3.N$*.o.w..a}.._I. T....
S;.sz..%.E...."0....R......p.D.....l.....S.n.K./]g.:K.'~!I..*,..._N&.&
gt;.....x....V...M.k y.-....=8.y(Ys...KS3\.y.Kro.-...*.Kr6..b.u.......
u7Y...J..S?./....$.'9.K>y.....5......re.~.8..km_..|....=.d.o0..<<< skipped >>>

GET /MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRNDpBTXFXL4hq1AIFFLZkDOqgNdgQUuMoR6QYxedvDlMboGSq8uzUWMaQCEQCuH3DgeG4oxuqQCCTRf5D9 HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.comodoca.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

Last-Modified: Thu, 29 Jan 2015 23:55:24 GMT

Expires: Mon, 02 Feb 2015 23:55:24 GMT

ETag: B116DBB1792D70115110AB40FDEBEE6A6AE1743D

Cache-Control: max-age=321393,public,no-transform,must-revalidate

X-OCSP-Reponder-ID: h6edcaocsp9

Content-Length: 472

Connection: close

Content-Type: application/ocsp-response
0..........0..... .....0......0...0...........1y......*..5.1...2015012
9235524Z0t0r0J0... ........M..S\U......E-..:..v.......1y......*..5.1..
....p.xn(....$........20150129235524Z....20150202235524Z0...*.H.......
......\.!.d.=.n..#..W&..y.'..#.oq..;.5........s....&./@...H.......Nr..
..x.....D..U.o....@`J.R...y. .YM.<.....N....J....].X...e.M.J\UGF...
.:.[.N......xc....p..T.....r..........,....,..oy6.{5P.Vb.;<.X.m..v.
......m..F.............,DjF>0.....;^HoF....H.,>.-s(.#."/(...

GET /UTN-USERFirst-Hardware.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 4376

Last-Modified: Fri, 30 Jan 2015 04:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt
 Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertr
ust.com1.0...U....UTN-USERFirst-Hardware..150130043254Z..150203043254Z
0...0!..^....t..30...{C...060927070327Z0"....}...G,..x6vcX& ..10011522
0539Z0!..V...1.pj.u...r<...100128214246Z0!..S..W.....,....v...10020
1155305Z0"....x....G0..X*.<.R..100209213528Z0".....}w.Z..H'r...&...
100301205223Z0".....`...*F......SS..100301222500Z0"....].>?'K...\..
>....100330175849Z0!..|.R..gge/...Kj....100405140057Z0".....'A.....
-eB?8.F..100407141829Z0"........hG.o..}A.....100505184113Z0".....l....
..^...b.'..100506202534Z0"......Mi.A...Q..-....100511230708Z0!..Zg...v
.:..\<?.....100525185217Z0"....Q....K........p..100526081011Z0!...}
....v..\...!.a..100528120357Z0".....m...3du>OP.mm7..100608151048Z0"
....9.........O..|O..100609180604Z0".....%.MD....J.z Q...100611122131Z
0!..<..........&......100629140452Z0!..w(...M.......Q5...1007141745
48Z0"....KG...#.OD.:U.....100723145923Z0"......)...p.u".......10072608
1911Z0"....r..X..Pr. .).....100805203159Z0!..:S1..:Uo.Z.....P..1008172
04713Z0!..8.....{..g........100820194555Z0!..U.\.i`............1008201
94711Z0!.._...z)....ym.   ..100825153759Z0!...M...OT.E......1..1009210
61635Z0!..j....O...,.|~.8...100922022250Z0!..o~..(..j_...c..E..1009271
73105Z0!...n(.&X.."...7$.S..101004174308Z0!....].......hM......1010181
42346Z0!..:....O..q..T......101019043227Z0".......=...R.6...q...101019
122714Z0!..I..l........Z.....101021135958Z0"[email protected]. ..1

<<< skipped >>>

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ad988118211 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1016

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.F.~...<.8...$ x...M.6q]..{q..].X..Y.a7...,.!a.~.....
>....T9....Y.HZ.....i.S.I...F.^..CEW..h.%...$sr......SY*.Fr.y..0...
H...?..f........X.F'^....`4..n....Mn....\.>[Y..........1.s...w@[.5.
.....'...,A.Ql9......6..8).$..wE. .5.......-.M.f.)....(.,...14w.J8.-..
.H4..9.Mk>..?..KI.N.b.....XS.t...... [....E..;.p...W~......~<=..
............._..._..8 a...].J... x.....3-.q....B7...e.E].k.b...4/.&}.H
.D.....zm(Y...,wG8f....;..........NG.=..izAV."....0........*.u.k]..q^.
...H...H..ca\U;.Xr4..Pr5.QR;..w;3.....5...-.G(.:.w......h(..8..; Z...x
.5s.'.$...*N....;[email protected]&........z....J....N....9@..*.........
I#.k.#.di...4....|.d.....*H.nX...e$(.p.").0....k^G....1..$O|LT..{n....
......TU5y&-..rU6d.F.........&...j.7z.....".S...eK.zC.H.-.7.e..R.{@;Y.
..<..6.A7.<.F}..Y...zO...)!.$....y..q...a..8h.^.(-...q.L.S.8iJ..
.`.A.\o....v0H......<.Ins...=C.......5....ERFgiQ7........6.Z1.....R
..........o.,%..0..v>..;3."...,..w'F.>.WW....V..r.\.$.j9.q.K..!.
...1f.....Y.cFv<].].,..HLa...:bk^EuH(F..4..h...PL......5...........
.

GET /freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://player.freeridegames.com/product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue Flo&GameId=659050

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT

Content-Type: text/html

Accept-Ranges: bytes

X-Varnish: 2052674614 2052168978

Content-Encoding: gzip

Content-Length: 1615

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:24 GMT

Date: Fri, 30 Jan 2015 06:26:24 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........YmO.8..\$..7......i){-...tp..-.;.'.&nkH.(v(.....v.B_...]..8
v...........^...ct.??C........c..4{.}.?..-.i.~.#N.e..m...q...?..P....]
P............a......it...z.....1!.@b.....^.>...'d..0...../.\.......
k.hg'........o.........7....F.[[email protected],D..m?.,rO"a.lb..B.....Nn...
H*....G.N.k.i8.j8..SP<O.:.lo..C..R<.....Ws..u.B...N...7.C.<.t
K.}&p.V8,......h$...h8..f..P...R..^t.U/.F...........!.N.C..C.....F..L1
...0%...U...J.A/..FW...N2..E...-.....D.DKJ..Z..n."=R.,QU........... .}
...C..A.h._...0%...A^.....T....Z..-...cNP..MT*.........!....).n.r...j.
...b.t........ ..!.e.[G...:...i.X~b........?P.@:.0i3...=5F$J....C..~..
.$f.O@9.}.z....9.7H........Ni.'#w.(...B....[o.yk.).....!.o..K..!NC.Q..
.. .Y....q...G.4."6.!.8...h....)/r..I....<..|.....T....sy..Y..=....
g!../.i....9.= !.Z..eU.P._H.'._..P.d...0*e.Y$.D.#s.;L.S ..Fx..${......
r.{.....#...".p$w.....gQ.^E..#! .Q..u#O.2R......'4.H...\(. .)O.K...$.i
.....0.l......Bm'i.u..U.....k..v*.&.Q......\.Q.W..L.~....[E..[..i...,.
..*.S..lj..DU`W7......usJ.1.>:N}L....a(...8.f.....,.A=.4...........
[email protected]>.gc.=......... ..D..5...*...g8...H..j..|/..Y.....Stp_.
.?E.. .....z....%.;.....A......Hv.23.TT..Qe...Dw..]..t....r....*..v.1.
U.n.). ....]V....!..v2#j...1..)...S...},.4?..]..A.u. u....K9awP,..R...
.hP7!;.....!.U..L..L).i....$.(W.FM.f..AQ&.....U..........w......o....|
...F.............n....v]..<......0.....mD.:o8.....G..$.*....<..Y
G.^}.V:....c...f....<..=.#[i...'.FZ.\...dO...qp...ei...r...:w.|...'
...|.`.j........,.t..s.nn7..f..w....L...w...*;.......X.v1H}a..><<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/css/SDM_PROGRESS.css HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT

Content-Type: text/css

Accept-Ranges: bytes

X-Varnish: 2052674622 2052169116

Content-Encoding: gzip

Content-Length: 347

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:24 GMT

Date: Fri, 30 Jan 2015 06:26:24 GMT

Connection: keep-alive

Vary: Accept-Encoding
.............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...0(
..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...n,
..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...([email protected].....
Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$...
..PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$............
HTTP/1.1 200 OK..Last-Modified: Tue, 12 Apr 2011 11:54:29 GMT..Content
-Type: text/css..Accept-Ranges: bytes..X-Varnish: 2052674622 205216911
6..Content-Encoding: gzip..Content-Length: 347..Cache-Control: private
, max-age=259200..Expires: Mon, 02 Feb 2015 06:26:24 GMT..Date: Fri, 3
0 Jan 2015 06:26:24 GMT..Connection: keep-alive..Vary: Accept-Encoding
...............N.0......M..)..k..I......`biI)....v)..F..z...L?.N..!...
0(..kC..P.A..c-75*F.=.:. ...=..noZ..AK.f.C..[0..;....6#....[e .>...
n,..z$.4..@U{G....V........r....\b.X......XB.YUie....Z?...([email protected]...
..Zj.......G....=.._..|....`.A!...wS...d..?..;....[^C.s....K..|."s..$.
....PY.g....,]....-;.|.7$6.......4N.O..'.').k.iJ.xO.3.a.F..$..........
......


GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion4.jpg HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:31 GMT

Content-Type: image/jpeg

Content-Length: 58728

Accept-Ranges: bytes

X-Varnish: 322094968 321769539

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:26 GMT

Date: Fri, 30 Jan 2015 06:26:26 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:B22AB4A0B36411DFA9EAD
1B5118C216B" xmpMM:InstanceID="xmp.iid:B22AB49FB36411DFA9EAD1B5118C216
B" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef
:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................=.|................................................
..............................................!..1Qa"A2..q...R#.....Bb
3..Cs$t.%E&r..DT..Ffv.....S...7.c..4d.58.Ueu...6V'....................
.....!.1..AQq"a...2....R....Br#D..b3$4...C..Sc5................?.....Y
.....b.........?.h..................H....;.P.g.H.0}.....1.".....$:<<< skipped >>>

HEAD /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Length: 41175632

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01

HTTP/1.1 200 OK..Accept-Ranges: bytes..Content-Length: 41175632..Conte
nt-Type: application/x-msdos-program..Etag: "4ec28"..Server: downloads
..Vary: *..X-Content-Type-Options: nosniff..X-Frame-Options: SAMEORIGI
N..X-Xss-Protection: 1; mode=block..Date: Thu, 29 Jan 2015 19:31:36 GM
T..Alternate-Protocol: 80:quic,p=0.02..Last-Modified: Thu, 29 Jan 2015
 19:07:00 GMT..Connection: keep-alive..Alternate-Protocol: 80:quic,p=0
.01......

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=0-8244

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 8245

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 0-8244/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01

MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........ K..A%..A%.
.A%..Nx..A%..A$..A%...K..A%...Y..A%..A%..A%...]..A%.Rich.A%.........PE
..L......T.................(....s......-.......@....@.................
.........@t.....l5t.....................................d1..P....P....
s...........t.P<...................................................
........................................text...&&.......(.............
..... ..`.data........@[email protected]..
,..............@..@...................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................2...2...2...2.......2.
..2...2...3...3.."3...3..D3..Z3..f3..r3...3...3...3...3...3...3...3...
4...4..64..B4..X4..n4...4...4...4...4...4...4...4...4...5...5..(5..>
;5..N5..b5..~5...5...5...5...5...5...5.......6........................
.T........0...............{.8.A.6.9.D.3.4.5.-.D.5.6.4.-.4.6.3.c.-.A.F.
F.1.-.A.6.9.D.9.E.5.3.0.F.9.6.}.....{.F.D.A.7.1.E.6.F.-.A.C.4.C.-.4.a.
0.0.-.8.B.7.0.-.9.9.5.8.A.6.8.9.0.6.B.F.}.....{.8.B.A.9.8.6.D.A.-.5.1.
0.0.-.4.0.5.E.-.A.A.3.5.-.8.6.F.3.4.A.0.2.A.C.B.F.}.....{.4.D.C.8.

<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=8245-20587

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 12343

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 8245-20587/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
[email protected]....@._[^..U........f.e..f.......V......P.....V.
[email protected]";[email protected].^..U....D...SV.....je^.M..u
.......M........u..u..M........^[..3.8].t.3.F...E.P.E.P.......YYu.....
..P.u.f......f.............YYt..E.P. .........P......P......P.u..E.Pf.
.....f......f.].f................u..E.f....:[email protected][email protected].....
.P......P.E.P..........u..E.g......................P......P......P....
[email protected][email protected]=..w... .E..P.f...w... 3.f;.
.....].U..V.u...69E.w.2..?.U.3.;.f...v0W.E...........f.<}[email protected].&
lt;[email protected];.r._..^].U...M...t..}..t.3...f.<[email protected].].3.].
U..V.u...Wt!.}...t..U......f..AABBf..t.Ou.f!>2._^].....U...U.V.u.RV
......u. .R..FP........^].U...}..SVWtH.][email protected]) ..&l
t;0..{..|!...P.E....pP.......YYt.NKKOy.....2._^[].U..S.]...VWt8.u...t1
...3.f..t#...3.....QP.q.....YYt.G..?...0f..u.....2._^[].U...U...SVWt^f
.:.tX.E....f....tC ......f...u.t"...f..t0P...7P.......YYt.FFf.<7.u.
f.>.t.CC...GGf..u.3........E._^[][email protected]".
.......f..-t.f..t..u.Q.Q.....YYu.2.^]..M...t.......U...E....w.3.]..U..
LB...f.9\t.II;.u... ........#.].U...E.V.u....u..&.P.F.....@.....^]...3
[email protected][email protected].;.u.2..eP....@.;..E.t.S......
[email protected][email protected]..}[email protected]...<[email protected]..
...<.@......[_^.......1...........2.......1...........5.......2....
.......6...........................2...2...2...2.......2...2...2...3..
.3.."3...3..D3..Z3..f3..r3...3...3...3...3...3...3...3...4...4..64<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=20588-34696

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 14109

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 20588-34696/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
[email protected]..!...@."hW$DcN..N.Z..q..\Y.b..f..~1.(..j..jB..]..D
[).......b..g..x..{(. ...\... .N..W..........`m..7..m)...P....M.dL^...
...C..jG.>.....2p.....y....5.,[email protected][...X .Vp.f.#.j1#_.......
..uj..S.Da>H.k...`...'r...Z.F........-....d.:....._.>P)?O}^.....
[email protected]. ..&.#:87z.{;..B.........].5....%.{.Y
.1l..B.......dT.u.;...t...Y)..G.......:hw=...#....k..1.).....y...e..'.
y.......2.F..'.byRR.V......5E....'....>.a.B...)_.......Wm}.'..up.=&
lt;........W;.v.*.U.J...;...BH.G..V....[.z........y.0..&v..O..yk. ....
{.....#7(=...H...<!%0.s.D..A!.0'..........\.........V..7..KI&......
z......Y~....|....^ouLw"M-`.kS..C....?^3*Q.u3!1.KC*.\H..[t}...Af......
C.O1O!..Y..dc..4e.........(.A....~I..3.3|.o56..H..0.H..$...lJ.Y....p.n
.Z.S.q.......(..(.s..O..U..?.:. .f.6.JW..J.hV....$ .......o{.t.....D.;
...-.8G[#..It.j...d..F~..k..v=...7............X..1,!y......{...s"...m&
gt;[email protected].`[email protected]}Q.......p..3..<.i.BO..8...\
,.?...ua...w...mM....v.......o-..........(R..m..R85..L._gc7....~....n{
BU..c....{.Y.T....!.?.kd.t.....X.{K....N.."...'........-...r...Z/....h
Y0...>.4........b..'W...^b...........v...K.<...x{.....B5k.W...!.
...O..*.D..z...-..#.....YVcA...U..._.i.7.....?.R.......}...C..G......Z
...X............g.r.N...'....S9<s.6.. ......T. ....4.s..[.J;....^$.
.G.........r9.Kz..........wW.Z.................w.N....e3.!cz..*.7.JG.~
h..v|N.M.AeA...........\./....v..e..D_q..B.....D..I...3[.... .~.1.n...
..i...X.?v...%.S;[.9......@.$aZ. [email protected]!.(.?..I....3.a<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=34697-55696

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 21000

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 34697-55696/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.....6...Ua....qihE...=|..J..b;.T-........UCL.j.B|u.!.Q..............V
.OOg.......UN.s..)(.....JK......#..z.......6%l....6....O*.. ..{...U...
:!M..R.&.Lf..M.6u_*<G#...}F..dL.DJ}...d.B.1.....{{o..OJ|Qf....p@...
.G.y.Oj.D.<.U....`B_....8_<.l......R...]....|.....A.........R$..
...[.U0.p.!..O........z..3YT.]6oe/D.!.. .z.|9Tj....g...<^EZ.6....~q
.!U$/.....h.r.7a..h..{'.[G.........Z..!..5.$.....y..:{....,.e.).p8h;\.
\W......R_..!.X....1ov....d..."w~..w..W..b..7'..k.e..Xl|.C.../.D..zsg9
#.b^6...).R..'...U w.2I.v.....yP.t.....y.Fi.8......('.6di......R..~>
;2.J..A*BC.....i.a........C.t..4..C.JO..~....S.H..ft.......S).`.F.....
 bjB....=P .. ...v....fazJ..>[email protected] ^..h..0I`
v.d....=..~,...<.u... &.$...D.. .yK.w).B..V{......S^..M..... .1.Fr.
iG(4......uW.?..].w........KTe.7....]N...u...E..Q;...;*p..`.D...".<
.'H..0N-..n.k. z....J.'H...*...X...<[email protected];p.F.k(..1f...V...7D.Ho
=......H...q..F.n...Q.z...u3...r...{.0).....L...sKS...y...Q,.83.M/sF~.
...=..QS...3.G..2.Ha>}....*l%..u.o........q..Z...............%.V8.3
....)..~q=b.S../..=.NSC...Q.!p.....=.....b#loN_.4.|....%7.8...6S.p{H/.
.....g...v...E..ml.`.!.....P....Tv......o`A............M.}\Pi=h=......
."[email protected]&...e../\....f.9.Y!....K._...B...c....q..3...eY........`...
.@w'...5..P....X......G..gd.].|.....<.J.&..<$y..*.....R..R...8_R
....eG.*d.ugs.v)Hc..h....... ..\..po..~....q.}..l...a..s..L.........~I
.t.V...<q...h..e(............j.Hi".....T.]..9.54...qk.....7....N:$.
,......5<.ZO..>8.../Z..Ftr0fm.:..!.....V...._Nt...>.q4...<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=55697-68960

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 13264

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 55697-68960/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.i>......u...N./..Ie?...........S...K.\..UX.G...H.....B. ...'.>m
.M 2P.:...L....o.."...B..c..[..KL.E..C......A]..%..uV.0...D.....m0!."I
JNze...*aX*.7....e.%..:}......eG.7!.C.W...|i..7r.:.{.g4.....]..[..h.M.
..N.h."..\...P..6b...b.|..........Y.....#...'..)jc..t.<.T. ..X_a...
X....1%.x{\..,..}B.X ....^.....<@.......t...R....r.A......%.i..A...
...5...o..8..W....... .....{U..K...*.x......^.H.Yt=..a=C3y...=..6...~.
U....R..`........>..{.....?.R....I.....k^.r.. 5P..[d.!Roo..r-t.3...
r...*_..l..1..O.....\.........-t.v.Ot}cY1...n...W.s..Y.s..1..#.IW...z~
\>...F0>.U.B8.p"8(BVQ3.3F....]c...m.Fex.}w..f...'..8.{.c.y]I.`..
...r...Q.l.~....{6l.Y_.z....[-T.QX..8R....3...]99.V........"9....'.sCU
..T.z.jZgU1.|:W....Ab..#....l.#.8w{.K..}h.?^..#...F2......l...O.....B.
......X.&.u....|....p.4.....7.\.e..L.M.[H.....-.y.K.....3. 8.....(.1-.
.;.............*B?..$..GV...r#q......l........v.J~M.5P.&.......<..a
-.B..?er3O.a.C`n...V..$1}.'KC.-....7.t.?.n...b'87...;..W{....?HB.1.;d.
.V.tc>.K]...E'..l..oY.^....[M.s.8R....[m......e.......@......^.(.j.
....M.XS./.a..$....0._.z.....,....B..ib.A.G..lQy0..........l%....t=.N"
..M.....d]..)..r.~$I.p.KNw.l...&.=B.W.f....... <.<u...?w.,..lN..
{...q...1..L'.K.Kl.[.......Y.....S'..H....[.T...,..O4..Yg.Gt.......R).
.:..d..6.Z.....=. ..FQyu."U}...V./.&K..._.U.i.c.[....Q.a...e........-.
?..s....7.h.....|g`B....Q..4 ...}W../......... ...!k.k.......d2.f.S..k
c......R..pk.-..f..)15..x^.t..t1..J....as..#m.......:^..A)Y.f.k.]...OV
..j.."..n......g&v.......sn.kQ,6.v#rN...0..j......P...S.<...H.*<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=68961-113122

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 44162

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 68961-113122/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
.....Z..O..9=i.^.........b.M..]u.[@i %.a.Q.o.7......?>.L..X...4....
.:..N.].Y..t)u...~...\9...._.C:O.$$..m.:[email protected].;z.bo
.....|2 ...sKp.........(.0.?C..".}u...e.K(E8.......a......}...Y..d]...
.#O... ...>M....<dvj7/.Gq...C(.".h.43n..f7.[.y..Q...D..^........
..A]_#....B..... T....W.t.....Z.."}a..{g}..)>.l.%B.j!}y8..#;......;
...K*.....X../.c.gQ..n.*,rx......,.3B7Z9..`.k.......)U.... ...%.....e.
....R.0.....L.q.Z.._.......=.G#v.]^m..pH.......72..F.m...H]{.....>.
[email protected].(.{.&Q.... /.].......3..m...ro.....\. tu. ..
.g{....at..b0....%...H.&...*k......_i<Og....F.W`.......w.6..[......
........!...C.Yr.O.b=.Ev....q.c.Ru$........3.h..,..n .......Q:.#xE..K.
.S..'$......<s.V..pFB..G.U.U._..xh>..LD.:.,.qP.....]..)k9M.Q..b^
.v...E....|..Y...aC.....?"j~.....jmk..0....f..4..AH...p...<.m......
..Y....D..*D.....Z.}..y.o...RA.!.M....).jY.5.J.."...j....0.x..[2.>.
[email protected]....<F(..?.j.70...t........;.*.c..p8.........N.)..
...9.....UK9qD..EU.z.....&...B.Z.`!C]..b.vZ.J...(&..........U\...[V...
....mU..... &.N...r...i.]\@...G..Q..h....{2P...V.p.e.b....v.g.j.-...S.
^.....2.....E.}Ry.4]..K....V..X...C]....t.. .~/...o.....].......P."O.6
..i.....R.[J.X..*.*{w.X...#....;..C.D..k...rr.....By&...q=9~..#.v...T.
....;...1c...3..L....1.>....."\~..K....4...G.(.#8..}.............5|
..T51..9...W./. z...W.m.C....m...0.h.G..&y.. 4. ....."..d...]..X..&.S.
.`.iZ.tZ.M.Q...."#.!.J..,.....O..sX...Y.;..\.......1.aG...........b.'2
:!..b?l.5:0..VI3\.M8b=`...#](.OAc.l.7.....!..$*....r....AA...'.H..<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=113123-188222

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 75100

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 113123-188222/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
...?`.L.m:z..O^._.].(......K..../..a.....#h...o(..........6.".ZS..|\..
..,..`...I.U.]..8C...t4.!.Z........u..._.bd......".G.z...e.L...n`.=..8
......!.n0[A.S..D..r.1.....^...y9.zu..5.......g..._.^....z.G..E.......
..).sm(..e...|.V'.{<..Xsknn.....Zz".....hJ0v..<..(S..p...JW.o;..
[email protected].[.N....9:$.g..h*X...L6..;.c....iS.7..=gK7....^
...]=....g..q..aG..\...]..<[email protected].[?rw.E.a.....$3..kU...ot..{(..
.G..22h.L.KM..a...6.1|..x...\...$s....h.T..........eI..:.......Q./....
.yx..z...@.}:......pB..i#........#..'0...."*.M!q.Y..*. ..; D...tT.....
....n.......]{x.J.6c...B.=......V........8.Z2.....2`m.....*[email protected]..
...]......?.....7...B..E.....-.o.u...........%.[......._W.X.%^..x,(...
.Y<M....)kM.....P.........v...1...=......]^..{......3Nr..0.._.=..}.
..Q.VP........T...B.O.....w..*..9l.fUdK..z...z2.u.X]......_....B...#y.
..|.....).{.p...b.....2;..P.....a..1...@UI....}m. .M?K.7.H...G.. .G.\C
rPLJ....h.*..|..Y.. ......dx...s....q........A...E.`.<..n.......b\.
..J.8}...p.%...1..Rn.XtJ*.......^..f.....$T.........E.!.....*..'k..~.~
...`@...gX.....U.....A.04B.M.Ws....C.j......' 2.M.........R7S."8.TE..B
...@...~..9.'_*...<:.A/=.......Q. u.2..p.#3SUO`.`r.......~.pJO...Z-
....a.....L...x..'..U.#u.\.dY...p..CS..6....i..db#.b..;..#JG....ze.,z.
.G........iz .....5}...dO..:WF [email protected];.90[...V0.`.P..N.T...W(.N.n..
..5 l_.g................*,..Z@.:......q.k....0}f../..X....~f.6.g.;..U.
....A..er.p..~.:....[.T....9....6...?.]..*,[...`sm...H..6...4..Ir....&
lt;%.T..O.g......aW..r..L1 G.%.g....9Ko>VM9..W.2.... u....{)^..<<< skipped >>>

GET /edgedl/chrome/win/8681233296A99640/40.0.2214.94_chrome_installer.exe?cms_redirect=yes&expire=1422613869&ip=193.138.244.231&ipbits=0&mm=28&ms=nvh&mt=1422599408&mv=m&pl=22&shardbypass=yes&sparams=expire,ip,ipbits,mm,ms,mv,pl,shardbypass&signature=40A3997E238BC2D74EB153F5C3035DD19231749E.4ECED4541094AF9CEBC6E55E60818AB6DE78200C&key=cms1 HTTP/1.1

Connection: Keep-Alive

Accept: */*

Accept-Encoding: identity

If-Unmodified-Since: Thu, 29 Jan 2015 19:07:00 GMT

Range: bytes=188223-227966

User-Agent: Microsoft BITS/7.5

X-Old-UID: cnt=0

X-Last-HR: 0x0

X-Last-HTTP-Status-Code: 0

X-Retry-Count: 0

Host: r3---sn-3c27ln7s.gvt1.com


HTTP/1.1 206 Partial Content

Accept-Ranges: bytes

Content-Length: 39744

Content-Type: application/x-msdos-program

Etag: "4ec28"

Server: downloads

Vary: *

X-Content-Type-Options: nosniff

X-Frame-Options: SAMEORIGIN

X-Xss-Protection: 1; mode=block

Date: Thu, 29 Jan 2015 19:31:36 GMT

Alternate-Protocol: 80:quic,p=0.02

Last-Modified: Thu, 29 Jan 2015 19:07:00 GMT

Content-Range: bytes 188223-227966/41175632

Connection: keep-alive

Alternate-Protocol: 80:quic,p=0.01
).......X.XqU....  .*>....]~..o..{...."i...v.f...J..]....o....x.?g.
0.56:.@Y...^....q.....j..aTU.......^ ..P...c7...d.V.....lS.V..{.t.".5.
X.#....Mr...f.r.e?...U....1...B$-Lt.@..>^BH=..0..5p|s%M4 ...J..W.C8
....`.!...uy.|.....?.z?......(.....e..2%...k..!...X.9.a.1.. ....|.....
..f.........7..*...!..[a...y....g.m....f....a.3.. ._.mS..t..X..>..V
........KoR. .$B..S.....S....H.>......2.jE.........9.z.Z...<7]V.
........5Ws ;..\...u.Li.V.?..Y.......=.....x....!..'.7N..fY......X{...
.|.3........H...4|..8/D..&K...)#..)]T..c.jvw&....3,, .....3...~.......
.'[email protected]..([email protected]..;..........rV..
....1...o......_. .............#(..../...AO#.;57da...<`.X$...['...S
zK.............:s.j.\.~..L."....(..q......t....).y...n......O..|..O.L.
..U*=..p.....V......(.a..v..........Q.....v.W..W.{D.maQ";.r. .....H...
.|[email protected]^..s...W)....$.F.!R.^..j..t...C..s.....J-...0....'.........
.N....G.T..(.$.Q........r."j..4..EiR..w...f....#4K...w.r.0...I2...8f..
i...-..bme.b....h{..4.,.".%. y...Bt.../YR...z)...2...(...D..w{..#..>
;.7.......vj@........ *. '.....OQ-..uv....5f.D.E...KK(.{..&N6....l?. .
..:. ....l..L.b..Tda...h...\..Q.Sw..<.I....(....,....{.....z...!N.f
.<.O.......P.o.n.^. .................j..i~....>...i..-...... .".
........N*.UY<......aJ...B$.Y. .....H.!..8....c3.I.Zn1&QQ.6.49.....
D.?...W..W.9j..NH0.bF.1..g.......n.=.JSq..~....b......m\CUW....f......
.Q..r .....(.K.tB {[email protected].|F..,h......&....R.O~D..zV..$.].R....
...B^E....,[..._H.S.gw. .>....n%1...}m.#....4.....D.-FO.......o<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=2659804&cr=58414&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /FRG_site/downloads/geo/en/Exetender_Default.exe HTTP/1.1

Range: bytes=4858524-7287785

User-Agent: AHTTPConnection

Host: dts1.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 206 Partial Content

Server: Apache/2.4.4 (Win64)

Last-Modified: Tue, 12 Nov 2013 14:37:41 GMT

Accept-Ranges: bytes

Content-Type: application/x-msdownload

Expires: Fri, 30 Jan 2015 06:26:24 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:26:24 GMT

Content-Range: bytes 4858524-7287785/12146312

Content-Length: 2429262

Connection: keep-alive
.>.W.O..Y.'...n....1l...^.YR...'...-..<.._...........'..,x.....`
........IS.V.....(.a.....i$.|.^.....W...P.(....&.....a...c.C......M..B
.4..3..y.R.....,x..O..... ./HT*.]..5..Y.W=..f.7....y.vcs......H..)0.h[
m...Z..ce[.XY...n...S....G..t.vD'.. . e..<...#12....6....W....<.
/{...W....8..pk.VoaN.9......C...g$...........'F.......2..YZfq-..v....f
d~Cd..-...s..T....t..S..T...9.S..Q/.0..l.=Z...p0...F...}7....e...G]:~.
q...l."...vv..~.#......S......=1......4.X#3D.t..Q..........I..4v`.. .=
a......ix3...CK.a.&....o.g...X.n.)..z....G..-.X.|%S..8..&...1}....../.
\.)..L.@wM..<P70.....b..hR..B...O.#.l5f.....1..op{..8..)... I...0.O
..}5Z...Qj`%f....6g..u..-.|...O..m.A..... *yV.i\...=...Wj...v..p? ...v
....:.......iKD_.t.k......|....68.6... &a@..:.....I....'...iI.L..._. .
..j..:"E...i).0R/2G&..w).fet.,.....#J..m...X/.......i.;..E..}..c..Z..&
gt;..Xi}.....`?.....N..i..i..qY..!r.Ji.n..p....oz....<.U.:..Rur....
Q....bE...F........zC.4.......s=~~..!...z.._:.-.z.9b.......1.f.......^
?..'...I.(.>P.K.....B.]5..;..m.e.!.........&..]...b^K...LCQx......Y
^:.....ofd...]..`..aR....o...p....h.e..l.... ol.lt......K.......,...r.
..........h.x`......|.1.x..}....T.c......h(..{.dgKm.......}p.3......a.
~....`SZ..2.Y...D.u(1.....i(Z,.iK./.W>h..o..b?J.9...A#..W...G..w.0_
.=.......WP............S......./....H.u....<8....j..._....|kaf...S.
..zy.v..x....E.&.W.7.u....|hX%.{.H.|..cA.~......WTC.E.wc1...K.d/.fgh7.
.}......s4.q..f..........S.W..~,N.v..v......8...h..b.......V.....D....
)#..F...%.......S?......>.U..}.>.|.N.O(..A}1...N.bO.. ...'..<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=7418964&cr=58416&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /PublicSureServerSV.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=864000

Content-Type: application/x-pkcs7-crl

Date: Fri, 30 Jan 2015 06:28:47 GMT

Etag: "2b001f-47061-a00e2fc0"

Expires: Mon, 09 Feb 2015 06:28:47 GMT

Last-Modified: Fri, 30 Jan 2015 03:59:03 GMT

Server: ECS (ams/49B3)

X-Cache: HIT

Content-Length: 290913

0..p\0..oC...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybe
rtrust Public SureServer SV CA..150130034345Z..150209034345Z0..n.0....
..... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I
..101116165848Z0.........,U./...101116173007Z0.........,U.h...10111617
2944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0....
.....,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z
..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..10111619
5619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0....
.....-..4...110315204303Z0........../P....120206141831Z0..........I..@
..120124180322Z0..........JP....110222182509Z0..........Jf/Y..12021314
2815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0....
......YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu.
..120220131416Z0..........^..^..111007192320Z0..........`.w...12021314
4727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0....
......hlG...120213145015Z0..........h.....120130140408Z0............j.
..120110213653Z0...........}....110406160143Z0............$...11040100
5006Z0................110401005536Z0............W...120308151704Z0....
.........h..120228141105Z0................110314145902Z0............`.
..110322142311Z0................110322142551Z0............lb..12011021
3802Z0.............0..130201130700Z0............OB..110321165802Z0....
.........o..110321172720Z0...........g.:..120221183148Z0...........Ud.
..110516131110Z0............h5..120229174140Z0................1202

<<< skipped >>>

GET /bk/8774481?t=1422599354266&l=http://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a&r=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&f=1&cb=ftgs_8774481&x= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t4ft.de

DNT: 1

Connection: Keep-Alive

Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=


HTTP/1.1 200 OK

X-Powered-By: PHP/5.5.19-1~dotdeb.1

Set-Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=; expires=Sat, 30-Jan-2016 06:28:52 GMT; Max-Age=31536000; path=/; domain=.t4ft.de

Content-Length: 598

Content-Type: text/javascript

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Pragma: no-cache

Expires: Fri, 31 Dec 1999 23:00:00 GMT

P3P: policyref="hXXp://t4ft.de/p3p.xml", CP="NOI DSP PSAa PSDa IVAa IVDa OUR NOR UNI COM NAV INT CNT"

Connection: close

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws-0402
window.ftgs_8774481(0, "<scr"   "ipt src=\"hXXp://accado.adspirit.d
e/adscript.php?pid=2344&ord=[timestamp]&rdclick_0=[clickurl]\" type=\"
text/javascript\" language=\"JavaScript\"></scr"   "ipt>\n<
;noscript>\n <a href=\"hXXp://accado.adspirit.de/adnoclick.php?p
id=2344&ord=[timestamp]&rdclick_0=[clickurl]\" target=\"_top\">\n  
<img src=\"hXXp://accado.adspirit.de/adnoscript.php?pid=2344&ord=[t
imestamp]&rdclick_0=[clickurl]\"\n       alt=\"Hier klicken!\" border=
\"0\" width=\"160\" height=\"600\" />\n </a>\n</noscript&g
t;", {"aid":1211,"otp":"1211\/5101070\/8774423\/8774451\/8774481","otf
p":null});..

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.min.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 33690

Cache-Control: max-age=15612

Expires: Fri, 30 Jan 2015 10:46:49 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...............F.?..<E..).b..(.........v..i.......E.,^"Y*.E......m|
#2...,.g...n.q$....;..v.f.y.o>.}...W....=.z.jq.77.Mq9/.|....^..?.[.
.r..c.....,.....&..m.g.^...\f.{z8....\e..O.<..?..^.O....oe~....u...
;."...U.w.....t6.....xs.Di/Ye.T.M|....]......:_foW~..<.z.v.{Y.]..O^
0.z.|......*DO..j.{.=_{.Cz....-U.n.x..=.../. '.x.{.Jo{|..j....n..l7..4
/.....T.{.rZ.3........C.jU..<..p.......'.V....e.J........?.m....fG.
..{......P.....t..?.B.X....k..s.c.K..-.".pS.n..P.6...:.Y.T5.4\.W;...U.
.44....;..,e.=...^..S?]c.i.C..O.h......_.....GK5.M..8....4.4.E..Q.<
...m.{[.....O.....=.lI..8....n....2.?.{/.....?&....}_...v5.....w..}..G
..w4.....l.V.......i.mw..&4Yi.@[&..........i.>.S%..aA0..fQ.hK..pP..
....<_......(.]..\-.R..z0Ym."....rPt........o.g..zM..!.P...p...Mi.l
w.rYx..|4..V.......0F..|4....<....1..-..S/....|Nx...;........".w.3.
{..Q>Z.i....x.Ut...:Jx. .3..f..G@Z.:.y..g4\j.v..B..]>...c...[.. 
z......\...:\.%.p...AB{[email protected].{?..d.[..dC....h...!X.V.w.[Q..
...:.h9\.i...........1.Ae.yr.W.........M.]..k...y...c.y.J.P..O..G....i
AJZ.{[email protected].}0.........^......&..5.....`.F.Y....<.......
....@[email protected]..`......V....78M.X yM.b.x(u....Q..f.l...f....E....
3.#..l.l...`1Y.t.N...M...o..ZR!.D.<..}.JFJ.bF..A.z.....z3.a....x.D.
..S9.D....N.n..j1...)f...$..?.z.Q>.....Q.3.'.n..P....x..|..v.....&l
t;...F..~..M.eh)..Q6..x..]..O.......G(@..N.H.... .Ip../.pjz....h.....t
UD..V.h2..........].Y4.N5........7j.}...3. [email protected]..}n4Pz..5.....h&
gt;...$...X0....U..S...u;...BV.A._ F.P.........T.F.6..I..b.%*..:..<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/cookie.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1228

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........W[[email protected]..)......e3.I....E...o.-_.....X"
.......y...P.....*._WB|g4...5YR....8=.=.i.........C.....gU..^,.U..!V..
..!....B.z.(.%.zPX....g..... &..?I...1|.../......./..~..m......'.U.,&g
t;"?V6.^..j......  ......VD..a..Ud...z....bDOAT....Fy.....=`....c..I.5
...........A...3=...I.k............,h...}..qK.&.....'a...=....qs...1D.
)F.c=g.....cl.b.....X#...q...1'.....e..V.............0.....Q..q.X.TR..
..B......M..>&._E..........,.h.<.....p..z...H...R]...8..o..*...8
.:.,r.[..j....`xK8..@.... [email protected]:...U..Bc.X.4MV...ox9..VNc
Y.L..]q.oM.......v......F.z......t.....t...}....mLl.*...._g..7..{\.4U.
.n.2-..;.=CF.... .....N..O.~.*.D.....F..'....V./_..W.Ss{..J,Of.Z:..D.m
.j...%R%Y..\..KI6.g.j.........(..G.u..Ri2..L P Z..a.3..}.......t..k.4~
..*..U8..........Lt..83....z.....O|/5M.....M.,./..m..v...fq...]Y3.J.$.
g0.h...C[u8.?.M}....f..T."6.M.3.77m6..X...Lc.Jc.....5.WD...d.........F
.V..6.?p.......C.......S)..}.3..../6..Z`P....\.Q.....-..n(A.....h4....
..em.Gj)...snr}..i.D_...._.N.m.[.........v...3p.`..}[email protected]..}F....~.
.\E....}..n...V....".B[@<9I.$..... ....-.*!m ...L.Xj....30.|..'....
.'[email protected]..{x..v...^..`/..E.\.Z7j...[wj..:8m,.{.@4).'
.........r'j......u. ..o...<.UFS.|...y`S..b<`v........
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.player/resources/js/player-debug.min.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 46010

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
.............W.9.0.{....}w...!.d2.;...'.._.Mf.........Yw......V.>ZR
..&..g.g....R.T*.JRIz.......*...].[[.............$..N .w............}.
.K.pp..G..(L.....Rk4Z:F.d.8L..]8\.....`..s....k....(...u5._.....q.....
h|....:JX.n{....N.!..;.i..}'...q;..E......4...8.......,../...#.>.38
7....,.'......D%.. \r~.bz..g).M.`..4...`....m..Q..K....(.D....O1.9.1..
>.._..QX.#)..L/.t..W.u/...I......e.Ys\7..U..^......,:[email protected])u.>
;'..f.....'.Q.^s.../_PJ...0I...C...m..4Ip..-.....5.....J...q.*......._
J...1..4....(N.K.8^......0..&......*.......@~5g........3...$^.oZ..ra#.
.B.....g..n....0&.J.7nS...}D...&iB...@1)I.I.`:.m.....FL......(.\......
.Aw0.nSW..8....\n...N.....Q._..  ..gq.ut.V\..b.:.o.......b...x.T....X.
.2..|....(...b...L..su~.X.............t4R*c...... .<.............$V
..S.h;.......,...x..'.H....nx..:...&..#.c.k......F.01.0.....&.Yz.s,k..
v.}.................kCA..:}I}..7.P .9...Q..>b.5l....8...>.,.Bz..
 P........s.a...=%.N.U..'.. .....y...... y.j.F.z.)..j..I.......B....v.
.l@..*......eS.XJ...ZY.Dl......S..!...*:...X..rf.|.Di.T..uy........}&g
t;.8j.`0...0..K.Q<...Fd9......q2...%..!..yE-...1=E..E..Xc.q.....w.=
9n..[.v....hM=8.n..6...5.2*,.x<..B[*.c........0}...1..m.9...Zs3.LIb
..%....*i*.....&Fl.5..Q0......1XX.j.G.8t.......f..E..D..2...9L.d<..
...6Mx$..}..A['l5v..G...OO9y.b...l..f-.;..l..[.S....<...-...b.L..Z.
.eE$~.6.|N..'.......|.J.....a._..jMGjb....S.A.s.Lv...t..YLI.LS..Vn.*..
j..L.*_x..|....%...Z..K*...j..2....._.."/.,.d...;..hX...."Z..T...v1.&g
t;h.$.%...f:.|.2.!.....G#..d......K6....>....o....#PP.~....e..b<<< skipped >>>

GET /static/marketing/main/css/gamebox.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 940

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
...............0........LW7".7z7..g...$jF$..m....'..$r.......%...O...!
.SG..p....S.O>2r72.."...|..w..m.&Szz.9[.7[......j.a..%!8......~3>
;...h.2..4...soNO..d...j......l..L(.6.c...?.%.,..3.tfWY .....tu`L....%
.......0.3..i..(.br..-....K...1..*.....T...U._b .o.P..<...3.. .Gq)N
...@e%....).<L.ZT.........#&..$.=N>/..7..$o......!. ..ak..0&i".B
Oc_.*pD,.....T.....?].<*.[.aD..b.^O&.b...(..(.....vY.-g.........R~.
.(..B.~.>\=.....".x.?).T.$ ..ED.(.Z.......]...g..{..\N.s...0N.j.R.h
.9.l.....'J..yU....u...P.c...K.........:.Q..w.[L.b.=.L..*6zg.R..Wf....
.&4..Ui....EH^l]...%..........9.S.e..w....R.j.m.e.v.?...u.D..@].7...do
.t.3Y.\.9.!.).Q.......V. ......i..!.9.(.&..N....&...k...Qj.....$...-:T
.....{..P../X..............y....o..!o..".....=.kR7.]......][..~.\.6..&
gt;.........m....u#y....3...D7...z3...*..=....BG.9.;.=k......~../....%
...1....Nh...hM...*...z..x.........Up.....S..f....... .......Y\qY.G.b.
...a.R.Fr.Qo...S.r.C.^...86fr'.[e.aq...$.H:..?Y@..........


GET /static/marketing/main/img/background_pixel.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1591

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:92F9539BA75
AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.did:27704965522811E1800CB
3176D22E618" xmpMM:InstanceID="xmp.iid:27704964522811E1800CB3176D22E61
8" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:165525FDC050E111B59EE6C32F2CA589" stRef
:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................b...............W..................................
..............................aQ...............................?......
............$v*.#P DE.;..........7..$P....F.U9...)4..7<QA....TRh.@S
...TV..R.0..............Rb.......H.X.R..* ....Vj...).....".J....* <
.y.NqEf..* ..@Vj..*......Q^}.&..>(.... ..B..E9.yTS.Rx".E .r....<<< skipped >>>

GET /static/marketing/footer/css/footer.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 403

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
..........}R.N.0..=...1.D.....0KG/[email protected]!:..dq..5....
[email protected]]...W.D8...C.k......K..UwY....2.....^M}O,....
..?Z.[.$j..I......FG....R....C.>C.........wa.._.oQ...w..rl....t.1W-
.P..g..r.....:..l..F.......#1i...8'[..<.......\.B.n6..*.V.vi ?.....
,=. ..X'}0 N..z.\q...].~I}0.. ..!,.]*.D..H5.....Q.....o...E...m.d...VI
}...p..XC..b...`....q.c#.....a..l..&.j.SX..U......7...6........


GET /static/marketing/header/img/icons.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 34162

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
.PNG........IHDR.......l......d.\....tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:F249C00A9951E111A7D697F015223A85" xmpMM:DocumentID="xmp.did:23E2
C840532E11E197DDFBD349484D06" xmpMM:InstanceID="xmp.iid:23E2C83F532E11
E197DDFBD349484D06" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B36963060153E111A7D697
F015223A85" stRef:documentID="xmp.did:F249C00A9951E111A7D697F015223A85
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>p.......IDATx..].`....{wi.v..4. .......T.(]DQ..
JS:XA)J.."E.). .B.-... .....K..7.../.$(........y.fg........i          
./(B,...........$         ............K..........B,...........$       
  ............K..........B,...........$         ............K.........
.B,...........$         ......r...h..} .s...?I#.........(.P.N..x.w.V..
........6.x....O........!.....C.6I..j).E....M.WfC~_v..Tf.;.{.....S...3
.7.r.*.o[*..j5...q{...N6..C@._....ww..q...F.......:v.......7r...:.....
6~S.W.........@..{.(.(o...............v.(.".p...BtARK..G-....^.B`.<<< skipped >>>

GET /static/marketing/main/img/sprite_sheet.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0



..2..|^.(..?'U.uS.././j.;...}..%.....%>....W...(.|`...........J^.N.
[email protected]......@'..o..9$..t..`.......f.b..W...
kL..8.......R...Z.`H.x...l.&D).cA......h .....%....".#].^....tK.*.....
D....F.#.q.....Way....O....hw.L.......... -..HDi.k.X|.H....Q.A......D.
~...W.A..(..3(O....I.Z..-...2.A...GJ..Zk\%wZ.......)..:....8.:*...^...
..O|......E .<.k-A...!w.v...m8.......>....g|....<.T..&O..}.2.
.9.|}....~v..u..s\.8..s<F..a...%$.%..........V...u..?.....3\.^k.U..
.).K.9.....w.=.k.Y.z,....w..U.VM...t......q.;w...,..}6l...E..;w.]]...U
UU$..}......i......{`.....4]q...P(\.E...T..~FQDoo/Z..o...O.....E.}..~u
[email protected]..|Na..E]m...8.p..2
.xP.eU...Z...W....X..w.@.|..M?....Y.=K!.....F...k..5..-~~.../vww/.dz..
.3w......N,.<][....b.q.K..z....,U......06....w..WP.~e....>c.?L.@
..w.....>0.......K.~...b.lBEEb..b.G).d.x..X...j..u1....P.........k.
..c..O.Z.......l.....j. }.7.....V..8/V.........p`.i.N.u.iG..P[.R_....N
RI.hc.L...P.z_Z..........i[....r..=D.*v......Y....'b........b..q.R.!..
R,.."MOO.L....}....9...........`.........f|.o.k..B...a ..)........).7.
...}"..LG...E.%.i...$...c1D.cP2..C.!./v.K}....".._.rA....D...1.8..5../
c....v>.....v(.lE.m....K`4q.P.gH..".!...z.Q.OZ.. .R(....... ..$."FP
[email protected].!%..3...Uq.W`...G.....{...G{k kW.....q.'.r.r.z.....K.@..
e..eDa....`..........T.....9...s.=......A...s..=..s..l.....=.jwT.1uN\ 
..F..5..G..Sq......&...[[..'@[email protected]....]a.{G.....O.
...&...k.F..c.o.l....t/.(w..&\.....2.ppH:.;.E..I...Dj..3..h.m.....<<< skipped >>>

GET /PublicSureServerSV.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=864000

Content-Type: application/x-pkcs7-crl

Date: Fri, 30 Jan 2015 06:28:47 GMT

Etag: "2b0027-47061-a7077700"

Expires: Mon, 09 Feb 2015 06:28:47 GMT

Last-Modified: Fri, 30 Jan 2015 04:01:00 GMT

Server: ECS (ams/D1C3)

X-Cache: HIT

X-Cnection: close

Content-Length: 290913

0..p\0..oC...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybe
rtrust Public SureServer SV CA..150130034345Z..150209034345Z0..n.0....
..... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I
..101116165848Z0.........,U./...101116173007Z0.........,U.h...10111617
2944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0....
.....,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z
..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..10111619
5619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0....
.....-..4...110315204303Z0........../P....120206141831Z0..........I..@
..120124180322Z0..........JP....110222182509Z0..........Jf/Y..12021314
2815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0....
......YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu.
..120220131416Z0..........^..^..111007192320Z0..........`.w...12021314
4727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0....
......hlG...120213145015Z0..........h.....120130140408Z0............j.
..120110213653Z0...........}....110406160143Z0............$...11040100
5006Z0................110401005536Z0............W...120308151704Z0....
.........h..120228141105Z0................110314145902Z0............`.
..110322142311Z0................110322142551Z0............lb..12011021
3802Z0.............0..130201130700Z0............OB..110321165802Z0....
.........o..110321172720Z0...........g.:..120221183148Z0...........Ud.
..110516131110Z0............h5..120229174140Z0................1202

<<< skipped >>>

GET /reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-588683927 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:53 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:53 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:53 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-70178975-0x0x50x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:58 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:58 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:58 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:58 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-665026422-0x0x175x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:29:15 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:29:15 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:29:15 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:29:15 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-245894870-0x0x302x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:29:45 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:29:45 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:29:45 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:29:45 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-488605887-0x0x601x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:30:46 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:30:46 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:30:46 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:30:46 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1..

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2560

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA4AA2AiRilAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:45 GMT

Server: Apache

Set-Cookie: JSESSIONID=94CA5BCB60CC9E82D5E81365EFBC6BB0; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=6&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601959428190

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 19
document.write('');..

GET /freeride_marketing/SDM/SDM_standard_2010/js/defines.js HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:32 GMT

Content-Type: application/javascript

Content-Length: 1376

Accept-Ranges: bytes

X-Varnish: 322094827 321769275

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:24 GMT

Date: Fri, 30 Jan 2015 06:26:24 GMT

Connection: keep-alive
Exent = function()..{..};..Exent.SDM = function()..{..};..Exent.SDM.Ma
rkting = function()..{..};..Exent.SDM.Markting.Defines = function()..{
..};....Exent.SDM.Markting.Defines.BASE_URL = ..{...cdn : "hXXp://cdn.
exent.com/freeride_marketing/SDM/SDM_standard_2010/img/",...freeride :
 "hXXp://VVV.freeridegames.com/product/img/SDM/"..}..if (navigator.use
rAgent.indexOf("Windows NT 6.0") != -1) ..{..  Exent.SDM.Markting.Defi
nes.SERVICE_PROMOTION = ..  {..  .servicePromotion1 : "url('"   Exent.
SDM.Markting.Defines.BASE_URL.cdn   "servicePromotion1.jpg')",..  .ser
vicePromotion2 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn   "
servicePromotion2.jpg')",..    servicePromotion3 : "url('"   Exent.SDM
.Markting.Defines.BASE_URL.cdn   "servicePromotion3vista.jpg')",..  .s
ervicePromotion4 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn  
 "servicePromotion4.jpg')"..  };..}..else..{ ..  ..  Exent.SDM.Marktin
g.Defines.SERVICE_PROMOTION = ..  {..  .servicePromotion1 : "url('"   
Exent.SDM.Markting.Defines.BASE_URL.cdn   "servicePromotion1.jpg')",..
  .servicePromotion2 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.c
dn   "servicePromotion2.jpg')",..    servicePromotion3 : "url('"   Exe
nt.SDM.Markting.Defines.BASE_URL.cdn   "servicePromotion3.gif')",..  .
servicePromotion4 : "url('"   Exent.SDM.Markting.Defines.BASE_URL.cdn 
  "servicePromotion4.jpg')"..  };..}....
<<< skipped >>>

GET /freeride_marketing/SDM/SDM_standard_2010/img/servicePromotion1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: cdn.exent.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 12 Apr 2011 11:54:30 GMT

Content-Type: image/jpeg

Content-Length: 48259

Accept-Ranges: bytes

X-Varnish: 322094855 321868070

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:24 GMT

Date: Fri, 30 Jan 2015 06:26:24 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:A1C6773DB36011DFB77BB
4D18C2D0A6A" xmpMM:InstanceID="xmp.iid:A1C6773CB36011DFB77BB4D18C2D0A6
A" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:B3C1E96644B3DF11B72A88327B6583E8" stRef
:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
...................=.|................................................
..............................................!a.1.A".Q.q2#.t....B.F..
...Rb..3C$4T%E&8.r.s.D...v.u...S.e6f7........................!1.AQ..aq
.."2........B#D..Rbr3$...4....c5.Cs.dE.............?..Y.......8.....Q.
..?Y...X@....@.....$z....d..8i....(O8..A..HE.W.T.*%....T.....i..c.<<< skipped >>>

GET /do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=659050 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 302 Moved Temporarily

Date: Fri, 30 Jan 2015 06:26:22 GMT

Server: Apache

Set-Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; Path=/; HttpOnly

Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_TURNKEY=Default-481422599182472568; Expires=Sat, 30-Jan-2016 06:26:22 GMT; Path=/

Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-Default; Expires=Thu, 30-Apr-2015 06:26:22 GMT; Path=/

Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Apr-2015 06:26:22 GMT; Path=/

Set-Cookie: 143_CT=1; Expires=Fri, 06-Feb-2015 06:26:22 GMT; Path=/

Location: hXXp://player.freeridegames.com/do/SDM?action=config_7_5&contentId=659050&type=EN_NO_TB

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html
....


GET /do/SDM?action=config_7_5&contentId=659050&type=EN_NO_TB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:22 GMT

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Transfer-Encoding: chunked

Content-Type: text/html
7e7..<?xml version="1.0" encoding="utf-8"?><Response><C
ontentConfiguration id="659050"><IS><Url>hXXp://dts1.fr
eeridegames.com/FRG_site/downloads/geo/en/Exetender.exe</Url><
;AddOns><Param><ID>""</ID><Name>noaddons<
;/Name><Priority>0</Priority><Checked>false</C
hecked><Dependencies/></Param></AddOns><Comman
dLine/></IS><SDMVersion>1.0.0.22</SDMVersion><
PromotionUrl>hXXp://player.freeridegames.com/product/SDM/SDM_standa
rd</PromotionUrl><ReportUrl>hXXp://player.freeridegames.co
m/opTools/clientTracking.jsp</ReportUrl><ConversionUrl>htt
p://player.freeridegames.com/do/conversionTracking</ConversionUrl&g
t;<PartnerName>Default</PartnerName><ProviderId>148&
lt;/ProviderId><ProviderName>FreeRideGames</ProviderName&g
t;<ClientVersion>7.2.0.0</ClientVersion><EULAUrl>htt
p://player.freeridegames.com/do/general?Partner=Default&jspName=li
censeAgreement</EULAUrl><ImgServerUrl>hXXp://img.exent.com
/free/frg</ImgServerUrl><HeaderUrl>hXXp://dts1.freeridegam
es.com/freeride_marketing/SDM/SDM_standard/header.html</HeaderUrl&g
t;<MyGamesUrl>hXXp://partners.freeridegames.com/my_games?gameId=
%GAME_ID%</MyGamesUrl><StartPageId>SDM_EULA</StartPageI
d><Type>EN_NO_TB</Type><Game><Id>659050<
/Id><Name><![CDATA[Avenue Flo]]></Name><Co<<< skipped >>>

POST /opTools/clientTracking.jsp?trackEvent=SDM_TotalProcessStart&sdmVersion=01.51.00.51&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:23 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=798

Connection: Keep-Alive

Content-Type: text/html

....

POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadStart&sdmVersion=01.51.00.51&fileName=hXXp://dts1.freeridegames.com/FRG_site/downloads/geo/en/Exetender_Default.exe&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:23 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=797

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 30 Jan 2015 06:26:23 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=797..Connection: Keep-Alive..Conten
t-Type: text/html......

GET /product/SDM/SDM_standard/SDM_PROGRESS.html?GameName=Avenue Flo&GameId=659050 HTTP/1.1

Accept: application/x-ms-application, image/jpeg, application/xaml xml, image/gif, image/pjpeg, application/x-ms-xbap, */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: player.freeridegames.com

Connection: Keep-Alive

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1

POST /opTools/clientTracking.jsp?trackEvent=SDM_DownloadFinished&sdmVersion=01.51.00.51&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:24 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=795

Connection: Keep-Alive

Content-Type: text/html

....

POST /opTools/clientTracking.jsp?trackEvent=SDM_InstallStart&sdmVersion=01.51.00.51&muid=30300030005056210174115FB48AFDFF00000800F5842E75C26823D03E83AAB000067EDB HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: JSESSIONID=6CC325E34CB1CC9E5D84512EF6746B0C; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:24 GMT

Server: Apache

Content-Length: 0

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=794

Connection: Keep-Alive

Content-Type: text/html

HTTP/1.1 200 OK..Date: Fri, 30 Jan 2015 06:26:24 GMT..Server: Apache..
Content-Length: 0..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI CO
M NAV"..Keep-Alive: timeout=3, max=794..Connection: Keep-Alive..Conten
t-Type: text/html..

GET /ThawtePremiumServerCA.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.thawte.com


HTTP/1.1 200 OK

Server: Apache

ETag: "5af11a746f5fb34628565e60758afc00:1422566442"

Last-Modified: Thu, 29 Jan 2015 21:20:42 GMT

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Length: 12067

Connection: keep-alive

Content-Type: application/pkix-crl
0./.0...0...*.H........0..1.0...U....ZA1.0...U....Western Cape1.0...U.
...Cape Town1.0...U....Thawte Consulting cc1(0&..U....Certification Se
rvices Division1!0...U....Thawte Premium Server CA1(0&..*.H........pre
[email protected]!....f....p..
........100129104213Z0!....l.C`..L.%|\.T...130819183955Z0!....T..W...p
.[..%...100322161038Z0!....hx.....k...7....130919164724Z0!....$#.R|..$
.....j..130926101045Z0!...!P..6{[email protected]!...Da\v.....
.....%..130920062728Z0!...>.e..-...s[.2I...140418142220Z0!....dU...
(...=...*..140801114607Z0!........d.{#E..9`...130926061856Z0!....6..q.
'tT..1.Q...130926062249Z0!.....cXzF..(O0.|.N..131002103626Z0!.........
...>..i....130528164218Z0!..........#.P.......130716072254Z0!.....W
........JH....130924125316Z0!.....%.......R......100801221434Z0!.....M
..HK.....x....130926060355Z0!....k."..z......64..130919082450Z0!...N..
D...0....`H2..130829152308Z0!......Q..m...A..j...100226190909Z0!.....-
...k......h...130930085951Z0!...... ...7. .UA.I..130927152007Z0!.....}
.L....\/..$^..100407191443Z0!....1....c...s.>9t..100215170304Z0!...
W..._....%..I....130926063253Z0!..._._~gq.I.)[email protected]!...
..=X>...][email protected]!.............U.<....100318180248
Z0!... .(........n.S...130923202627Z0!.....k(....k4.......130919073042
Z0!....rF..O..#^.......100312081338Z0!.....:...B..=]Hsx_..130920011556
Z0!....uJdm..'...\G....130523054519Z0!....]h..g.o....@\ ..100107184454
Z0!...z..1).Ht.........100323155426Z0!.... ....z.i.a.nl...10031221<<< skipped >>>

GET /js?wp_id=2659948 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: aa.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 11282745515801077923

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 962
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('0');}catch(e){h
5=new Array('','')}var screen_res;try{screen_res=Adition_ResId();}catc
h(e){screen_res=''}var fvers;try{fvers=Adition_Flash();}catch(e){fvers
=''}var prfstr;try{prfstr=Adition_Prfstr(2659948);}catch(e){prfstr=''}
document.write('<script type=\'text/javascript\' src=\'hXXp://aa.ad
farm1.adition.com/banner?sid=2659948&adjsver=' adjsver '' prfstr '&co=
1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=' os '&browser=' br
owser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac=' (  ad_count) '&s
creen_res=' screen_res '&wpt=J&clickurl=\'></script>');..

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 494

Last-Modified: Fri, 30 Jan 2015 05:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0.....0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U.
...AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..
150130053254Z..150203053254Z.00.0...U.#..0......z4.&...&T....$.T.0...U
........0...*[email protected]..*..: ..../.5....a]..-q...}.s4..Q...
.....X.m..3I!.....G4.;*[email protected].,R.B..F9..........
.T......L.^..kDPv."..QA.z0CNm..T...r...NO...'.R5!.o}..<q.....x.$Ol.
EL..d...xy.0..N...*...2.q..4&\.b=6u_..?.v...._.O}...&...8'..@.\.......
.q ......

GET /e/xrefid.xgi?na_exid=3338670318734125865&na_pid=2684 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: e.nexac.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-type: image/gif

Date: Fri, 30 Jan 2015 06:28:52 GMT

Expires: Wed Sep 15 09:14:42 MDT 2010

P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"

Pragma: no-cache

Server: lighttpd/1.4.28

Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2016 22:00:00 GMT; domain=.nexac.com; path=/

Set-Cookie: na_an=1422599332; expires=Sun, 01-Mar-2015 06:28:52 GMT; path=/; domain=.nexac.com

X-Powered-By: Jigawatts

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-ty
pe: image/gif..Date: Fri, 30 Jan 2015 06:28:52 GMT..Expires: Wed Sep 1
5 09:14:42 MDT 2010..P3P: policyref="hXXp://VVV.nextaction.net/P3P/Pol
icyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo 
HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"..Pra
gma: no-cache..Server: lighttpd/1.4.28..Set-Cookie: na_tc=Y; expires=S
un, 30-Nov-2016 22:00:00 GMT; domain=.nexac.com; path=/..Set-Cookie: n
a_an=1422599332; expires=Sun, 01-Mar-2015 06:28:52 GMT; path=/; domain
=.nexac.com..X-Powered-By: Jigawatts..Content-Length: 43..Connection: 
keep-alive..GIF89a.............!.......,...........D..;..

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Content-Length: 29648

Date: Fri, 30 Jan 2015 06:28:48 GMT
if(!Adition_Environment){var Adition_Environment=function(){var _this=
{};var env={ref:false,os:false,browser:false,screen_res:false,flash:fa
lse,prf:false,iframe:false,cb_initialized:false};var brs=navigator.use
rAgent.toLowerCase();var fallback_json_parse=function(){'use strict';v
ar at,ch,escapee={'"':'"','\\':'\\','/':'/',b:'\b',f:'\f',n:'\n',r:'\r
',t:'\t'},text,error=function(m){throw{name:'SyntaxError',message:m,at
:at,text:text};},next=function(c){if(c&&c!==ch)error("Expected '" c "'
 instead of '" .ch "'");ch=text.charAt(at);at =1;return ch},number=fun
ction(){var number,string='';if(ch==='-'){string='-';next('-')}while(c
h>='0'&&ch<='9'){string =ch;next()}if(ch==='.'){string ='.';whil
e(next()&&ch>='0'&&ch<='9')string =ch}if(ch==='e'||ch==='E'){str
ing =ch;next();if(ch==='-'||ch===' '){string =ch;next()}while(ch>='
0'&&ch<='9'){string =ch;next()}}number= string;if(!isFinite(number)
)error('Bad number');else return number},string=function(){var hex,i,s
tring='',uffff;if(ch==='"')while(next())if(ch===.'"'){next();return st
ring}else if(ch==='\\'){next();if(ch==='u'){uffff=0;for(i=0;i<4;i =
1){hex=parseInt(next(),16);if(!isFinite(hex))break;uffff=uffff*16 hex}
string =String.fromCharCode(uffff)}else if(typeof escapee[ch]==='strin
g')string =escapee[ch];else break}else string =ch;error('Bad string')}
,white=function(){while(ch&&ch<=' ')next()},word=function(){switch(
ch){case 't':next('t');next('r');next('u');next('e');return true;case 
'f':next('f');next('a');next('l');next('s');next('e');return false<<< skipped >>>

GET /banners/533/oba_priv.sjs?oba=&domId=obaButton_6110017589092089913&btr=true&pos=top-right&cid=12452&aid=54647 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-type: text/html

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:49 GMT
61b..var oba= 0,.    info = {.                    title: "Advertising 
Alliance AG",.                    text: "Nutzungsbasierte Online-Werbu
ng",.                    url: "hXXp://VVV.advertising-alliance.de/opt-
out.html",.                    linkText: "mehr Infos & deaktivieren". 
                   },    domId = "obaButton_6110017589092089913",.    
position = "top-right"||'top-right';..   if (info != null || oba != 0)
 {.     if (typeof $ADP == 'object') {   .       try {.        $ADP&&$
ADP.Registry&&function() {..          if (!oba) { oba = $ADP.Registry.
generateId(); }..          if (info!=null) { $ADP.Registry.register(ob
a,info);}..          if (domId) {.            $ADP.Registry.createPlay
er(oba,{.                 domId: domId,.                 position: pos
ition.            });.          }.        }();.        }catch(e) {}   
.     } else {.        var infostr = info!=null?'&title=Advertising Al
liance AG&text=Nutzungsbasierte Online-Werbung&url=http://VVV.ad
vertising-alliance.de/opt-out.html&linkText=mehr Infos & deaktivie
ren':'';.        var proto = ((window.location.protocol.match(/http/i)
)?window.location.protocol:"http:");.        var oba_script = document
.createElement('script');.        oba_script.setAttribute('type','text
/javascript');.        oba_script.setAttribute('charset','utf-8');.   
     oba_script.setAttribute('src',proto '//imagesrv.adition.com/js/ad
player/adplayer_privacy.sjs?oba=' oba '&domId=' domId infostr '&pos=' 
position);.        document.getElementsByTagName('head')[0].append<<< skipped >>>

GET /js/adplayer/adplayer_privacy.sjs?oba=0&domId=obaButton_6110017589092089913&title=Advertising Alliance AG&text=Nutzungsbasierte Online-Werbung&url=http://VVV.advertising-alliance.de/opt-out.html&linkText=mehr Infos & deaktivieren&pos=top-right HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-type: text/javascript

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:49 GMT
4c90..var proto = ((window.location.protocol.match(/http/i))?window.lo
cation.protocol:"http:");.var playercss = document.createElement("link
");.playercss.setAttribute("rel", "stylesheet");.playercss.setAttribut
e("type", "text/css");.playercss.setAttribute("href", proto "//imagesr
v.adition.com/js/adplayer/adplayer.min.css");.document.getElementsByTa
gName("head")[0].appendChild(playercss);...if(!window.$ADP){$ADP={}}$A
DP.Registry=$ADP.Registry||{data:{},translationFile:false,wait:2000,LA
ST:"LAST",MAIN:"MAIN",POPUP:"POPUP",FRIENDLY_IFRAME:"FRIENDLY_IFRAME",
FOREIGN_IFRAME:"FOREIGN_IFRAME",POSTMESSAGE_SEARCH:"POSTMESSAGE_SEARCH
",publisherInfo:undefined,register:function(b,a){this._register(b,a,fa
lse)},_register:function(e,c,b){if(!c){c={}}if(!this.data[e]){this.dat
a[e]={items:[]}}var d={};for(var a in c){switch(a){case"domId":this.da
ta[e][a]=c[a];break;case"header":case"footer":case"title":case"text":c
ase"url":case"linkText":case"usePopup":case"renderCloseButton":d[a]=c[
a];break;default:break}}if(!b){this.data[e].items.push(d)}else{this.da
ta[e].items.unshift(d)}$ADP.Util.log('Registered item with title "' c.
title '" for ID ' e)},unregister:function(a){if(!this.data[a]){return}
delete this.data[a]},getById:function(b){var a=[];if(this.data[b]){a=t
his.data[b].items||[]}return a},pullById:function(b){,b){if(!b){b=[]}i
f(!this.data[c]){return}if(this.data[c].iframeSearch&&this.data[c].ifr
ameSearch.timeoutId){clearTimeout(this.data[c].iframeSearch.timeoutId)
}b.reverse();for(var a in b){$ADP.Registry._register(c,b[a],true)}<<< skipped >>>

GET /js/adplayer/adplayer.min.css HTTP/1.1

Accept: text/css

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: text/css

Accept-Ranges: bytes

ETag: "1471831326"

Last-Modified: Tue, 30 Oct 2012 15:33:13 GMT

Content-Length: 3560

Date: Fri, 30 Jan 2015 06:28:49 GMT
/*.   ----------------------------------------------------------------
---------------------------.   AdPlayer v2.0.3.FINAL (FINAL.103012).  
 Authors: [email protected].            felix.ritter@adtec
h.com.            [email protected].            marius.n
[email protected].            [email protected].          
  [email protected].            [email protected].        
    .   --------------------------------------------------------------
-----------------------------.  .   This file is part of AdPlayer v2.0
.3.FINAL (FINAL.103012)..   AdPlayer is free software: you can redistr
ibute it and/or modify.   it under the terms of the GNU General Public
 License as published by.   the Free Software Foundation, either versi
on 3 of the License, or.   (at your option) any later version.. .   Ad
Player is distributed in the hope that it will be useful,.   but WITHO
UT ANY WARRANTY; without even the implied warranty of.   MERCHANTABILI
TY or FITNESS FOR A PARTICULAR PURPOSE.  See the.   GNU General Public
 License for more details.. .   You should have received a copy of the
 GNU General Public License.   along with AdPlayer.  If not, see <h
ttp://VVV.gnu.org/licenses/>..  .  --------------------------------
------------------------------------------------------------.*/.body.a
dp-popup{margin:0;padding:10px;background-color:#FFF;color:#000;}.adp-
top-right{top:0;right:0;}.adp-top-left{top:0;left:0;}.adp-bottom-right
{bottom:0;right:0;}.adp-bottom-left{bottom:0;left:0;}.adp-wrapper{<<< skipped >>>

GET /js/adplayer/oba_icon.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/png

Accept-Ranges: bytes

ETag: "1455054096"

Last-Modified: Tue, 30 Oct 2012 15:33:13 GMT

Content-Length: 3262

Date: Fri, 30 Jan 2015 06:28:49 GMT
.PNG........IHDR..............D.,....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:49 GMT

HTTP/1.1 304 Not Modified..Access-Control-Allow-Origin: *..Content-Typ
e: application/javascript..Accept-Ranges: bytes..ETag: "1035523256"..L
ast-Modified: Tue, 09 Dec 2014 09:34:51 GMT..Date: Fri, 30 Jan 2015 06
:28:49 GMT......

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:49 GMT

....

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:49 GMT

HTTP/1.1 304 Not Modified..Access-Control-Allow-Origin: *..Content-Typ
e: application/javascript..Accept-Ranges: bytes..ETag: "1035523256"..L
ast-Modified: Tue, 09 Dec 2014 09:34:51 GMT..Date: Fri, 30 Jan 2015 06
:28:49 GMT......

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

....

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

....

GET /js/acb/uid.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Mon, 30 Apr 2012 09:53:27 GMT

If-None-Match: "626933837"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: text/html

Accept-Ranges: bytes

ETag: "626933837"

Last-Modified: Mon, 30 Apr 2012 09:53:27 GMT

Connection: close

Date: Fri, 30 Jan 2015 06:28:50 GMT

GET /UTN-USERFirst-Hardware.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 4376

Last-Modified: Fri, 30 Jan 2015 04:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt
 Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertr
ust.com1.0...U....UTN-USERFirst-Hardware..150130043254Z..150203043254Z
0...0!..^....t..30...{C...060927070327Z0"....}...G,..x6vcX& ..10011522
0539Z0!..V...1.pj.u...r<...100128214246Z0!..S..W.....,....v...10020
1155305Z0"....x....G0..X*.<.R..100209213528Z0".....}w.Z..H'r...&...
100301205223Z0".....`...*F......SS..100301222500Z0"....].>?'K...\..
>....100330175849Z0!..|.R..gge/...Kj....100405140057Z0".....'A.....
-eB?8.F..100407141829Z0"........hG.o..}A.....100505184113Z0".....l....
..^...b.'..100506202534Z0"......Mi.A...Q..-....100511230708Z0!..Zg...v
.:..\<?.....100525185217Z0"....Q....K........p..100526081011Z0!...}
....v..\...!.a..100528120357Z0".....m...3du>OP.mm7..100608151048Z0"
....9.........O..|O..100609180604Z0".....%.MD....J.z Q...100611122131Z
0!..<..........&......100629140452Z0!..w(...M.......Q5...1007141745
48Z0"....KG...#.OD.:U.....100723145923Z0"......)...p.u".......10072608
1911Z0"....r..X..Pr. .).....100805203159Z0!..:S1..:Uo.Z.....P..1008172
04713Z0!..8.....{..g........100820194555Z0!..U.\.i`............1008201
94711Z0!.._...z)....ym.   ..100825153759Z0!...M...OT.E......1..1009210
61635Z0!..j....O...,.|~.8...100922022250Z0!..o~..(..j_...c..E..1009271
73105Z0!...n(.&X.."...7$.S..101004174308Z0!....].......hM......1010181
42346Z0!..:....O..q..T......101019043227Z0".......=...R.6...q...101019
122714Z0!..I..l........Z.....101021135958Z0"[email protected]. ..1

<<< skipped >>>

GET /bk/8640634?t=1422599352651&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&r=&f=1&cb=ftgs_8640634&x= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t4ft.de

DNT: 1

Connection: Keep-Alive

Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=


HTTP/1.1 200 OK

X-Powered-By: PHP/5.5.19-1~dotdeb.1

Set-Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=; expires=Sat, 30-Jan-2016 06:28:50 GMT; Max-Age=31536000; path=/; domain=.t4ft.de

Content-Length: 102

Content-Type: text/javascript

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Pragma: no-cache

Expires: Fri, 31 Dec 1999 23:00:00 GMT

P3P: policyref="hXXp://t4ft.de/p3p.xml", CP="NOI DSP PSAa PSDa IVAa IVDa OUR NOR UNI COM NAV INT CNT"

Connection: close

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: ws-0401
window.ftgs_8640634(1, "", {"aid":1211,"otp":"1211\/5101070\/8640138\/
8640196\/8640634","otfp":null});..

GET /sync/msft/3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pr.ybp.yahoo.com

DNT: 1

Connection: Keep-Alive

Cookie: B=52qa5ah9dvsod&b=3&s=ur


HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Content-Type: image/gif

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:50 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Ap
ache-Coyote/1.1..Content-Type: image/gif..Content-Length: 43..Date: Fr
i, 30 Jan 2015 06:28:50 GMT..GIF89a.............!.......,...........D.
.;..

GET /adview.php?tz=142259933223254&pid=789&kid=4&wmid=3348&sid=4&nvc=1&swid=3826&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.5

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /gsorganizationvalg2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBReGXQV/tqUV3SNMRE+s25eR/vhjwQUXUayjcRLdBy77fVztjq3OI91nn4CEhEhsdKok21jslbiISkSn7ME6Q== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:54 GMT

Content-Type: application/ocsp-response

Content-Length: 1499

Connection: keep-alive

Set-Cookie: __cfduid=d10205083ea8f50464f457b4687e4655c1422599334; expires=Sat, 30-Jan-16 06:28:54 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: b4925491c4fa563b81fe34d05f3a704f7bad5d28

Expires: Sat, 31 Jan 2015 06:28:53 GMT

Last-Modified: Thu, 29 Jan 2015 07:40:14 GMT

Cache-Control: public, max-age=86399

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9cad9d3f0f75-FRA
0..........0..... .....0......0...0........1..aq.....P%]....<..2015
0129074014Z0u0s0K0... ........^.t....Wt.1.>.n^G.....]F...Kt....s.:.
8.u.~...!....mc.V.!).........20150129074014Z....20150130074014Z0...*.H
...........$."...*.......(r(2.........J..l........V(.......H8.f..RJe._
........2... .\.?.z....!>...0O.^.H......:i..O....{......t_?4uk...`&
gt;.v...aK[(..j.........;..0d.........Y.`.;.K}..../[email protected] t.T...
-92.).......iC\z.R.(....S8-...O.......y....]Nn..*....Cj5..{>.......
0...0...0...........!m...Oq....-d)..#0...*.H........0]1.0...U....BE1.0
...U....GlobalSign nv-sa1301..U...*GlobalSign Organization Validation 
CA - G20...141212164309Z..150312164309Z0..1.0...U....BE1.0...U....Glob
alSign nv-sa1F0D..U...=GlobalSign Organization Validation CA - G2 OCSP
 responder - 11.0...U....201412121742000.."0...*.H.............0......
....{`D|L.......T..Sfj..[8....\...!...k..@>...H..T,...K.vI.v.kZ....
...'.^....4.d....dx.X......>X...O9>.p.....=..d#;@.......x.].#.$.
..I...5Z|z:....tY..6o2 7.......7X#.....c.......Z~|...Zk..c.o(.z.*,..y}
.....w.......72.25.!.K.}.......vc..?...Y.........S.M._..[........0..0.
..U....0.0...U...........0...U.%..0... .......0... .....0......0...U..
......1..aq.....P%]....<0...U.#..0...]F...Kt....s.:.8.u.~0...*.H...
...............YJ....KU1... g...N.a.?"Z......>O..o .G~..U.H......k.
.7.(nz/......"u..#. .m!.k.HjZ.3..G.J.9....i.................i.....4>
;...!.c..U...Du...x...0.....6..@u....&.......4<./..[...M.f....o.<
;.....o6.s"w.L....#..4~./.u..v.i.y.=.gR_=.sm.;iK.0.w..g......oq..)<<< skipped >>>

GET /gtm.js?id=GTM-MJF4W9 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googletagmanager.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: text/javascript; charset=UTF-8

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Fri, 30 Jan 2015 06:26:39 GMT

Expires: Fri, 30 Jan 2015 06:26:39 GMT

Cache-Control: private, max-age=903

Server: HTTP server (unknown)

Content-Length: 11319

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
...........}iw.8.....Gw^"U..r.M..'.T..-......$z..Hv\..... ..rU..s.r.Tw
[email protected]&.j....G.v_....Y:..K...B...Q..F...'.;.a.....hh..7..t
.O ..X.x.5.M.?......S.I..x..d..K...!.,......`4c.m..n..w.>.m.n.N....
......t...<[email protected].;.&|.c..0.O..H.....2...U
..9.O..Ts..&#....>O...m...............H..7.[...C..sm8.x".H<$./..
IgkK.....y...47....X....E8y..^C.".^..n.g..lL3Vq..{.p..[.-"....6.......
[email protected].<....O..yY"c.$......~..RS.....$b..7..`I......g.
.Q...q.I.XR;..U...g,......)..(.......h...U.}.Vse..5.2/F0p..3....0....2
B1..YzQ...p.|.O..j4..>..'Z.K...3?',...D.?....c..Yf....y@h]..kH6.kD!
........).....7^.kXM(.v4......v<...^.<Um....>..7....C.....69.
..j.mqH...9......a..)9.....L.'.B.?...N..(..oCu.e.4C.f...3.......d]lZ..
O.....RZ.P....V....G..Tq]w../[email protected]..\9.z.i?/..;../...QK.! ..7...
.).z...-..0X.v.M.Q...R.0....Qe..*.......PC..Db......{...2GIy...yQ..~..
)w...-&..P.S......\...............O...........z`.......?.......-......
..Z..lT4...s3..>..V..m.3.....L.`e..< ...O:f.lJ...q5.W.l\..7.....
UFB.0. [email protected]#..q6R.~....<...2..{([email protected]...
I.9p..n...]n...........6......L..$...".j_8..;..,..)..4.........M....|u
_..QQ...l.$.aGH..m-a...m.......jZ.3....".4.3.a.&..M.'&....@.,O .......
-.'.<CR.od...SJR.D..4...(q...%.....)[email protected]/.TXa-
`.....e...XD...$.v%&...W..o.j......C..~/]......:.........Kw.{&{Z..x^..
....x...v.`?s.7.&Oi...|...Ow...t.y^..G]../\..\...'y.......m.. .c.Z9...
N.......w......y;{......x...4..v....`;$!...v..#...E..?r..I..K(...H<<< skipped >>>

GET /imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?694091172 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: servedby.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Jetty(6.1.22)

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Content-Length: 0

Access-Control-Allow-Origin: *

Location: hXXp://cdn.flashtalking.com/xre/107/1078532/922460/image/922460.gif

Via: 1.1 ttn061009 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive

HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:53 GMT..Server: Jetty
(6.1.22)..P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo 
OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:
00:00 GMT..Content-Length: 0..Access-Control-Allow-Origin: *..Location
: hXXp://cdn.flashtalking.com/xre/107/1078532/922460/image/922460.gif.
.Via: 1.1 ttn061009 (MII-APC/2.4)..Keep-Alive: timeout=2..Connection: 
Keep-Alive..

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

X-Pad: avoid browser bug

Cache-Control: no-cache

Date: Fri, 30 Jan 2015 06:26:23 GMT

Connection: keep-alive

HTTP/1.1 200 OK..Server: Apache..Pragma: no-cache..Content-Length: 32.
.P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Ty
pe: text/html;charset=ISO-8859-1..X-Pad: avoid browser bug..Cache-Cont
rol: no-cache..Date: Fri, 30 Jan 2015 06:26:23 GMT..Connection: keep-a
live......

GET /product/img/SDM/servicePromotion1.jpg HTTP/1.1

Accept: */*

Referer: hXXp://cdn.exent.com/freeride_marketing/SDM/SDM_standard_2010/SDM_PROGRESS.html

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.freeridegames.com

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Length: 51132

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=518400

Expires: Thu, 05 Feb 2015 06:26:25 GMT

Date: Fri, 30 Jan 2015 06:26:25 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P......hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpRights="hXXp://ns.adobe.com/xap/1.0/rights/" xmlns
:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.
com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0
/" xmpRights:Marked="False" xmpMM:OriginalDocumentID="uuid:E075493B8A6
3DD11AC50F33A9CF1BD4A" xmpMM:DocumentID="xmp.did:EFBA4B468D9311DF8C86B
CB125227836" xmpMM:InstanceID="xmp.iid:EFBA4B458D9311DF8C86BCB12522783
6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:Derived
From stRef:instanceID="xmp.iid:C5457F038C8DDF11BC73DE4FB01F0763" stRef
:documentID="uuid:E075493B8A63DD11AC50F33A9CF1BD4A"/> </rdf:Desc
ription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&
gt;....Adobe.d........................................................
......................................................................
.....................|................................................
..............................................!.a.1"...AQR.U.q2.#.t.&F
..B....3S$4TEb.s..Vv8...r..C.d.%.....u65.7........................!1Q.
.Aaq..."2....R....D.Br#..b..34..c$5...Cs.dE.............?..Y.....O~.U.
..].*....Em5..P..P..P..P..P..P..T.B.E....T.h..P...U [email protected]. ..H-*.<<< skipped >>>

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

X-Pad: avoid browser bug

Cache-Control: no-cache

Date: Fri, 30 Jan 2015 06:26:29 GMT

Connection: keep-alive

HTTP/1.1 200 OK..Server: Apache..Pragma: no-cache..Content-Length: 32.
.P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Ty
pe: text/html;charset=ISO-8859-1..X-Pad: avoid browser bug..Cache-Cont
rol: no-cache..Date: Fri, 30 Jan 2015 06:26:29 GMT..Connection: keep-a
live......

HEAD /check.jsp HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C)

Host: VVV.freeridegames.com

Content-Length: 0

Connection: Keep-Alive

Cache-Control: no-cache


HTTP/1.1 200 OK

Server: Apache

Pragma: no-cache

Content-Length: 32

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=ISO-8859-1

X-Pad: avoid browser bug

Cache-Control: no-cache

Date: Fri, 30 Jan 2015 06:26:35 GMT

Connection: keep-alive

HTTP/1.1 200 OK..Server: Apache..Pragma: no-cache..Content-Length: 32.
.P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Ty
pe: text/html;charset=ISO-8859-1..X-Pad: avoid browser bug..Cache-Cont
rol: no-cache..Date: Fri, 30 Jan 2015 06:26:35 GMT..Connection: keep-a
live..

GET /cookie/?ssp=3&userid=6110017589072035866 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: sync.active-agent.com


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:52 GMT

Set-Cookie: userid=6110017589072035866;Path=/;Domain=.active-agent.com;Expires=Wed, 29-Jul-2015 06:28:52 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://ib.adnxs.com/setuid?entity=254&code=6110017589072035866

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: application/ocsp-response

Content-Length: 1514

Connection: keep-alive

Set-Cookie: __cfduid=d403a445e84e5eda71cf5389888ae97e01422599333; expires=Sat, 30-Jan-16 06:28:53 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Thu, 29 Jan 2015 16:30:16 GMT

X-Powered-By: Servlet/3.0; JBossAS-6

ETag: 7b29ae1b1bb3659ef51be7354d0197767ef2663d

Expires: Sat, 31 Jan 2015 06:28:52 GMT

Cache-Control: public, max-age=86399

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9cac41680899-FRA
0..........0..... .....0......0...0......"... H([email protected]|.`......2015012
9163016Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K.
......./N.E.....20150129163016Z....20150130163016Z0...*.H............d
x4D3.&;X2....3w........m.c.Zh.....kl.n.S.o.R2k....G[..4..^..V..(.L....
.`,n...9..._...M...5.;..hD.{.x&.X.Wu4m&S.|.4./.=..*2f&...c....b."....j
/....)....C..%..~.|.......L...2........"`v.jY....-R..'K.r.Z.`.3.~.6.Y/
.............TF.m.F._...}..P7....o...J..B.......0...0...0..........E..
...i..y... 0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA0...150106000000Z..150331
000000Z0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign
 OCSP for Root R1 - Branch 10.."0...*.H.............0.........V-...b.%
.q.A$..D..2wh..5.......}o..rB.s.....jj........cO...q.......8r?.F(....S
....?!......F-.F(.EEe.\(mF...E...[.3.6.Z.h.q.?g..L....Gb.9h...(n......
..{-.....U$.N.;.Qx.a..n..YQ.*).....Sl..t.6........2..W....4?...5sb..8.
.>.,. ..^.y>..@%..ql.[.....1.!..$...5........0..0...U...........
0...U.%..0... .......0...U.......0.0...U......"... H([email protected]|.`....0...
U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._
0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.........
.....Cz.$8.....^l.Z...[..X.7].Ig.......b.s{.M m.....wp..{w..`.1..*....
9e......@B,Z.....G.W...g  .-b.....#.....H&&.8.}.K1a...~L?....0Y*rhg..!
..i..\sl...5.o...^.k..M.....J.......{8....8/.......L.1.hT.>.....WG.
......5.[.9.'.....*............W......X....UA..9.#w)...<<< skipped >>>

GET /js?wp_id=3086960&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:49  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 14365445

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1105
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(3086960);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac
=' (  ad_count) '&screen_res=' screen_res '&wpt=J&clickurl=http:/%
2Fc13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr
=AA==_a_w3hr=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /free/frg/products/554350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 11:07:11 GMT

Content-Type: image/jpeg

Content-Length: 16660

Accept-Ranges: bytes

X-Varnish: 2052680175 2052118412

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3EB270A5EA1911E2A262D7F48
EA80A8F" xmpMM:InstanceID="xmp.iid:3EB270A4EA1911E2A262D7F48EA80A8F" x
mp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:EAF28A94E70E11E2BDD183F16790EF49" stRef:doc
umentID="xmp.did:EAF28A95E70E11E2BDD183F16790EF49"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
........................................."..2.BR.b#3.r...C$....4u61S..
.%5..ATd.aq.cs..D.e.!...tU&......................."2.B..Rr..#...b...3S
4%5.Cc.$d....s&.!1Qa...D............?.....$&..JH..g.$.6...-.VK..j..ls0
..$..s....M. ..../,.u..?..}.(..;...........z..|J...8.c. ..........X...
. m.]b..w.._....'.:ET..6O.u.i...T...^..^..z....c..`...T..Z..X.e.......
? ..,.[......u.s.Q..\.5.......W6..'..W..9.(..W/.FlrI...\.: .M..u..<<< skipped >>>

GET /free/frg/products/631850/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Wed, 15 Jul 2009 11:11:31 GMT

Content-Type: image/jpeg

Content-Length: 23693

Accept-Ranges: bytes

X-Varnish: 2052680222 2052166672

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d....................
......................................................................
......................................................................
......................................................................
...................!1.#$.3C..AQa..."R4q..2bScDT%....Bd...s.5EU&....t..
6eu..'..............................!1Q.#Aa.3$..q....CS.4...cs....DT%.
.d5."..t.62B..&...Uu...............?..<........k..c.E.6@#on].3.....
( .._O.....&..5B..^sYQ.......?>..." .....8q[|.....c..C.~.....2.....
./N..1.}.....0].D.M....d..~.Z./........".....w..$..I............8.5..D
8...N8..1..>.V .=...d..%..X.1_.......\*..<b....i>......A...].
..^!U..~y..dS&F.d..........>f.....j.Ei...g.....,..<.y.......z...
g.E....8..PUX#,...ws...JQ!."..B.ZJ.m..F.t...l*a...j.f.._. ......_.....
.>..\8.O....5Ys$.o..y......&t'.z...).|....i....z9..M....3LK..!..>
;......"O......Q.5.*..;....)..C.:..4.V.^`..W..P..0.</...)i........E
~}...#l}.|...]......R)r.tY.../F;)9f..6......6g.....<J...9.q...C.n..
.5..`.0....8>.c..yCve...8o>}TJ..KT/.PB.,.4..2o...}:.&.~..p.{._.B
..&..........=.UF.3..7.~.."W.2.C..L&....C.."IvwqQ..%.iz...{r{......0..
.......)........r...z...6j....U.F........h.....`..............{.J....:
...I.....b4.....3.M..p........{".TI...r6..kf.`.n....o,3....m(]n9:M.s.|
..J.\...z...X...EP.{..d......S;....7...<.4>.#.@......< ...U..
.....R...kA....F......Mm...]...-....7.5qn....'c...&.o....}['s.G.......
...<...U...5...O..a5.....")..^..j...C..kP3.....[)..6V..]..Op)..<<< skipped >>>

GET /free/frg/products/668950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/571950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 02 Apr 2009 12:56:42 GMT

Content-Type: image/jpeg

Content-Length: 17011

Accept-Ranges: bytes

X-Varnish: 2052680375 2052297022

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
...........!.1"..AQa.q.2..b.BR.#...cs$.r...4.v....3C..&7..............
.........!1..AQaq..".....2.B....R...#35.r.b.s.............?...Z$...hB4
!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!....F.#B.....hB4!.
...F.#B.....hB4!....F....hH..F.#B.....hB4!....F.#B.....|.I.P'm...|....
.......H......).5.E..\....3..).I-............q..y.-.J`q...`.....uQ;8..
......1....Q.[)!E.#......Ihq...r.....J.....,=.Z4!......A.4.IU.H.hJ...L
8r.$...u.....(.}...N...:G84T...xj.H.-b@..).G..%..R.p...Oh)..<N..L.@
..0n(N..-...J.....hJ...4....uM.$I.H.ZI\...?.........P.....Q%y{M2.....E
.~`H.....U......<.maGt...P:...a...by}TgKW5..h.N|;....H .u#.>.c..
.....(T._.0;....N ......J..Z.Nb.i6.-.....h.K.$..8....H...CZ..@..&..#Y$
..T...z.........S.I.$.I%K.6..-....t..Q......%.. ..;|...&..i.[..o.X7%t.
.....e#...I.......a.......V*4....A..W.9-..>.......e..r.............
......h.|....5.!.....c7%...1...\.;....Z...R.7.... .. ....5`~..E...$uJ.
(W.@x.|.....)-{\h. wAth.>..2.q.2..BV.!AH'......5,BF.73].n4......aw.
<F~......m..........(.t0.c8......_.=...^f.?&;.%J..B....qM.....ON...
.y......#.tiWh..hJ..|.3....{.Vq~9.b...YC.............'...$........N.ka
......\....V....of)...4nxyh.8..LE.G..........~Y....L...Eo....z.0^l....
e#..'...F........,.(.C...@.]..G....D....yo..7.>.8........L.v[.u<<< skipped >>>

GET /free/frg/products/559350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 13:21:44 GMT

Content-Type: image/jpeg

Content-Length: 15034

Accept-Ranges: bytes

X-Varnish: 322100412 321597011

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:00F0D465EA2C11E297FAE79CF
768BDAE" xmpMM:InstanceID="xmp.iid:00F0D464EA2C11E297FAE79CF768BDAE" x
mp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:E1799641E79A11E2A6FFB8C361BB07AA" stRef:doc
umentID="xmp.did:E1799642E79A11E2A6FFB8C361BB07AA"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
............................................!.1.A..Qaq"...2#...BR...br
....S$34...............................!1.A.Qa.q.."....2.B#....Rb.r..S
..3c.$t.............?..as.ocgD.r.R..1..........>..W.#._G..yeZ^....O
).P:E.6.....T.j...72[/.s#JEi..?~..l.`..&K...YR.Z....tjjmJ.....$.;...2.
|....#u....[..bM........C.....]x6..).......J...i.....~.!R.$...'...A.v.
..D....]............1KG{u^&.S...}..E........e...;}..\a.......e....<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=513433

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:26:40 GMT

Etag: "54cb0a52-1d7"

Expires: Thu, 05 Feb 2015 18:26:40 GMT

Last-Modified: Fri, 30 Jan 2015 04:36:34 GMT

Server: ECS (ams/D1DC)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2015
0129200000Z0s0q0I0... ............([email protected]....>.i...G...&...
.cd ...._.M.[........?;....20150129200000Z....20150205200000Z0...*.H..
...........P.m.%E.......c.q..2g...m/ ..?./<B.....y..d..B....B.V-...
h32.....1...`j.{...........l.&.......N{.Ui ..$.....|...s.8.n.]@....F.7
.`;...!..dX...q......r..,.....I<.......o...J<.$......=..w.FW@u..
C-...6...e..A......N/H...p...eu....,k..K.&Z.Vq............5....HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=513433..Cont
ent-Type: application/ocsp-response..Date: Fri, 30 Jan 2015 06:26:40 G
MT..Etag: "54cb0a52-1d7"..Expires: Thu, 05 Feb 2015 18:26:40 GMT..Last
-Modified: Fri, 30 Jan 2015 04:36:34 GMT..Server: ECS (ams/D1DC)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
...>.i...G...&....cd ...20150129200000Z0s0q0I0... ............(..A.
[email protected]....>.i...G...&....cd ...._.M.[........?;....201501292000
00Z....20150205200000Z0...*.H.............P.m.%E.......c.q..2g...m/ ..
?./<B.....y..d..B....B.V-...h32.....1...`j.{...........l.&.......N{
.Ui ..$.....|...s.8.n.]@....F.7.`;...!..dX...q......r..,.....I<....
...o...J<[email protected]/H...p...eu....,
k..K.&Z.Vq............5........
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= HTTP/1.1

Cache-Control: max-age = 513316

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 30 Jan 2015 04:04:45 GMT

If-None-Match: "54cb02dd-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 304 Not Modified

Accept-Ranges: bytes

Cache-Control: max-age=515117

Date: Fri, 30 Jan 2015 06:26:40 GMT

Etag: "54cb02dd-1d7"

Expires: Thu, 05 Feb 2015 18:26:40 GMT

Last-Modified: Fri, 30 Jan 2015 04:04:45 GMT

Server: ECS (ams/49CA)

X-Cache: HIT

HTTP/1.1 304 Not Modified..Accept-Ranges: bytes..Cache-Control: max-ag
e=515117..Date: Fri, 30 Jan 2015 06:26:40 GMT..Etag: "54cb02dd-1d7"..E
xpires: Thu, 05 Feb 2015 18:26:40 GMT..Last-Modified: Fri, 30 Jan 2015
 04:04:45 GMT..Server: ECS (ams/49CA)..X-Cache: HIT..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEE1fLDQIskwgzW1QfiRNyew= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1503

content-transfer-encoding: binary

Cache-Control: max-age=367925, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 12:37:06 GMT

Expires: Tue, 3 Feb 2015 12:37:06 GMT

Date: Fri, 30 Jan 2015 06:28:54 GMT

Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015012
7123706Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.M_,4..L .mP~$M......20150127123706Z....20150203123706Z0...*.H........
.....z=.5.....x...r.b>C.7.B.q..C.6.y%...._.......U.>.q.3......!.
....kR../H.6....SFG.(F[;.)..Et.dzq.....^Rf|...........}..F..g>.....
nH............`[email protected].../....D...5~1.F....r6......b./..`S.?.t..
.W..;4lXx........?..d......&q.b.l.f.[.^....#..*..Y2.O..... .....0...0.
..0............I...*....^n...0...*.H........0..1.0...U....US1.0...U...
.thawte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 
2006 thawte, Inc. - For authorized use only1.0...U....thawte Primary R
oot CA0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte
, Inc.1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0
...*.H.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}
.M.s.....S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.
o..8|.B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3.
.kao]c...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!
<.3.)...y#.........i0g0...U.%..0... .......0... .....0......0...U..
.....0.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H.....
...........lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f
... .........GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.
uya..:...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S
....h........U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;...<<< skipped >>>

GET /api/v/1/1107,1,0/?callback=cb_1422599350324&ts=1422599350324&connectionType=0&sessionId=Qvbxi&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 895

Content-Type: text/javascript; charset=utf-8

Server: Microsoft-HTTPAPI/2.0

X-Country: UA

Date: Fri, 30 Jan 2015 06:28:48 GMT
cb_1422599350324 && cb_1422599350324({"zones":[{"id":1107,"status":200
,"enabled":true,"template":"Free_Creative_300X250","data":[{"snippet":
"<!-- BEGIN IFRAME TAG - 300x250 (#19) < - DO NOT MODIFY -->\
n<IFRAME SRC=\"hXXp://ib.adnxs.com/tt?id=2488352\" FRAMEBORDER=\"0\
" SCROLLING=\"no\" MARGINHEIGHT=\"0\" MARGINWIDTH=\"0\" TOPMARGIN=\"0\
" LEFTMARGIN=\"0\" ALLOWTRANSPARENCY=\"true\" WIDTH=\"300\" HEIGHT=\"2
50\"></IFRAME>\n<!-- END TAG -->","clk":"0iO77Sl1u3WC4K
yNH_vcLgX7eV1ko-HlUgZTKGhiNTl177HYZTv9w0vtO0TFys1eYQpuHB89izY3DtAS9fMQ
yiTKUpYwd5Jkt-2UWJ5-lYMzSc481jlWZBloByIjdDDdXA8SnZEVOmz8vixkwRF_z0KJ7c
Y7HTmcaioOKiNdvHq6jzBvpHZvj0S9YipGteQctT9q5fwHFBLdPMIYZBLzKM-1gcm3M0pZ
TkLzNlAA_z7F4ACE0PloVE8nlHSi4ZtArClytGYFWxRVdkgvL3k0cgZI_ZFeAKLTKraF72
gcF6Q","width":300,"height":250,"cUrl":"hXXp://d.castplatform.com/api/
c/1?clk=%clk%","vUrl":"hXXp://d.castplatform.com/api/vp/1?clk=%clk%"}]
}],"ts":0});....


GET /api/vp/1?clk=0iO77Sl1u3WC4KyNH_vcLgX7eV1ko-HlUgZTKGhiNTl177HYZTv9w0vtO0TFys1eYQpuHB89izY3DtAS9fMQyiTKUpYwd5Jkt-2UWJ5-lYMzSc481jlWZBloByIjdDDdXA8SnZEVOmz8vixkwRF_z0KJ7cY7HTmcaioOKiNdvHq6jzBvpHZvj0S9YipGteQctT9q5fwHFBLdPMIYZBLzKM-1gcm3M0pZTkLzNlAA_z7F4ACE0PloVE8nlHSi4ZtArClytGYFWxRVdkgvL3k0cgZI_ZFeAKLTKraF72gcF6Q&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 43

Content-Type: image/gif

Server: Microsoft-HTTPAPI/2.0

Date: Fri, 30 Jan 2015 06:28:48 GMT

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: no-cache..Content-Length: 43..Content-Type: image/gif..Server: Mi
crosoft-HTTPAPI/2.0..Date: Fri, 30 Jan 2015 06:28:48 GMT..GIF89a......
.......!.......,...........L..;..

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.globalEvents.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 436

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
..........uSMo.0.=;R...r...M.=m6..............d...6....].Q9......<.
Q.U..`s..^q.NU.....,..Eg34..0<..5l[.t...f/......~..&..Gm.aA...s.-.D
..B%..gO.wc..\...)..(.....m...cR"..\..c...`.,G..a,.C.*.....To ."..I...
.s..0.....K......n..!.q0\....8;./..].Vd..\..niAw.~.Z....N~..b..I...b.X
m........U.....2...,.S...T..R.C"....w....X./.F.iB....F...(c1J.'l..5.N,
z!.wO......M?.H.C...........%j.X...HD...\....EO......1t.& ......ML2.L#
....y..Th._.>..K..........


GET /system/modules/com.exent.owned.geo.templates/resources/js/controller.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1037

Cache-Control: max-age=13539

Expires: Fri, 30 Jan 2015 10:12:16 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........V]o.H.}&R....V.S.J}"...S..8X...jeQ<v......Z........6i..J
E6.s..9...#[email protected].._P$.}J.F..3.>^.....K..)%...........;[email protected].
\O|4....Q$..>...6..cZ?.qB.[LVx5..8....Yr7,....C..,C...w......P.q0..
i.......<[email protected]..$.....pr.A.6N..$1..F,z..E.p..\r.0%..
..... .=..`..Z,...N...(..L....F.s&7..E..0...X6%....X.........X..<..
.K ).^.^.|..4w.6BY.|.U\..%Q..^...0F....[DV.........%....6W..S..m:..<
;3r.un..*..=.d..... .CX.X..so^D....^.c.\..4_.y...U..:h...._.....*.u{i.
.N....V.G...v....../..Fm...QE..L.Q......)....f.ej.p3e...zU.j\..T.jtE..
$.|...!#..x..:s....ld1.T..&q.......=~S...........B....U..h.l.d...%...Q
x.vy...q7/XJ6.zo....d....9%j^....%[[email protected]@..2.
..F.X.$(\U-R...p..'..J|...zZ......n"jK..i..l.u.IZ...R./.;.Uh.X...$&..(
.......2....b......"......8...V.C.l.0i>..aY...a~.LSr.......~U.. .gR
3d.k....w.......a.S]..y...$...X.F..s._....G.J.N...y....5.#.6.H;'E.i...
..=.p[ .\.,.5..j.....W..........I........l.V.......w..?.&.....}.@.....
c...J!.S=q.=......|h.j......>...^..........i....]......?.k~. ..J..K
...../H........


GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/js/myGamesBoxUtils.jsp HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/html;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Fri, 30 Jan 2015 06:26:37 GMT

Content-Length: 4879

Connection: keep-alive
...........<ms....u3.../9Q'...K..-w..I=u.._.v.WC...'......>.....
 E.oj.>...E`.............KIp.{.....................qr..\.Q..a<..
........g...#..W{1....m...........j.n..%.O....}:...;..CQ=dT..... ..3..
.."9..".Y..v... |f_.q.\.....Is.eS........L[...x#...N....98.....Z.q...2
PJ.Wvk.{o....................G......dK..a.2....&..i......F.I.;...~.1..
..c..d.}.7..{t.;.t.(;.g4Y0s:d...#.zA.{.h...i.I.q-:.. .J]...'.yD..(..fn
s.....v.%.b..Y.h.../..J.7.~...eu.....<.......e..`.m.%Xb.pLl9.....3.
r/.,.E.j...2.4..........{...M....K.)p..,b3..%..-.Gr.L.Z....:.m..%@...Q
cSJ.i.2.......qkh...Q...rm......^!T......b...4.{0....W/."..=....E.)k.N
R......4.....#:Z.1P.......I....._..%.4x.&...;.&)... a.8.&.....0IC.....
.=B......L&....<....x..NA...|..]..T.,.s......3.h.q..<nX..Q?....2
....O.....!....7p.0.].=6u.Q..j<....V.;M.i...4bir.ms@~%.!V.j.&Wu....
.CT..:....7...n....R.H...m.z&.]........].u.D.....>$.p;K\...?...S...
:.......o..~.....*c..K..jR.W..[q.U..T-{!N......h.Q.>zi..-..........
........."..=......nhH.3i`B..&...>rk`.....X...=M..'....2.i........|
V[..&.s..4Tp#.mn...7...1NGo.&.k....D.....$.....S..R.L...?..^G.<..l.
.....))..%./X.U# f..}8:.X...6..F0.D........h..)W......E..z.7..%...i..S
.0.#..P.4..%......([email protected].......{.....&V.
c)9Qk9f..2.._"cd.e.Y$..J.7(a...0..W.vddD......7.H.E.. #:.f$..q..<hM
@.........ol..5..X... !..\z...i..Hk.AoJ.3.-.b3j..c...kuie<l'.. ..#^
..d...~.........^.....v..P{i..~...._c.my1p.....6D.....X.....AY.i9.....
N....g.2}Rw...E!Zw.A.ZaLmV.m..#...MO-....N @.ME-.x.~D.T../..,.s...<<< skipped >>>

GET /system/modules/com.exent.owned.geo.general/resources/breadCrumbs/css/breadCrumbs.css?version=38 HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 219

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
[email protected].....%.k...Efi.V.{w..4.....y.......p....,v=
q.G8...%..v..k.>..,..~.T......9..Le..~yJ....>`.Om.6.....X<...
....teY... I...L..I....f....jkO...A.{<DE....48rD._..Q..>..8.>
.....p....A`.G.......5.|...HTTP/1.1 200 OK..Server: Apache..Content-Ty
pe: text/css;charset=UTF-8..Content-Encoding: gzip..Content-Length: 21
9..Cache-Control: max-age=86400..Expires: Sat, 31 Jan 2015 06:26:37 GM
T..Date: Fri, 30 Jan 2015 06:26:37 GMT..Connection: keep-alive..Vary: 
[email protected].....%.k...Efi.V.{w..4....
.y.......p....,v=q.G8...%..v..k.>..,..~.T......9..Le..~yJ....>`.
Om.6.....X<.......teY... I...L..I....f....jkO...A.{<DE....48rD._
..Q..>..8.>.....p....A`.G.......5.|.......


GET /static/marketing/main/css/tinybox.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 459

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........SMo.0.=._a)..{[email protected].!V...f.v..}mCRh....,y><3..sb 
...h...V.*......c.a....).....2&T["..#"/...o.P..%*0..EQb.R\....]..6q.oq
..q.k..`\-....Wga.D.{....V..X..M..A..I.,....\.eI ...A.y..E.~..V..;,..`
h[.z}..q.C4.v....\7...I0....Qs.2....M.K.....E{..U..".=...B.......Z....
.m....:M..h....g...m@....,....k.a..x....o@.'~..-.mlN.9....qg[7Y.......
.0....X....M[x1.c........2K.,..*.4..:..K4..A....P...O..8%.....*'$.FV.~
...F21X.._.....".4... g..6..[.q.y....9.T.k...HTTP/1.1 200 OK..Server: 
Apache..Content-Type: text/css;charset=UTF-8..Content-Encoding: gzip..
Content-Length: 459..Cache-Control: max-age=86400..Expires: Sat, 31 Ja
n 2015 06:26:38 GMT..Date: Fri, 30 Jan 2015 06:26:38 GMT..Connection: 
keep-alive..Vary: Accept-Encoding.............SMo.0.=._a)..{[email protected].
!V...f.v..}mCRh....,y><3..sb ...h...V.*......c.a....).....2&T[".
.#"/...o.P..%*0..EQb.R\....]..6q.oq..q.k..`\-....Wga.D.{....V..X..M..A
..I.,....\.eI ...A.y..E.~..V..;,..`h[.z}..q.C4.v....\7...I0....Qs.2...
.M.K.....E{..U..".=...B.......Z.....m....:M..h....g...m@....,....k.a..
x....o@.'~..-.mlN.9....qg[7Y........0....X....M[x1.c........2K.,..*.4.
.:..K4..A....P...O..8%.....*'$.FV.~...F21X.._.....".4... g..6..[.q.y..
..9.T.k.......


GET /static/marketing/main/img/containers/yellow_left_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1227

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A40556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8DAB8A3F556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................].....................................
.......................3s.....................Aq.2r..4............?...
9..'Rk...7UD....I........


GET /static/marketing/main/img/containers/labels.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 3454

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:FABB056B558811E1B193BFB3C877D24E" xmpMM:DocumentI
D="xmp.did:FABB056C558811E1B193BFB3C877D24E"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:FABB0569558811E1B193BFB3C877D24E" stRef:doc
umentID="xmp.did:FABB056A558811E1B193BFB3C877D24E"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................c.0.................................................
............................................!Q..1AaR.q.."2.#3C....u...
.Bb.S.t..5e67.........................!1AQ..a.q.."2Rb......Br.#CSs..$.
...34t%5...cT..............?...c..cA4.A..S....7.t.....F...#....L.0..EC
F...v.`..Z....7.*...P...T?.^`..v}e.8.!...k..v..;.5..q....C.J_OW../r..1
.Jk...m.I.............j.Zq....W..&.!...[ ....D....yvB^p..s. .....G.1h.
v........}......2.{..n..N...K....$.a^.....J..C...;#.-..B5.....a..j<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_corners.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 2323

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5E231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:AEB0E8BA556411E1A2C0A3AE56E
7EFC1" xmpMM:InstanceID="xmp.iid:AEB0E8B9556411E1A2C0A3AE56E7EFC1" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5069219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5E231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
..................I...................................................
....................................!1..Aaq.Q."R.#....Bbr..3C$d.UV....
....................!..1Aq.Qa......"2r...Rb......#3Ss.$4............?.
...e....g...J...[p..:(&.t...k.3.R[[email protected]
..._}._....W.....?..$..m.........L.G .~T....2..h..~..u..5=<. ......
y.t.....0.e[\..8e......=..........j..v.z.o...5.a.\...A....A ......<<< skipped >>>

GET /cookie/?ssp=1&userid=6110017589072035866 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: sync.active-agent.com


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:52 GMT

Set-Cookie: userid=6110017589072035866;Path=/;Domain=.active-agent.com;Expires=Wed, 29-Jul-2015 06:28:52 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://ad.yieldlab.net/m?dt_id=15233&ext_id=6110017589072035866

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /banner/twiago/676/2014-10-31/0_Teilen16_9.jpeg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; accado_ex=



...i.vO.=..l.......Q..F.q..-.Y..W...5.....VP.H"....R=.k..r.....]E.I%.T
.r........W5....i...q.u..7_0.?.p~..#..=........E....G6FH..#.... 4.....
I..a...o.3....vO4....n.l.z.4''k.{Sw....2)..ON..:...bj..q..uA..r;....@X
..IRK...Km...Wb..1...NN>....f..................s.P..9n.K.J..Fq.....
>`...Z'.G..9#'..#P..'.[`."*}....bG...H.5".q...V..J....'.*E.nkM....z
....,..=.i./...I..R..... ..:.......'.z.....x.z.w........w.v.G..9.....|
.......Pn p..T...w.8.!Q......(. L..1....b.....A,.....)...,[email protected].
V.dX.'...R#........V............[....=.........QI6  )..qY.,..O..... 9%
. .Wl...S........i.B...3...$ ...."..bP0#$c.G!r.1%W.s..].v.qAEmB.......
....q>..Y.5.#.4.....q..........\...2...F.y...f...ZE....i.u.HaP.....
...k..^F...n...3<.... ....in....(..s..7....c.._....TD.....?...`.d.(
6..-XJ..{1...>U...5.1....l.~u..T.6.$..b....W.x..Y2..=.Z.......*.r..
>.V4.....[...$y..x4...8R._i....^....s.......I.?{9=..]....&..O.^....
....o.......4..r=.<<.H..$....<...>F.aN.1.)[email protected].
rXg.N\..#...U...iNI..PC%r.K.~^...x......E1...-8..z.B\....$.A.,...FD...
=i..KG....r8...4.W......;..>V9"...$6rH.W..0.`L.....leP.;..1$[..A..I
g!uh........&7J....j.X....`.9...(;x.....ry...lpzs.)[email protected].^
...T.!..L............f.I<^^..c-.A$. H ..J.Y..........p..[.b..N..x..
=EQ.Cc....s.Q.......E.%. ..\4d....T#e..D..O...U..<......R}...ß=X.
h..j'D...Py.i4.<d$."..g..xb.t......*.K/*1%.,H:).......J.#..I.:Vcnc.
9..r.Eg..`..*.P.O>.......a./..{...I....f...8..E.BId..........|.....
.FC.$..F=......-........k..._AE....uw..{..!e!C{.....z,W~4..r.-...;<<< skipped >>>

GET /PublicSureServerSV.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.omniroot.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=864000

Content-Type: application/x-pkcs7-crl

Date: Fri, 30 Jan 2015 06:28:47 GMT

Etag: "2b001f-47061-a00e2fc0"

Expires: Mon, 09 Feb 2015 06:28:47 GMT

Last-Modified: Fri, 30 Jan 2015 03:59:03 GMT

Server: ECS (ams/49B3)

X-Cache: HIT

Content-Length: 290913

0..p\0..oC...0...*.H........0F1.0...U....Cybertrust Inc1 0)..U..."Cybe
rtrust Public SureServer SV CA..150130034345Z..150209034345Z0..n.0....
..... .Lz...101018164835Z0.........,.)5...101116173409Z0.........,U..I
..101116165848Z0.........,U./...101116173007Z0.........,U.h...10111617
2944Z0.........,V.bC..101116193600Z0.........,V.[H..101116193534Z0....
.....,V3Y)..101116193648Z0.........,V5._..101116193745Z0.........,Vg.z
..101116194901Z0.........,Vh....101116194922Z0.........,Vn.4..10111619
5619Z0.........,Vqvg..101116195553Z0.........,_..(..101118145747Z0....
.....-..4...110315204303Z0........../P....120206141831Z0..........I..@
..120124180322Z0..........JP....110222182509Z0..........Jf/Y..12021314
2815Z0..........Jf.P..120213142915Z0..........OT....120221131614Z0....
......YQ.1..120220131256Z0..........Y`?W..120220131507Z0..........Yuu.
..120220131416Z0..........^..^..111007192320Z0..........`.w...12021314
4727Z0..........`.y...120213145412Z0..........`.&...120130163851Z0....
......hlG...120213145015Z0..........h.....120130140408Z0............j.
..120110213653Z0...........}....110406160143Z0............$...11040100
5006Z0................110401005536Z0............W...120308151704Z0....
.........h..120228141105Z0................110314145902Z0............`.
..110322142311Z0................110322142551Z0............lb..12011021
3802Z0.............0..130201130700Z0............OB..110321165802Z0....
.........o..110321172720Z0...........g.:..120221183148Z0...........Ud.
..110516131110Z0............h5..120229174140Z0................1202

<<< skipped >>>

GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.yahoo.com

DNT: 1

Connection: Keep-Alive

Cookie: B=52qa5ah9dvsod&b=3&s=ur; RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; ih="b!!!!#!C'Wg!!!!#>[b?c"


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:49 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Sun, 29-Jan-2017 06:28:49 GMT

Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com

Location: hXXp://ib.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC

Cache-Control: private

Content-Length: 0

Content-Type: text/plain; charset=utf-8

Age: 0

Connection: keep-alive

Server: ATS
HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:49 GMT..P3P: policyre
f="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI
 PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY
 ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"..Set-Coo
kie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Sun, 29-Jan-201
7 06:28:49 GMT..Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; 
expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com..Location: ht
tp://ib.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC..Cache-Control:
 private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..
Age: 0..Connection: keep-alive..Server: ATS..

GET /banner/twiago/761/2014-12-18/0_NCR_NE_Kampagne_Performance_1114_00_000_300x169.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; accado_ex=


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: image/jpeg

Content-Length: 39400

Connection: keep-alive

Last-Modified: Thu, 18 Dec 2014 14:37:29 GMT

X-Age: 3136042

X-Cache: HIT

Accept-Ranges: bytes

X-Edge-IP: 46.234.105.122

X-Edge-Location: Ricany, CZ
......Exif..II*.................Ducky.......X.....rhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c02
1 79.154911, 2013/10/29-11:47:16        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:8E4AF5936D35E211B
C7382F3BDA9CA7F" xmpMM:DocumentID="xmp.did:CCE4DB2A7FB511E49C34E788E8F
9A03F" xmpMM:InstanceID="xmp.iid:CCE4DB297FB511E49C34E788E8F9A03F" xmp
:CreatorTool="Adobe Photoshop CC (Windows)"> <xmpMM:DerivedFrom 
stRef:instanceID="xmp.iid:9858622a-7cd8-804c-9b60-e4f31f750ebf" stRef:
documentID="xmp.did:8E4AF5936D35E211BC7382F3BDA9CA7F"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.......................,..............................................
.................................................!1..AQ.aq"2......BR#.
..br.3$45...CSs7.ct.%......u68.DTEv.......................!1..AQaq..."
....2...BR..br#...3.5.C46...$.stc.D............?..^.2..}....2>.\.y.
.\....K..=.*Q....N.W..Oy.x... ....r/..1>..%.....UT............*P..p
..qij.ue.oS.......IyiS..IIHQBI.<H....Y.8%....}rk..@............<<< skipped >>>

GET /tags/FreeRideGames/Germany_ROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: tags.expo9.exponential.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:26:40 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 4408853015460759652

Expires: Fri, 30 Jan 2015 07:26:40 GMT

Cache-Control: max-age=3600, public

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 2305

Connection: keep-alive
...........Y.o.F..L...~(.Z.d..h.p..)` >.....3.....R$.\Y.]....7..s.)
@L..kg.3;.|.%a.?.t.....x...]....m..j|t.M.y....7./,... S.1.._.e?...i..l
)...a.F\..,..?..dAB. X..V..tJ.M6g.$cs?"G.....Bhw..I.p._..b .67O.".;.L 
.YB..,.I.......5......3.G.c..u..V#Y..........B.....k...R.}...>P...k
"".{1....)Z.#h.d...N..a.. !.(..d...<.......x.'9"4i/.......%.].....i
......\`R]}.)o.VR16....c..</..(~ge....s.t.........\..)(.<\.....T
.<_...M(.|.7.,..........L.....P.....W2.)3..8/F..O...i........6...pk
....bS.`...D...;...U-...H.2t..y.`.n2.b.@h..<.7kt....2|.>[email protected].
@lvMT.YK.0:.r.)..|.b..p......._*...O,..:.!...e.]K...T.`..:$..(`..$.x.b
..'..0v6%C.{r"..E..V =v[....O..U...,...8.f1...~..U.t...`T{.....e"tt.T.
F)..(..........d>I.9..q..."...#. "..p..vH.;...."|.3..k`p.|..x.?..k&
lt;..#f#.."Mx.C"..O1y.hk.....IS %r....^.x.....a........|.I.jQ.3.|WrK..
.eo.....b.r.;S.........R.~.. n..(<{.8....r...E.a..4....i.IS..!{.9..
..?mf ..~.....#:..t.........s8..Oc.....~.......u...'....{..Y...YJ.?}..
.~...>........kZ..L.m:$4M....g.O..\)..*..xx..B....3....y.B-6.r.....
[email protected]*...E.._.....'8 ...gd...\.Y ._......m.....v.....)&>.
..gp.K>..^.g......q.}.]......$.-l..D...T=..6..g.z...i.S\C.dP..p.~..
T...,..}-...cW'J...lq..[.....`Y..;...C..n.8. .Z .!...g...b..~.X....A..
f.7..)L|.c~d...".W;.qK.N[[email protected][..s.W."...Z.u...$~ c.M.m
jh...Z.......,...4.....ad.{.T.L........zQ.1...M..,S~c.......<.LZ.:P
.e......xu.1<w..n.>...d.9l.`..3..........<.?......o.....G....
l..gt....4............u.S..akt7..Y.le..........c2.T.....5}........<<< skipped >>>

GET /UTNAddTrustServerCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1162

Last-Modified: Tue, 07 Jun 2005 08:09:10 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0..n.......RB.JO7.CiHz.g.]'0...*.H........0o1.0...U....SE1.0...U..
..AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTru
st External CA Root0...050607080910Z..200530104838Z0..1.0...U....US1.0
...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0
...U....hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0.."0
...*.H.............0...........8?....9.Qg.m...X... ...T..8....!yH..at.
..<jr.<.g:9. ..f...3.l......uy.F^...j..*U..T.......]..m..q.k....
...1w...z.2. ..8n..^#.E.{P..0... z.[.3@...........].......i.....!...i.
.3.).F...I4.iQ....h.fL.>.a......=.|.L..^k.....(..M..s.n.......vD..c
...I.....2.H[........0..0...U.#..0......z4.&...&T....$.T.0...U.......r
_&.(.C.].7....K..E0...U...........0...U.......0....0...U. ..0.0...U. .
0{..U...t0r08.6.4.2hXXp://crl.comodoca.com/AddTrustExternalCARoot.crl0
6.4.2.0hXXp://crl.comodo.net/AddTrustExternalCARoot.crl0...*.H........
.....`d9Y.Ce......3..S....#.l..dYSS..6....Ny/.....*Amq..x8#.pK....."b.
...Q.-...E....~..2...5^n.,hh.....U../.@..."\m......3(f...3......y.....
..R.?....>...._..IC.9}./..u]~gg..Y @.7"..C.0.C...]m.)....bc...7.og.
.bW9..M.*a=....w ./..r....x.'..`.......k$.....Kh.....?..

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: eu-gmtdmp.gd1.mookie1.com

DNT: 1

Connection: Keep-Alive

Cookie: id=3025970665045060; mdata=1|3025970665045060|1422599330; OAX=IAz1ClTLJKIAATbP


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=3025970665045060; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Set-Cookie: mdata=1|3025970665045060|1422599330; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Connection: close

GIF89a.............!.......,...........D..;..

GET /xre/107/1078532/922460/js/j-1078532-922460.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

x-amz-id-2: jGTYRaHR8NPlWzIB mZJWUlU9bCBEVpWFdFp QHrk9WWcZwTFVbe4UPdcqP9ep a

x-amz-request-id: DF0B0196911E30B5

Last-Modified: Wed, 28 Jan 2015 09:31:11 GMT

ETag: "3763fbaa53f0f2cfd0683b51ae5fff82"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Length: 9617

Connection: keep-alive
...........}kW.J..g..B ......NbGa.H.pN^..>.^`.d[.".%$.....~..OY.$.g
..$k.............l..N.4..Ag....j....;...........o6!m......{....G...:..
..&H......z.|...[.D..B..9?..y.M........d...!..aO3......&.... o.....|..
....6R..!...U..Q4../..2...Y..4:?.A.%r..k...0.j&......4.g..I...[60.....
..I.9...........a..8....w.&.=@....`.M..s.i?.._>....$......:N....vj.
.Ml.@.........;.?.i0...8#..7..$.._...^Xw.^X.....G..i.z@/.w_..w.%`..I.t
.........P....;..n.r..4.._.....x:<:. ..^...G.N.BO...:.*....."....Sw
..I.i6..0H'.I8..d....x...<mn?}.b..b{g...N....V...$....'...?.~|...3.
..FI.x)a.G.(....].*.z..ic8..Q...F.K.'..f....<ld.!......?....r...$..
~. >..).'5......../..r.G7!.......E..$...).:.....]L.G.|.J....0......
..,.....m..1...E...1 ..4...q.u...x>...K....p(........../.U.P.D...0.
......v.0....8.=...Z.....g...mjy.... .......J.$N...6.y.!.vvv....x..x..
..{....%_...2..;.`...|.....B.H.&tjStl.;.y.5..D...5.2j.|.S..\.0../.'N.b
.@.]@/,.......z[..8.&..M.....r}.$in7I.....vk.{.....E.$8|.......V.._...
..?|........|.........G'..`:..o.........|.?.tpt.. ~...0Af...`:.>m7.
...(...qx4IR..P.o.g[..M.E8...%..4D..iF..`p7.Y...T..<.ro..D...5.$.-L
..U9`...q.....4....1^..W[m....#(JG.(...Y..........q..-0...9.o.......1u
...1s.8.?<..0..s.R....$...|2...]FD..#.h.4.D..M.G.........?_....V..@
..f.L...6.........nwq.>......y.........*.'.,..T.........}P........$
..X....4c.?..O.3........}3^.....*...[.4...o.s....?.O......N.4Va!...'..
[email protected]#...Tx0..........q.<.99,.:..
..Q...@...!.].....N... L...M..o.x..i...D....$=.o.0.ae0...Xr2..`.&g<<< skipped >>>

GET /pageFold/ftpagefold_v3.0.18.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

x-amz-id-2: mDn5GRQEMQ/w1wI8v4lV4WUSbQkcKurjZABYqORtehCk8KMsxeFHaJQw/Uso3NRg

x-amz-request-id: F2DEDD6D088F3727

Last-Modified: Thu, 27 Nov 2014 12:56:33 GMT

ETag: "c4e7b5e7a3dafbb4b750da9bf5707dfb"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Length: 3840

Connection: keep-alive
...........:kw.8... [email protected][email protected].|y{NA.
.F..\...<tS.....`qeL.[...m.....*..3.._......O...;.o...w..... d..t".
.Sa.T..{.(.....X2.`A.0..R*.........H....,...........{|d./..g... 7.}.#.
........(\.8........jU~.N,.1...j.z...........b.%..,..Y..d..X.:|...M..O
.uc.R...Z.`.. ....VV.....y.Pw.j...%.x.f$K.z.r..k1....._Rg.lp6z|$.4Uxk.
~:....y.F.m.o$|..^ab......W.Q.:..tb.<.........O.&<N? O..&....3.P
R%`....3..Q.........F.Zc...rlg..\O`0......-.<a..~.M.....$.[~FhUR.g.
..H.....3I.^~...N(.'..05..X...h..x......)..<..=... ......^...8.....
..~...O,.g.....A.\S..[`x..."...DzoOQ.R.....e....D..u.e.......>HV...
...O....._...Lu..>=..X.N.. ....c... c%p.....>.^9....@......@....
[email protected].&..G......z^.aN(...E.......4..$ro.l.......=.|y._..E.......
......A.i..iOq.F...........M$B...T".y...p....~.#......4..Y0.....2U..dT
...B..,.........(.C...:......6.g._...6.K!f.(.c.$=...k.i.m..<...../}
..W0..Y..........Z..~Y.b.G.S....?.*.>.YW.`(.pde...`.}pX..K....Y[...
K];..9..A.b#f.........G.Y.3q....E..0....)..h...M.....L.c.d.....yk?".@.
B..<...E.(....X.N.L/...W.4.`..$.RB.qm.<.....U.x..%m..]S.)d......
.... ./....<....q....O..2Q...46...21....Q..je......|c.XLh..~.^.]...
..e.......33..... ...k6....A&.y...AE..{3..g<.B..,..D..........c:^.u
..r(h..1...X......w..F.W.......W.7.8... Z...8J#.\.....-.z{7.....w?h...
.A.X........)298$.#./.. ~.$./...............A..z7.$D.&...v..........[V
...u.jY/.....:8?.......;..!U)i..[9-8..,..j.W.a:..'..W..U....J.r.......
.fs.$...o.\......f...$.3.s....,.s ../...WT....2..y.(.....R.....~I.<<< skipped >>>

GET /xre/107/1078532/922460/image/922460.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: flashtalkingad1="GUID=258658AC9B8964"

DNT: 1

Connection: Keep-Alive

Host: cdn.flashtalking.com


HTTP/1.1 200 OK

x-amz-id-2: yc6G6yd4knM8NS4f5F0SX60dNRigRAiWTyDV0eTrIffWHsFipAnlOE72kVU WL1tyqPs3tLygPE=

x-amz-request-id: 3AE12336DE85C8B0

Last-Modified: Thu, 22 Jan 2015 10:08:17 GMT

ETag: "639c9edd245180f07fbc923883e24803"

Accept-Ranges: bytes

Content-Type: image/gif

Content-Length: 19150

Server: AmazonS3

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ........,..........................................K
...........................!..1AQ"4Rqs....2STa...#3Bt$5r....Cb..&6G...
...................................F........................!..1Q2Aq..
."Sa.....4Bs.....#3Rr...$Cb..D.c..............?.. ...Q......I(Ns...1V&
lt;..Y.z.&....f."~U9..}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....
D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...G
W..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.
?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}&
gt;o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u
|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5..
..D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7..
.GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW...
_.?*dC}>o.u|..5....D7...N{P..SP..........>.^...`d.5.S.6;-..-....
.3*Q...........h....jZ1...a.7o.z......hBs.yJ).:|Z...z......:.......>
;R...3.{...QZ.../.O,v...a..#vg.......}.._..X.?K....F..E.O..Ej.....<
..~....<.......:......:yc../...y..=..?.u...?R.t..i._v.(.7fz/z.0. W.
~.........>Q.n..^..a.V...K......}.|..........._a.....;O....G..3.{..
.QZ.../.O,v...a..#vg.......}.._..X.?K....F..E.O..Ej.....<..~....<
;.......:......:yc../...y..=..?.u...?R.t..i._v.(.7fz/z.0. W.~.........
>Q.n..^..a.V...K......}.|..........._a.....;O....G..3.{...QZ...<<< skipped >>>

GET /UTNAddTrustServerCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1162

Last-Modified: Tue, 07 Jun 2005 08:09:10 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0..n.......RB.JO7.CiHz.g.]'0...*.H........0o1.0...U....SE1.0...U..
..AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTru
st External CA Root0...050607080910Z..200530104838Z0..1.0...U....US1.0
...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0
...U....hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0.."0
...*.H.............0...........8?....9.Qg.m...X... ...T..8....!yH..at.
..<jr.<.g:9. ..f...3.l......uy.F^...j..*U..T.......]..m..q.k....
...1w...z.2. ..8n..^#.E.{P..0... z.[.3@...........].......i.....!...i.
.3.).F...I4.iQ....h.fL.>.a......=.|.L..^k.....(..M..s.n.......vD..c
...I.....2.H[........0..0...U.#..0......z4.&...&T....$.T.0...U.......r
_&.(.C.].7....K..E0...U...........0...U.......0....0...U. ..0.0...U. .
0{..U...t0r08.6.4.2hXXp://crl.comodoca.com/AddTrustExternalCARoot.crl0
6.4.2.0hXXp://crl.comodo.net/AddTrustExternalCARoot.crl0...*.H........
.....`d9Y.Ce......3..S....#.l..dYSS..6....Ny/.....*Amq..x8#.pK....."b.
...Q.-...E....~..2...5^n.,hh.....U../.@..."\m......3(f...3......y.....
..R.?....>...._..IC.9}./..u]~gg..Y @.7"..C.0.C...]m.)....bc...7.og.
.bW9..M.*a=....w ./..r....x.'..`.......k$.....Kh.....?..

GET /rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t.mookie1.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.3 (Red Hat)

Set-Cookie: id=3025970665045060; expires=Mon, 29-Feb-16 06:28:50 GMT; path=/; domain=.mookie1.com

Set-Cookie: mdata=1|3025970665045060|1422599330; expires=Mon, 29-Feb-16 06:28:50 GMT; path=/; domain=.mookie1.com

Set-Cookie: OAX=IAz1ClTLJKIAATbP; expires=Mon, 29-Feb-16 06:28:50 GMT; path=/; domain=.mookie1.com

P3P: CP="NOI DSP COR NID CUR OUR NOR"

Location: /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]

Connection: close

Content-Type: text/plain; charset=UTF-8

GET /dc.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stats.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:00:39 GMT

Expires: Fri, 30 Jan 2015 08:00:39 GMT

Last-Modified: Fri, 16 Jan 2015 00:55:08 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15931

Cache-Control: public, max-age=7200

Age: 1560

Alternate-Protocol: 80:quic,p=0.02
...........}k[.<[email protected].^.,[email protected]..>
;.......i4...x...7H\..-O.9.d".....`wp=.$2.X...$.%......dv....q."..F..{
...yv.$."9..i*Y...g..;..8M....k.....{[email protected]
C...).o0A*y&.....sX7p........`.......Y.K..{......p..G.`x..........8...
...B.....Z.A6.....!.".1..!>......b<..=.e.k....=.....y...B..?..M.
..H....R...%.....aw.E&]......!D.....t...a.. .......e.{.....q8....c..=.
1..n.\.z...8JG.;......W......]......$....N...&A...X.KCV5.R...<..._|
b..$.l.*3..1P'.....N.k.\.....Z%[email protected]..}.q......7.u.......,
C.PX%.0..<...^[email protected].`..}.;n.....x{.........:.u G.iP
sv.........q......./.6.... .D.k....y&...[5..1..{0z<.8.ot...........
..h.../.....C...2L..;...P.....E.kBur~uY.`.$....z......D.a=...'E..Y.. .
s.7&X...y.....9..2...5.r1q..A.|.e\\P..R..u`iV!.7a...J...VNW7.j...R...U
c....^L..."8l..".........q.!f..V..-.1..G...*5..R..N.{Q.6..(8...j.;.y8.
........N3..<....,|.K.f;...tq....I...Y{[email protected]..)......oa.F..V..
....)......X..z#..X.....}.I.B....d.......N.....*].*..;pd.\.R.. Og5../e
..h^n.....U.B...;B<............j.........Z..H/.Z.,.~..~.3s.5..,.:..
K.L....F.D...2.......Ix....)tc.  ..j[....r.%..%<.[).k.N.v..s......?
."..^.c3....<...mo.7i)M....mQ.7.....p/..*.....:m2L.0%.-.KK:..y....&
lt;.4./..Nyqla...X...... .........<s<B...|......;*RC..n.9.\....J
.^..l......L 4;..4SC3_f0.P.P. p...........VX..I.q...D..p..N..w......-.
..F...A...cX....k..C..n..wZ..*...E..a- [[email protected].^..gE....>..
[email protected]...'...........w...{L.LB.......w.n.P,....H..<<< skipped >>>

GET /__utm.gif?utmwv=5.6.2dc&utms=2&utmn=790040421&utmhn=partners.freeridegames.com&utmcs=utf-8&utmsr=1716x901&utmvp=1173x539&utmsc=24-bit&utmul=en-us&utmje=1&utmfl=-&utmdt=Download free games, Play free games at FreeRide Games&utmhid=1024398902&utmr=-&utmp=/my_games?gameId=659050&utmht=1422599221790&utmac=UA-4994835-25&utmcc=__utma=2252849.2023569898.1422599221.1422599221.1422599221.1;+__utmz=2252849.1422599221.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=q~ HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stats.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 29 Jan 2015 06:00:37 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 87963

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Wed, 19 Apr 2000 11:43:00 GMT..Last-Modified: Wed, 21 Jan 200
4 19:51:30 GMT..X-Content-Type-Options: nosniff..Content-Type: image/g
if..Date: Thu, 29 Jan 2015 06:00:37 GMT..Server: Golfe2..Content-Lengt
h: 35..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-re
validate..Age: 87963..Alternate-Protocol: 80:quic,p=0.02..GIF89a......
.......,...........D..;..

GET /tags/FreeRideGames/Germany_ROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: tags.expo9.exponential.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:26:40 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 4408853015460759652

Expires: Fri, 30 Jan 2015 07:26:40 GMT

Cache-Control: max-age=3600, public

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 2305

Connection: keep-alive
...........Y.o.F..L...~(.Z.d..h.p..)` >.....3.....R$.\Y.]....7..s.)
@L..kg.3;.|.%a.?.t.....x...]....m..j|t.M.y....7./,... S.1.._.e?...i..l
)...a.F\..,..?..dAB. X..V..tJ.M6g.$cs?"G.....Bhw..I.p._..b .67O.".;.L 
.YB..,.I.......5......3.G.c..u..V#Y..........B.....k...R.}...>P...k
"".{1....)Z.#h.d...N..a.. !.(..d...<.......x.'9"4i/.......%.].....i
......\`R]}.)o.VR16....c..</..(~ge....s.t.........\..)(.<\.....T
.<_...M(.|.7.,..........L.....P.....W2.)3..8/F..O...i........6...pk
....bS.`...D...;...U-...H.2t..y.`.n2.b.@h..<.7kt....2|.>[email protected].
@lvMT.YK.0:.r.)..|.b..p......._*...O,..:.!...e.]K...T.`..:$..(`..$.x.b
..'..0v6%C.{r"..E..V =v[....O..U...,...8.f1...~..U.t...`T{.....e"tt.T.
F)..(..........d>I.9..q..."...#. "..p..vH.;...."|.3..k`p.|..x.?..k&
lt;..#f#.."Mx.C"..O1y.hk.....IS %r....^.x.....a........|.I.jQ.3.|WrK..
.eo.....b.r.;S.........R.~.. n..(<{.8....r...E.a..4....i.IS..!{.9..
..?mf ..~.....#:..t.........s8..Oc.....~.......u...'....{..Y...YJ.?}..
.~...>........kZ..L.m:$4M....g.O..\)..*..xx..B....3....y.B-6.r.....
[email protected]*...E.._.....'8 ...gd...\.Y ._......m.....v.....)&>.
..gp.K>..^.g......q.}.]......$.-l..D...T=..6..g.z...i.S\C.dP..p.~..
T...,..}-...cW'J...lq..[.....`Y..;...C..n.8. .Z .!...g...b..~.X....A..
f.7..)L|.c~d...".W;.qK.N[[email protected][..s.W."...Z.u...$~ c.M.m
jh...Z.......,...4.....ad.{.T.L........zQ.1...M..,S~c.......<.LZ.:P
.e......xu.1<w..n.>...d.9l.`..3..........<.?......o.....G....
l..gt....4............u.S..akt7..Y.le..........c2.T.....5}........<<< skipped >>>

GET /banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=7&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601957986398

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 5947
document.write('\x3Cdiv style="position:absolute;width:300px;height:0p
x">\x3Cdiv id="obaButton_6110017601957986398">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_300x250_grey {\n    width:300px;.\n    height:250px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0k
Ra2RNR3aG3NRNa a,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoff
er_0kRa2RNR3aG3NRNa h2,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey 
.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\n}\n.
paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa 
a {\n.display:block;\n.float:left;.\n.background:transparent url(http:
//imagesrv.adition.com/banners/270/files/00/00/b6/f2/000000046834.png)
 no-repeat top left;\n.padding:1px;\n.text-decoration:none !important;
\n.color:#000 !important;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250
_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3N
RNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer-block_0
kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:focus  {\n.ba
ckground-position:left bottom;\n}\n\n.paoffer-block_0kRa2RNR3aG3NRNa_3
00x250_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kR<<< skipped >>>

GET /free/frg/products/661050/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 13 Sep 2010 08:36:31 GMT

Content-Type: image/jpeg

Content-Length: 17879

Accept-Ranges: bytes

X-Varnish: 322100255 321473029

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......R......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?.......n7...5.9.}.o........9.`.... v[-.......1s.0...U......
.[..7..5,_.......{ mZj........[q..}C..8.bW.f.....>%..._.....3.#....
c..7...-kK|.f.mA~...,.V6$.i.j...U>u.........V.Nh...&.....3...4.Sr..
..[....Q)....61'..........;..k{r.O]z.d#...,..JrA.^.X^$.Z.d..j.UHf...s.
!.. S..=.*.[....3.3t......R........n..q....G. k ........ ...&.,\.|....
..>h...........&..~_._...;.......X......B..?...I.....&..U._L..Ei\..
.2}.onM.=>....`....s...|.X..qBz.zy..!......2~....a. ..}...jX.......
MIe......^...x.....".._... .r.HG...sp..5..{|..\.Q..}..?.[...-.<>
..ZR_../Ox.C,.H.X.^-.....w.5z....w}.r.t...C....y.4&..|.d90.....k1"....
.....,.... .R.."N..l.k.. ..AM...........l......n%..... VQ!....|.......
....n.... ...z..\.`.k..2........H..&..X....M.X\|$..v.....9..x....'....
................;......K-W.~}.k..?#..u....G.r$=......I..Z........o8.8b
..h....Zf..H|...C.....I...y<.?I.*A....%..KF.<[email protected]*<<< skipped >>>

GET /free/frg/products/589550/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 19 Apr 2009 06:44:48 GMT

Content-Type: image/jpeg

Content-Length: 26276

Accept-Ranges: bytes

X-Varnish: 2215254987 2214678205

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
..............!1...AQ"a2#.q.BR....b3C....S$T...4%5..r.s.DdtE.&........
...............!1..AQaq".......2..BRb#...r.3......c$..CSs45...........
..?.p.re...`..............l.R......?..._........|.Q..y..l.V..S......9S
.U..."..>.u.....V.*..WJW%.cMa....J..Bh.....H?j.jI......Q. RPn....5*
'..3.P.l..o....LBN."..G..<[email protected].<
.uUU^...UW.\J..fD....7=..(....q....h......W..z .M*.v9T.E.....#......&g
t;.j..H..c...q.I..).H..k........z.............x...7l..'S......:.._c...
U...{...W0.QV...h.q.....i*.r..rG..m%..Y\...&.^T.H..B,....".....*.sm.g.
...B..Q.....e....ch.....3.A.\..........2=\*.k.D.2K.....2O.E...*..zr]..
.D..~W...o........1k........y.).....vA..|.b.lC.|TEL.T.k."...N2.....o..
a.a.wQGN..8\..\..^..T.vV,...a.X.....h!#._1.Q.Tw.wN......:9...W.?t..l!.
..=.1...2.. .S..../i (.....~..\n.2...j..Qf......h..B....d.g...0Z...i.4
..t>K..4^-.01.DZ.Q..e..D.D.:....I..Z.<....."..h....Mu..P.)c..h..
.N.SQ]n ....~.E_........YM..|.sutt...g.s0....]7y. ....""|W..t.V..O....
...r..g.....=$.N.2.5...DW.>]7.....].U*.....2.......c.\*U$.0~>...
...."..g..h.T....v..5.......59I...K..N../......J..U].. ...q..Eh..,s.l.
%..!.=-.M4....*/....[v.|.K.Z...o.G,..cd'...l./,?.... C3)..N...k..."...
'.x....U.34..M|t.......!.6.:.4...d..{....j.1..*..Y.}OE{: W..ya.^/Q<<< skipped >>>

GET /free/frg/products/643650/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/524350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 05 Mar 2009 14:05:07 GMT

Content-Type: image/jpeg

Content-Length: 29022

Accept-Ranges: bytes

X-Varnish: 322100376 321480578

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!.1.AQ"...aq.2#...B......R3$%.rCb..4&.....................
..!..1A..Qa..q....."2.....B.Rbr#......3s.Sc$....4D............?..;....
.=.... *...-.G5..YJSU!(......#F..K..H.........IU3.Ls.....Q.x....a.....
[>Q...'.......1...zBV...o.J....j...gb.Q..u.C..M!T......"7Z.e.3.....
.......a7...s...v.........~p. OMhTv...P.q.]..t&..,.3..\.I ..'..M.7V..v
.yq(fx..3S.b.../.}........S.J\..}.q.!..u....Rk..).bk.O.q.A.m..k.1o..t.
.....U.....P...........t.._.LV .(.%..>.r|......[.G*).V.l...==.J..un
.\..<....A.W?..` ..>....{.9.s.p..P....!..n3...F?tZ.Rmr..........
x...C.c....{...Q....(.`YM...u...:.A.Z....SU).J..H.i..z.{..$Q.....H..f.
.....j.Bv0>W.-.J}...*$......f....teizD..{u.).p..n$V.]y...BEN.'...H.
V.J..Y.0bI......*..)Ris..!$.>c".&...T.1.Ty7&...6^MO.........I..v.`5
.5.Z...9.<.......&...!.......q..}....qc..N..V..@uM.*j...P...B..../.
.].w...<..=..=l.....H....bI.c)...........o...D....7q.R.....]@.>.
"..U.W.sN.M(u/..6d...........A..oG...{....{]....v.......e.......?.....
X.".:..`..#.v3..R.x..ZBTh....{C{.uQF.F..d.$......m.....Rx.....^.T.f...
...X...c...sP.v;.A)<J.... Ji.~...V4.]..1..x.{......Q..E......8.....
.....$(qJB-...xmF..-S.,D.]...........S.S.F1;q.....h.....CmY..fBJ...t..
.H$.P..........y...j...e..6..w....S.W`.Iq...ko.[.."^3m.1.Y.!A.M.%.<<< skipped >>>

GET /free/frg/products/719950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/765950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/764350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 26 Feb 2012 08:57:18 GMT

Content-Type: image/jpeg

Content-Length: 12274

Accept-Ranges: bytes

X-Varnish: 783609349 783241634

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:39 GMT

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".........................................E.......
....................!1.."AQ.2aq...B....#3R.b...$5CSr.%4...............
......................3........................!1..AQa..."q..2.....#BR
..............?.......\....qOI..uD.JKi$.6..........v....-OU..`1=q..XA.
..l{[email protected]#=.*.$.....c;M..m.. f
..,u`..ETQ .....;N......~XB0........G.o.|1.....B..Xv{JU<..[..v.. .]
A.......v....ck.Q.m..PT.{.$...f2.h..t.O..Z.\U..xq.....;R....W.T[X.B.B.
......%........6.|G..T[....f....|.Xn.H......`^..b?6k..(T..9;.o......l.
.4.)..Ts.t....<[email protected]\5.....i..2.G...r.\a...F.q.2kDv.[c..r
[email protected]..:..*(Qf..}\....E.SP.Fi.DX......%A.V.B[).....?..../.l
*.x....'..s-..{1....c......(..b.}...V'2d..JMR...*..R......).\.....IH..
.O....T.T...A........B....2\.........f.Q.......Y.'..(e.v.[.A..>...M
......pe....X8..`....lx&......[N.[.<T......6[......].LdCA.....b..kE
.....t6..O....Z6W...Q.II..._..enkr..k=5....y....'.lHP..V......V$......
"X  ..;B.l....)L.Dih!A.7.n..mo..'vH.-[d... ..N.Fi....... ,.......P .V.
1"....G.^...;...!M.%....R:c'.Fs.).d\nZ.u[..-..94......[RcA..d1..,...).
j...,.g..Qn-.xE..b.&......e.'.TO[b..oda..!#6K...y.6....R.....w..6.E..C
Hv...7C.....%...(.....E.u..>"..;S.Zk. xHe..|#....B...g..f.&.... ...
$....U/j.M..f.r...'...,..F..'.Ea7i..(..g.D...rv......c.yIU.<K..<<< skipped >>>

GET /Security.xml HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: __utmc=2252849; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0; __utma=2252849.2023569898.1422599221.1422599221.1422599221.1; __utmb=2252849.2.10.1422599221; __utmz=2252849.1422599221.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}


HTTP/1.1 200 OK

Server: Apache

Content-Length: 404

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/xml;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:28:46 GMT

Date: Fri, 30 Jan 2015 06:28:46 GMT

Connection: keep-alive
<wl:whitelist xmlns:wl="hXXp://VVV.exent.com/EXEtender/WhiteList"&g
t;...<wl:general>....<wl:urls>.....<wl:url>hXXp://pa
rtners.freeridegames.com</wl:url>....</wl:urls>...</wl:
general>...<Signature Value="UWyEE6aHdzxjS0-NmcpRe2Ya8OzGKCOjRoh
PMGEuR5equoDUJip2l.e6h4qBxgdBc0p6kKQEPeL98HS-eVi.Whk7NrC11fcoLJHfRWLyd
-6fg9dp6l6OIoAs1ybJTsHXw-TKFPIexWAakG5nlf022XIPbeSVpi2fbgN74OxxUHo*" I
D="Server"/></wl:whitelist>..HTTP/1.1 200 OK..Server: Apache.
.Content-Length: 404..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI
 COM NAV"..Content-Type: text/xml;charset=UTF-8..Cache-Control: max-ag
e=86400..Expires: Sat, 31 Jan 2015 06:28:46 GMT..Date: Fri, 30 Jan 201
5 06:28:46 GMT..Connection: keep-alive..<wl:whitelist xmlns:wl="htt
p://VVV.exent.com/EXEtender/WhiteList">...<wl:general>....<
;wl:urls>.....<wl:url>hXXp://partners.freeridegames.com</w
l:url>....</wl:urls>...</wl:general>...<Signature Va
lue="UWyEE6aHdzxjS0-NmcpRe2Ya8OzGKCOjRohPMGEuR5equoDUJip2l.e6h4qBxgdBc
0p6kKQEPeL98HS-eVi.Whk7NrC11fcoLJHfRWLyd-6fg9dp6l6OIoAs1ybJTsHXw-TKFPI
exWAakG5nlf022XIPbeSVpi2fbgN74OxxUHo*" ID="Server"/></wl:whiteli
st>......


GET /system/modules/com.exent.owned.geo.game/resources/myGamesBox/img/arrow.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: __utmc=2252849; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0; __utma=2252849.2023569898.1422599221.1422599221.1422599221.1; __utmb=2252849.2.10.1422599221; __utmz=2252849.1422599221.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}


HTTP/1.1 200 OK

Server: Apache

Content-Length: 3330

Content-Type: image/png;charset=UTF-8

X-Pad: avoid browser bug

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:28:46 GMT

Date: Fri, 30 Jan 2015 06:28:46 GMT

Connection: keep-alive
.PNG........IHDR...1...).............tEXtSoftware.Adobe ImageReadyq.e&
lt;....iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpRights="hXXp://ns.adobe.com
/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:
stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http
://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xmpMM:OriginalDocum
entID="uuid:92F9539BA75AE011BCF9E9E1A3754F5D" xmpMM:DocumentID="xmp.di
d:4E25B844FBE211E19D22C37B1A58EBB1" xmpMM:InstanceID="xmp.iid:4E25B843
FBE211E19D22C37B1A58EBB1" xmp:CreatorTool="Adobe Photoshop CS5 Windows
"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:18547691F077E111
8511BC5C7C940756" stRef:documentID="uuid:92F9539BA75AE011BCF9E9E1A3754
F5D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
 <?xpacket end="r"?>?.u.....IDATx..Y]l\G.>g.......IJ.4)..J...
KS..P.!Q.......'$........Q.*H..Z.F.ETi..RZJ..B,...sl.....zw..{...s83.n
.(?..I.e...{=w.|s..3c$"._o....m..-.^...< wZ.....ZU..........`...I..
.@E...........".7.._#[email protected]...(.
...mKV...Tx.. .Xz......(.]yaB..*K.%......0G..e...jA#=?..8[rE......}r..
Z||n.T...ul...y....I....T.MA.Mq.....[.*.7.....D...k........\.;..LN~..?
4.Z.....n.M....xL.e.e....-.<..../0...F.... ...K......}....!.M..<<< skipped >>>

GET /favicon.ico HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: __utmc=2252849; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0; __utma=2252849.2023569898.1422599221.1422599221.1422599221.1; __utmb=2252849.2.10.1422599221; __utmz=2252849.1422599221.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 143_UDOM=partners.freeridegames.com; geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}


HTTP/1.1 200 OK

Server: Apache

Content-Length: 17542

Content-Type: image/x-icon;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:28:53 GMT

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

......00.... ..%..F...  .... ......%........ ......6........ .h....@..
(...0...`..... .......................................................
...........................^7..^7>.^7y.^8.._8.._7..a6..d4..f3..f3..
f3..f3..f3..f3f.f3W.f3................................................
......................................................................
...._72._8..`9..`9..^6..\2..[1..\2.._7..`7..d4..f3..f3..f3..f3..f3..f3
..f3..f3..f3~.f3-.....................................................
................................................_80._8..`:..]4..X*..R.
..K...G...F...G...Q...]4..a7..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..
f3..f3Q...............................................................
..........................`8:.`9.._5..U$..I...F...O..efI.L|[email protected]..
M...R...a:..e4..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3<
......................................................................
.......`8..a9..^3..N...H..chM.7.......................]lW..I..._6..c5.
.f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3...........
...........................................................a8[.b:..S..
.K..6...............................E....F...^2..c8..f3..f3..f3..f3..f
3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f3..f36........................
.....................................f3..d7..a9..K..^kV...............
................../....F...Y ..c:..f3..f3..f3..f3..f3..f3..f3..f3..f3.
.f3..f3..f3..f3..f3..f3..f3..f3H......................................
...............f3..f3..d7..a6..H..Nyr.............................

<<< skipped >>>

GET /ANX_async_usersync.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db


HTTP/1.1 200 OK

Server: Apache

ETag: "e3de0e76c13e81e3b0683dac240498eb:1377552334"

Last-Modified: Mon, 26 Aug 2013 21:25:34 GMT

Accept-Ranges: bytes

Content-Type: application/x-javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 509

Connection: keep-alive
...........TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s..
.|\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H....
..-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...
W:4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X
.\...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w.
........X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&..
.M6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,
./.,H).|..0g.z...k../g.......


GET /p/47/d1/cc/6b/47d1cc6bf034a7bd1124aee8bed80309.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DF7/.XDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/S6aPHH9q)kTnJ!7 !!(xI $oV=


HTTP/1.1 200 OK

Server: Apache

ETag: "47d1cc6bf034a7bd1124aee8bed80309:1407679571"

Last-Modified: Sun, 10 Aug 2014 14:06:10 GMT

Accept-Ranges: bytes

Content-Length: 42501

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:49 GMT

Connection: keep-alive
GIF89a,...............NOO...npn.......s^.....I,, ..2Tt.....G....VG4...
./.....................v..:....../Jf...tfT........p...u..n............
.....iXGG5#..}...\ej.gP..-............,#..........:d...dU..26?........
.VZ^............|.............D)a..................J..................
.....v.............!%........k9L%..8..>Fx..............."..N.1.^cM.
............................................|{z.........#........>?
?.....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="
..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:n
s:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:
01        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rd
f-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="ht
tp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xa
p/1.0/mm/" xmlns:stRef="hXXp://n1....QGs.W.2...`..t`..r..;..!%0k..*9..
..{@zz....(.t.}........(}6!...G..0..P....b..C.tZ1F.LA....A..G.......6.
8.,..'.[......[ ..9Y...k..6.a...>=..L../.F'-[....,...=.a.5,..0o..E.
.p..&.`G.;..C. .y....l...f{-.)...Yn.*.I*..k..&....:..N..ee....0LH....$
....K..S.JI]~m/.GA.Z?...pW...5 1v.g..z...)r......U2s....1.....x..H<<< skipped >>>

GET /UTNAddTrustServerCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1162

Last-Modified: Tue, 07 Jun 2005 08:09:10 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0..n.......RB.JO7.CiHz.g.]'0...*.H........0o1.0...U....SE1.0...U..
..AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTru
st External CA Root0...050607080910Z..200530104838Z0..1.0...U....US1.0
...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0
...U....hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0.."0
...*.H.............0...........8?....9.Qg.m...X... ...T..8....!yH..at.
..<jr.<.g:9. ..f...3.l......uy.F^...j..*U..T.......]..m..q.k....
...1w...z.2. ..8n..^#.E.{P..0... z.[.3@...........].......i.....!...i.
.3.).F...I4.iQ....h.fL.>.a......=.|.L..^k.....(..M..s.n.......vD..c
...I.....2.H[........0..0...U.#..0......z4.&...&T....$.T.0...U.......r
_&.(.C.].7....K..E0...U...........0...U.......0....0...U. ..0.0...U. .
0{..U...t0r08.6.4.2hXXp://crl.comodoca.com/AddTrustExternalCARoot.crl0
6.4.2.0hXXp://crl.comodo.net/AddTrustExternalCARoot.crl0...*.H........
.....`d9Y.Ce......3..S....#.l..dYSS..6....Ny/.....*Amq..x8#.pK....."b.
...Q.-...E....~..2...5^n.,hh.....U../.@..."\m......3(f...3......y.....
..R.?....>...._..IC.9}./..u]~gg..Y @.7"..C.0.C...]m.)....bc...7.og.
.bW9..M.*a=....w ./..r....x.'..`.......k$.....Kh.....?..

GET /system/modules/com.exent.owned.geo.templates/resources/js/slides.jquery.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 4815

Cache-Control: max-age=15571

Expires: Fri, 30 Jan 2015 10:46:08 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
............ks.F... .............7I...9.:.N'..Y. .1E*$e......}S.,%m...
......X.......5...DT..P.f......4g..d.....=.].u...i.WC6......h..*..s...
~..x=.9.........q%.*.....tCv......?/.^.d......D.....=....#.?.c.H......
g.],..~..H#[email protected]..}.ds~...f.J...b.4.L..aU.....Y...`....2.I.(~U(
.Q.......M\8.k"X.~.Z.....r..$P.........G@,....w*V.....m..._.-c>..3.
b .>-......*.:.....I....,IZ.e:Z...4e._..X..:..f..........p.r...W?.a
.\...........O......o._]..........W/"&.M...[.H?..".E.....#....W.1N'...
.O.|*....e..a.Q....Y.y.`..yZsR..M.2..p..I?.....{..$....3f.X......f..g.
f.P,.....J.]Q......f...X.."OB..C...b...EN.a^).e.........t..../.".4..[.
.o.1QF.q7..e)4.....b|.2q 2Dt..q....cg.a...z.x.fI)`......08M.[6.xU..H..
U..........[."...9 .E.xOS......D8C..E..L...T.o"T`.4......../8..g".....
?....j^".b..z.....L...........$....N..}...acB)....0`A.........o...Z..&
......~.r.j..T...D....../........)....H".AMo........EQ.R..0Pc.1...}.q:
@p0.o............-.......B.!..d`;s....p:..M.r...cJs....p..F.M.[....\..
..o....r........%.2QK.5.S..79xJ8z.=....{.|...g.'.Mqb..y...5...5..=mb..
.$.P......p....q.P.(..XV..: ...A.....>...-..u8P.(s5.Y%.~.WR.9......
j6...Q...Fy.$Q._H.b_}[email protected]........~.....j]~.....*0.`y.yf..1... ...
zDr.p.\.FE[F....A.iRp'..)...}R.s...a..tF...'0.je.....0IK=...,.........
>....>..S.5.,.......)g.,..O]..SP..($...d|!.9`.z...,..Q....JT../.
.a....Q)...'Z..g..Q.h..D......y.....=:...........Z...<&.A..O.3..3$l
\.'g_J...p..>.\..qb.t.../xY.....f.kKi.16.u).().B..m5..a.-..4.l7..q`
....F....S......`V..D.`....o..e......PC."8..R....:[email protected]<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/swfobject.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 3944

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
.............w.8..........I.nw...%i..[..I.6.{O.......4%..oF.?!..]...h4
..{....t......w....<h.N.d.i.....$.'>7.p.....8.........F.}.b.6...
.F2....U.... .9..je.s.....f.M..D..3/.U.s>...'...,j...."p./.4}../)..
.^.]bD.H4b\Rr9....[.. ..Sb.Y...Y.../J.|.G`.G..n.!..%.'......<:.b.. 
l.D..wq...LY0.... /p..qC..Y.x........$.. :f~...t0..!.....q.....83N....
...xm.h.-.....1...y8n........<.;ww..fs.\|rw.&...W1..M...L.lJ.s...x.
.3... ....5..an..d.F.....>j...f..D..Ni.... ..9%.b$0.....[/).Gs.. ..
...8..p.....D.nk.nK.6.S?..'...y.Ot.#.i....^...M.`...C..h....7../.f....
e.......H_..2.ty.D..e......)(.......Y.......0y.F>w?........ZR!..5.U
.p.../[....tu......T..<....i....,.d......-.]L.(.\t0.....v...f..).m!
....^.Vg/M9\q]H..<.._rK. .O_'...~..|.. h.......s..<..".9..GK.. "
".F.....<...$.i.......I:(.....5...M.....4...L......'.(X..v.3.......
.....X..J.q.....4...-.=.z.g...kI&......H...........s.'......P\.mw.....
[email protected]:.`..^....\.l...yq.....m.5...w....B..K..B......f...V....
9SAA.jT...Ua....X4..96.....].D*....$..k.J.m.m.< .|..../.(.}..|..]..
..1O......Cm_.LGQ...x.q...w...n..W..%...Y....cm...u....mwG.......A....
..].T#............cv..Y........|...2qK.~6}.L.i.".. ..u.C.k.Z....."....
.....`B.......Z%...P..l..M0H..@.;......f.}B.e..4<....D-..@..!d.$2_.
h6...J......HA0..S...6..q...d.}S...-.....UY.....e&h.q.D.h......4. ....
....l_...P....~9....=G........3... ,db..a..M.~.h...M... '.2.y..y.T.d9.
...5.E'/`... .....!..'...m8`....].:9....s.*........Xe\......j.%p.w...:
`ub{.d.J.$!.."..c...PD........V.m.[(d.:#.T...k....g#dM.g...,..1...<<< skipped >>>

GET /system/modules/com.exent.owned.geo.player/resources/js/config.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 284

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
.............J.0...W.;.^9(i]....d.!X.........%%.Ze.....^.D.@ .../.azzr
...tI..........gC.|........t\.....)fdH.U9...]...V ..*.q......l..1./h..
m.0..m/.ik7C. ..,..~....a.d.kP..g....)#..1.l.M.O..Q..I.......|..9go.h.
...el....6....\....$Y....,b.#<...bv.=.s...Q...g.#...........{G)....
=.?....HTTP/1.1 200 OK..Server: Apache..Content-Type: application/x-ja
vascript;charset=UTF-8..Content-Encoding: gzip..Content-Length: 284..C
ache-Control: max-age=86400..Expires: Sat, 31 Jan 2015 06:26:37 GMT..D
ate: Fri, 30 Jan 2015 06:26:37 GMT..Connection: keep-alive..Vary: Acce
pt-Encoding...............J.0...W.;.^9(i]....d.!X.........%%.Ze.....^.
D.@ .../.azzr...tI..........gC.|........t\.....)fdH.U9...]...V ..*.q..
....l..1./h..m.0..m/.ik7C. ..,..~....a.d.kP..g....)#..1.l.M.O..Q..I...
....|..9go.h....el....6....\....$Y....,b.#<...bv.=.s...Q...g.#.....
......{G)....=.?........


GET /static/marketing/main/css/hover_elements_sheet.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 409

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
.............n. [email protected]....:....'N..H......f......!..... (:.
.Q..kKy..<.eG.Tv.c`..5.V.../....Q.w._..]_}@....z.../X.Q]V .I......'
.UW..8T...Se...Z..(.Y.EI&.^........!.\.. .t.,Z,..%..j...R\5....._.....
.....7h..f..|...L.I.3I....R..74n.Mai.x:Qp..,..AI..=:...2.gA.-. ...I.B.
yb./.T.....?q......\r.|.Z8..nQ.N....Q..w.;........^..d.9..h....'>.,
^..b.,x.|zfN...BS.B.gI..C...e.&......".........0..<Fl"....<.....
.HTTP/1.1 200 OK..Server: Apache..P3P: CP="IDC CURa ADMa DEVa TAIa OUR
 BUS IND UNI COM NAV"..Content-Type: text/css;charset=UTF-8..Content-E
ncoding: gzip..Content-Length: 409..Cache-Control: max-age=86400..Expi
res: Sat, 31 Jan 2015 06:26:38 GMT..Date: Fri, 30 Jan 2015 06:26:38 GM
T..Connection: keep-alive..Vary: Accept-Encoding...............n. .@..
W..J.....X.Ll....:....'N..H......f......!..... (:..Q..kKy..<.eG.Tv.
c`..5.V.../....Q.w._..]_}@....z.../X.Q]V .I......'.UW..8T...Se...Z..(.
Y.EI&.^........!.\.. .t.,Z,..%..j...R\5....._..........7h..f..|...L.I.
3I....R..74n.Mai.x:Qp..,..AI..=:...2.gA.-. ...I.B.yb./.T.....?q......\
r.|.Z8..nQ.N....Q..w.;........^..d.9..h....'>.,^..b.,x.|zfN...BS.B.
gI..C...e.&......".........0..<Fl"....<..........


GET /static/marketing/main/img/containers/yellow_pagenation_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1260

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=16292

Expires: Fri, 30 Jan 2015 10:58:10 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DAB8A38556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8DAB8A37556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................j.....................................
...........................R......V.....................Q.....S.......
.........?......L.*.{!r......O..M..-...hoF...u/..&V.......
<<< skipped >>>

GET /static/marketing/main/css/signika_negative/Signika-Regular-webfont.eot? HTTP/1.1

Accept: */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Origin: hXXp://partners.freeridegames.com

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/html;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Content-Length: 36195

Connection: keep-alive
.............|T........L&3.I&.3.I2.!.$.8`.......1.J.1".H.R.,e)".......
""......M...Z...K..H.RK...kY..d..y......b........s..{..s...s...?.=Za.F
)La*.?Ua......~....-...........'. ..Y...9.m.^v.{....;..Vv7.,b....p&.M.
.o...g>....l(..m8.._................|.L..J.......n..6)..>.......
..]... ......o.......g.Vm..a_.-\]..?..._.............c..y.Gw}.!_.u...=
.g..;..g^fW.y|....}.....y'ck.co...%....Y...3............1eh.........\.
.w.^6g.C.y.................=..j<_y....yPu.c.2b...=p....~;......w>
;8..C...!...3.....u..y....).......bo..O.eG.O-I....8H.z.3..X......2....
=.W.s86...'...1L...9.......t.%..z..r...z....I.......}{&S\.......].V.).
T...-....&.Ec...8....).>.?..7..'XZ-.._,....6.mN...o...C......n...?.
.....g.d.b ...G9..2.2:2...f<..D.&.DGG........2..]....omJn.x_r.....7
.o25.........'..o......oMn....|.......M.\.o\....KPH..'.1 ....`P.8.....
F&.....,....N...O.d7.<v. bSq..L....W...*..X......I..x.l...O..g.._..
.x...9.......3?..q.OZ.X.p.E...:d...i.~s=......a..<.V.G...Oq.0..$V"&
....D....*.G.`P....'X5.G.:..)...Kl`........oIla_...~...q...66......i.]
l:....*...a.@.:[email protected]......$x.<.6.M`...,....;.........^.... .w
.AX.p....^..@7........._"|..kx....@&G..2..9..9|.t?.t.....(......X=.7..
).OY{.<.{.q..i.....p_@./ ..........>...3,.).Ild...&h.3.....K....
.....s...3x..x....m..5v3..'N.;...T....N.............x.Y....y.......(e.
,.....6.........e.JT.N....I|......!..&..n .>..\R. ...'...l7.7.....w
[email protected] q.....v..v..l..]..].<..g..g..g..g..g..g..g..g..g......
~..C..........{[email protected].."&..v.<<< skipped >>>

GET /static/marketing/main/img/containers/yellow_bottom_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1237

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:8DCA0EBD556411E1A50ABAD0BCA
65938" xmpMM:InstanceID="xmp.iid:8DCA0EBC556411E1A50ABAD0BCA65938" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:49753B4E6455E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................b.....................................
......................Q....U........................b...S.............
.?...Y........F...H......tH........
<<< skipped >>>

POST /action/JSONService HTTP/1.1

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: partners.freeridegames.com

Content-Length: 103

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0

{"service":"geoService","action":"searchGeo","domainObj":{"site":"frg_partners","lang":"en"},"data":""}
HTTP/1.1 200 OK

Server: Apache

Content-Length: 59

Content-Type: text/plain;charset=UTF-8

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive
{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}..

GET /cfcm.ashx?providerId=1006&appnexus_uid=3338670318734125865&$extMatch=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: an.pxl.ace.advertising.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: private, no-cache, max-age=0

Pragma: no-cache

Content-Type: image/gif

Expires: Fri, 30 Jan 2015 06:28:56 GMT

Server: Microsoft-IIS/7.5

P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 06:28:55 GMT

Content-Length: 49

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Cach
e-Control: private, no-cache, max-age=0..Pragma: no-cache..Content-Typ
e: image/gif..Expires: Fri, 30 Jan 2015 06:28:56 GMT..Server: Microsof
t-IIS/7.5..P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UN
I COM NAV..X-AspNet-Version: 4.0.30319..X-Powered-By: ASP.NET..Date: F
ri, 30 Jan 2015 06:28:55 GMT..Content-Length: 49..GIF89a..............
.....!.......,...........T..;..

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1860

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA4AAvApADlAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:26 GMT

Server: Apache

Set-Cookie: JSESSIONID=E41E413EAFC92DF32D66D3780E1CA6F0; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /free/frg/products/680950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT

Content-Type: image/jpeg

Content-Length: 17864

Accept-Ranges: bytes

X-Varnish: 2052680186 2052559201

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?..y7..k.5.......P .$...................^.D.......=:....V...
6..<..{x.u..g2..J.a...../....SE..f&.Q"..9y...%1,.......X..|..O%y..I
..[.... .......0 ..5.d&2F.\...%w$^k./...1].........K...i$r)R}.....e...
...6.S......M....Y...4..dp.O8L,....u..x-....6...?h.l4../hw"..-!J.5....
.....Ij.#.P.....?....`.a#"...(.......5.9SP.J..l&.Mv...T.( .f.l....b^`.
d....X.J...n.Fs..n.Z=..r.^........1...0l.>g...5&..z.....Pt...y... .
...z.=.Y1....1 .E.......By..<T......Z.........K..#)...w..S....W...5
[email protected].}.k,i:... ...:.x.K..(....8qu...1.......&..,..%..{.KP.X..?...q..
..^...g.x.&n-......M~yZ~a~tj.e.OM&............G..6..S.......n.N.....,.
P.<.H......b]Y.Okl..^..7...2.%<x.n..kJ}.....U.O.C.....IdQ.......
:..(.K`..|2....!(.{.../ZS2#..\..bj<..k...p."J......./..2N,4P.x.Vb .
.6;u..........I..)....'.s.6w#.4..U".Kl..]6m...U.UNv-5.H...g$.A...U3S.&
..O.........2..S.....c...!.../]f.E$..H>...V..m......0I.((..9Ts2<<< skipped >>>

GET /free/frg/products/633350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 14 May 2009 11:41:01 GMT

Content-Type: image/jpeg

Content-Length: 22203

Accept-Ranges: bytes

X-Varnish: 322100330 321667877

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!.1.A"..Qa2.q....BR#.br3.....c$.C..SsD%...................
.....!1..AQ.aq."...2....BRb...r..#...3.....sSc$.............?.J..m....
.._V.$.|..3..#.....HE]GI...k..;9SW....'m..k...b.._m....Y.R.u......BZ Q
.$.j%.]G&..z#....(.....=.....s..........I.%bl.q7...8...c.A.].m.h.,....
[H.N......x..[.\......t...U....W\..G`2....`.{....!.sE.D...]1..&:=..R..
.y...,.....RU..i.~b..ie.q#.5...SC..U.,.IT....N...3.w^......v......;.l.
..".K%..p..$..v$P!..r..:...T{d\0'....K..,....rT..P..{....qg....P..-.o.
.$....[[email protected].....^.I......n.6.........,...-?R.PG...;.h;p8.
55.4.W..w...Tii.;...r..&$.TQ.*.@)...y'}...pEv.UO6w..3N.j......&E9i..P.
..2).MW8.o...."...i]|u...*2............R...qQw..c....O5s..5.3...d...yM
...>......dM`....9.|U...C.......5X.a.n..?mX_,.....N.{..g...ND.p....
@..2....!.l..<=B}4.|.j J.."1(W!%t.%iS.B.H\.#*!....&.y....X\... ...$
.K..|:....s.N..jhd.K^...$B.\..(s.....BI...0..w..VY.I.\o.n.j........T..
Dv....m.hy).....:M..|...s..#.......w0.<!.s..Aqih!.....v...Yx...d...
'...z..jr8...K...UN.T.x...^..3....DN...S..8...qZB.$..Q...(..>...a.f
I;.......Y9V.....&..Yu.eA....eI.S...Rv$h....X.6.^...G..e.P.,2.:..t....
..i..B.p(N`....l=...7.6..5.....P....1(...^.......GPz.....;.7.....I....
.......W.-.{1.U.[.cl..<!!...ajK@!.iZ.R...B.|.6..mX.7.Ksa...qn'.<<< skipped >>>

GET /free/frg/products/624150/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Tue, 22 Mar 2011 12:18:46 GMT

Content-Type: image/jpeg

Content-Length: 28217

Accept-Ranges: bytes

X-Varnish: 322100369 321493083

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......J......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?...J.........V...>.r...G..^G.C.H#.`....J.I...F.....x....
A.L=6.............../..... .W.j..Ou..Ek,.qZJ.9.%R....S\997.....<.&g
t;.<......H ....)...........fa.V.......3...^^..$.......BT..<@...
..|#..\.....f...../.^.^M2.y{R..R...i..Z]}[email protected]./......#..k..
@...e.&...I4^.\.NbD...@.. y"....8a../5I.#K ...-...G..$.......~29>..
...........mR;.<...?.......T.......%..siI...C~..y...E..S.>.e...b
K{.k......a'%....'.G.,...w.}5.C.... .B..z.3ZhZ...g..sq/(.8`J..S.....Y.
.r......s..s..'..]*.X.!....M=...o$.Zi..K......>.J............X..z..
.#qBI=.r..K/...e....,....Uf..............U~Gy..Z.......k...I}E...r....
.J....1?...54Y.b..9..\,%.........I.lC...N^p......yc;. .........J.....S
XC5c{..bY....nb..=2. [email protected].....{m.R..W.k...6.#.....Rd..,..#R...m,..
..y#.............%..Xfy..b...".s..{..9(..XZ._k.........HY@"..J...... .
w}...8...?..........[.<yz..Cc.s..S....w.@y.;:J...W..f.....@.?.5<<< skipped >>>

GET /free/frg/products/632750/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 08 Feb 2010 12:06:05 GMT

Content-Type: image/jpeg

Content-Length: 22958

Accept-Ranges: bytes

X-Varnish: 2052680338 2052214526

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......Z......Adobe.d....................
......................................................................
......................................................................
......................................................................
...............!.1A..Qa".q2...R#...B...b..3C.rc$%.'..S4Tt.&...........
..............!1..AQ.aq......."2..R.Bbr#.......%.3Cs.4d5....Sc.$6.....
........?....b....T)m.mCD.....t2Q(...L..{....~Q......:c...A...?...V'..
.m..v%?..R..h.$...uK..O..?..r1..2...;...P..A..Q..1.K..*(>"..j]...H.
...Y..`7..F).p .H.......1..(.aI.6..5JQ^..#.u.-........xCC!)..G_.T..F.2
...I.....\.a....?...iSE.u.....9..EAQ2.0..)...R.g.....5........6.|4....
..~;H...z...T..M......s...8!TE..tU.#....P..e.....?.8..I..N..a..hd.I.&l
t;I...F..`...#Im'.$.u...5....9....z.~..m...h.a5.%@........D...X....p..
...-.~)5....:..V..G..e..VT...B..^...R&a...h...j<...:X"7..*.}.- ....
.@a 9...YXY...j..#]k.|...."2.4. ........#l6.......|..P..8FA....[~%Z...
.R].8.-..u.....J.... ...aAi).;S.A.Z4..')......S.?n......}0..OR.|..~.m.
9JPQhA..C..c....d.}).......T%..o....*..........B.~...L...#.f=T)....z..
4.z..../.c.W....J.>.].Za.{m..jIK..N...t.."..Hrp....u;..G...0....".)
.z.|4<.3.....O..<.v.FpM.%..:.. .4<.._.X\|5....sj.....]Be....`
.....QO..M. .F0.....>......#.......Ec.\...s..5)p.[5..Y..9..n... .dv
..}Z..".....G.`}G?%R.....8.wT.F>[email protected]_...w.GP.1..
....O.Py$.}.q...%...8 .4Fb...'.D9....QJ...[B\.....j...B.Sg}(.... ?..SB
..3...H...C.z[.G.wUH.M)....lS.h$.a..\Yq!"i>.H.]....T.:..n.4..0&<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD+Oyl+0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEG7MeqWnAyAJuM689OlS1JE= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1762

content-transfer-encoding: binary

Cache-Control: max-age=381657, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 16:27:13 GMT

Expires: Tue, 3 Feb 2015 16:27:13 GMT

Date: Fri, 30 Jan 2015 06:28:55 GMT

Connection: keep-alive

0..........0..... .....0......0...0......;O}a.!..u...au..eUNp..2015012
7162713Z0s0q0I0... ...................B.>.I.$&.....e......0..C9...3
13..n.z... ......R......20150127162713Z....20150203162713Z0...*.H.....
...............A....H...#...At.(..lE.........W..s.U......UV;..?.).)p.j
M........#.K:P..#YN%....Q.5r.].I...9.(}.....C.qS]!.n..ZO@..~:_.L..e..H
X0...#3k.q..N8..>....._..9.. ...d..FGw......PW.%..V.?J..B..]5..{...
"j...%.,%.h.]..k6/...6.5..%Yu...7...z2]......8.WS...Y.l.e....0...0...0
...........2...'U.BM...g.B0...*.H........0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1:08..U...1(c) 2006 VeriS
ign, Inc. - For authorized use only1E0C..U...<VeriSign Class 3 Publ
ic Primary Certification Authority - G50...141202000000Z..151216235959
Z0..1.0...U....US1.0...U....Symantec Corporation1.0...U....Symantec Tr
ust Network1?0=..U...6Symantec Class 3 PCA - G5 OCSP Responder Certifi
cate 30.."0...*.H.............0...............2&..PL...,..2....:..tH..
.`JG.%..*...s.c%[email protected]"1.5?..s.....
3[...u......]...R0..Z}....l..I.Y.....j\H.q...#.uw.4qz.#.J.....@2$"..$l
.B.......D.ye..(..2.........@...... ...."... E..0M,..b{.^..s'....f.6.p
r4.J........'j..........0...0...U.......0.0l..U. .e0c0a..`.H...E....0R
0&.. .........hXXp://VVV.symauth.com/cps0(.. .......0...hXXp://VVV.sym
auth.com/rpa0...U.%..0... .......0...U...........0... .....0......0!..
U....0...0.1.0...U....TGV-B-2760...U......;O}a.!..u...au..eUNp0...U.#.
.0.....e......0..C9...3130...*.H.............(.&..Dgr.Ve..#...5.N.

<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQMgSk4dLKWKRB+2DViUmQEUw3ggwQUDURcFlNEwYJ+HSCrJfQBY9i+eaUCEChTiL6sps8WmjYtXlOSTfM= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1730

content-transfer-encoding: binary

Cache-Control: max-age=378223, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 15:31:48 GMT

Expires: Tue, 3 Feb 2015 15:31:48 GMT

Date: Fri, 30 Jan 2015 06:28:55 GMT

Connection: keep-alive
0..........0..... .....0......0...0......P).Niz5............?..2015012
7153148Z0s0q0I0... ..........)8t..).~.5bRd.S......D\.SD..~. .%..c..y..
.(S.......6-^S.M.....20150127153148Z....20150203153148Z0...*.H........
.....^......^.35.~...#.S..B.-V...;.....?..v3.b...K....&..@..^rQ4gXk...
..aE...r.X.......bU.8..P.f./AZF.3.......0..Q..m....C.v.......4|Q.t.g,.
.z.......sP/ ....ISjL...e.......r.....q... ..mH.]..Ww".:"..X.{.9.U.Y..
../.C.3........EsA....$pc|6nvn..U_.-|...w*P..iC..U.....0...0...0......
....]../g.0.h.....$C0...*.H........0..1.0...U....US1.0...U....VeriSign
, Inc.1.0...U....VeriSign Trust Network1;09..U...2Terms of use at http
s://VVV.verisign.com/rpa (c)101/0-..U...&VeriSign Class 3 Secure Serve
r CA - G30...141204000000Z..150304235959Z0..1.0...U....US1.0...U....Ve
riSign, Inc.1.0...U....VeriSign Trust Network1>0<..U...5VeriSign
 Class 3 Secure Server CA - G3 OCSP Responder0.."0...*.H.............0
............Q..>.]....b...........G[..sz_:.eM.J..m)....J.KV..W....e
.M...C.......8.|...^...S./[email protected]...:S4....R..&"...
...l.....1&..nY..p.....4...L`.g...E#t....Mw....1.O.....i..e.b.qa...p..
...$...b...V....#.M3......|..B.R..:@UtY@:s..h.........me..........0...
0...U....0.0....U. ...0..0....`.H...E....0..0(.. .........hXXps://VVV.
verisign.com/CPS0b.. .......0V0...VeriSign, Inc.0.....=VeriSign's CPS 
incorp. by reference liab. ltd. (c)97 VeriSign0...U.%..0... .......0..
.U........0... .....0......0"..U....0...0.1.0...U....TGV-B-24570...*.H
.............y.boc.....2<.-..O...ehR.............. .....n....'c<<< skipped >>>

GET /imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=246631.83414114974 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: servedby.flashtalking.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Jetty(6.1.22)

Set-Cookie: flashtalkingad1="GUID=258658AC9B8964";Path=/;Domain=flashtalking.com;Expires=Sun, 29-Jan-17 06:28:52 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: no-cache, no-store

content-type: text/javascript

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Content-Length: 661

Via: 1.1 ttn161182010000 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive
.var ftGUID_1078532="258658AC9B8964";..var ftConfID_1078532="0";..var 
ftParams_1078532="ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referr
er=&cachebuster=246631.83414114974";..var ftKeyword_1078532="";..var f
tCustom_1078532="";..var ftSection_1078532="";..var ftSegment_1078532=
"";..var ftSegmentList_1078532=[];..var ftRuleMatch_1078532="0";..var 
ftTimestamp_1078532="1422599332";..var ftImp1078532 = {};..ftImp107853
2.privacy = "x";..ftImp1078532.guidAge = "-1";....document.write('<
scr' 'ipt src="hXXp://cdn.flashtalking.com/xre/107/1078532/922460/js/j
-1078532-922460.js" id="ftscript_m1078532" name="ftscript_m1078532">
;</scr' 'ipt>');.                    ....


GET /imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=369662.84632262785 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: servedby.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Jetty(6.1.22)

Expires: Fri, 01 Jan 1990 00:00:00 GMT

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: no-cache, no-store

content-type: text/javascript

Content-Length: 660

Pragma: no-cache

Via: 1.1 ttn061011 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive
.var ftGUID_1078532="258658AC9B8964";..var ftConfID_1078532="0";..var 
ftParams_1078532="ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referr
er=&cachebuster=369662.84632262785";..var ftKeyword_1078532="";..var f
tCustom_1078532="";..var ftSection_1078532="";..var ftSegment_1078532=
"";..var ftSegmentList_1078532=[];..var ftRuleMatch_1078532="0";..var 
ftTimestamp_1078532="1422599332";..var ftImp1078532 = {};..ftImp107853
2.privacy = "x";..ftImp1078532.guidAge = "0";....document.write('<s
cr' 'ipt src="hXXp://cdn.flashtalking.com/xre/107/1078532/922460/js/j-
1078532-922460.js" id="ftscript_m1078532" name="ftscript_m1078532">
</scr' 'ipt>');.                    ....


GET /imp/2/43305;1078532;201;js;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referrer=&cachebuster=703830.1892982249 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: servedby.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Jetty(6.1.22)

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Content-Length: 659

content-type: text/javascript

Via: 1.1 ttn061005 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive
.var ftGUID_1078532="258658AC9B8964";..var ftConfID_1078532="0";..var 
ftParams_1078532="ftx=&fty=&ftadz=&ftscw=&ft_custom=&ftOBA=1&ft_referr
er=&cachebuster=703830.1892982249";..var ftKeyword_1078532="";..var ft
Custom_1078532="";..var ftSection_1078532="";..var ftSegment_1078532="
";..var ftSegmentList_1078532=[];..var ftRuleMatch_1078532="0";..var f
tTimestamp_1078532="1422599332";..var ftImp1078532 = {};..ftImp1078532
.privacy = "x";..ftImp1078532.guidAge = "0";....document.write('<sc
r' 'ipt src="hXXp://cdn.flashtalking.com/xre/107/1078532/922460/js/j-1
078532-922460.js" id="ftscript_m1078532" name="ftscript_m1078532">&
lt;/scr' 'ipt>');.                    ....


GET /imp/2/43305;1078532;204;gif;QuismaDE;23991924474182218QUISMADEUNATECHNOLOGYQuismaxITChannelEXPANDABLENACPCIIPWorkstationAwarenessExpandURL1/?ft_configuration=0&ft_creative=922460&?764305987 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: servedby.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Jetty(6.1.22)

P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Content-Length: 0

Location: hXXp://cdn.flashtalking.com/xre/107/1078532/922460/image/922460.gif

Access-Control-Allow-Origin: *

Via: 1.1 ttn061014 (MII-APC/2.4)

Keep-Alive: timeout=2

Connection: Keep-Alive

HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:53 GMT..Server: Jetty
(6.1.22)..P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo 
OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Cache-Contro
l: no-cache, no-store..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:
00:00 GMT..Content-Length: 0..Location: hXXp://cdn.flashtalking.com/xr
e/107/1078532/922460/image/922460.gif..Access-Control-Allow-Origin: *.
.Via: 1.1 ttn061014 (MII-APC/2.4)..Keep-Alive: timeout=2..Connection: 
Keep-Alive..

GET /banner?sid=2566322&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=10&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601962704990

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:51 GMT; path=/

Content-Length: 5947
document.write('\x3Cdiv style="position:absolute;width:300px;height:0p
x">\x3Cdiv id="obaButton_6110017601962704990">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_300x250_grey {\n    width:300px;.\n    height:250px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0k
Ra2RNR3aG3NRNa a,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoff
er_0kRa2RNR3aG3NRNa h2,\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey 
.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\n}\n.
paoffer-block_0kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa 
a {\n.display:block;\n.float:left;.\n.background:transparent url(http:
//imagesrv.adition.com/banners/270/files/00/00/b6/f2/000000046834.png)
 no-repeat top left;\n.padding:1px;\n.text-decoration:none !important;
\n.color:#000 !important;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_300x250
_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3N
RNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer-block_0
kRa2RNR3aG3NRNa_300x250_grey .paoffer_0kRa2RNR3aG3NRNa a:focus  {\n.ba
ckground-position:left bottom;\n}\n\n.paoffer-block_0kRa2RNR3aG3NRNa_3
00x250_grey .paoffer_0kRa2RNR3aG3NRNa a:hover,\n.paoffer-block_0kR<<< skipped >>>

GET /mapuid?member=181&user= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.CwKyvPkDi2)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?W KdC

DNT: 1

Connection: Keep-Alive

Host: adx.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:49 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=333867031873412
5865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28
:49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=33386703187341
25865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.co
m; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Fri, 3
0 Jan 2015 06:28:49 GMT..GIF89a.............!.......,[email protected]..;..

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9882440&cr=58415&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /pixel?google_nid=theadex_dmp&google_cm&axd_cuid=104&c=100315090728510000 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cm.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://dmp.theadex.com/d/cm.gif?axd_pid=8&axd_fuid=CAESECAbMZA9QydOGSzhQC_fPEc&google_cver=1&axd_cuid=104&c=100315090728510000

Date: Fri, 30 Jan 2015 06:28:51 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 339

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://dmp.theadex.com/d/cm.gif?axd_pid=8&axd_fuid=
CAESECAbMZA9QydOGSzhQC_fPEc&google_cver=1&axd_cuid=104&c=1
00315090728510000">here</A>...</BODY></HTML>..HTT
P/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pa
gead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR 
INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://dmp.theadex
.com/d/cm.gif?axd_pid=8&axd_fuid=CAESECAbMZA9QydOGSzhQC_fPEc&google_cv
er=1&axd_cuid=104&c=100315090728510000..Date: Fri, 30 Jan 2015 06:28:5
1 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache
-Control: no-cache, must-revalidate..Content-Type: text/html; charset=
UTF-8..Server: HTTP server (unknown)..Content-Length: 339..X-XSS-Prote
ction: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..<HTML>
<HEAD><meta http-equiv="content-type" content="text/html;char
set=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BO
DY>.<H1>302 Moved</H1>.The document has moved.<A HRE
F="hXXp://dmp.theadex.com/d/cm.gif?axd_pid=8&axd_fuid=CAESECAbMZA9
QydOGSzhQC_fPEc&google_cver=1&axd_cuid=104&c=1003150907285
10000">here</A>...</BODY></HTML>......
<<< skipped >>>

GET /pixel?google_nid=agent&google_hm=NjExMDAxNzU4OTA3MjAzNTg2Ng==&type=response HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4

DNT: 1

Connection: Keep-Alive

Host: cm.g.doubleclick.net


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://dsp.active-agent.com/cookie/?ssp=2&type=response

Date: Fri, 30 Jan 2015 06:28:55 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 256

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://dsp.active-agent.com/cookie/?ssp=2&type=resp
onse">here</A>...</BODY></HTML>..HTTP/1.1 302 Fou
nd..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_
.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA P
RE COM NAV OTC NOI DSP COR"..Location: hXXp://dsp.active-agent.com/coo
kie/?ssp=2&type=response..Date: Fri, 30 Jan 2015 06:28:55 GMT..Pragma:
 no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-c
ache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server:
 HTTP server (unknown)..Content-Length: 256..X-XSS-Protection: 1; mode
=block..Alternate-Protocol: 80:quic,p=0.02..<HTML><HEAD>&l
t;meta http-equiv="content-type" content="text/html;charset=utf-8">
.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1&
gt;302 Moved</H1>.The document has moved.<A HREF="hXXp://dsp.
active-agent.com/cookie/?ssp=2&type=response">here</A>...
</BODY></HTML>....<<< skipped >>>

GET /reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-608672771 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:53 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:53 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:53 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1..

GET /only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ== HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1627

Connection: close

Content-Type: text/html
...........X[s.F.~.....K.G\$..d...$ug.<83...xV..ks ...N.{..@x.\;/..
.{.....\..ga.......Z.......! ...tK...<...e..4a....b..i.x..Q..8.....
~...rt..)......1.g..bK.&.{....-......XE v.....u.m>.......>`>.
.}.........<........ ....78........GxO....q.&..,....9......D[..%...
.Vl.......<}.0..F]H...bP.....*b..?..j.C.R8...M.. .........%......X.
PD .T...t..8......d...c..N.~(FD.r..r1....|B../.t............^?..U..].F
....gmt.'I@]YE4...a...C..d...S.`Z}...-...E.....Q....G.'.y...I..-a.../.
.7.h... [email protected]"..Y.-......@..)x*%.
0F.,[email protected].=(....{...r[Y......Rj.A\......$k..u..x...#..6dc....
s=....:N=....."(.j.m.\.`...s.1.>....'t......=I7A..A'..E.E.g.ki...3.
'.o.B.sc. .9.....8pO".y0...l..g,.k.k..|...#....{..&~.6.E..c..tr...|.X.
....6I.....~........d...._.t...;u.c..|.U.0G.[.o....G...V....i.EY...3`-
...=9E..n.Fisb.S!....[;...8.1.`qR..d....;v...L.!..Cjx.&H...c\..r!.2..7
....h...j.a....zh..fhO.fC.4-kl....A]An..5.H../.. ...b7.C.Q..q.%..V.NMJ
.`(.H.Z......?..30.3y....o.yEx8..FA.].$e....1.P."^..c...(...v.C.....8.
.P......;[email protected]#JD...yQ..X.Qs^.8FJ.(Z.Y.T.j..v8.....N`.v&
lt;._.(... ..=.;.%YV#. ..L..z.N..!h..c).2...).J..SP...w..........E.rm.
hN.).#I....\..._i.O..1.Z..$........X....<..T.|-....=P23.Y.`h.....,.
Z./bu..$.....D...N.2.>.s4...../2...yu...%....[UX......5<.PW-..K.
d[4...Qt. .{.=. [email protected][email protected]^.;.....S.....S.H._7.o.....o..E.;.*
z.f..b....*o....[.....h(..........r|..../.R.R4..t'.FpO........y....#5i
.U..G..`.6a.3.....T.ZV)....DT...T....u".I..,cdO&z......Ry.Q.....D=<<< skipped >>>

GET /appnexus/match?dtm_test=236c4565ef5118a4&nuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: apnx-match.dotomi.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: nginx/1.6.2

Date: Fri, 30 Jan 2015 06:29:00 GMT

Content-Length: 0

Connection: close

Location: hXXp://dtm.gap.com/appnexus/match?fpc=2366&pnid=1982&nuid=3338670318734125865&trid=574502685977146491&fpctok=1&nuid=3338670318734125865

GET /pixel/2605/?che=022311&puid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.agkn.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache, must-revalidate

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:53 GMT

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Pragma: no-cache

Server: Apache-Coyote/1.1

Set-Cookie: uuid=900696890297854153; Version=1; Domain=.agkn.com; Max-Age=157680000; Expires=Wed, 29-Jan-2020 06:28:53 GMT; Path=/

Set-Cookie: u=C|0CAIcXeElHF3hJQAAAAAAAAABBykAAAATMzMzODY3MDMxODczNDEyNTg2NQ; Version=1; Domain=.agkn.com; Max-Age=63072000; Expires=Sun, 29-Jan-2017 06:28:53 GMT; Path=/

Content-Length: 43

Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: no-cache, must-revalidate..Content-Type: image/gif..Date: Fri, 30
 Jan 2015 06:28:53 GMT..Expires: Sat, 01 Jan 2000 00:00:00 GMT..P3P: C
P="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Pragm
a: no-cache..Server: Apache-Coyote/1.1..Set-Cookie: uuid=9006968902978
54153; Version=1; Domain=.agkn.com; Max-Age=157680000; Expires=Wed, 29
-Jan-2020 06:28:53 GMT; Path=/..Set-Cookie: u=C|0CAIcXeElHF3hJQAAAAAAA
AABBykAAAATMzMzODY3MDMxODczNDEyNTg2NQ; Version=1; Domain=.agkn.com; Ma
x-Age=63072000; Expires=Sun, 29-Jan-2017 06:28:53 GMT; Path=/..Content
-Length: 43..Connection: keep-alive..GIF89a.............!.......,.....
......L..;..

GET /reportV3/ft.stat?44535597-0-304-0-258658AC9B8964-241392218 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:53 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-492280933-0x0x50x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:58 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:58 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:58 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:58 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-603447532-0x0x175x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:29:15 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:29:15 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:29:15 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:29:15 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-131952831-0x0x302x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:29:45 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:29:45 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:29:45 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:29:45 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-225115148-0x0x601x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:30:46 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:30:46 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:30:46 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:30:46 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1..

GET /js?wp_id=2566332&&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

If-None-Match: 14365446

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 14365451

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1105
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2566332);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad4.adfarm1.adition.com/banner?sid=2566332&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac
=' (  ad_count) '&screen_res=' screen_res '&wpt=J&clickurl=http:/%
2Fc13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr
=AA==_a_w3hr=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /free/frg/products/554350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Thu, 11 Jul 2013 11:07:11 GMT

Content-Type: image/jpeg

Content-Length: 16660

Accept-Ranges: bytes

X-Varnish: 2052680175 2052118412

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:3EB270A5EA1911E2A262D7F48
EA80A8F" xmpMM:InstanceID="xmp.iid:3EB270A4EA1911E2A262D7F48EA80A8F" x
mp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:EAF28A94E70E11E2BDD183F16790EF49" stRef:doc
umentID="xmp.did:EAF28A95E70E11E2BDD183F16790EF49"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
......................................................................
........................................."..2.BR.b#3.r...C$....4u61S..
.%5..ATd.aq.cs..D.e.!...tU&......................."2.B..Rr..#...b...3S
4%5.Cc.$d....s&.!1Qa...D............?.....$&..JH..g.$.6...-.VK..j..ls0
..$..s....M. ..../,.u..?..}.(..;...........z..|J...8.c. ..........X...
. m.]b..w.._....'.:ET..6O.u.i...T...^..^..z....c..`...T..Z..X.e.......
? ..,.[......u.s.Q..\.5.......W6..'..W..9.(..W/.FlrI...\.: .M..u..<<< skipped >>>

GET /free/frg/products/631850/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Wed, 15 Jul 2009 11:11:31 GMT

Content-Type: image/jpeg

Content-Length: 23693

Accept-Ranges: bytes

X-Varnish: 2052680222 2052166672

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......d......Adobe.d....................
......................................................................
......................................................................
......................................................................
...................!1.#$.3C..AQa..."R4q..2bScDT%....Bd...s.5EU&....t..
6eu..'..............................!1Q.#Aa.3$..q....CS.4...cs....DT%.
.d5."..t.62B..&...Uu...............?..<........k..c.E.6@#on].3.....
( .._O.....&..5B..^sYQ.......?>..." .....8q[|.....c..C.~.....2.....
./N..1.}.....0].D.M....d..~.Z./........".....w..$..I............8.5..D
8...N8..1..>.V .=...d..%..X.1_.......\*..<b....i>......A...].
..^!U..~y..dS&F.d..........>f.....j.Ei...g.....,..<.y.......z...
g.E....8..PUX#,...ws...JQ!."..B.ZJ.m..F.t...l*a...j.f.._. ......_.....
.>..\8.O....5Ys$.o..y......&t'.z...).|....i....z9..M....3LK..!..>
;......"O......Q.5.*..;....)..C.:..4.V.^`..W..P..0.</...)i........E
~}...#l}.|...]......R)r.tY.../F;)9f..6......6g.....<J...9.q...C.n..
.5..`.0....8>.c..yCve...8o>}TJ..KT/.PB.,.4..2o...}:.&.~..p.{._.B
..&..........=.UF.3..7.~.."W.2.C..L&....C.."IvwqQ..%.iz...{r{......0..
.......)........r...z...6j....U.F........h.....`..............{.J....:
...I.....b4.....3.M..p........{".TI...r6..kf.`.n....o,3....m(]n9:M.s.|
..J.\...z...X...EP.{..d......S;....7...<.4>.#.@......< ...U..
.....R...kA....F......Mm...]...-....7.5qn....'c...&.o....}['s.G.......
...<...U...5...O..a5.....")..^..j...C..kP3.....[)..6V..]..Op)..<<< skipped >>>

GET /free/frg/products/668950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive

GET /free/frg/products/761850/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 26 Feb 2012 08:56:37 GMT

Content-Type: image/jpeg

Content-Length: 12469

Accept-Ranges: bytes

X-Varnish: 322100397 321652117

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....H.H.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".........................................D.......
...................!.1."AQ.2a..q..#3BRb..r......$CS...ED............
.......................9.......................!.1..AQ."aq2...BR.....#
[email protected]=......4.....H>.J....I.g..H...,..H.8W..
.QHM..gRZb.......H.Z.D.&.T.O..<.......j.f.~..P..H...T8R.W....G..G..
....U..7Hk.X.%.7.cC.8%.q........F3...u..).....w..O.NHA?S..............
}.W...M_.yv%..w>..w. i.....!..W$....?..S..v..kEE..2.LbUNx~..c2.....
..?.}....]|..6....v.......A....h.F.=.}.)5..5,8..*.z)'U}..{.....?......
...b.S..._..#.b?1._E.....W.T.{*.~.x..l..'.:..v.5x...f#;,...N....gh$e .
@=.....L...k........J.R.l.^..,...n..F.U....E.I..PSBBF.d..X8..x.Sa....L
.1..........i.eL.9U....2g...[.D.....T...h..........%.8.."..'.9....H...
..w..-;...?.g...%HP...c...\.2;j'U.x..$......1.rq....^.."..X.$.....q.s.
.....Q...tY.;.i..]....Ns.......e( .v...P.8..& .VMH.O...F...:.EQJ....r7
.........N.x....%.. ... ls.k......................6.DNV.F.Y..L...A..im
.-...h..P.k..Q..U...{j...:oNm.....*....P..Q.a>.dd.....Lu.....u.!...
....-....2TT=...>[email protected]\Aq.E...R...{OA..
..KCe.......I.1.'.(...z.U.....J"..n....H._.....N....N..\48E.M...R..d..
[email protected]../1.....R../......(>d...~:...6...].0.ASe.I...'.E.m..%N
..q.{.'z._...RB2L{.s..t..6...v.n.). [email protected] .\'...b.Z.)xr.<<< skipped >>>

GET /r/dd/id/L2NzaWQvMS9jaWQvMjg0NDg2MjYvdC8y/dpuid/100315090728510000 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.turn.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0

Pragma: no-cache

Set-Cookie: uid=2821299455705972228; Domain=.turn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; Path=/

Set-Cookie: rrs=27; Domain=.turn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; Path=/

Set-Cookie: rds=16465; Domain=.turn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; Path=/

Set-Cookie: rv=1; Domain=.turn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; Path=/

Set-Cookie: mpc=28448626; Domain=.turn.com; Expires=Fri, 30-Jan-2015 06:28:57 GMT; Path=/

Location: hXXp://VVV.facebook.com/fr/u.php?m=2821299455705972228&p=328546547221502&t=2592000

Content-Length: 0

Date: Fri, 30 Jan 2015 06:28:51 GMT
HTTP/1.1 302 Found..Server: Apache-Coyote/1.1..P3P: policyref="/w3c/p3
p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"..C
ache-Control: max-age=0, no-cache, no-store, private, must-revalidate,
 s-maxage=0..Pragma: no-cache..Set-Cookie: uid=2821299455705972228; Do
main=.turn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; Path=/..Set-Coo
kie: rrs=27; Domain=.turn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; 
Path=/..Set-Cookie: rds=16465; Domain=.turn.com; Expires=Wed, 29-Jul-2
015 06:28:52 GMT; Path=/..Set-Cookie: rv=1; Domain=.turn.com; Expires=
Wed, 29-Jul-2015 06:28:52 GMT; Path=/..Set-Cookie: mpc=28448626; Domai
n=.turn.com; Expires=Fri, 30-Jan-2015 06:28:57 GMT; Path=/..Location: 
hXXp://VVV.facebook.com/fr/u.php?m=2821299455705972228&p=3285465472215
02&t=2592000..Content-Length: 0..Date: Fri, 30 Jan 2015 06:28:51 GMT..<<< skipped >>>

GET /sync/msft/3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pr.ybp.yahoo.com

DNT: 1

Connection: Keep-Alive

Cookie: B=52qa5ah9dvsod&b=3&s=ur


HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Content-Type: image/gif

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:50 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Ap
ache-Coyote/1.1..Content-Type: image/gif..Content-Length: 43..Date: Fr
i, 30 Jan 2015 06:28:50 GMT..GIF89a.............!.......,...........D.
.;..

GET /free/frg/products/616550/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Sun, 25 Jan 2009 14:27:28 GMT

Content-Type: image/jpeg

Content-Length: 30153

Accept-Ranges: bytes

X-Varnish: 2052680191 2052042272

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
............!.1".A..Q2#aB.q.3$..RbC4%...r..&........................!1
..AQa.q..."......2.BR..br.......#3..Cs$Td%&.c..4t5............?....}..
.~P.............pj.^jq...Qt..B.1.R.....4L>._#f.......z.....36.8...8
..E(I...:/Y..z....W..g....h.'.@..;.7..WT=.]...QY...9].;v..0....|.c....
...........9..p....~L....\...xP..Z.qw.."...&..MG.W..f.Vp...w.....d.t..
-..#oE....]..!.....Mc}.RHh..}.y7m-SB.>..z...U.$....o..9...1......X.
..&9..d#....w.l.^u.9o.s....R....U.~..C~.V?.8....O.D...G5.9....Ja......
..c........U...c ..wy{.....m...zWs-@..?..W.5...2...6...^...1.....T.|.z
o5..-.y.m.Q.M...}A..Hy..d.^.M.H.^......E.M...j ..66...^Rh....[Kq.hE.H.
RC...&...ut]5#y.......Z..v..~}...`-..J..p.C).................G..jZ..wm
8..P./.9....,.<..T.!.Y...}[email protected]^. ..l^{i.|..."...u.m..r...
2........VT "t.,..D........EuKM&.S........X....q6....2Zd...wkm!.wR..@.
.zd|[....K$..\^[email protected]'..M
G.V.0*hE.7.....s.l.F..K.i...i.BWy.}..>....U.O.N=..C.......4.U....mk
/*M..);.....k..'...m.V.a.Bn,........{..>,l..I=.jFA.9<..<.?!..
.. L....3jV.]<..q.;^7]...V.r3h...U...bsZ.!.A...t.]..>....].*.&o.
......q.V-.M.Z....re................ ....zz..0Ck.m.\.60.I%1....&w...G.
.,.yS...Xq~-.Y).5...1...5..#7..q.x\....../E~.XKp#......T........R.<<< skipped >>>

GET /free/frg/products/616950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Wed, 13 May 2009 07:04:16 GMT

Content-Type: image/jpeg

Content-Length: 15113

Accept-Ranges: bytes

X-Varnish: 2052680257 2052294469

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
......................................................................
......................................................................
..........!.1.AQ".aq2..B#...R...b3$...r....CS%........................
!1.A.Qa"....q....2B..Rb#...3..r...$............?.u.kg..e..W..e`.@...:.
......~C..1.7]....f...8..r....5......dn..AVF......9@.>...^..g....Or
[email protected].@$...E......-..(&}.~.......WrY....:...yWI%.....=#.0W....i....H
...H.{....Q.zj<~cI...k...V.h....e.........3.m....'kUc9....[.Un?...`
|.n](...3.jZ....O.u.6.....8.p.v........A...2..^C.....#.8.>"s...K{.-
....fajx...B...Q.NDyj...l.u.W.e8_.......... v..v.. ..A Dm..V..W`T.)"..
.u....m..Tua.A{...Y..E....B....gMm$od....nD....Z..A...{... ha..1...9.m
.l~..........`a...I..4.j...U.p|..\.^....|.g2.......9D.).3.GC.;kg......
g.;.7........=4O(.c.N.. .L.Y3 P../ ...}.s..CB.....qy*[email protected].=
h .GMv.p.p.N..]."../..)....[Y$...(.6.|u..k:.t.......vP~..@.:..b.i.>
......<..p.q..}Q.....6Z...e.U..N?.6.G9y%.{v.........[...-....ww....
b.X,x..@..&j..F.#...(...Et. .LkW.........3.l..x.@w?P.{{.r.$...,...p...
.5......J;.M..n#.6...1,=.f....We....wq..V.h..........#....k.....s.....
........V....{i...~(/23.& .*[px.o..W....od...3[.k.?t.....&}.P......Zw.
.d.{v?.J......v4.....c..t.|g..v.r..7......2.v..#..w.\.k.r..?..s..w....
s7._..~.~.O..|...\{s7....J...h.W......Xkr.......||{.dn..0....7v.......
&....G3A..5......:...K.. V.u.cR...^w&b.........k...64..P|..#......<<< skipped >>>

GET /js?wp_id=3097401&kid=1219206&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58695_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc3=10039


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 24377732

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1083
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(3097401);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad2.adfarm1.adition.com/banner?sid=3097401&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&kid=1219206&scre
en_res=' screen_res '&wpt=J&clickurl=http://c13.w3hoster.de/ad
sc.php?sw3=14046_a_cw3=58695_a_gpr=AA==_a_w3hr
=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /ANX_async_usersync.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=4197282237715168703; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db


HTTP/1.1 200 OK

Server: Apache

ETag: "e3de0e76c13e81e3b0683dac240498eb:1377552334"

Last-Modified: Mon, 26 Aug 2013 21:25:34 GMT

Accept-Ranges: bytes

Content-Type: application/x-javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 509

Connection: keep-alive
...........TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s..
.|\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H....
..-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...
W:4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X
.\...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w.
........X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&..
.M6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,
./.,H).|..0g.z...k../g...HTTP/1.1 200 OK..Server: Apache..ETag: "e3de0
e76c13e81e3b0683dac240498eb:1377552334"..Last-Modified: Mon, 26 Aug 20
13 21:25:34 GMT..Accept-Ranges: bytes..Content-Type: application/x-jav
ascript..Vary: Accept-Encoding..Content-Encoding: gzip..Date: Fri, 30 
Jan 2015 06:28:48 GMT..Content-Length: 509..Connection: keep-alive....
.........TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s...|
\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H......
-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...W:
4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X.\
...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w...
......X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&...M
6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,./
.,H).|..0g.z...k../g.......
<<< skipped >>>

GET /p/47/d1/cc/6b/47d1cc6bf034a7bd1124aee8bed80309.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DF7/.XDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/S6aPHH9q)kTnJ!7 !!(xI $oV=


HTTP/1.1 200 OK

Server: Apache

ETag: "47d1cc6bf034a7bd1124aee8bed80309:1407679571"

Last-Modified: Sun, 10 Aug 2014 14:06:10 GMT

Accept-Ranges: bytes

Content-Length: 42501

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:49 GMT

Connection: keep-alive

GIF89a,...............NOO...npn.......s^.....I,, ..2Tt.....G....VG4...
./.....................v..:....../Jf...tfT........p...u..n............
.....iXGG5#..}...\ej.gP..-............,#..........:d...dU..26?........
.VZ^............|.............D)a..................J..................
.....v.............!%........k9L%..8..>Fx..............."..N.1.^cM.
............................................|{z.........#........>?
?.....................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="
..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:n
s:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:
01        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rd
f-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpRights="ht
tp://ns.adobe.com/xap/1.0/rights/" xmlns:xmpMM="hXXp://ns.adobe.com/xa
p/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#
" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpRights:Marked="False" xm
pMM:OriginalDocumentID="uuid:78EE78388847E211A83D852C29ACADB7" xmpMM:D
ocumentID="xmp.did:32C9DEDAD33111E2800BB1582FBDC385" xmpMM:InstanceID=
"xmp.iid:32C9DED9D33111E2800BB1582FBDC385" xmp:CreatorTool="Adobe

<<< skipped >>>

GET /api/v/1/1107,1,0/?callback=cb_1422599350355&ts=1422599350355&connectionType=0&sessionId=QuaTY&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 895

Content-Type: text/javascript; charset=utf-8

Server: Microsoft-HTTPAPI/2.0

X-Country: UA

Date: Fri, 30 Jan 2015 06:28:48 GMT
cb_1422599350355 && cb_1422599350355({"zones":[{"id":1107,"status":200
,"enabled":true,"template":"Free_Creative_300X250","data":[{"snippet":
"<!-- BEGIN IFRAME TAG - 300x250 (#19) < - DO NOT MODIFY -->\
n<IFRAME SRC=\"hXXp://ib.adnxs.com/tt?id=2488352\" FRAMEBORDER=\"0\
" SCROLLING=\"no\" MARGINHEIGHT=\"0\" MARGINWIDTH=\"0\" TOPMARGIN=\"0\
" LEFTMARGIN=\"0\" ALLOWTRANSPARENCY=\"true\" WIDTH=\"300\" HEIGHT=\"2
50\"></IFRAME>\n<!-- END TAG -->","clk":"PXR3SD9nFWRRHb
SWPOhcQ2Uu_4azObF4rx4Ca5gKE8BUd4iBKyn80qFKXHgtARTm0ftWLB8eBbJeWgtAIypz
jg7eDYw-Kdll2VWqDUfnV_9Ipx2YyCQv9Hw093U62kwYzQwPeAU_bXtMctjJVnbBbgHZjk
FYOYw4nkzmkr1UsGt4jcQsAoQ72m50_lHf-XGXXN5GMW7ivLh9fNTojvL0QWAMPqaNhHwo
-QwUS0zKjtPIdlFGJh-hB8PDvRj4Qh56UWG73DKFuTBzwy_eiBhBTC46re7ry9jSrYKrd6
AYoAg","width":300,"height":250,"cUrl":"hXXp://d.castplatform.com/api/
c/1?clk=%clk%","vUrl":"hXXp://d.castplatform.com/api/vp/1?clk=%clk%"}]
}],"ts":0});....


GET /api/vp/1?clk=PXR3SD9nFWRRHbSWPOhcQ2Uu_4azObF4rx4Ca5gKE8BUd4iBKyn80qFKXHgtARTm0ftWLB8eBbJeWgtAIypzjg7eDYw-Kdll2VWqDUfnV_9Ipx2YyCQv9Hw093U62kwYzQwPeAU_bXtMctjJVnbBbgHZjkFYOYw4nkzmkr1UsGt4jcQsAoQ72m50_lHf-XGXXN5GMW7ivLh9fNTojvL0QWAMPqaNhHwo-QwUS0zKjtPIdlFGJh-hB8PDvRj4Qh56UWG73DKFuTBzwy_eiBhBTC46re7ry9jSrYKrd6AYoAg&rfr=aHR0cDovL3BhcnRuZXJzLmZyZWVyaWRlZ2FtZXMuY29tL2Jhbm5lcnMvZGVmYXVsdC8zMDB4MjUwX0lOVF9ST1NfdHJpYmVsLmh0bWw= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 43

Content-Type: image/gif

Server: Microsoft-HTTPAPI/2.0

Date: Fri, 30 Jan 2015 06:28:48 GMT

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: no-cache..Content-Length: 43..Content-Type: image/gif..Server: Mi
crosoft-HTTPAPI/2.0..Date: Fri, 30 Jan 2015 06:28:48 GMT..GIF89a......
.......!.......,...........L..;..

GET /PositiveSSLCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1287

Last-Modified: Mon, 18 Sep 2006 00:00:00 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes
0...0..........L.J.[E.!.../. Qq0...*.H........0..1.0...U....US1.0...U.
...UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U.
...hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0...060918
000000Z..200530104838Z0q1.0...U....GB1.0...U....Greater Manchester1.0.
..U....Salford1.0...U....Comodo CA Limited1.0...U....PositiveSSL CA0..
"0...*.H.............0.........OyX"..(>R../.. ..-U.......*..^...X.T
....A...U.... .E.&. .=...1.!\y.y.$.\V...............S..F...$.b...^ Z..
.P...(*M..HO....O......?....,......p..i..<......?n...-..].........~
....}..:=.r.y%.......V^...Z..b4 (H2.........f.....iM....]..7b........~
.jR.................n0..j0...U.#..0....r_&.(.C.].7....K..E0...U.......
....1y......*..5.1.0...U...........0...U.......0.......0{..U...t0r08.6
.4.2hXXp://crl.comodoca.com/UTN-USERFirst-Hardware.crl06.4.2.0hXXp://c
rl.comodo.net/UTN-USERFirst-Hardware.crl0.... ........z0x0;.. .....0..
/hXXp://crt.comodoca.com/UTNAddTrustServerCA.crt09.. .....0..-hXXp://c
rt.comodo.net/UTNAddTrustServerCA.crt0...*.H..................H]..Z...
.....l.I..1.1\...d.....Z-..;>[email protected]....&=[!.....=.<
...._.S........NI}.......e....1w..*....j-.e..g.m.J.f..2M.B#..EAjv.....
n..>.Q......P*...o."6...F....;}.....2 .....@..$..]..........KS}.(.V
=..gI...... LG..L.D...c..{[1.&a.y...N..P{...<<< skipped >>>

GET /banner?sid=2813375&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1211553&screen_res=undefined&wpt=J&clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad3.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:53  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017610551985112

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:52 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc4=103d8; expires=Wed, 29-Jul-2015 07:28:52 GMT; path=/

Set-Cookie: lv_1211553=w=2813375|t=1422599332; expires=Fri, 30-Jan-2015 06:58:52 GMT; path=/; domain=.adfarm1.adition.com

Content-Length: 2340
document.write('\x3Cscript type="text/javascript">\n    void 0===wi
ndow.oobClickURL&&(window.oobClickURL=\'\');void 0===window.AdOob&&(wi
ndow.AdOob=function(a){if(0\x3Ca.length){var b,c=new Date;a=a \'×
tamp=\' c.getTime();(new Image).src=a;try{b=window.top.AdClicks=window
.top.AdClicks||[],b[b.length]={url:a,time:c.getTime()}}catch(d){}}});\
n\x3C/script>\n\x3Cdiv id="adBanner_6110017610551985112" style="pad
ding:0;margin:0;display:inline-block;">\n\x3Cdiv id="obaButton_6110
017610551985112" style="position:relative;padding:0;margin:0">\x3C/
div>\n\x3Ca id="adlnk_6110017610551985112" href="hXXp://ad3.adfarm1
.adition.com/redi*lid=6110017610551985112/sid=2813375/kid=1211553/bid=
3956561/c=22id=3956561&dr=&cn=performancet&cs=1211553&cm=NEC1402&t=pag
eview&dl=https://VVV.neckermann-reisen.de/vbit/NEC1402/121
1553/performance&cd=&z=6110017610551985112" />\n\n');..<<< skipped >>>

GET /banner?sid=3086960&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=3&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597667737694

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 19
document.write('');..

GET /pixel?google_nid=appnexus1&google_sc&google_hm=MzMzODY3MDMxODczNDEyNTg2NQ== HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cm.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://adx.adnxs.com/mapuid?member=181&user=

Date: Fri, 30 Jan 2015 06:28:49 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 245

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://adx.adnxs.com/mapuid?member=181&user=">he
re</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: po
licyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="
CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV 
OTC NOI DSP COR"..Location: hXXp://adx.adnxs.com/mapuid?member=181&use
r=..Date: Fri, 30 Jan 2015 06:28:49 GMT..Pragma: no-cache..Expires: Fr
i, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate.
.Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)
..Content-Length: 245..X-XSS-Protection: 1; mode=block..Alternate-Prot
ocol: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="con
tent-type" content="text/html;charset=utf-8">.<TITLE>302 Move
d</TITLE></HEAD><BODY>.<H1>302 Moved</H1>
;.The document has moved.<A HREF="hXXp://adx.adnxs.com/mapuid?membe
r=181&user=">here</A>...</BODY></HTML>..t>....<<< skipped >>>

GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cm.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3338670318734125865&code=CAESEOtIY_p5x_ubAlShQqSV770&google_cver=1

Date: Fri, 30 Jan 2015 06:28:50 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 317

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=333867031
8734125865&code=CAESEOtIY_p5x_ubAlShQqSV770&google_cver=1">
here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: 
policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP
="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NA
V OTC NOI DSP COR"..Location: hXXp://ib.adnxs.com/setuid?entity=101&ui
d=3338670318734125865&code=CAESEOtIY_p5x_ubAlShQqSV770&google_cver=1..
Date: Fri, 30 Jan 2015 06:28:50 GMT..Pragma: no-cache..Expires: Fri, 0
1 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Con
tent-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Co
ntent-Length: 317..X-XSS-Protection: 1; mode=block..Alternate-Protocol
: 80:quic,p=0.02..<HTML><HEAD><meta http-equiv="content
-type" content="text/html;charset=utf-8">.<TITLE>302 Moved<
;/TITLE></HEAD><BODY>.<H1>302 Moved</H1>.Th
e document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101
&uid=3338670318734125865&code=CAESEOtIY_p5x_ubAlShQqSV770&
google_cver=1">here</A>...</BODY></HTML>..
....
<<< skipped >>>

GET /pixel?google_nid=accordant_dmp&google_cm&google_ck=1&APN=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cm.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://t.a3cloud.net/gx.png?APN=3338670318734125865&google_gid=CAESENmAYpTPZntugDgw3jO6nz4&google_cver=1

Date: Fri, 30 Jan 2015 06:28:54 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 309

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://t.a3cloud.net/gx.png?APN=3338670318734125865&
;google_gid=CAESENmAYpTPZntugDgw3jO6nz4&google_cver=1">here<
/A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyre
f="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa A
DMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NO
I DSP COR"..Location: hXXp://t.a3cloud.net/gx.png?APN=3338670318734125
865&google_gid=CAESENmAYpTPZntugDgw3jO6nz4&google_cver=1..Date: Fri, 3
0 Jan 2015 06:28:54 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 0
0:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: t
ext/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length
: 309..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=
0.02..<HTML><HEAD><meta http-equiv="content-type" conte
nt="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE>&
lt;/HEAD><BODY>.<H1>302 Moved</H1>.The document h
as moved.<A HREF="hXXp://t.a3cloud.net/gx.png?APN=33386703187341258
65&google_gid=CAESENmAYpTPZntugDgw3jO6nz4&google_cver=1">he
re</A>...</BODY></HTML>....<<< skipped >>>

GET /reportV3/ft.stat?44535597-0-308-0-258658AC9B8964-813111153 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:53 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:53 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:53 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-955826505-0x0x51x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:28:58 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:28:58 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:28:58 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:28:58 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-516200727-0x0x175x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:29:15 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:29:15 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:29:15 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:29:15 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-545696636-0x0x302x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:29:45 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:29:45 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1HTTP/1.1 200 OK..Server: Apache..ETag: "c4ca4238a0b923820dcc509a6f758
49b:1340894289"..Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT..Accept-
Ranges: bytes..Content-Length: 1..Content-Type: text/plain..Expires: F
ri, 30 Jan 2015 06:29:45 GMT..Cache-Control: max-age=0, no-cache, no-s
tore..Pragma: no-cache..Date: Fri, 30 Jan 2015 06:29:45 GMT..Connectio
n: keep-alive..access-control-max-age: 86400..access-control-allow-cre
dentials: false..access-control-allow-headers: *..access-control-allow
-methods: GET,POST..access-control-allow-origin: *..1....

GET /reportV3/ft.stat?44535597-0-310-0-258658AC9B8964-597843830-0x0x600x0 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: stat.flashtalking.com

DNT: 1

Connection: Keep-Alive

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 200 OK

Server: Apache

ETag: "c4ca4238a0b923820dcc509a6f75849b:1340894289"

Last-Modified: Thu, 28 Jun 2012 14:38:09 GMT

Accept-Ranges: bytes

Content-Length: 1

Content-Type: text/plain

Expires: Fri, 30 Jan 2015 06:30:46 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Fri, 30 Jan 2015 06:30:46 GMT

Connection: keep-alive

access-control-max-age: 86400

access-control-allow-credentials: false

access-control-allow-headers: *

access-control-allow-methods: GET,POST

access-control-allow-origin: *

1..

GET /do/gatewayCD?sId=FRG_Website&subId=&actid=&callback=updateClientCookies&_=1422599219946 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: player.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; JSESSIONID=49C83FF2E975AF303626693D6FF75A1F


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:38 GMT

Server: Apache

Content-Length: 243

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
updateClientCookies( [{name:'143_CAMPAIGN_SERIAL_ID',value:'Default-FR
G_Website',expire:'7776000'},{name:'143_TURNKEY',value:'Default-481422
599182472568',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'Defau
lt-MSIE 7.0',expire:'7776000'}]);HTTP/1.1 200 OK..Date: Fri, 30 Jan 20
15 06:26:38 GMT..Server: Apache..Content-Length: 243..P3P: CP="IDC CUR
a ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Keep-Alive: timeout=3, max=
800..Connection: Keep-Alive..Content-Type: text/html;charset=ISO-8859-
1..updateClientCookies( [{name:'143_CAMPAIGN_SERIAL_ID',value:'Default
-FRG_Website',expire:'7776000'},{name:'143_TURNKEY',value:'Default-481
422599182472568',expire:'7776000'},{name:'143_FIRST_BROWSER',value:'De
fault-MSIE 7.0',expire:'7776000'}]);....


GET /do/gateway?sId=FRG_Website&subId=&actid=&udom=partners.freeridegames.com HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: player.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; JSESSIONID=49C83FF2E975AF303626693D6FF75A1F


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:39 GMT

Server: Apache

Set-Cookie: 143_userName=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_password=""; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/

Set-Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; Expires=Thu, 30-Apr-2015 06:26:39 GMT; Path=/

Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version=1; Max-Age=7776000; Expires=Thu, 30-Apr-2015 06:26:39 GMT; Path=/

Set-Cookie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Apr-2015 06:26:39 GMT; Path=/

Set-Cookie: 143_CT=1; Expires=Fri, 06-Feb-2015 06:26:39 GMT; Path=/

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Length: 38

Keep-Alive: timeout=3, max=799

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
({"gateway replay":"{'status':'ok'}"})HTTP/1.1 200 OK..Date: Fri, 30 J
an 2015 06:26:39 GMT..Server: Apache..Set-Cookie: 143_userName=""; Exp
ires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_password="
"; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/..Set-Cookie: 143_CAMP
AIGN_SERIAL_ID=Default-FRG_Website; Expires=Thu, 30-Apr-2015 06:26:39 
GMT; Path=/..Set-Cookie: 143_FIRST_BROWSER="Default-MSIE 7.0"; Version
=1; Max-Age=7776000; Expires=Thu, 30-Apr-2015 06:26:39 GMT; Path=/..Se
t-Cookie: 143_UDOM=partners.freeridegames.com; Expires=Thu, 30-Apr-201
5 06:26:39 GMT; Path=/..Set-Cookie: 143_CT=1; Expires=Fri, 06-Feb-2015
 06:26:39 GMT; Path=/..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UN
I COM NAV"..Content-Length: 38..Keep-Alive: timeout=3, max=799..Connec
tion: Keep-Alive..Content-Type: text/html;charset=ISO-8859-1..({"gatew
ay replay":"{'status':'ok'}"})..<<< skipped >>>

GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: image2.pubmatic.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6

Set-Cookie: KRTBCOOKIE_57=476-uid:3338670318734125865; domain=pubmatic.com; expires=Mon, 29-Jan-2018 06:28:50 GMT; path=/

Set-Cookie: PUBRETARGET=dummy; domain=pubmatic.com; expires=Fri, 30-Jan-2015 06:28:50 GMT; path=/

Set-Cookie: PUBMDCID=3; domain=pubmatic.com; expires=Sat, 30-Jan-2016 06:28:50 GMT; path=/

Content-Length: 42

P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Connection: close

Content-Type: image/gif; charset=utf-8
GIF89a.............!.......,...........D.;..

GET /banner/twiago/676/2014-10-31/0_Teilen16_9.jpeg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn5.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; accado_ex=


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"2048277039"

Last-Modified: Fri, 31 Oct 2014 15:07:52 GMT

Expires: Mon, 09 Feb 2015 06:28:53 GMT

Cache-Control: max-age=864000

Strict-Transport-Security: max-age=31536000; includeSubdomains

X-Frame-Options: DENY

Content-Encoding: gzip
2a60..............g4...'.at.wf...D.6z.5.!j.}.....1D.A.D...A.....^"z...
..........s....{..y^..s.W....Z................).....;;..z;9....?b...Ex
:.kik.k..i..K....#..../..a.R.$...*.|.....$..' "#""[email protected]
......Pf0 ....-....;7....?........Q..Q..Q...?.o;........p.p.p.T8...l..
.8................_A.%........?.......<*|j..%..C;BN$.hDb..T....h..K
..'.........7./.....c)i..U5u.M-...&.f.....N..].../.......^..~......!%.
cZz.......blI............................k...[.;.{.'.g...W.7.q........
..E....o,x..q.....@*<|...jË;$..h...rbnu.1T.....g...K.......K.....
...7.....  .........r...1.U....;..U2..W.9y..B..-E....DaY.O...........1
.K3A..=[z....iqQ...KT......iyW....G.$M..r....(_.....'F..*......8\.e.A/
..A...,.NMf.}. .." .BO..^.@.>..."....%.d^...U.NNV...N8N../~..u....n
....L.&..l../.Z.....&*...J.w...........~E......'...e..j..*V...b...M\.g
.....!..e.?.ja.i......Bir...D...T7?/....Q.xJ.._.....R_.~e_...dDs.b_.R.
[email protected] w^.....s.ti.V^.h...~..Z....'.../&..w...Hr....-..q....X..f
.'C..Kt......dt.Y...tR..[..<...?....(...Y.=...?..........uVx.V.Wf..
...7...%.......r.`.._.......)...5.ZSOD...mZ|.4..:.(/...25.....^.f.kukO
.Y..B.Z..i=H5..YD'.....3..I.&C..&F..m.?~..C!....1t......;..bE...nVCR].
<....f..o..JL......*.b...........A.......<<n.!O.R....|..}...2
t81.. ...{?..9.../.tEs.....vcI...Xnf..!RJL..'_...}....q?..Y....D%.].|.
...J{...j.D.#;rH.j.m;..-y.4...P..T.A..O....'...ZZ...pO....'-2...4lE..5
.$O..Z...nim<$x ")[.w.F.x.05.Ak.e...OH&p.)C...E.y../....*...&..d.M.
lI.....j..H....N..Z.^A.Q.x.x..6.g...I.s.2.6..vx...0........w...*.6<<< skipped >>>

GET /c/de8640634.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c.t4ft.de

If-Modified-Since: Wed, 17 Dec 2014 16:10:04 GMT

If-None-Match: "21951253"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Last-Modified: Wed, 17 Dec 2014 16:10:05 GMT

ETag: "55571221"

Content-Type: application/javascript

Expires: Fri, 30 Jan 2015 07:28:50 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Content-Length: 3764

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: ws-0403
.......T...:.s....._!...a5.$..$........$..q.Uz:............_.|..P..WWW
......g...H......V.E..{..^.....K.w.........E..A.....M[.|r..........g.\
<v'V...X.../..}.&n..."....G.I..<.n..............|Jy.H.uQ....{S..
...NwB3....u......c.K|..d...^.sV...u......~.pw...8.u..Jy...7....1..Cq.
.J....<7.M..My..s....4..!.eRG.?sO...!.@. ....9d[...Y(.rAA........*.
..8N......>Q|..n.~.....O.....Y.".".C...h......C...n.,."...Y.0..5/AS
J/..gl6G^.eq.-...$.W...=.. .M'.9(.......k2J~..,."s..zX..3.V,.`...SmA&g
t;..:5.......>[email protected]..^p...f.b.Hg.`0........P..r.8.
.].U...a8r./.cbO0.w.....s...b.l...."7...........A.....ZE.].A....-e....
<w..XS1.`...F.5.......[..../...%...P...4.w.V.. .l.*M....q....[..?..
_.[t....Y...]...?b..~a.....x:c....$.:.Np1s....<...."O....c.6S.t....
?.U.`I.E.H...S...N'..9..._...^....@..!.!..~..f...(...h.'...I....R.t...
E...?zi..;1..4.NT._3Zd..<.... c%!......oV...;.. ....f.|.....e.6M...
Nj.N.e....5..S-..|.D..Jp&......C<..t)_l..D..mZ...H....,O.h.G....L!y
...XB.b..]..;}.Gw.6....i:.....B.......fT`..V.zp.@...*d...)..H.*.U."...
4..p......./s..l....&.Dp..x.Y....P..r/..../.....c.RA..A..5.hNV..1i....
......hy.w .-r..R....e.G....J^...BF(d:$Av...x..Pk.....s...x.._.i.=l.Z.
.b.S.eH'tL1.*Hk........O...V.....3....~.J .v!G.`..mHQrK.gy. ..9.......
[email protected]...(.7..R?(r.....y:.i`1..U..... .z7V...?a.b_lU,...
'....Y.x.....<~......F...4ax....3..G1.|.0......(Xr&^..,...;j..L...l
./..>^....YH..l.rSN.QVT..Y.d...........,R.. ?.....4.i."D....3...k$.
.x>..9k.{.3..x...H...&..I.}$......l.)....FBW.*,....<...\T...<<< skipped >>>

GET /c/de8774481.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c.t4ft.de

DNT: 1

Connection: Keep-Alive

Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=


HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Last-Modified: Tue, 23 Dec 2014 13:10:02 GMT

ETag: "230199605"

Content-Type: application/javascript

Expires: Fri, 30 Jan 2015 07:28:52 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Content-Length: 3762

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws-0403
.....i.T....ks.H....yvW.h.$...0.9...wN..8W...\.F.2...."...{..$.G]]]U..
......~.v.q7c.qp..`n...=jt.........t;..h.Y.f~.j...I..lt..............l
.....6.C/.......,J.Y.....3..Bx.........d......xJX6K.e......c..v._.....
I....z.n...n..S...8......o./.d!.5.....y4.....R#aq..L..J.D.s..iL)...,u.
....4a.,..en..~.4..-t4.3s.............}{.r..s)W,......y`..B.o..D.H....
...c..7...$.Y.-.....g..!-b..............fL"?.H..9...Y..4....{.j..Fa...
.J...`.N8..h.B.d4...)H..A..%....../..k..e. eK.2..q..*....V..4%..)..A..
h..S....L.......}.I.H..7..l."f..6.z.p...jH/..XI...[.x.Rg.....>...\.
....>eN.l.&n.........<..".......O3..D_.h...H.9......Z.e.;.kJ&%L#
QX...].7...}o.?...^.O....$Vx[.q'`.........Y.q.eQ.............$4.L. ...
HC..m....6}........,.ec...O&.?3....STEd....b..fr.NY2b7.I)..tQ...yx:..I
.t...2........P|..d....2...>j.-_.....b{.Sl..l.v.*.#........M.8.....
.U.....<...9.4.....A.e......sF.A'..2.[...1\.F....$.#8:.$8..f.......
*..cC?d.W...[..i8....I...$.%2...2A.D.d:..Y...-...N.s..$......].t......
.6.6..u.*..c.'.......7....0...K...GV"..(O..DXU..t.....~..3....^.<.K
.`k...k.O8.s..........K....^y"..al2.,..l4(.......{pL.k...o.j.I.Z......
....*) k......\..gA....n..2.n.C...y^..lJ.`......yK....%].c..n.*.^...'.
.. ......h......... ..5.. ~r.....I*g...;........a.H..2H.......$ZK.F"za
..\i.S....\^...'cj...Y..8aC{7G.=g..6.k..l.*_.%...(_.1.. .....&.a...$X.
....[...$.Z.D. .....'t(Qp.$M.........,...-Ei.@#v.^.(.ux..*(.k.XI.....*
..:.K(.....R...T"..*.&l6..e......fK.J....J].C.,D.....D.KQ..iP.]......[
..~.........t..... .s..^..1...vyT.[Wx..\g...jU.]....4.|..6.{/....9<<< skipped >>>

GET /plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1aa58c94f2bf34&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ff30ab89be913e2c&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.facebook.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Location: hXXps://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1aa58c94f2bf34&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ff30ab89be913e2c&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100

X-Content-Type-Options: nosniff

X-UA-Compatible: IE=edge

Vary: Accept-Encoding

Content-Type: text/html; charset=utf-8

X-FB-Debug: 6YQrcXbDqYjg9ba/grbTjc JuLMDTuB56tymry2xUPn8xGYajiBib5bPt/n919O7 JErcHUfIhHRahV2fWyplA==

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive

Content-Length: 0
HTTP/1.1 302 Found..Location: hXXps://VVV.facebook.com/plugins/like.ph
p?app_id=170803223095607&channel=http://static.ak.facebook.com%2
Fconnect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1aa58c94
f2bf34&domain=partners.freeridegames.com&origin=http%3A%2F
%2Fpartners.freeridegames.com%2Ff30ab89be913e2c&relation=paren
t.parent&href=http://VVV.facebook.com/pages/FreeRideGames/
148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&sh
ow_faces=false&width=100..X-Content-Type-Options: nosniff..X-UA-Compat
ible: IE=edge..Vary: Accept-Encoding..Content-Type: text/html; charset
=utf-8..X-FB-Debug: 6YQrcXbDqYjg9ba/grbTjc JuLMDTuB56tymry2xUPn8xGYaji
Bib5bPt/n919O7 JErcHUfIhHRahV2fWyplA==..Date: Fri, 30 Jan 2015 06:26:3
9 GMT..Connection: keep-alive..Content-Length: 0..<<< skipped >>>

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:53 GMT

....

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:53 GMT

HTTP/1.1 304 Not Modified..Access-Control-Allow-Origin: *..Content-Typ
e: application/javascript..Accept-Ranges: bytes..ETag: "1035523256"..L
ast-Modified: Tue, 09 Dec 2014 09:34:51 GMT..Date: Fri, 30 Jan 2015 06
:28:53 GMT......

GET /banners/250/files/00/00/03/9c/000000000924.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Content-Type: image/gif

Accept-Ranges: bytes

ETag: "3199130772"

Last-Modified: Wed, 07 Nov 2012 11:36:43 GMT

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:53 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Content-Type: image/gif..Accept-Ranges: bytes..E
Tag: "3199130772"..Last-Modified: Wed, 07 Nov 2012 11:36:43 GMT..Conte
nt-Length: 43..Date: Fri, 30 Jan 2015 06:28:53 GMT..GIF89a............
.!.......,...........D..;..

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=8136a9601400 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1025

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.F.~.... .!G\..R..'...M..vS.........,.e7...,.!aYz.4....|
3..{..%........=..c..|..RUw0hU..CUW...\ ..S... .[...O.Tp.(...[......8.
.o.t6u...7s...m......D........WG..<Yx..qV...?/..*.q....KL,.t.7....d
[email protected]...!.....\K%OH............e..B.7j...t_.^x.Y..e...S..e...].}e.y[
.Q.....'.l:.b.s.......v.X...5qL..M.......5.....B./..IT..pt....'.?}....
/..^\.....?......h....Kr.f.W^..~....i...L.fs. ..../X...4.G...y)4...!.-
|/...mR.JQ...=.cn.i...........V...tX....Y..t.z....=~.....1]..&.~......
.*.b...X:..Z..a..."GCOh.......kx.....`.]........b.O..B4b..w.z...4..[S.
}F4)(._.......N.W.UU.*..C{..Lt.....9m/.B.k.....DS.m.....1K(.F.]k..F".\
NE.....<`.Hd.8.|O..w..I.R.o.... ..;..1.!....q.m.I...N......^N...aDo
`.h[ ..r..Z...#.P$..4.)....hu.......Y..K..d.v....M..K..f..Ae._.8l.m...
k<.....k&..A..Q.d..=...{..t.K..."v......Rip....IZ&...v.R...d)......
l.....p..G......".In8,[email protected]<&.
........YJ].h...\....d.!..[.P-W..z.......5.....R..k9.y.K..!..4.....=,.
z..9..tAu.X..BN....i~..U...r`.Gs_.V..$LN...*..5..b...9.....

GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3338670318734125865&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dis.eu.criteo.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: image/gif

Expires: -1

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 43

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Cont
rol: no-cache..Pragma: no-cache..Content-Type: image/gif..Expires: -1.
.Server: Microsoft-IIS/7.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS 
NAV STA"..Date: Fri, 30 Jan 2015 06:28:50 GMT..Content-Length: 43..GIF
89a.............!.......,...........D..;..

GET /orbserv/hbpix?pixId=4138&pcv=33&ptid=9&tpuv=01&tpu=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: idpix.media6degrees.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Server: Apache-Coyote/1.1

P3P: CP="COM NAV INT STA NID OUR IND NOI"

Pragma: no-cache

Cache-Control: no-cache

Set-Cookie: cckz=1niz8ob; Domain=media6degrees.com; Expires=Fri, 30-Jan-2015 06:38:59 GMT; Path=/

Set-Cookie: cckz=1niz8ob; Domain=media6degrees.com; Expires=Wed, 29-Jul-2015 06:28:59 GMT; Path=/

Location: hXXp://idpix.media6degrees.com/orbserv/hbpix?pixId=4138&pcv=33&tpu=3338670318734125865&ptid=9&tpuv=01&cckz=true

Content-Length: 0

Date: Fri, 30 Jan 2015 06:28:58 GMT

Connection: close

GET /pagead/viewthroughconversion/1018863546/?random=1422599221684&cv=7&fst=1422599221684&num=1&fmt=3&guid=ON&u_h=901&u_w=1716&u_ah=857&u_aw=1716&u_cd=24&u_his=0&u_tz=120&u_java=true&u_nplug=0&u_nmime=0&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&vis=0&async=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: googleads.g.doubleclick.net

DNT: 1

Connection: Keep-Alive

Cookie: id=caebd6253000002||t=1384780400|et=730|cs=002213fd480c4c2631f7c541a4


HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/1018863546/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=3170539322

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/101886354
6/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_g
ames?gameId=659050&random=3170539322..Content-Type: image/gif..X-C
ontent-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-
Protection: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..GIF89a.
............!.......,...........D.;..

GET /cgi-bin/CRL/2018/cdp.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: VVV.public-trust.com


HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Last-Modified: Tue, 20 Jan 2015 06:15:01 GMT

ETag: "200c0-409-50d0f5bed6e6c"

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Connection: Keep-Alive

Date: Fri, 30 Jan 2015 06:28:19 GMT

Content-Length: 1033

0...0..n...0...*.H........0u1.0...U....US1.0...U....GTE Corporation1'0
%..U....GTE CyberTrust Solutions, Inc.1#0!..U....GTE CyberTrust Global
 Root..141217194339Z..150419194839Z0...0....'.x..110110211653Z0....'..
..141119195306Z0....'B...141119195752Z0....'....141119200006Z0....'.:.
.071121154528Z0....'.v..080219183346Z0....'....080514142515Z0....'....
080515170349Z0....'....080924143337Z0....'#...081203144336Z0....''j..0
90209174351Z0....'b...100414181148Z0....'....080917150432Z0....'#...08
1203144209Z0....'#...081203144241Z0....'#...081203144304Z0....'%u..081
203144409Z0....'/9..090318130930Z0....'8...090715181853Z0....'TU..1001
13191852Z0....'k...101130163724Z0....'.B..111107193907Z0....'@...14111
9200409Z0....'....080917150312Z0....'....140709175318Z0....'....141210
173900Z0....'-E..141119195854Z0....'....141119200037Z0....'F...1412171
93909Z0....'F...141217193956Z..0.0...U........0...*.H............ ....
.....0.g97a.b...5.h.....<......G...}.E/.y1.n..>... ...........U.
.O../..1...~t[I/y.:.....s.#E....b.1.k.._........y#*...:Ol..HTTP/1.1 20
0 OK..Server: Apache/2.2.15 (CentOS)..Last-Modified: Tue, 20 Jan 2015 
06:15:01 GMT..ETag: "200c0-409-50d0f5bed6e6c"..Accept-Ranges: bytes..C
ontent-Type: application/x-pkcs7-crl..Connection: Keep-Alive..Date: Fr
i, 30 Jan 2015 06:28:19 GMT..Content-Length: 1033..0...0..n...0...*.H.
.......0u1.0...U....US1.0...U....GTE Corporation1'0%..U....GTE CyberTr
ust Solutions, Inc.1#0!..U....GTE CyberTrust Global Root..141217194339
Z..150419194839Z0...0....'.x..110110211653Z0....'....141119195306Z

<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1856

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA2wA-ANIilAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:43 GMT

Server: Apache

Set-Cookie: JSESSIONID=8EDFDE70952B1FDBF21C0A62DD2032FB; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /system/modules/com.exent.owned.geo.templates/resources/js/jquery.ThreeDots.min.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: application/x-javascript;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Content-Length: 1417

Connection: keep-alive
...........WMo.6.....P...5#..z.e.(..m...h.KQ..E.thJ.(;.W..CR.%....:@l.
..7o.3.......%.O._<g.c..`/........i...r.?y...V.fy!R...i0.^_}.4.{...
.........i..\.l>..,Y.4.6.~...\_.s&$.....=."..H.)..4.|.....T...}..,.
..L.nq|>D..P.E.....S....)E.z.6..._}x,U..B.......U.$...irJ.be...`...
.s.%U...._....MU)...';R....'I....'..A...|.....Z.....Q3........Rbk3.zxQ
....U..-..b.....PW9...,XX...6....!."^.L....`[email protected]...;z.....#..d*....
..q.KVU..L.3.&...9.-.|...7Ya.0.....d.3...._.NC$VE...FFEq.>m1Z..~...
i.."z.....J..#h....q...$'.u.m.....i..H..1.F..tR.|9.q......*Kz`>..!.
..iai..U..".V..{....7e...." DQ..e.&....W..d..9..-.l.\..<..gAQ4z#...
-_..Q....c....K.C..Y...k.C...y.u9.k58.T..4.C.?..........9......M.d.|..
k....]..vf.....y..#O%[....b.(..1u....W..t.p...vV::...r..go....J5|C.p._
..B.1T'.r.......(....! .....~@.#.~~.=n3......j8.f]].../...^Y....?....B
Kf.y.6..{....O.._."...6......A."./@..A... ..iz....X.....A..6....?D..cn
....L..8R.ds.(.....v.U..A.....)p1Amkn..Sg..w5;.R.K\5....bQd2:!.#l..u%.
...R.j.. r. p.].Q.....j..|Av.8.f...gI..K..\.f...g".p.'.@.........)..pj
...n.N.%.s..-.5plEw5'o...{Z.o..{.S.};...v...gw....nO...\....j.{Z..g2E.
.........l...w7..*V....*. .J.1.@..%M.f.\.....P.=?;*........03.U7.C5.9.
>m.......ye1...l...8x".#..Y{.W.:.'.Q.....G."..f.w..X.).i.E.35Z~ZL..
.].....NtI..%..{..kN..M.{.Z........N..ba..$D...,...n.#J...1..ih'.z..u.
..=p.L}.4..2Ms....fxr.!M.:1.H6...a...o....tC..Y.....y....p..E.^..p.Q..
#(...]...Mk..Y..[Y.....'}..8....Y#Q.......
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/geoServices.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 580

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........U.n.0..i.....(@..t.:....h..]..`....&....H..%E..m..:..{.xw..
...Z...........#m:].4.....\.....g._J:...y..]..7`...I.eG.....4.? #`e...
.|..Y..<..V...p.b....R.r....k....;6......eW...O..`yNC..........0#..
._.9.....]../W......y(.2.., v.:[email protected]?.V.@,..&.t;.u.eT3.
..|..;.....v.F....DQ"..D..u..}\.ew.".-`g.XU.a.i.3.......{..s...:..N...
`..h..4R...?..s....Nav..i..,[email protected].....
..K.Sk....7..sE.|o.y..i...,......J.{_....;...va.....K..t.|.W....t.A.|u
./l. /....:...g.TT......E).be.;....... u.....S.....'P5..JE'......u..pq
.7..c...N>......rp[o...HTTP/1.1 200 OK..Server: Apache..P3P: CP="ID
C CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Content-Type: applicat
ion/x-javascript;charset=UTF-8..Content-Encoding: gzip..Content-Length
: 580..Cache-Control: max-age=86400..Expires: Sat, 31 Jan 2015 06:26:3
7 GMT..Date: Fri, 30 Jan 2015 06:26:37 GMT..Connection: keep-alive..Va
ry: Accept-Encoding.............U.n.0..i.....(@..t.:....h..]..`....&..
..H..%E..m..:..{.xw.....Z...........#m:].4.....\.....g._J:...y..]..7`.
..I.eG.....4.? #`e....|..Y..<..V...p.b....R.r....k....;6......eW...
O..`yNC..........0#..._.9.....]../W......y(.2.., v.:[email protected]...
.C?.V.@,..&.t;.u.eT3...|..;.....v.F....DQ"..D..u..}\.ew.".-`g.XU.a.i.3
.......{..s...:..N...`..h..4R...?..s....Nav..i..,[email protected]
..I.Ff......r.Zc.......K.Sk....7..sE.|o.y..i...,......J.{_....;...va..
...K..t.|.W....t.A.|u./l. /....:...g.TT......E).be.;....... u.....S...
..'P5..JE'......u..pq.7..c...N>......rp[o.......
<<< skipped >>>

GET /system/modules/com.exent.owned.geo.general/resources/newsBox/css/newsBox.css?version=38 HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 336

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
..........}P.n.0.<..?X..(......AN.I,.odo ...k'.....}xfvfm..?.g..u.\
../........f..>lYx.XSc...!?j......V......:.U..E.I..2.h:.}..H..Hbm..
..pm..C....V...Z...{.u`$..L..Y..;kE........tU.H_.....%../2{.!...i....N
I [email protected].$r.m.8h........p.......I.3Q.4(I.h&,.3...). O..3..(.p.........X
.^'^"..Ji[....NI....AO\.]YQ.......$...(..Bi...)r..1.....2.....HTTP/1.1
 200 OK..Server: Apache..Content-Type: text/css;charset=UTF-8..Content
-Encoding: gzip..Content-Length: 336..Cache-Control: max-age=86400..Ex
pires: Sat, 31 Jan 2015 06:26:37 GMT..Date: Fri, 30 Jan 2015 06:26:37 
GMT..Connection: keep-alive..Vary: Accept-Encoding............}P.n.0.&
lt;..?X..(......AN.I,.odo ...k'.....}xfvfm..?.g..u.\../........f..>
lYx.XSc...!?j......V......:.U..E.I..2.h:.}..H..Hbm....pm..C....V...Z..
.{.u`$..L..Y..;kE........tU.H_.....%../2{.!...i....NI [email protected].$r.m.8h...
.....p.......I.3Q.4(I.h&,.3...). O..3..(.p.........X.^'^"..Ji[....NI..
..AO\.]YQ.......$...(..Bi...)r..1.....2.........


GET /static/marketing/main/css/sprite_sheet.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 2713

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
............[..6....WP.<.......=......g...&...e<=S.. .0: k.v.&..
.GGG../.yO;...y^^.....Z.'............omW.K....s..^.............?..n.w9
.o~.....r.........G..!..$e..u.....5...z.7....2m........E............./
....~M..Ls..>:(.=q.;........V.o..>.........C.H..kQ.E...R._>{.
 ..Jq}=....>{.....]ux._ o......g....?JW..x~~)....=Is..}.T..~.[~{zH.
..1.O..hy........b|...;..xj_....."..-D..=1.9..#...%.,..<~.de.G.....
.....4B....R...F``...H.....w.9...!.Q.p8k..p...w...T.6........c QqHz...
...5D..).T.V.p`.f.........6..|.q.y<|....e.1)rQ%.6r.Yi..R...d...`...
.e.....q.V.dm..().[{{..q..a..z...W........!p.%4...<1.]...@.{..x....
.fm.b.R...W....\/.O...Qi..;>..Z../....$...`....p$X......O..d.m.Y...
2B......%hp.44Ty...J...o.h..I......Z..TgRGk.?Q..][email protected]...../.....8...
LTh...K.tH.w...d..........v.]Ov.4.#..T..$.J.c....mH...........X/|..[.C
pk.[s.m.'.25.<6P..."...S....!.....H3.Cpe,.z..-x{[email protected].@....
f.........E....J._T..qC.......&...z`D13.1...H......Ka.J..n.*....(..-y.
.b.j.l.8........H..W>.]3....#..D..>.n.......b.3 .t...g......M..5
l..........S...4..x....|C.?@&.......~...3%.Dm6...0.2}*u.X.o.Z.0.$..l..
......,P...K .... . ...,.o9/......q...N..hItdo ...'.....<....0.....
2...J..$6..y.O.LW..V...3h[..PH..%...B...,..|F{...........-..;.GT.$6..!
e.......lQ.....7.. zO..b3..c?X*0.....=...t...4.qB.Y0W..."'..Y.......# 
.G....L........*5.(^.`.].......I......J.x.D.A..=,L.Vsu..../j3...~..OP.
.&T. ...)K.Xl.W.,6U.....w...O. D..s.............A.N..C......Cp/.f.ox..
....j..V.d.>....EcW..r5...K....|.....*.A..*..F6....L.cr.]...i..<<< skipped >>>

GET /static/marketing/main/img/containers/green_left_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1219

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8570556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F87F856F556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................W.....................................
...................A...4t....................q2.............?..<...
..P.......[.........
<<< skipped >>>

GET /static/marketing/main/img/containers/green_pagenation_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1256

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=14878

Expires: Fri, 30 Jan 2015 10:34:36 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F87F8568556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F87F8567556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................h.....................................
.........................a...R.....f........................R.........
.......?.........x..TB..w2".&}...>.O....3$.P4.........
<<< skipped >>>

GET /static/marketing/main/img/preload.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 6712

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/gif;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
GIF89a0.#.............................................................
......................................................................
......................................................................
......................................................................
......................................................................
...............................................!..NETSCAPE2.0.....!...
..G.,....0.#.....4...................................<............&
gt;.......<. ........< ...... .....3........<..*........!....
*<.<.....<...<............._.1.0hA^.G T..."..H.(J\w..F..:B
.h..B..T.\.....!B.lI#DI.1....S.O.3f..!t^L.!~.X1....D..[.T)..O.J=W..R..
.v...k/.P........p......!.....G.,...... .....G....!<...<.3..!...
G.G...........: .G........;..........G..!G.....*...... G.........<.
.......<..............*....*...G*........!..s........8.p......0..b.
..z........B.[.2......L..e...h.|.r...3rV..B..G3n.......G~>..shQ.=.n
...(..Q....s..@.!.....G.,...... .....G....<..<.......G..........
..........*........;......G...:*..G....3. !.....<.......<.G.....
.... .G.<.........4.. G*....!*.*.....T..G..>....C.".B........#.3
...qD..#.C~..r....R..yD....U..........\[email protected]..<.
..O.R..x.5 A.......!.....G.,...... .....4...4.!.<...!....!<.....
...... .........!.4*.......<..<........ ....*.3.  !...>;.....
.... <..>..3...3...........3*. *.....*.*.......j..{....d...s.!.p
.-"...;Y.41...44x...$.."E.3yH.K.&i.p.aELA.Q.X..B..@o..:[email protected]<<< skipped >>>

GET /static/marketing/main/img/containers/green_bottom_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1229

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=18532

Expires: Fri, 30 Jan 2015 11:35:30 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:5C231C124755E111A
E99EBBBB0CD1E24" xmpMM:DocumentID="xmp.did:F89900DD556311E18B85DF7AB3A
24927" xmpMM:InstanceID="xmp.iid:F89900DC556311E18B85DF7AB3A24927" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5669219F5E55E111AE99EBBBB0CD1E24" stRef:docum
entID="xmp.did:5C231C124755E111AE99EBBBB0CD1E24"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
................................^.....................................
.......................R...U........................R..............?..
..L. ..Qu...-..oz\..3..HTTP/1.1 200 OK..Server: Apache..Content-Length
: 404..P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"..Cont
ent-Type: text/xml;charset=UTF-8..Cache-Control: max-age=86400..Expire
s: Sat, 31 Jan 2015 06:26:39 GMT..Date: Fri, 30 Jan 2015 06:26:39 <<< skipped >>>

GET /js?wp_id=2566322&&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 14365455

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1105
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2566322);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad4.adfarm1.adition.com/banner?sid=2566322&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac
=' (  ad_count) '&screen_res=' screen_res '&wpt=J&clickurl=http:/%
2Fc13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58415_a_gpr
=AA==_a_w3hr=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /scripts/au1107.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:47 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Content-MD5: OJUB vkxG3ve6mufLm5kfA==

Last-Modified: Tue, 30 Dec 2014 16:10:45 GMT

x-ms-request-id: d852ba98-0001-004e-5933-50d3cf000000

x-ms-version: 2009-09-19

x-ms-lease-status: unlocked

x-ms-blob-type: BlockBlob

Server: NetDNA-cache/2.2

Expires: Sat, 31 Jan 2015 06:28:47 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
16f.............RQk.0.~v......Fb...*..`...*.EJL...ii.L......a........|
wA..bx{.. v./..@.....&..TI...|.....6u.S.....X....]..9.....w ...I..`.z0
...z.rw...Q%.&R.;..(L..4.dQ...M.h..w....l..[...ID..uA..jJD.....?.K....
.....__.M....E./a).....P.RhA.q...w.3...K.E%..<.a2......m8.|R..K.:..
NkLO!.P...... .c.)*.D;....j.g..7....r}.U...l.Rr..9a......k.Y........sY
E.vN..gy{2...p{s_u.^Xz.....0......


GET /scripts/1/adnl.min.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn.castplatform.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Type: text/javascript

Transfer-Encoding: chunked

Connection: keep-alive

Content-MD5: EHHAdvEjgoimR0CMRq 8Dg==

Last-Modified: Wed, 28 Jan 2015 08:37:53 GMT

x-ms-request-id: ac42dd22-0001-006b-6923-519f25000000

x-ms-version: 2009-09-19

x-ms-lease-status: unlocked

x-ms-blob-type: BlockBlob

Server: NetDNA-cache/2.2

Expires: Sat, 31 Jan 2015 06:28:48 GMT

Cache-Control: max-age=86400

X-Cache: HIT

Content-Encoding: gzip
600a..............{[.H.>.......3.....[...(..x...W ..!.!.h.~.w..TR.T
..3..k..T...j..{...|..../.h.\.,}G=E7}.hX.G........S5...R..G.....'.i...
.VuY.?.~..x......|T....N..../_....'.!h.'... ..%.[.L.I./?>.........O
7L..tU].....%.......g........j..._......-T%.........Ox&.C....w.t..~...
............. ..b.&.....v#O.q..^..{......k0...OMI.(F.g~...*..[L..X....
..)..4..,.A...%..o....i......$R.<.#bu.....j..UwZ?.C...J........|Z..
..v.. i...`.L........MZr...!..`4.*..:R......>..~....._.|..|......3.
. .....W!...U..5...(.|T?}..h..`....LE...Q.).f..2.4...8.".......2r...4.
}....x..F&.&....p_..-...1V&&..W...H...O......c.w.Z)8..x*9...s5...M.(a 
..iN.6.,`..Y.... ......0o..B.5.f....Y.eR..N.l....{.....`.<..uV.....
........S ..f%.Q..7t.....T..U...AX/.D....v..(#c.|[O.......0....g..<
Na&..C....,I.8.S.h.....c...5E........>...i....<.....\]..-....B..
...g=.......l........B..D..p.u......Tku....>..*.A....e}.....)..`.&l
t;./)......)..7.g5...k...@ .}....bx:.T3...G.pGB...Gc... <..........
4t1~.n...f*..{.p".)....9..6..........'.(|.h...."....q./_./v.@R<.TXe
O......V...h.....}....1..L%............h|rF.=p~UC.98........_4.`zP...q
.,3Z.LnF..}.C^..tz...~.p[...V1...&p... [email protected]%.5......w.Yi...cI;A...3.
'..).7....!.l.3Q`..M.#7..v&...r...2~S.7...\.....N.......LX.{.NaD.J..U.
4...z.....".. N,J"..........NJ..-..*.r......... ..}0S....%l...)...b...
........... j...fvm.1..p|.B_..cg.,..;P...bmC^ZM.gN...l..*ll..y...R\...
.Iy.......q...A.u.0...b.P........y..0.y8.T.......~.W.....-.gFH.=.zp...
...n&..>:$..X....0v.....1X<..1X..Dy......~.g#.&..>glj<<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=1684536&cr=58588&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /banner?sid=2566327&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=1733047328&ac=3&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58416_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597668196446

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 5866
document.write('\x3Cdiv style="position:absolute;width:728px;height:0p
x">\x3Cdiv id="obaButton_6110017597668196446">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_728x90_grey {\n    width:728px;.\n    height:90px;\n}\n.paof
fer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa {\n.f
loat:left;\n.margin-bottom:2px;\n.margin-right:0px;\n.font-family:Taho
ma, Geneva, sans-serif !important;.\n.font-size:11px !important;.\n.te
xt-align: left !important;\n    line-height:14px !important;.\n}\n.pao
ffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa a,\n
.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa 
h2,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3
NRNa span {\n    cursor:pointer !important;\n}\n.paoffer-block_0kRa2RN
R3aG3NRNa_728x90_grey .paoffer_0kRa2RNR3aG3NRNa a {\n.display:block;\n
.float:left;.\n.background:transparent url(hXXp://imagesrv.adition.com
/banners/270/files/00/00/b7/16/000000046870.png) no-repeat top left;\n
.padding:1px;\n.text-decoration:none !important;\n.color:#000 !importa
nt;.\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RNR
3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffe
r_0kRa2RNR3aG3NRNa a:active,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_g
rey .paoffer_0kRa2RNR3aG3NRNa a:focus  {\n.background-position:left bo
ttom;\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .paoffer_0kRa2RN
R3aG3NRNa a:hover,\n.paoffer-block_0kRa2RNR3aG3NRNa_728x90_grey .p<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2560

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA2wAZAioelAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:03 GMT

Server: Apache

Set-Cookie: JSESSIONID=1466E7CFC25F3006C2ECBDF1A75E3A1F; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=-1&h5s=0&wi=1733047328&ac=1&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597665050718

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 5235
document.write('\x3Cdiv style="position:absolute;width:160px;height:0p
x">\x3Cdiv id="obaButton_6110017597665050718">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_160x600_grey {\n    width:160px;.\n    height:600px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a,\n.paoffer_0kRa2RNR3aG3NRNa 
h2,\n.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\
n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3
NRNa a {\n.display:block;\n.float:left;.\n.background:transparent url(
hXXp://imagesrv.adition.com/banners/270/files/00/00/b7/09/000000046857
.png) no-repeat top left;\n.padding:1px;\n.text-decoration:none !impor
tant;\n.color:#000 !important;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a:hover,
\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3aG3NRNa a:foc
us  {\n.background-position:left bottom;\n}\n \n.paoffer_0kRa2RNR3aG3N
RNa a:hover,\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3a
G3NRNa a:focus,\n.paoffer_0kRa2RNR3aG3NRNa a:hover span  {\n.text-deco
ration:underline;\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .pa
offer-inner_0kRa2RNR3aG3NRNa {\n.position:relative;.\n    display:bloc
k;\n.width:160px;\n.height:195px;\n.overflow:hidden;\n. \n.text-de<<< skipped >>>

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com


HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 29 Jan 2015 06:15:01 GMT

ETag: "2015b-6ca-50dc46885cd67"

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Connection: Keep-Alive

Date: Fri, 30 Jan 2015 06:30:27 GMT

Content-Length: 1738

0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U..
..CyberTrust1"0 ..U....Baltimore CyberTrust Root..141203203511Z..15042
8204011Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..13
0130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140
212185542Z0....'....141112202254Z0....'....100217174732Z0....'#...1003
03201301Z0....'!...100312202204Z0....''q..100414175202Z0....'L...11022
4181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303
201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..1012081
75749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..11081
5145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...1
20111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....10
0216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100
908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..1012
08175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...11120
7220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012
182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...1301231
62633Z0....'....130904190524Z0....'....131024214319Z0....'....14012917
2435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204
601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...1407091719
30Z0....'/:..141119193302Z0....'k...120111220827Z0....'8...14071619120
3Z0....'....131219195909Z0....'....140219171545Z..0.0...U........0...*
.H.............7.im~...|.....3........]..Cm...Y.[.......c.J[.....^

<<< skipped >>>

GET /s.gif?uid1=bb2907ac1b42e83598c555edb1d581a2&uid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d2tjil5tz17cbz.cloudfront.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

Date: Fri, 30 Jan 2015 06:28:59 GMT

x-amz-meta-cb-modifiedtime: Tue, 08 May 2012 12:38:45 GMT

Last-Modified: Mon, 19 May 2014 15:26:46 GMT

ETag: "45cf913e5d9d3c9b2058033056d3dd23"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: Miss from cloudfront

Via: 1.1 affe26bf02a36a4a45ea1eb3ce2b4a62.cloudfront.net (CloudFront)

X-Amz-Cf-Id: P9CmaPKC0uKwqfO0aQTKqxh7mdV-Ycx5ITndtuVi7VWNUEqv_xKiAw==

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Ty
pe: image/gif..Content-Length: 43..Connection: keep-alive..Date: Fri, 
30 Jan 2015 06:28:59 GMT..x-amz-meta-cb-modifiedtime: Tue, 08 May 2012
 12:38:45 GMT..Last-Modified: Mon, 19 May 2014 15:26:46 GMT..ETag: "45
cf913e5d9d3c9b2058033056d3dd23"..Accept-Ranges: bytes..Server: AmazonS
3..X-Cache: Miss from cloudfront..Via: 1.1 affe26bf02a36a4a45ea1eb3ce2
b4a62.cloudfront.net (CloudFront)..X-Amz-Cf-Id: P9CmaPKC0uKwqfO0aQTKqx
h7mdV-Ycx5ITndtuVi7VWNUEqv_xKiAw==..GIF89a.............!.......,......
.....D..;..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=513433

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:26:40 GMT

Etag: "54cb0a52-1d7"

Expires: Thu, 05 Feb 2015 18:26:40 GMT

Last-Modified: Fri, 30 Jan 2015 04:36:34 GMT

Server: ECS (ams/D1DC)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2015
0129200000Z0s0q0I0... ............([email protected]....>.i...G...&...
.cd ...._.M.[........?;....20150129200000Z....20150205200000Z0...*.H..
...........P.m.%E.......c.q..2g...m/ ..?./<B.....y..d..B....B.V-...
h32.....1...`j.{...........l.&.......N{.Ui ..$.....|...s.8.n.]@....F.7
.`;...!..dX...q......r..,.....I<.......o...J<.$......=..w.FW@u..
C-...6...e..A......N/H...p...eu....,k..K.&Z.Vq............5....HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=513433..Cont
ent-Type: application/ocsp-response..Date: Fri, 30 Jan 2015 06:26:40 G
MT..Etag: "54cb0a52-1d7"..Expires: Thu, 05 Feb 2015 18:26:40 GMT..Last
-Modified: Fri, 30 Jan 2015 04:36:34 GMT..Server: ECS (ams/D1DC)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
...>.i...G...&....cd ...20150129200000Z0s0q0I0... ............(..A.
[email protected]....>.i...G...&....cd ...._.M.[........?;....201501292000
00Z....20150205200000Z0...*.H.............P.m.%E.......c.q..2g...m/ ..
?./<B.....y..d..B....B.V-...h32.....1...`j.{...........l.&.......N{
.Ui ..$.....|...s.8.n.]@....F.7.`;...!..dX...q......r..,.....I<....
...o...J<[email protected]/H...p...eu....,
k..K.&Z.Vq............5........
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=515117

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:26:40 GMT

Etag: "54cb02dd-1d7"

Expires: Thu, 05 Feb 2015 18:26:40 GMT

Last-Modified: Fri, 30 Jan 2015 04:04:45 GMT

Server: ECS (ams/49CA)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......P.s..)...... ..y.H....2015013
0035000Z0s0q0I0... .........H...{....*.....04....P.s..)...... ..y.H...
..p.x.f..7.L.%o. ....20150130035000Z....20150206040500Z0...*.H........
..........W......q.Zg.l.."...q.]7.F.#.`.X...h..g2..:[email protected]......
...y.i...ocx... ..G|N`3.......-....n..[.......k.0....L.X>:.......3]
%H..=.p>..w.kBH.CUK.N....P2Y......z.h.v....D_"d..`...Q.....D.3-(.!j
=.l.~h ..-V...ug.A.p..G....L..}Fq*tzX:..."..s.....u...s.LHTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=515117..Content-Type:
 application/ocsp-response..Date: Fri, 30 Jan 2015 06:26:40 GMT..Etag:
 "54cb02dd-1d7"..Expires: Thu, 05 Feb 2015 18:26:40 GMT..Last-Modified
: Fri, 30 Jan 2015 04:04:45 GMT..Server: ECS (ams/49CA)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0......P.s..).
..... ..y.H....20150130035000Z0s0q0I0... .........H...{....*.....04...
.P.s..)...... ..y.H.....p.x.f..7.L.%o. ....20150130035000Z....20150206
040500Z0...*.H..................W......q.Zg.l.."...q.]7.F.#.`.X...h..g
2..:[email protected]... ..G|N`3.......-....n..[.......k.
0....L.X>:.......3]%H..=.p>..w.kBH.CUK.N....P2Y......z.h.v....D_
"d..`...Q.....D.3-(.!j=.l.~h ..-V...ug.A.p..G....L..}Fq*tzX:..."..s...
..u...s.L..<<< skipped >>>

GET /only.php?skrel=1&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ== HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=244535336147_142_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

refresh: 0.1;url=hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 20

Connection: close

Content-Type: text/html

......................

GET /real/tags/FreeRideGames/Germany_ROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:28:47 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 29940672511492546

Expires: Fri, 30 Jan 2015 07:28:47 GMT

Cache-Control: max-age=3600, private

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 13564

Connection: keep-alive
...........}.w.........@.{ .Vd9........m.l...;...Z.,.2.KR~4...a.......
...H...`0......b...8.O.j......09Z.M.........'....e.6.%.l6c.<I.Y.&..
..t..Y...xU..o..>...#....0.X..& ..../23>.CS...J4.eZ,....b..;..Hc
..o.ev...8...8.....w.~0.l~HK>.....(.N..i...)........a...7v.6..d.i..
....z.^.'......E....p.3....O.wvo....ae\.............8.y.c{.c.7..J9.*m.
U.8.)|.....XV.(...<...d..r.9.G'..|3.1.............8....(9..1T=^V...
[email protected];..G..|9H....I..$.uc.X..@....(*6....l2..>a.W..4?m.....P
[email protected]...:Z..I..1.....Iz.v1...?dO...9...Q
.Od.y....q]..f..W..x.q...|P.5..M....UQ:c..@q^[email protected]
R.....&.z.......T.;....r..... ....\.A.^[email protected].....
. ..?..D....%.h.....,[...Zk.:.O6.O.....M.P.p....C.c`........./..l.~...
 ..y.uZ..rB.6..Ev.7E5._.....L..q..L....Mq..RQ.L!.Y.,..KV....H..).*..K.
...........t7.7i..tu.`....'.....#=..?..8b@.@....?..u.W.-".$....q."...#
,....S9....<\>.....2..#kA...D..g.h.%1..G...[S..o ...w..C.4.>,
..8......&.&..3.SA........DS o.l......1..........~.,.G.....eI.....I?..
..!...w..U|^r.R..u..s(....f.%.=x8..W...F.'..b....P.l.5..PK#.1..O&.["N.
...I$.~.K. B.7.....J.1.g.#R.c:...........>........4../?...Vmj..F...
.n<a..|.)V..y.A...zT....lF.$!.z........^...S"....5.M....aU..<...
.6...M..}d.GCWy......f..9..%... ...).........6?..v.*......r...v7.. P..
d$ Y(..;\....vl|........."...J..,..M..Xr.....up..G..)...UI...k..H....t
......|U.i.:..,.Y...(N.....*..j...au...7...ph.(F.#.....CE"..D.1.R....*
...6[...........y.O...*.-.RI!......-/...*j.2......;...t7......sX..<<< skipped >>>

GET /j.ad?flashVer=0&ver=1.27&th=8608858615&tagKey=1444796509&loaderVer=0.1&site=freeridegames&adSpace=germany_ros&center=1&env=display&size=728x90&busted=1&url=http://partners.freeridegames.com/my_games?gameId=659050&f=1&p=19279864&a=3&adContainerId=richmedia_4&rnd=19282202 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive

Cookie: ANON_ID=alnpe3tZdPuvA7SpHoSaFZdDMVZd4lisQtFfl5fZbW1irZaRKEAAyCPGt


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 101

X-Reuse-Index: 2

Pragma: no-cache

Cache-Control: private, no-cache, no-store, proxy-revalidate

Set-Cookie: ANON_ID=aRnsAGPME7p7mKvCiHhindaorWAvtZd9Sf4nUZaGZbdV7ZctFZc5Rifw7NBHtBL2kWxcOZbsdJrSZdpx6tbpAlinjX1; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-2015 06:28:47 GMT;

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 226

Expires: 0

Connection: keep-alive

..........%.MO.@.....'.V...j..,F.m0...K..f...6.4.m..k.:...n.S...=..7..
.1xOVi..%...0..(......4..Br.r..y..7.XTQe.rQ.k.e....s.g...W..._..w..j..
{....`B.G"$....'D2..T......5...[[email protected]...$Y&
lt;N.hz.r..0...........

GET /p.media/awmPwn2FXxoWInYqPx2HbHQG7B2AnJmdiOVd760bM7YUQi0qqnSUnAUb3XTt3UobJnPUrt1TZbs5EFa4qj1mqFGYFfbUWM0nmfZcpGUqmHnJ3Erf2tmq5AnJprvEYcrTXsQYXGbnnEvT5U32VrnZbUAn5PqnXPVvMQd3w1drrWmry2sQ20UZbuhGKINZb/3002246/adTag.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive

Cookie: ANON_ID=axnsAGsKBRmrmDqU7pexF4ZdPQSfXCdbUjQqbX3eUcREEMm1HXUuG0ICGYKPjGi6QmqKiPUWt1QCF3XH5mAh1


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 102

X-Reuse-Index: 3

Pragma: no-cache

Cache-Control: private, no-cache, no-store, proxy-revalidate

Content-Type: text/html

Content-Encoding: none

Content-Length: 87

Expires: 0

Connection: keep-alive
<img src="hXXp://b.scorecardresearch.com/p?c1=8&c2=6035746&c3=3054&
c15=&cv=2.0&cj=1" />HTTP/1.1 200 OK..P3P: CP="NOI DEVo TAIa OUR BUS
"..X-Function: 102..X-Reuse-Index: 3..Pragma: no-cache..Cache-Control:
 private, no-cache, no-store, proxy-revalidate..Content-Type: text/htm
l..Content-Encoding: none..Content-Length: 87..Expires: 0..Connection:
 keep-alive..<img src="hXXp://b.scorecardresearch.com/p?c1=8&c2=603
5746&c3=3054&c15=&cv=2.0&cj=1" />....


GET /i.match?p=b3&u=QGc9Yy99999kB1+D HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://a.tribalfusion.com/p.media/avmPwnWHFXomUZdmVjnodfB3qni2tym3AZbFpFUZd0GMUYcZbY0VvMmaBS3bYWTFbZaUPv4PEbXSsFtQdFr1drnVA3M2GMYXbZbBUAir2PvcR6bK2Wrt1WBKndTM363Y4VnaUs38Uc78RAFuWd33UFMS5bIqWaMrVTMlQEJKSG3ZdQbesRHnbUVbaeua0Go/2713736/frame.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.tribalfusion.com

DNT: 1

Connection: Keep-Alive

Cookie: ANON_ID=aNnsAGyg6ANFA7u8QGkxJ7a6Za7H55ZabDB8Ory0hUR3BoF62mXwuT8FKVu80ytO72QijgZbkKFZdQxcKilin1pT


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

Date: Fri, 30 Jan 2015 06:28:48 GMT

X-Function: 302

Cache-Control: no-cache

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Pragma: no-cache

Cache-Control: private

Set-Cookie: ANON_ID=aKnuYpxNeT7neZdwQMlEurfZaoFwZbu9ZbKrFJ0UTZbNnNfZdZcTxQeZbSRMkmHWuZcPug0RZbFkFrPeOZbjokLI5ZaX6WFE7bvqFgmq7KjTJZcgFIEBv; path=/; domain=.tribalfusion.com; expires=Thu, 30-Apr-2015 06:28:48 GMT;

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..P3P: CP="N
OI DEVo TAIa OUR BUS"..Date: Fri, 30 Jan 2015 06:28:48 GMT..X-Function
: 302..Cache-Control: no-cache..Expires: Thu, 01 Jan 1970 00:00:00 GMT
..Pragma: no-cache..Cache-Control: private..Set-Cookie: ANON_ID=aKnuYp
xNeT7neZdwQMlEurfZaoFwZbu9ZbKrFJ0UTZbNnNfZdZcTxQeZbSRMkmHWuZcPug0RZbFk
FrPeOZbjokLI5ZaX6WFE7bvqFgmq7KjTJZcgFIEBv; path=/; domain=.tribalfusio
n.com; expires=Thu, 30-Apr-2015 06:28:48 GMT;..Content-Type: image/gif
..Content-Length: 43..Connection: keep-alive..GIF89a.............!....
...,[email protected]..;..

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2560

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-Default; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1

tAQAAAAAAADfew-AeQABAAYA2CAyAxkelAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:26:28 GMT

Server: Apache

Set-Cookie: JSESSIONID=AE18CC855A339AB1A038332F36FFFFF2; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /adsi-j.php?s=14076&w=728&h=90&t=_blank&gpts=6110017589092089913 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Set-Cookie: W3HUnique=2fd197815403_73_07_20150130; expires=Wed, 29-Jan-2020 06:28:49 GMT; path=/; domain=.w3hoster.de

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1055

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[W.H.~..`y..0'....l.d....F..:....t..4..$......H.8.I.......
..O..r.....aw.'X:h4."....(v..Zk.q....t_..:...H.w...i.Q.]..s.DIJx.#z..e
?.....NBlt]<...5...n.c0s9.us....\HA...u.......t2FSz.......mt~... ?a
_...'...!?.{.wt.7...8.....k..j<<......4.X....#.m."...Y.;..,.^...
..~......0...2.d..l....@ /#sW>.).....I.......#.....5...9.`..y..h..Z
...5....h^..u...=..e..........................?7_..:.].....?.s...<I
..|.|..&..;..=M..=........s{...8KU.G-.I$q..4J..%... ....p.C%.... pN...
..T.V.. .l/*b..a]..w...F...=.i.]..k...D.WB.#..$....{.Z...*..K.*.H..x.[
......7....2@.`.6.V.".. ....M.........7V;..*.0!...jLj`.r...z...d.J..S.
0.....;:..E.h.E.h..JT......R....oi.)mH.....I.q..._;t.K...F.#..7..p.Z.?
6...{....K.p..../..........8t\.....N..u..\...H...7.$.i..uY....?......2
.?.........]...&^Ei.Be......;.N|.Ga.h.D.o.(6 .B...v:....0..t....aBX?..
......._5..........,._^......I..dh.u..r.*..B..../.po....../....:*.R.*.
..1P...?fIQ.zH......j.......XJ.eH..Q....."Fl.\t..;....S..' .......US.I
{.ETS.o........<..C.......=........'.c.....=>.]..lp-...|.....
.~.Z<W.Pt.jo$.......e.k.....<<< skipped >>>

GET /js?wp_id=3086960&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

If-None-Match: 14365445

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 14365456

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1105
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(3086960);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad4.adfarm1.adition.com/banner?sid=3086960&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac
=' (  ad_count) '&screen_res=' screen_res '&wpt=J&clickurl=http:/%
2Fc13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58636_a_gpr
=AA==_a_w3hr=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.yahoo.com

DNT: 1

Connection: Keep-Alive

Cookie: B=52qa5ah9dvsod&b=3&s=ur; RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; ih="b!!!!#!C'Wg!!!!#>[b?c"


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:49 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Sun, 29-Jan-2017 06:28:49 GMT

Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com

Location: hXXp://ib.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC

Cache-Control: private

Content-Length: 0

Content-Type: text/plain; charset=utf-8

Age: 0

Connection: keep-alive

Server: ATS
HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:49 GMT..P3P: policyre
f="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI
 PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY
 ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"..Set-Coo
kie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; expires=Sun, 29-Jan-201
7 06:28:49 GMT..Set-Cookie: RMBX=52qa5ah9dvsod&b=3&s=ur&t=33; path=/; 
expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com..Location: ht
tp://ib.adnxs.com/ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC..Cache-Control:
 private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..
Age: 0..Connection: keep-alive..Server: ATS..

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=6587465&cr=58620&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /js/adition.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Tue, 09 Dec 2014 09:34:51 GMT

If-None-Match: "1035523256"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: application/javascript

Accept-Ranges: bytes

ETag: "1035523256"

Last-Modified: Tue, 09 Dec 2014 09:34:51 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

....

GET /js/acb/uid.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: imagesrv.adition.com

If-Modified-Since: Mon, 30 Apr 2012 09:53:27 GMT

If-None-Match: "626933837"

DNT: 1

Connection: Keep-Alive


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Content-Type: text/html

Accept-Ranges: bytes

ETag: "626933837"

Last-Modified: Mon, 30 Apr 2012 09:53:27 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

HTTP/1.1 304 Not Modified..Access-Control-Allow-Origin: *..Content-Typ
e: text/html..Accept-Ranges: bytes..ETag: "626933837"..Last-Modified: 
Mon, 30 Apr 2012 09:53:27 GMT..Date: Fri, 30 Jan 2015 06:28:50 GMT..

GET /cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t.mookie1.com

DNT: 1

Connection: Keep-Alive

Cookie: id=3025970665045060; mdata=1|3025970665045060|1422599330; OAX=IAz1ClTLJKIAATbP


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: Apache/2.2.3 (Red Hat)

Content-Length: 35

Connection: close

Content-Type: image/gif

GIF87a.............,...........D..;..

GET /d/104/s/adex.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

Vary: Accept-Encoding

Content-Encoding: gzip

Last-Modified: Tue, 27 Jan 2015 15:28:07 GMT

ETag: "585060915"

Content-Type: text/javascript

Expires: Fri, 30 Jan 2015 07:28:51 GMT

Cache-Control: max-age=3600

Accept-Ranges: bytes

Content-Length: 6792

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws32.int03.theadex.com
.......T...<m{.8r.._a..HD.^......N6...$.....IZ.").1E.H..WV.{.. A.vr
..s.`.3..`0...`......d~..._>.:.....^n..;.....c/....[c...Y..@...~0..
.M.|.........3.. ..$.]'y.dA.. w.........l..P5..y..@~n.f;...*r=h..v!...
u...Y..;.&...T...P.xa...c<^.m...?...]......r.':yrI.V.T.N.....K..m.c
@.`I..p..;g.b;.C;..g.....:9...-.....N....=....X..u....\$5(.N....F.....
.av....j....f.R.@j......... -.a.!.C..K..b.TQdp.Y.D........q..).p.0.CW0
....j;!.A.........;.4...A1-.w....-...\.......b.... ^...y.Z1XU.C6..N_.G
.....A;.....Y.....v41. .....F....I.[.-..m`)[email protected]....)&ZN.Z
a 3..cRW..GP.2,7..0..X....B...........EC......2..]..*....0..hR...}...N
.U...l]......;...v'5........4....N[ ?.yP1....%.m.q4OW_..u.un.h.|.[B.S}
...^.....?..Z ....[..S.....7.P.`.6.j.?&.4#.........q....>..b...wC.r
.F....>.-...QMU#0.....]:it...m..6X.6M.......k.S0q...xl.7...x...7..P
8........S...K........K..j.>...c.....7T9..i.*.P..s.;.#.~...b.B;[c&l
t;3p.......r(.ub1....s,.TL..v..........V.]j.6.;.m$%.6.?...T(-F' }.....
...x....&m.80x..Z*.!YC .H9./.T^..V....u=<(.\...X".N...8.;x.. .Q..!.
.EGb...0 X..ELMVn..r..y).LT.E......q.@....*2<o...'.8k..R....I.D..t.
.U.......S.........d........o...o..{....TN.....4.!.(..>..S....u...N
O.>.g.wou.-ZRC.3I....;...V.j.Q.K....f*......N.?.G0!*j.......]..b[..
...?.."*.|j..{V.4.K...-...8........>_.<m..........).....W...1.N.
..Y.G....r.0..(0]{9L}=".T.R....`....H^l..C....#?FG.>8.~v?.B./.R....
$...C.....Z....ZL@..}..c\.w...F.Y..........i....|`........<.]X.....
...s...:}.v..4..d.(.....N..S$..qG,!.$....l.t..a.).../.._....Y.....<<< skipped >>>

GET /d/7727/d/t.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510003; expires=Mon, 27-Jan-2025 06:28:51 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:51 GMT

Cache-Control: private

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Vary: User-Agent

Content-type: application/javascript

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws31.int03.theadex.com

28..window.adex.trace = 100315090728510003;...0......

GET /d/104/s/adex.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

If-Modified-Since: Tue, 27 Jan 2015 15:28:07 GMT

If-None-Match: "585060915"

DNT: 1

Connection: Keep-Alive

Cookie: axd=100315090728510003


HTTP/1.1 304 Not Modified

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

Vary: Accept-Encoding

Content-Type: text/javascript

Last-Modified: Tue, 27 Jan 2015 15:28:07 GMT

ETag: "585060915"

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws32.int03.theadex.com

....

GET /r/104/6/?c=100315090728510000 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive

Cookie: axd=100315090728510003


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

P3P: CP="CAO PSA OUR"

Set-Cookie: tis=EP14_1:523; expires=Mon, 17-Apr-2023 22:00:00 GMT; path=/; domain=.theadex.com

Set-Cookie: tis=EP14_1:523|EP13A:523; expires=Mon, 17-Apr-2023 22:00:00 GMT; path=/; domain=.theadex.com

Content-type: text/html

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: ws31.int03.theadex.com
53f..    <html>.        <body>.            <img width='
1' height='1' src='hXXp://c1.adform.net/serving/cookie/match/?party=10
10&adx_id=104' />.<img width='1' height='1' src='hXXp://dsp.adfa
rm1.adition.com/cookie.php?url=http://dsp.active-agent.com/coo
kie/?dmp=1&userid=%COOKIE%&xxx=104&c=10031509072
8510000' />.<img width='1' height='1' src='hXXp://dsp.adfarm1.ad
ition.com/cookie.php?url=http://dsp.active-agent.com/cookie/
?ssp=3&userid=%COOKIE%' />.<img width='1' height='1'
 src='hXXp://ib.adnxs.com/getuid?http://dmp.theadex.com/d/10
4/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=$U
ID' />.<img width='1' height='1' src='hXXp://i.w55c.net/ping_mat
ch.gif?st=ADEX&rurl=http://dmp.theadex.com/d/104/i/2.gif
?c=100315090728510000&axd_pid=6&axd_fuid=_wfivefivec_' /&g
t;.<img width='1' height='1' src='hXXp://cm.g.doubleclick.net/pixel
?google_nid=theadex_dmp&google_cm&axd_cuid=104&c=100315090728510000' /
>.<img width='1' height='1' src='hXXp://d.turn.com/r/dd/id/L2Nza
WQvMS9jaWQvMjg0NjAyMTcvdC8w/url/hXXp://dmp.theadex.com/d/104/i/2.gif?c
=100315090728510000&axd_pid=13&axd_fuid=$!{TURN_UUID}' />.<img w
idth='1' height='1' src='hXXp://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg
0NDg2MjYvdC8y/dpuid/100315090728510000' />.        </body>.  
  </html>.    ..0......
<<< skipped >>>

GET /d/104/i/2.gif?c=100315090728510000&axd_pid=1&axd_fuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: axd=100315090728510003; tis=EP14_1:523|EP13A:523

DNT: 1

Connection: Keep-Alive

Host: dmp.theadex.com


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510000; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

Set-Cookie: tis=EP14_1:523|EP13A:523|EP1:523; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Content-type: image/gif

Content-Transfer-Encoding: binary

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws32.int03.theadex.com

GIF89a.............!.......,...........L..;....

GET /d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=3614204343869728150 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive

Cookie: axd=100315090728510000; tis=EP14_1:523|EP13A:523|EP8:523


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510000; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

Set-Cookie: tis=EP14_1:523|EP13A:523|EP8:523|EP13:523; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Content-type: image/gif

Content-Transfer-Encoding: binary

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws32.int03.theadex.com

GIF89a.............!.......,...........L..;....

GET /d/104/i/2.gif?axd_pid=2&axd_fuid=5393689920369647502 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: axd=100315090728510000; tis=EP14_1:523|EP13A:523|EP8:523|EP13:523

DNT: 1

Connection: Keep-Alive

Host: dmp.theadex.com


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510000; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

Set-Cookie: tis=EP14_1:523|EP13A:523|EP8:523|EP13:523|EP2:523; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Content-type: image/gif

Content-Transfer-Encoding: binary

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws32.int03.theadex.com

GIF89a.............!.......,...........L..;....

GET /d/104/i/2.gif?c=100315090728510000&axd_pid=14&axd_fuid=6110017589072035866 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: axd=100315090728510000; tis=EP14_1:523|EP13A:523|EP8:523|EP13:523|EP2:523

DNT: 1

Connection: Keep-Alive

Host: dmp.theadex.com


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510000; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

Set-Cookie: tis=EP14_1:523|EP13A:523|EP8:523|EP13:523|EP2:523|EP14:523; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Content-type: image/gif

Content-Transfer-Encoding: binary

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws31.int03.theadex.com
GIF89a.............!.......,...........L..;....


GET /d/104/6/i/1.gif?c=100315090728510000&t=1&location=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&protocol=http://&inframe=1&csource=1&tzo=-120 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive

Cookie: axd=100315090728510000; tis=EP14_1:523|EP13A:523|EP8:523|EP13:523|EP2:523|EP14:523


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510000; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Content-type: image/gif

Content-Transfer-Encoding: binary

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws32.int03.theadex.com

GIF89a.............!.......,...........L..;....

GET /d/104/i/2.gif?c=100315090728510000&axd_pid=6&axd_fuid=7052af40-cf8f-45f7-952e-25f4ab050d93 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dmp.theadex.com

DNT: 1

Connection: Keep-Alive

Cookie: axd=100315090728510000; tis=EP14_1:523|EP13A:523|EP8:523|EP13:523|EP2:523|EP14:523


HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

X-Powered-By: PHP/5.4.4-14 deb7u12

Set-Cookie: axd=100315090728510000; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

Set-Cookie: tis=EP14_1:523|EP13A:523|EP8:523|EP13:523|EP2:523|EP14:523|EP6:523; expires=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com

P3P: CP="CAO PSA OUR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

Cache-Control: no-store, no-cache, must-revalidate

Cache-Control: post-check=0, pre-check=0

Pragma: no-cache

Content-type: image/gif

Content-Transfer-Encoding: binary

Content-Length: 43

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: ws31.int03.theadex.com
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Access-Con
trol-Allow-Origin: *..Access-Control-Allow-Credentials: true..X-Powere
d-By: PHP/5.4.4-14 deb7u12..Set-Cookie: axd=100315090728510000; expire
s=Mon, 27-Jan-2025 06:28:52 GMT; path=/; domain=.theadex.com..Set-Cook
ie: tis=EP14_1:523|EP13A:523|EP8:523|EP13:523|EP2:52
3|EP14:523|EP6:523; expires=Mon, 27-Jan-2025 06:28:52 GMT; pat
h=/; domain=.theadex.com..P3P: CP="CAO PSA OUR"..Expires: Mon, 26 Jul 
1997 05:00:00 GMT..Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT..Cache
-Control: no-store, no-cache, must-revalidate..Cache-Control: post-che
ck=0, pre-check=0..Pragma: no-cache..Content-type: image/gif..Content-
Transfer-Encoding: binary..Content-Length: 43..Date: Fri, 30 Jan 2015 
06:28:52 GMT..Server: ws31.int03.theadex.com..GIF89a.............!....
...,...........L..;..<<< skipped >>>

GET /js?wp_id=2566332&&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:49  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 14365446

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1105
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2566332);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad4.adfarm1.adition.com/banner?sid=2566332&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac
=' (  ad_count) '&screen_res=' screen_res '&wpt=J&clickurl=http:/%
2Fc13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr
=AA==_a_w3hr=73_a_w3hurl=\'></script>');..<<< skipped >>>

GET /js?wp_id=2554279&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589071970330


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 24377612

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589071970330; expires=Wed, 29-Jul-2015 07:28:47 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1286
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907197
0330');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2554279);}c
atch(e){prfstr=''}document.write('<iframe allowtransparency=\'true\
' scrolling=\'no\' frameborder=0 border=0 width=728 height=90 marginwi
dth=0 marginheight=0 name=\'Adition_Frame\' background-color=\'transpa
rent\' src=\'hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver
=' adjsver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' re
f '&os=' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_w
id '&ac=' (  ad_count) '&screen_res=' screen_res '&wpt=H&clickurl=http
://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid
=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0
/clickurl=\'></iframe>');..<<< skipped >>>

GET /c.gif?anx_uid=3338670318734125865&Red3=MSAN_pd HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c.bing.com

DNT: 1

Connection: Keep-Alive

Cookie: SRCHD=MS=3187714&SM=1&D=3093912&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MUID=1785AC2FD94664211AC0A9A6DD466620


HTTP/1.1 302 Redirect

Cache-Control: private, no-cache, proxy-revalidate, no-store

Pragma: no-cache

Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Fri, 30-Jan-2015 10:28:49 GMT; path=/;

Set-Cookie: MUID=1785AC2FD94664211AC0A9A6DD466620; domain=.bing.com; expires=Sun, 29-Jan-2017 06:28:49 GMT; path=/;

Set-Cookie: MR=0; domain=c.bing.com; expires=Wed, 29-Jul-2015 06:28:49 GMT; path=/;

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 0
HTTP/1.1 302 Redirect..Cache-Control: private, no-cache, proxy-revalid
ate, no-store..Pragma: no-cache..Location: hXXp://ib.adnxs.com/pxj?bid
der=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620
|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")..Server: 
Microsoft-IIS/8.0..X-Powered-By: ASP.NET..P3P: CP="BUS CUR CONo FIN IV
Do ONL OUR PHY SAMo TELo"..Set-Cookie: ANONCHK=1; domain=c.bing.com; e
xpires=Fri, 30-Jan-2015 10:28:49 GMT; path=/;..Set-Cookie: MUID=1785AC
2FD94664211AC0A9A6DD466620; domain=.bing.com; expires=Sun, 29-Jan-2017
 06:28:49 GMT; path=/;..Set-Cookie: MR=0; domain=c.bing.com; expires=W
ed, 29-Jul-2015 06:28:49 GMT; path=/;..Date: Fri, 30 Jan 2015 06:28:48
 GMT..Content-Length: 0..

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCC0gVOkA+hgL HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 02:19:38 GMT

Expires: Sat, 31 Jan 2015 02:19:38 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 274149

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
6190341Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.- T.........20150126190341Z....20150202190341Z0...*.H.............3.i
.`...(..m.."[email protected]=.3^..Q...9!.....^.,..)......7S..d...Y..'.
..w. ..G.s]/7{2%[email protected]..<.y.}.FV..tA..`I..:......... 
'..........H1,...}K:QG...K d7..q.....!....j......I.Kg...[..(....(u.v..
c......^....o9LD.?I.G..|.....Y).....1..y..].C]HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 02:19:38 GMT.
.Expires: Sat, 31 Jan 2015 02:19:38 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 274149..Alternate-Protocol: 80:quic,p=0.02..Cache-Control
: public, max-age=345600..0..........0..... .....0......0...0......J..
....h.v....b..Z./..20150126190341Z0k0i0A0... ..........j.....p.I.#z...
(~d..J......h.v....b..Z./..- T.........20150126190341Z....201502021903
41Z0...*.H.............3.i.`...(..m.."[email protected]=.3^..Q...9!....
.^.,..)......7S..d...Y..'...w. ..G.s]/7{2%[email protected]..<.y
.}.FV..tA..`I..:......... '..........H1,...}K:QG...K d7..q.....!....j.
.....I.Kg...[..(....(u.v..c......^....o9LD.?I.G..|.....Y).....1..y..].
C]....
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCG1HMsB+XmUO HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 19:15:05 GMT

Expires: Sat, 31 Jan 2015 19:15:05 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 213222

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7130707Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.mG2.~^e.....20150127130707Z....20150203130707Z0...*.H.............$.B
D*Sc.......X..)...c.0....... V/....|.jHZ.w.......g.MP.ka....d.......OJ
.>`V0...m...a7../...*.....z..p..f..~n.x...6^..#./2..p...6.N...ug..5
..(..V~,4..PG..=..}Dl.......d..?..~.....g...$...m...b......Cy".._...g.
rZ..1..:..h....xb-1.H...%.U...1..~z..m..D.....HTTP/1.1 200 OK..Content
-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 19:15:05 GMT.
.Expires: Sat, 31 Jan 2015 19:15:05 GMT..Server: ocsp_responder..Conte
nt-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options: SAME
ORIGIN..Age: 213222..Alternate-Protocol: 80:quic,p=0.02..Cache-Control
: public, max-age=345600..0..........0..... .....0......0...0......J..
....h.v....b..Z./..20150127130707Z0k0i0A0... ..........j.....p.I.#z...
(~d..J......h.v....b..Z./..mG2.~^e.....20150127130707Z....201502031307
07Z0...*.H.............$.BD*Sc.......X..)...c.0....... V/....|.jHZ.w..
.....g.MP.ka....d.......OJ.>`V0...m...a7../...*.....z..p..f..~n.x..
.6^..#./2..p...6.N...ug..5..(..V~,4..PG..=..}Dl.......d..?..~.....g...
$...m...b......Cy".._...g.rZ..1..:..h....xb-1.H...%.U...1..~z..m..D...
......
<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCCUoyoQiZhRO HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 02:23:49 GMT

Expires: Sat, 31 Jan 2015 02:23:49 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 273904

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
6190508Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
.%(.."f.N....20150126190508Z....20150202190508Z0...*.H.............-&l
t;.cF}.....E..0.&s.......'..C....<.\...W.9PR..#.Y..(..;..Q....q..4.
..B......N..k|.(.qPYe..m........... ..$...A......0...9.r....pYLhv?....
.i}9. .qy..^6.h%.H..n. ..e.B........W..>.5...tl[6.Vn)....a...ORU}..
....IS.F.@y&..G.o.-r.~.^...F...I...HE(pVU....b..#)..HTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 02:23:4
9 GMT..Expires: Sat, 31 Jan 2015 02:23:49 GMT..Server: ocsp_responder.
.Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options
: SAMEORIGIN..Age: 273904..Alternate-Protocol: 80:quic,p=0.02..Cache-C
ontrol: public, max-age=345600..0..........0..... .....0......0...0...
...J......h.v....b..Z./..20150126190508Z0k0i0A0... ..........j.....p.I
.#z...(~d..J......h.v....b..Z./..%(.."f.N....20150126190508Z....201502
02190508Z0...*.H.............-<.cF}.....E..0.&s.......'..C....<.
\...W.9PR..#.Y..(..;..Q....q..4...B......N..k|.(.qPYe..m........... ..
$...A......0...9.r....pYLhv?.....i}9. .qy..^6.h%.H..n. ..e.B........W.
.>.5...tl[6.Vn)....a...ORU}......IS.F.@y&..G.o.-r.~.^...F...I...HE(
pVU....b..#)....<<< skipped >>>

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=812f69926030 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1013

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........V[w.F.~...<.8..q.l..rR...&.k7u/..... # ."......".V.....o
g...vX{L*...a.Lw$.a.....e........k.6..].1....&#H....Ko.....3......a...
...'.O9M....1......V.....`........&..=?........ .;...l6?...dZ.yt....VL
.}.b....=).(.9a.....O.({..62..3...0........ta.P.a.....:.kI8...2?......
.sttd}N....."..|....9S.... /....5.......5gPX...'.?|......?~........>
;.~....y.b..aD...*I./,...|..75-..........H...pM...}.d.......H...tJ..%-
x...v.G.|..V .;[email protected]'[email protected]
..j..K.&..K.&=Jj...Nk...-......;`.......k.|n.4.T._x.....Lc.;5w.'..9..G
..H..W...moUY..4.....&.......ik.%..Q..`..M..1...TF4&.[:.J..$...2...tD.
...T.f.8..h..PN.`...._F.... ...#.a...u..>.....d...jTw..qk......=..,
'..y.S...,h..yIA.{..V...Q.uGO..{bW.;..XQz'.64......J'./q...a..{<...
..k&O.Q..I....>...EJH2....d<r......X48(.^.()...q.N...8iB|..`.A.\
o....r0 z]E}C}.A'7.J.t.....#...j....e\..I^....0....m..d..U9...ob..>
..y..I...F.].;.........^. T..#E....q...#. [email protected]`
....tEt.X..Bta...Z...";$.-.........(.Vs..l...?8.........

GET /adsi-j.php?s=14046&w=1&h=3&t=_blank&noct=1&gpts=7ac4d4470755 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ads.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1117

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........W[w.6.~.W.<`|...;...=.....4M.M/....l... ..t..../..I...0.
|.f..Y2K.) ..._...P.0......C.).j5..q.&&jGM0.1W.CL.L....s{i..3UI..y....
......-..C9...Pn1.h....t...:.Q..o:...).n.`;&.wm.......[...AF.x8..Z8...
e2Y..".7. [email protected]..........!l/....b.\...C##.R.....I.....;.
.F.z.e.....[.:P.Z.e.....p......)s..~..2.....-s.(..b.< _q.@.;...c.b.
._~...2...3 ..u....o.s..8..#s46?..SJ.O.:p..xt.?2{...aWv.D.. &....#....
..|....w..?;....~........>.~......b...O.w."..O,..ru.._.?0....x..Q.r
...1Eh..6..0N..|.M.D.l..rZE*[email protected]...!`.J.(...R0{..e..b..9t
.o...!.y.v:.U.|.b......,.t...iA.n...bh.d.........7K.c.?.|.([0.X`...r..
.k.|hX.U.4../J.-oLA^.....B..(...ZR.7;W.....T.E.1......................
..B.......|...[.T..H.q_...)..B...u.<..A.m...A....P.,?..9.N.$.]F\..a
....:........I[.N..>[email protected]..*.R0.....)...a.....M...
N..V......z.m..F.._..P.....o..M...;.....r>...].{. 8H.............J.
....M..Da......f...IC.4a.H.T.z....,.T.u...u..;..a%.....P.......|.\..w.
&Y..... ......b...:...?..5.......QH..tB.^.......D....'`d.'FjG........b
;...'/[email protected]./.V......V. .Q..=..]X..B..._.:..[.~4..h..%.b.j.
.f.....N.........<<< skipped >>>

GET /cookie/?ssp=2&userid=6110017589072035866 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: sync.active-agent.com


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:55 GMT

Set-Cookie: userid=6110017589072035866;Path=/;Domain=.active-agent.com;Expires=Wed, 29-Jul-2015 06:28:55 GMT

Set-Cookie: googleUserId=6110017589072035866;Path=/;Domain=.active-agent.com;Expires=Fri, 13-Feb-2015 06:28:55 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=agent&google_hm=NjExMDAxNzU4OTA3MjAzNTg2Ng==&type=response

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /banner/twiago/815/2014-12-23/0_z010_300x169.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn5.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; accado_ex=


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"1576254021"

Last-Modified: Tue, 23 Dec 2014 10:59:15 GMT

Expires: Mon, 09 Feb 2015 06:28:53 GMT

Cache-Control: max-age=864000

Strict-Transport-Security: max-age=31536000; includeSubdomains

X-Frame-Options: DENY

Content-Encoding: gzip
7baf.............zeP.O.... .......w]..Y`.... 8,.,.Xp.....w'!.........3
..LUOw.t..L...W....U.W..   .. ..;...O.v.... .....w. .@[email protected] . ..Tdd$.
4T4..>t.,.ttLt44LlLL.7............B.c..._}.......?..............x.H
x....T.....o....H(.h.......t....$D....EFEAG..  "!...P..i....Iia.XB.yB.
..`D|  .:L.^.^~.!O...kbFAh?.....OhXaCc..?.......z....%..b..d...."#.#..
kP...l.....O.-.........C#........&.....?.J$.YX...5.w........... ...c.n
..POo..<..F.|. .,.]........R...O.k]pX?Hn.....|.i.D.8...V>k..*b/.
....Rf...!....dxQ/....i...?40-h..{4..}..V..P~...........;U...:...D.nw?
....'..K.W..&..#.;....w*w ...:#..J..]A.d`.I...Enb.8R.i.J.*....PF3.....
6c.....D..:|. .Gj......},...w.N..@.....[.Z[X......?.pw..."JM,6.xl..$..
d... .L..0.72.[....ap(...N?.........J.Q.5.E(N.......b.......Tc...Ja .O
.....%[email protected].....=..........W...S....|..s..k...-W...-.~...,.....
`.....P.W3MQh...=.....Ks...K.L......o....w.g.!.......c....%....:.n&...
...-..^.1u.1_h......I.._..2..B ..c...L..Z-ep].E3.s...L.......z..P.)g8.
.r..........RA..d.:..lF..D.D............D...BR.....^`.8.=OU*....7#c...
.q..I.....8@v<...f.\&..D.f.\..e....H;.T.v. ..d.......":..B.7.I.,.jB
.G.Y.9X.........S-....YE;..a....(..JK.d:.H5.R....=:7..m.fM...Un....KC.
.iz?&|soJ.A.....P.....-{Q......;S...e...._k.[...>.}K?......N._...-.
M2...... ..t..-....T9O.Ns..C=..........-..|~..{... _.TdPx`W]...2.....&
.q..(.|._...P.w~*?.Y.,...!..O.&.x..U.7M...\[email protected]...;
h~c.w....?OLDJ..]J...*.8..j.....M...(E6.A... !.=.b..B......&}....p.!u.
"...`....ze..h.R.......j.3..`....`..H1?...A.M.C......;..N.".Lx.:O.<<< skipped >>>

GET /banner?sid=65567&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&kid=1221974&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:50  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017597666427860

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc1=103d4; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 1509
document.write('\x3Cdiv style="position:absolute;width:160px;height:0p
x">\x3Cdiv id="obaButton_6110017597666427860">\x3C/div>\x3C/d
iv>\x3Cscript language="JavaScript">\nsb_redirect_click = "http:
//c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_
a_w3hurl=http://adfarm1.adition.com/redi*lid=611001759766642
7860/sid=65567/kid=1221974/bid=3994675/c=3001/keywor
d=/sr=0/clickurl="; // 3rd-party clicktracking\nsb_subid = "
"; // your own tracking-sub-id, max. 64 chars: a-z, A-Z, 0-9 and:  -_.
,:;/|\nsb_url_base = "hXXp://ad.ad-srv.net/zone/kw470o566d2z";\nsb_url
 = sb_url_base;\nsb_url = sb_url   "?subid="   encodeURIComponent(sb_s
ubid);\nsb_url = sb_url   "&redirectClick="   encodeURIComponent(sb_re
direct_click);\ndocument.write(\'\x3Cscr\' \'ipt src="\' sb_url \'">
;\x3C/scr\' \'ipt>\'); \n\x3C/script>\x3Cscript type="text/javas
cript">\n(function() {\n  var domId = \'obaButton_61100175976664278
60\',oba=\'\',btr = \'false\',position= \'top-right\'||\'top-right\';\
n  if (oba != \'\' || btr == \'true\') {\n    var oba_script = documen
t.createElement(\'script\');\n    oba_script.setAttribute(\'type\',\'t
ext/javascript\');\n    oba_script.setAttribute(\'charset\',\'utf-8\')
;\n          oba_script.setAttribute(\'src\', \'hXXp://imagesrv.aditio
n.com/js/adplayer/oba_priv.sjs?oba=\' oba \'&domId=\' domId \'&btr=\' 
btr \'&pos=\' position);\n    \n    document.getElementsByTagName(\'he
ad\')[0].appendChild(oba_script);\n\n  }\n  })();\n\x3C/script><<< skipped >>>

GET /adscript.php?&ref=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==&vis=2&pid=789&ord=6110017601960017977&rdclick=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58620_a_gpr=AA==_a_w3hr=73_a_w3hurl=http://ad2.adfarm1.adition.com/redi*lid=6110017601960017977/sid=2990114/kid=1210582/bid=3952316/c=24754/keyword=/sr=0/clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814b55; deuxesse_ex=; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:34 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:34 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.20

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:34 GMT; domain=a.twiago.com; path=/

x-oread: 1422599315.0043

Set-Cookie: deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; expires=Sat, 30-Jan-2016 06:28:34 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:34 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; expires=Sat, 30-Jan-2016 06:28:34 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:34 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; expires=Sat, 30-Jan-2016 06:28:34 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:34 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; expires=Sat, 30-Jan-2016 06:28:35 GMT; domain=a.twiago.com; path=/

Set-Cookie: deuxesse_tgt=000000000; expires=Sun, 01-Mar-2015 06:28:35 GMT; domain=a.twiago.com; path=/

Connection: close

Transfer-Encoding: chunked

Content-Type: text/javascript; charset=iso-8859-1
3286.. if(typeof(document.asm_excl) == "undefined"){ document.asm_excl
 = new Array(); } document.asm_excl = document.asm_excl.concat(String(
"586|579|580|585|582|583|446|447|449|450|451|452|453|454|564|566|567|5
68|569|570|571|584|462|581|623|624|680|681|679|671|625|730").split("|"
)); .. var asm_ex = false;. var asm_ex_all = false;. for(var asm_i=0; 
asm_i<document.asm_excl.length; asm_i  ) { if(document.asm_excl[asm
_i] == "4"){asm_ex = true; break;}}. for(var asm_i=0; asm_i<documen
t.asm_excl.length; asm_i  ) { if(document.asm_excl[asm_i] == "w210" ||
 document.asm_excl[asm_i] == "p789"){asm_ex_all = true; break;}}. if(a
sm_ex_all){}. else if(!asm_ex ). {.   var adspirit_pid = "789"; docume
nt.write('<div class="asmbeacon asmmain" style="position:absolute; 
left:0px; top:0px;"><img border="0" style="border:0px white soli
d !important;" width="1" height="1" alt="" src="hXXp://a.twiago.com/ad
view.php?tz=1422599315949108&pid=789&kid=4&wmid=3826&sid=4&nvc=1&targe
t1=-" /></div><style>\r\n#twiago_bx.tw_sky_160x600 { fo
nt-family: Arial; }\r\n#twiago_bx.tw_sky_160x600 * { margin: 0; paddin
g: 0; -moz-hyphens: auto; -webkit-hyphens: auto; hyphens: auto; word-w
rap: break-word; font-family: Arial!important; }\r\n#twiago_bx.tw_sky_
160x600 img { border:  none; }\r\n#twiago_bx.tw_sky_160x600 a { text-d
ecoration: none; }\r\n#twiago_bx.tw_sky_160x600 h2 {}\r\n\r\n#twiago_b
x.tw_sky_160x600 {\r\n.width: 160px;\r\n.height: 600px;\r\n.overflow: 
hidden;\r\n.position: relative;\r\n}\r\n\r\n#twiago_bx.tw_sky_160x<<< skipped >>>

GET /en_US/all.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: connect.facebook.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

ETag: "61f4e1ea814477cd8955e01294e5b17d"

Content-Type: application/x-javascript; charset=utf-8

Timing-Allow-Origin: *

Vary: Accept-Encoding

Content-Encoding: gzip

Content-MD5: OS0ZnQlRXiWd9LoEWxbpMA==

X-FB-Debug: wYQ6t79q2GPYNkX/ICvk wMz5tlbGcW66XtTlqkXDL6sLr7qb7rU3xxLnYHbIW44LKicPQdfXA ubDEAtsTRgg==

Content-Length: 52530

Cache-Control: public, max-age=1200

Expires: Fri, 30 Jan 2015 06:46:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive
............{..../...^..$.1.(J..4...%.....=.l(....H... %Q..k..[..h. %'
.s~.l.......U.U.G?.?99y...../<.?>~/..'.|....xR/].?}Q{Y{....o.~:.
_......W.'*6]..^.^..t.v..K.'.*e!....N..[ZL...4...7..C.T.W.k8K...I.....
|Z?:.....\...zG#).......O...J...5.-K..h..o..~......b...K.[Z...`VJ..e./
I.W....8..MRU.4.8.|.Mh.~.:.....'..{4...U3M...q2.g..(S@'z.Q..6..S..f ..
...j.{..V......K.x:_~.P.....[-.w.E...|...]...b6)...E..A..s...Yx..f..ju
.).. 2.........tz......Qu..w.I0.:i./...~...b.r..4........c..Kw.].;.~.|
..|...p6_.C.U..4.....k..A.K]r......,.)M.....,..._y.%..V...P...R;.'%...
...|{~....~........e....eu.Nz..7..~..qI.....5F....RqW.M4.......]u...T.
...^[email protected]?2...)?..k.S..,.........a.I>.$X..i.j'...(.......t..
...L..L..e9..n..eMJ.L....f...y}^..r.........w.5.W..z......N<..sZ{O.
\_...M........i..../#.....y?J\l.ny....of.`I.5.1.}.y....k{...1....n.U..
4.N..............;]..@ .E...G).M.`.t....^.........hR......./..<$Q.!
.LM....P...D.s..)H}...(........hB...z...F..Z.<h&..zvC=/w,hH..WS....
.p..............-.@.?........F...3.....F......PP....!.:...M..3..c.af..
1.A..~...[.b-v#ZS..~...F...#iD...H...U?8.5..h..u........5.........A...
7p.fb...=.. ......x..T)[email protected]=.j..H...z..$.1.{U.4,..;R.
.."M.....2..F.t.,?..oN;&...T....^G...u.g..}X.....h.3P*....f.|.h.T.....
..p...8])Y(...GX..H?.p...H.Y.-..14s..,$.i..R...<.....x.........&.{4
....#..Qu..3.O[.`............b..g)j4./..l..S...v.t......._.G..|....Ws.
H5g..izPV3..DA|[email protected]...&...s.h(.R(.\.......4....7...CC./....EG
..,HH.......n...M>..I.A.~.P..G.*.,...F;.c.g......K..'.(..3.....<<< skipped >>>

GET /only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw== HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Expires: Sat, 13 Jun 1992 00:00:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

P3P: CP="NOI DEVa TAIa OUR BUS UNI"

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 1623

Connection: close

Content-Type: text/html
...........X[o.6.~...4 ..Z..wG....2`.C...<..D.Lt.D[q....J....i.....
(...s.s..7"....F...V....'....R...y8......L.....}...{..=..bT!>..[..G
?..m1....d.G........th.....H..8; o/.~...e..s...Y..}..\[email protected].....
...x....r.JH2....S.(.p.t.!..5..0J....U..9?'......p-6dI.^..JxQB.T..).. 
..#[email protected]."HX...S.i.T.g~..uW....N..`..Qp.i...P...XA.....E..c.oeB
8.H......0... ...?.\..0<..x........ ...o..........i.6..... . 4.}.4.
..P{....y....=i8..f.{.5jn-o.:.T.*....p.u..q#g..P.k&>.L^^.o\P...W4.Y
..,."<c`0...g...i......Q......`...\.>..o.......].Z .............
...H........}.....}...UnK...Ut;T.U.h#..)^...R?...6.&......X...q...we..
..e.\.}.0!3.p.g...ny.qWl.....7..7b>....%..esP...X....K....S.wl... y
n,..]KA.....v0....d.0.R6B.sMs.S..M........:j.....B4-c.O.w...Lk4..S.^..
..7../... .m~.4.:...=.-x...51..x.....rg.W........V....y.&i...S......#.
...{J...N.(...l..j....l!.8..3O...cf.g..u...'...M....`.G.q .R.......`..
.j.......o.........p8........ ..\f..Urp.,.#...u.(`.....Z...*Wj8....<
;.ji.........`Bk.F.3..........B..4..LWZmQ..*%..,...E;...>.......S.d
TW.10..;...=..Fc.P..[.....w..Zl ......@P'B.<gq..2<......j.....b.
..F`.v8.......!u...;.aiZ.S?............b.'......e..7.O1Y`3../.A<...
W.D.`gR...S......i.(WeO....C..[......e...u..fr..bX. /#..S..jc*sI3.Z5..
[email protected].$.....f..j.aB..J..n^]YK[a.......AU.....{.:U4A..Ul.
...Z..}.c...`F.......x.sq.....7..6.Xv..Kd#...:K.`.n....yv~............
F.`....bn.6..'@pE..w.}C..,..Du..vkt...w...Mo=.....y..P...p|.Y....].y.\
.a.....EjAG9q.1t...P..oE.&BD..^E.A.Y..i..d23...4.~m.5.......'iz..l<<< skipped >>>

GET /ocsp/MEkwRzBFMEMwQTAJBgUrDgMCGgUABBTy4Gr5hYodjXCbSRkjeqm1Gih+ZAQUSt0GFhu89mi1dvWBtrtiGrpagS8CCAaHMqBTgR3n HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: clients1.google.com


HTTP/1.1 200 OK

Content-Type: application/ocsp-response

Date: Tue, 27 Jan 2015 03:49:59 GMT

Expires: Sat, 31 Jan 2015 03:49:59 GMT

Server: ocsp_responder

Content-Length: 463

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

Age: 268601

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=345600
0..........0..... .....0......0...0......J......h.v....b..Z./..2015012
7010212Z0k0i0A0... ..........j.....p.I.#z...(~d..J......h.v....b..Z./.
...2.S.......20150127010212Z....20150203010212Z0...*.H.............@K.
.O.4....0"...j....5rR.@H&....z....`y.....X.:..{U.x..]K.W7.Dr.e=Qy.$D..
..o,....y.{.^.....0.Nt.y"....D.......5..4....*,T.....$..\]....<P.C@
.t.....|.......M=.\..%s6......w.....^ .....A1...8....ZJ.......o.,..l.&
gt;.n..p.. .6.>.L.$.....C...x.k]5..3....G......C.HTTP/1.1 200 OK..C
ontent-Type: application/ocsp-response..Date: Tue, 27 Jan 2015 03:49:5
9 GMT..Expires: Sat, 31 Jan 2015 03:49:59 GMT..Server: ocsp_responder.
.Content-Length: 463..X-XSS-Protection: 1; mode=block..X-Frame-Options
: SAMEORIGIN..Age: 268601..Alternate-Protocol: 80:quic,p=0.02..Cache-C
ontrol: public, max-age=345600..0..........0..... .....0......0...0...
...J......h.v....b..Z./..20150127010212Z0k0i0A0... ..........j.....p.I
.#z...(~d..J......h.v....b..Z./....2.S.......20150127010212Z....201502
03010212Z0...*[email protected]"...j....5rR.@H&....z....`y..
...X.:..{U.x..]K.W7.Dr.e=Qy.$D....o,....y.{.^.....0.Nt.y"....D.......5
..4....*,T.....$..\]....<[email protected].....|.......M=.\..%s6......w.....^ 
.....A1...8....ZJ.......o.,..l.>.n..p.. .6.>.L.$.....C...x.k]5..
3....G......C...<<< skipped >>>

GET /379828.gif?partner_uid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: idsync.rlcdn.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: no-cache, no-store

Content-Type: image/gif; charset=ISO-8859-1

Date: Fri, 30 Jan 2015 06:28:56 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://idsync.rlcdn.com/379828.gif?partner_uid=3338670318734125865&redirect=1

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Set-Cookie: ck1=ck1;Domain=.rlcdn.com;Expires=Wed, 29-Jul-2015 06:28:54 GMT

Content-Length: 0

Connection: keep-alive

....

GET /379828.gif?partner_uid=3338670318734125865&redirect=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: idsync.rlcdn.com

DNT: 1

Connection: Keep-Alive

Cookie: ck1=ck1


HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Content-Type: image/gif; charset=ISO-8859-1

Date: Fri, 30 Jan 2015 06:28:56 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Set-Cookie: rlas3="fqfIXaOp6xpfTR 9Pt1rzo1VRk/4yiguW0wJENO0YT2BXpdqF5nU3Q==";Version=1;Domain=.rlcdn.com;Expires=Wed, 29-Jul-2015 06:28:53 GMT;Max-Age=15551997

Set-Cookie: rtn1=8bf77b9a057a44a9f86b12932f97ce18;Domain=.rlcdn.com;Expires=Wed, 29-Jul-2015 06:28:53 GMT

Set-Cookie: dids1759600482=b95e7b4120bedf4544bdb8c3c76b36ae2dbc40cc921931702b4e656c3ca22d1b8cc80f631000aee7;Domain=.rlcdn.com;Expires=Wed, 29-Jul-2015 06:28:55 GMT

Content-Length: 43

Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: no-cache, no-store..Content-Type: image/gif; charset=ISO-8859-1..
Date: Fri, 30 Jan 2015 06:28:56 GMT..Expires: Thu, 01 Jan 1970 00:00:0
0 GMT..P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE
"..Set-Cookie: rlas3="fqfIXaOp6xpfTR 9Pt1rzo1VRk/4yiguW0wJENO0YT2BXpdq
F5nU3Q==";Version=1;Domain=.rlcdn.com;Expires=Wed, 29-Jul-2015 06:28:5
3 GMT;Max-Age=15551997..Set-Cookie: rtn1=8bf77b9a057a44a9f86b12932f97c
e18;Domain=.rlcdn.com;Expires=Wed, 29-Jul-2015 06:28:53 GMT..Set-Cooki
e: dids1759600482=b95e7b4120bedf4544bdb8c3c76b36ae2dbc40cc921931702b4e
656c3ca22d1b8cc80f631000aee7;Domain=.rlcdn.com;Expires=Wed, 29-Jul-201
5 06:28:55 GMT..Content-Length: 43..Connection: keep-alive..GIF89a....
.........!.......,...........L..;..

GET /bk/8640634?t=1422599352685&l=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&r=&f=1&cb=ftgs_8640634&x= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: t4ft.de

DNT: 1

Connection: Keep-Alive

Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=


HTTP/1.1 200 OK

X-Powered-By: PHP/5.5.19-1~dotdeb.1

Set-Cookie: ftgnetid=MzAxNTAxMzAwNzI4MDA0NzU=; expires=Sat, 30-Jan-2016 06:28:50 GMT; Max-Age=31536000; path=/; domain=.t4ft.de

Content-Length: 102

Content-Type: text/javascript

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Pragma: no-cache

Expires: Fri, 31 Dec 1999 23:00:00 GMT

P3P: policyref="hXXp://t4ft.de/p3p.xml", CP="NOI DSP PSAa PSDa IVAa IVDa OUR NOR UNI COM NAV INT CNT"

Connection: close

Date: Fri, 30 Jan 2015 06:28:50 GMT

Server: ws-0403
window.ftgs_8640634(1, "", {"aid":1211,"otp":"1211\/5101070\/8640138\/
8640196\/8640634","otfp":null});..

GET /my_games?gameId=659050 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/html;charset=UTF-8

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Fri, 30 Jan 2015 06:26:38 GMT

Content-Length: 16219

Connection: keep-alive
...........}{w.6....9.......Y...X..3.n^?..no..C..D."U....9.~....'.3.H.
$(..6QVNk..03.`.x.......{O...].......G..?|uvD..F....F.....x...Y.7[.2..
......F...A.~..w.......Z=.{.....ZoxA....;.>.._../............4...\.
.......... G.`h.n.....?.~.6.N.;......m......".Y..qp.{...nH).A..F.y.X.@
.......P...Tr.?..M.:.DB9`...'W...^.......S.....} .(....te...c.t.X.....
.F....7.....&[..1..B[....h.'  m....>O&o..'/Ck.'.......KN...`H.x.6..
]....Dd.............f.4....C.u..[......Zsg......].$5..R.....{.eTZ.<
.;.z3e..P.]m.^..<...Z....umK-ft..5......q...7.....W....^..k...:..[.
...`.............S.m..........fk.t{s{..`k.p.ur..:<9^?6......%MMG.'.
0)4.7M..... ..k $.o_...i.".v.n.3.V..4......._.o|~....\...._.6.T..G.:ys
lr`.4.1.a.%;.....n..,..HI.......d...4.....%^L...... ).K./.Eqe][..A..n.
.h..t......Q....O..:.E.z..uH.J....(..6<]....Z..^@'.......}..{O~...v
... )..D.=.....r..O@....?....h8...........t,....D_......zA....e.D..l..
m........#.uj........... }I.....K....t...../G.$]........v.D.q0.\..5...
.'.#..%.......z.|.>.K..<.tG..].X.{........Zk..n.v.V...Ns.2..v...
.].Nu.........ah.O.`.>x......K....E6.. ...g.d2p.BC.r...ms.i$.......
.o..c....|@...X.b.%...|..../.....D.A.?.4Mh0s..q.a...<..w.U...Q....[
..S.....%H.5...}!...`..~.l}....T....%.. ..L../..|r....ii.....?.(P.n..\
.%Ns...f4..ZS&}I%.)%}.......BC....q..e.....'U...o...\N.L...Q.Yn(......
.&.T*..6..c..o.W]A.6..GQ.*....F../....n.$.r...(.*&k:..RP.g.!T.j|o<c
....Y.i.X!.yIV...K....P..<lH*..Y....Y..)*...B.d*..@V!..P!...P!ST...
B.d*..]k....9{si...0c..Po.O..d.O...!A...).......H....%Y...>..O.<<< skipped >>>

POST /action/JSONService HTTP/1.1

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Host: partners.freeridegames.com

Content-Length: 103

DNT: 1

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 59

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/plain;charset=UTF-8

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive
{"error":{"code":"0","msg":[]},"data":{"countryCode":"UA"}}HTTP/1.1 20
0 OK..Server: Apache..Content-Length: 59..P3P: CP="IDC CURa ADMa DEVa 
TAIa OUR BUS IND UNI COM NAV"..Content-Type: text/plain;charset=UTF-8.
.Date: Fri, 30 Jan 2015 06:26:39 GMT..Connection: keep-alive..{"error"
:{"code":"0","msg":[]},"data":{"countryCode":"UA"}}....


GET /static/marketing/footer/img/footer_pixel.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 8258

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:39 GMT

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive

......Exif..II*.......................................................
................................................(...........1.........
..2...........i..........................'.......'..Adobe Photoshop CS
5 Windows.2012:02:16 17:49:45...........0221..........................
......................................j...........r...(...............
....z...........2.......H.......H.............Adobe_CM......Adobe.d...
......................................................................
......................................................................
......."................?.............................................
.............................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S
...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw....
....................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......
&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.............
....?..~.o...)*{.Z....z_k..G......uI$.........Photoshop 3.0.8BIM......
....Z...%G..Z...%G........8BIM.%.......m.l...F.4..?|.‹IM.:..........
..........printOutput........ClrSenum....ClrS....RGBC....Inteenum....I
nte....Clrm....MpBlbool.....printSixteenBitbool.....pullTEXT..........
MsgeTEXT..........altTagTEXT..........cellTextIsHTMLbool.....cellTextT
EXT..........horzAlignenum....ESliceHorzAlign....default....vertAligne
num....ESliceVertAlign....default....bgColorTypeenum....ESliceBGColorT
ype....None....topOutsetlong........leftOutsetlong........bottomOutset
long........rightOutsetlong.....8BIM.(..........?.......8BIM......

<<< skipped >>>

GET /banners/DE/Tribal/728x90_ros_de_tribal.html HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0; geoCountryCode=UA; gfad_300x250={"refreshCount":1,"sessionRefreshCount":0,"lastRefreshTime":1422599221435}


HTTP/1.1 200 OK

Server: Apache

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 221

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:39 GMT

Date: Fri, 30 Jan 2015 06:26:39 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........P.n.0...W....|..r.......T9bA..Qb...o.U.V.....m=9... ...l.~.
}6 O.N......?...co}.B..`2u.....<F....S.]..CY..k.r._.z........XW.~c.
....R.D...RI8....<....Q8...S.K..={.d.Tu..)x..7k...&.`t..........s.m
Fl...`w...CS|(...HTTP/1.1 200 OK..Server: Apache..Content-Type: text/h
tml;charset=UTF-8..Content-Encoding: gzip..Content-Length: 221..Cache-
Control: max-age=86400..Expires: Sat, 31 Jan 2015 06:26:39 GMT..Date: 
Fri, 30 Jan 2015 06:26:39 GMT..Connection: keep-alive..Vary: Accept-En
coding.............P.n.0...W....|..r.......T9bA..Qb...o.U.V.....m=9...
 ...l.~.}6 O.N......?...co}.B..`2u.....<F....S.]..CY..k.r._.z......
..XW.~c.....R.D...RI8....<....Q8...S.K..={.d.Tu..)x..7k...&.`t.....
.....s.mFl...`w...CS|(.....

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD/yl6nWPkczAQUe1tFz6/Oy3r9MZIaarbzRutXSFACEE1fLDQIskwgzW1QfiRNyew= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.thawte.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1503

content-transfer-encoding: binary

Cache-Control: max-age=367925, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 12:37:06 GMT

Expires: Tue, 3 Feb 2015 12:37:06 GMT

Date: Fri, 30 Jan 2015 06:28:54 GMT

Connection: keep-alive
0..........0..... .....0......0...0......&Km...."....}....,.c..2015012
7123706Z0s0q0I0... ........0..k....&..p..^.X.....{[E....z.1..j..F.WHP.
.M_,4..L .mP~$M......20150127123706Z....20150203123706Z0...*.H........
.....z=.5.....x...r.b>C.7.B.q..C.6.y%...._.......U.>.q.3......!.
....kR../H.6....SFG.(F[;.)..Et.dzq.....^Rf|...........}..F..g>.....
nH............`[email protected].../....D...5~1.F....r6......b./..`S.?.t..
.W..;4lXx........?..d......&q.b.l.f.[.^....#..*..Y2.O..... .....0...0.
..0............I...*....^n...0...*.H........0..1.0...U....US1.0...U...
.thawte, Inc.1(0&..U....Certification Services Division1806..U.../(c) 
2006 thawte, Inc. - For authorized use only1.0...U....thawte Primary R
oot CA0...141202000000Z..151216235959Z0_1.0...U....US1.0...U....thawte
, Inc.1907..U...0thawte Primary Root OCSP Responder Certificate 30.."0
...*.H.............0.........x...F83..,.D.,2D.;JGc.|_.k.....B.7.....G}
.M.s.....S.i.Uu.h.Aq..v...4:l..U.......T7l...~vl...r....{*..........V.
o..8|.B..^.a.. ...z....x..s...\[Y....<....'> ..YC..7.zVk.$...o3.
.kao]c...>C./bPX.......I..Oc.....NN......g.....,/..]......qN.....V!
<.3.)...y#.........i0g0...U.%..0... .......0... .....0......0...U..
.....0.0...U...........0!..U....0...0.1.0...U....TGV-B-2770...*.H.....
...........lt..\..z. ..N.f.!.S5d?J.&....r...D........L.`.s.p...HC.L.8f
... .........GA7......P..Z.%.../............z.n.6~I...].).....W...W\|.
uya..:...^...hW..7.Z.uc.'....:.xL...HS.....>.........5......%....3S
....h........U....o.C.\.t.....G.._.C0(l.E9..6UTxg.gF ..;...<<< skipped >>>

GET /banner?sid=2659948&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=-1&h5s=0&wi=200732349&ac=1&screen_res=undefined&wpt=J&clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: aa.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017589072166938

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc14=1001a; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/

Content-Length: 1206
document.write('\x3Cdiv style="position:absolute;width:728px;height:0p
x">\x3Cdiv id="obaButton_6110017589072166938">\x3C/div>\x3C/d
iv>\x3C!-- BEGIN ADITIONTAG -->\n\x3Cscript type="text/javascrip
t" src="hXXp://imagesrv.adition.com/js/adition.js">\x3C/script>\
n\x3Cscript type="text/javascript" src="hXXp://ad2.adfarm1.adition.com
/js?wp_id=2554279&clickurl=http://aa.adfarm1.adition.com/redi*
lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/
c=13050/keyword=/sr=0/clickurl=">\x3C/script>\n\x3
C!-- END ADITIONTAG -->\x3Cscript type="text/javascript">\n(func
tion() {\n  var domId = \'obaButton_6110017589072166938\',oba=\'\',btr
 = \'false\',position= \'top-right\'||\'top-right\';\n  if (oba != \'\
' || btr == \'true\') {\n    var oba_script = document.createElement(\
'script\');\n    oba_script.setAttribute(\'type\',\'text/javascript\')
;\n    oba_script.setAttribute(\'charset\',\'utf-8\');\n          oba_
script.setAttribute(\'src\', \'hXXp://imagesrv.adition.com/js/adplayer
/oba_priv.sjs?oba=\' oba \'&domId=\' domId \'&btr=\' btr \'&pos=\' pos
ition);\n    \n    document.getElementsByTagName(\'head\')[0].appendCh
ild(oba_script);\n\n  }\n  })();\n\x3C/script>');..<<< skipped >>>

GET /MFUwUzBRME8wTTAJBgUrDgMCGgUABBS856ddZAq5lE7vDJmoUDW1u98SMAQU3WyAfLq1MhelhEFA8NIEZhMvqZACFGozgiJkrf5JafrJHx/pwJ6+De+O HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: vassg141.ocsp.omniroot.com


HTTP/1.1 200 OK

Server: nginx

Content-Type: application/ocsp-response

Content-Length: 1765

Last-Modified: Fri, 30 Jan 2015 06:06:33 GMT

ETag: "dc03c23f8eb330db9ddad1bd8952209aff112f47"

Cache-Control: public, no-transform, must-revalidate, max-age=339456

Expires: Tue, 03 Feb 2015 04:44:16 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive

0..........0..... .....0......0...0..........[us..Ni......f....2015013
0060633Z0w0u0M0... ...........]d...N....P5....0...l.|[email protected]./...
.j3."d..Ii...............20150130060633Z....20150203060633Z0...*.H....
.........6..r...[.Ktp..i........$...Y...&D`..M..v.@.....%...a..m.$...J
.)..s.........J3Q......B....>a.}.KyyH....83....a.r....2....K..$0...
........(<J, ..W......6..U....D?#..!ux....xW..vM/s.I...n...v.9.!.n.
...h.n..>.S....y...`X.8Q...gA.>".N..<<."ob.9...-...0....l{
.F.....0...0...0...........=......Ri..\..(.{..0...*.H........0..1.0...
U....NL1.0...U....Amsterdam1%0#..U....Verizon Enterprise Solutions1.0.
..U....Cybertrust1.0,..U...%Verizon Akamai SureServer CA G14-SHA10...1
40410115548Z..150410115548Z0..1.0...U....NL1.0...U....Amsterdam1%0#..U
....Verizon Enterprise Solutions1.0...U....Cybertrust1806..U.../Verizo
n Akamai SureServer CA G14-SHA1 Responder0.."0...*.H.............0....
.....f..).1.............Z.45..l. IB..r`...f....h.....h..._i'...J....|.
c....E.D0bg.b.v..........:Q....W._U.w..3....i...k........t.....m.CO$..
j@.....>..Q.m......1/Z.r......L..a.n..;..KoIY.......fk{..c..d...IU.
......zy.X...zp...F.1..F......b...Z...=9.o...N.fL.%Z.........H0..D0...
 .....0......0L..U. .E0C0A.. .....>..0402.. ........&hXXps://secure
.omniroot.com/repository0~.. ........r0p06.. .....0..*hXXps://cacert.a
.omniroot.com/vassg141.crt06.. .....0..*hXXps://cacert.a.omniroot.com/
vassg141.der0...U...........0...U.%..0... .......0...U.#..0....l.|..2.
[email protected]./..0...U..........[us..Ni......f..0...*.H.............Fk:

<<< skipped >>>

GET /banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl= HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589071970330


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/html

ETag: 6110017589091237945

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589071970330; expires=Wed, 29-Jul-2015 07:28:47 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc3=10039; expires=Wed, 29-Jul-2015 07:28:47 GMT; path=/

Content-Length: 1008
<HTML><HEAD><TITLE></TITLE></HEAD><BO
DY topmargin="0" leftmargin="0" style="background-color:transparent;ov
erflow:hidden;margin:0;padding:0;"><div style="position:absolute
;width:728px;height:0px"><div id="obaButton_6110017589091237945"
></div></div><script language="JavaScript" src="http
://ads.w3hoster.de/adsi-j.php?s=14076&w=728&h=90&t=_blank&gpts=6110017
589091237945"></script><script type="text/javascript">.
(function() {.  var domId = 'obaButton_6110017589091237945',oba='',btr
 = 'true',position= 'top-right'||'top-right';.  if (oba != '' || btr =
= 'true') {.    var oba_script = document.createElement('script');.   
 oba_script.setAttribute('type','text/javascript');.    oba_script.set
Attribute('charset','utf-8');.          oba_script.setAttribute('src',
 'hXXp://imagesrv.adition.com/banners/533/oba_priv.sjs?oba=' oba '&dom
Id=' domId '&btr=' btr '&pos=' position '&cid=12452&aid=54647');.    .
    document.getElementsByTagName('head')[0].appendChild(oba_script);.
.  }.  })();.</script></BODY></HTML>..<<< skipped >>>

GET /ibs:dpid=358&dpuuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dpm.demdex.net

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private

DCS: va6-dcs98.va6.demdex.com master-1.21.92

Expires: Thu, 01 Jan 2009 00:00:00 GMT

Location: hXXp://dpm.demdex.net/demconf.jpg?et:ibs|data:dpid=358&dpuuid=3338670318734125865

P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"

Pragma: no-cache

Set-Cookie: demdex=85142299456820519092965016384829198287;Path=/;Domain=.demdex.net;Expires=Sun, 29-Jan-2017 06:28:53 GMT

Content-Length: 0

Connection: keep-alive
....


GET /demconf.jpg?et:ibs|data:dpid=358&dpuuid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dpm.demdex.net

DNT: 1

Connection: Keep-Alive

Cookie: demdex=85142299456820519092965016384829198287


HTTP/1.1 200 OK

Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private

Content-Type: image/jpeg

DCS: va6-dcs17.va6.demdex.com master-1.21.92

Expires: Thu, 01 Jan 2009 00:00:00 GMT

P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"

Pragma: no-cache

Set-Cookie: dpm=85142299456820519092965016384829198287;Path=/;Domain=.dpm.demdex.net;Expires=Sun, 29-Jan-2017 06:28:54 GMT

STS: OK

Content-Length: 308

Connection: keep-alive

......JFIF..............Exif..II*..............C......................
..............................................C.......................
....................................................."................
......................................................................
......................?.....HTTP/1.1 200 OK..Cache-Control: no-cache,n
o-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,privat
e..Content-Type: image/jpeg..DCS: va6-dcs17.va6.demdex.com master-1.21
.92..Expires: Thu, 01 Jan 2009 00:00:00 GMT..P3P: policyref="/w3c/p3p.
xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV IN
T"..Pragma: no-cache..Set-Cookie: dpm=85142299456820519092965016384829
198287;Path=/;Domain=.dpm.demdex.net;Expires=Sun, 29-Jan-2017 06:28:54
 GMT..STS: OK..Content-Length: 308..Connection: keep-alive........JFIF
..............Exif..II*..............C................................
....................................C.................................
..........................................."..........................
......................................................................
............?.......

<<< skipped >>>

GET /PositiveSSLCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1287

Last-Modified: Mon, 18 Sep 2006 00:00:00 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes
0...0..........L.J.[E.!.../. Qq0...*.H........0..1.0...U....US1.0...U.
...UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0...U.
...hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0...060918
000000Z..200530104838Z0q1.0...U....GB1.0...U....Greater Manchester1.0.
..U....Salford1.0...U....Comodo CA Limited1.0...U....PositiveSSL CA0..
"0...*.H.............0.........OyX"..(>R../.. ..-U.......*..^...X.T
....A...U.... .E.&. .=...1.!\y.y.$.\V...............S..F...$.b...^ Z..
.P...(*M..HO....O......?....,......p..i..<......?n...-..].........~
....}..:=.r.y%.......V^...Z..b4 (H2.........f.....iM....]..7b........~
.jR.................n0..j0...U.#..0....r_&.(.C.].7....K..E0...U.......
....1y......*..5.1.0...U...........0...U.......0.......0{..U...t0r08.6
.4.2hXXp://crl.comodoca.com/UTN-USERFirst-Hardware.crl06.4.2.0hXXp://c
rl.comodo.net/UTN-USERFirst-Hardware.crl0.... ........z0x0;.. .....0..
/hXXp://crt.comodoca.com/UTNAddTrustServerCA.crt09.. .....0..-hXXp://c
rt.comodo.net/UTNAddTrustServerCA.crt0...*.H..................H]..Z...
.....l.I..1.1\...d.....Z-..;>[email protected]....&=[!.....=.<
...._.S........NI}.......e....1w..*....j-.e..g.m.J.f..2M.B#..EAjv.....
n..>.Q......P*...o."6...F....;}.....2 .....@..$..]..........KS}.(.V
=..gI...... LG..L.D...c..{[1.&a.y...N..P{...<<< skipped >>>

GET /pca3.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.verisign.com


HTTP/1.1 200 OK

Server: Apache

ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"

Last-Modified: Fri, 19 Dec 2014 01:00:19 GMT

Date: Fri, 30 Jan 2015 06:31:13 GMT

Content-Length: 933

Connection: keep-alive

Content-Type: application/pkix-crl

0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc.1705..U
....Class 3 Public Primary Certification Authority..141210000000Z..150
331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A.....{2..Y
.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y..q.....
..fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!............R
.e.53..010207212458Z0!..!......Y...ISi....010706171411Z0!..$-..I{r....
u<._...080403172226Z0!..&.."?..y..51}..1..010706172118Z0!..4....2..
..{W......080605175030Z0!..B....c............070411175910Z0!..H.Py...N
....* [email protected]!..Y......w
`G........070411175657Z0!..Z`[email protected].*q..080403172017Z0!..l....I..
.Y..] .c..010706171749Z0"......T=deQ...1u.]...010207212247Z0".....p..1
..7<.....e..010207211822Z0...*.H............5..v...V.._)....A... ..
..>.5]....6.(.0uFW.*:T...6$.....R...Y.N.k........%Jn..I.j*.6.3~...r
../[email protected]?....0.A.HTTP/1.1 200 OK..Server: Apache.
.ETag: "66304c4a5660ab8615727e6bb27b3cdb:1418950819"..Last-Modified: F
ri, 19 Dec 2014 01:00:19 GMT..Date: Fri, 30 Jan 2015 06:31:13 GMT..Con
tent-Length: 933..Connection: keep-alive..Content-Type: application/pk
ix-crl..0...0...0...*.H........0_1.0...U....US1.0...U....VeriSign, Inc
.1705..U....Class 3 Public Primary Certification Authority..1412100000
00Z..150331235959Z0..x0!...v....a_>..2......020924164823Z0!.....A..
...{2..Y.#..140129175709Z0!...,.|.|...<...j ...080605174907Z0!...`y
..q.......fh...020923171400Z0!...?A....a.nF`.P....020923171548Z0!.

<<< skipped >>>

GET /banner?sid=2566332&adjsver=3&co=1&fvers=&iframe=1&ref=&os=10&browser=13&h5=6110017589072035866&h5s=0&wi=652539272&ac=6&screen_res=undefined&wpt=J&clickurl=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58414_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4; fc5=1005e


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:51  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017601956741214

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc5=1005e; expires=Wed, 29-Jul-2015 07:28:50 GMT; path=/

Content-Length: 5235
document.write('\x3Cdiv style="position:absolute;width:160px;height:0p
x">\x3Cdiv id="obaButton_6110017601956741214">\x3C/div>\x3C/d
iv>\n\x3Cstyle type="text/css">\n\x3C!--\n.paoffer-block_0kRa2RN
R3aG3NRNa_160x600_grey {\n    width:160px;.\n    height:600px;\n}\n.pa
offer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3NRNa {\
n.float:left;\n.clear:both;.\n.margin-bottom:2px;\n.margin-right:0px;\
n.font-family:Tahoma, Geneva, sans-serif !important;.\n.font-size:11px
 !important;.\n.text-align: left !important;\n    line-height:14px !im
portant;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a,\n.paoffer_0kRa2RNR3aG3NRNa 
h2,\n.paoffer_0kRa2RNR3aG3NRNa span {\n    cursor:pointer !important;\
n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .paoffer_0kRa2RNR3aG3
NRNa a {\n.display:block;\n.float:left;.\n.background:transparent url(
hXXp://imagesrv.adition.com/banners/270/files/00/00/b7/09/000000046857
.png) no-repeat top left;\n.padding:1px;\n.text-decoration:none !impor
tant;\n.color:#000 !important;.\n}\n.paoffer_0kRa2RNR3aG3NRNa a:hover,
\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3aG3NRNa a:foc
us  {\n.background-position:left bottom;\n}\n \n.paoffer_0kRa2RNR3aG3N
RNa a:hover,\n.paoffer_0kRa2RNR3aG3NRNa a:active,\n.paoffer_0kRa2RNR3a
G3NRNa a:focus,\n.paoffer_0kRa2RNR3aG3NRNa a:hover span  {\n.text-deco
ration:underline;\n}\n.paoffer-block_0kRa2RNR3aG3NRNa_160x600_grey .pa
offer-inner_0kRa2RNR3aG3NRNa {\n.position:relative;.\n    display:bloc
k;\n.width:160px;\n.height:195px;\n.overflow:hidden;\n. \n.text-de<<< skipped >>>

GET /w/1.0/sd?cc=1&id=537072399&val=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: us-u.openx.net

DNT: 1

Connection: Keep-Alive

Cookie: i=5b119fb5-f5e3-4c30-6291-67d07cce8928|1422599330


HTTP/1.1 200 OK

Server: OXGW/10.89.3

Pragma: no-cache

P3P: CP="CUR ADM OUR NOR STA NID"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: image/gif

Content-Length: 43

Cache-Control: private, max-age=0, no-cache

Connection: close

GIF89a.............!.......,...........D..;..

GET /bridge?AG_SETCOOKIE&AG_PID=appnexus HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cm.adgrx.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: text/plain

Transfer-Encoding: chunked

Connection: keep-alive

Server: Apache

X-RealServer-AP: h017

P3P: CP="NOI OTC OTP OUR NOR"

Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate

Pragma: no-cache

Expires: Thu, 23 Sep 2004 17:42:04 GMT

Set-Cookie: ADGRX_UID=42a09b72-a849-11e4-a60c-78e7d1f6c9c0; expires=Sunday, 29-Jan-2017 06:28:53 GMT; path=/; domain=.adgrx.com

Location: hXXp://cm.adgrx.com/bridge.gif?AG_PID=appnexus

X-RealServer-NX: h017

Access-Control-Allow-Origin: *

0......

GET /bridge.gif?AG_PID=appnexus HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cm.adgrx.com

DNT: 1

Connection: Keep-Alive

Cookie: ADGRX_UID=42a09b72-a849-11e4-a60c-78e7d1f6c9c0


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: image/gif

Transfer-Encoding: chunked

Connection: keep-alive

Server: Apache

X-RealServer-AP: h017

P3P: CP="NOI OTC OTP OUR NOR"

Cache-Control: no-cache, no-store, must-revalidate, proxy-revalidate

Pragma: no-cache

Expires: Thu, 23 Sep 2004 17:42:04 GMT

Set-Cookie: ADGRX_CM_APPNEXUS_BRIDGED=1; expires=Saturday, 31-Jan-2015 06:28:53 GMT; path=/; domain=.adgrx.com

Location: hXXp://ib.adnxs.com/setuid?entity=94&code=42a09b72-a849-11e4-a60c-78e7d1f6c9c0

X-RealServer-NX: h017

Access-Control-Allow-Origin: *

0..HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:53 GMT..Content-Ty
pe: image/gif..Transfer-Encoding: chunked..Connection: keep-alive..Ser
ver: Apache..X-RealServer-AP: h017..P3P: CP="NOI OTC OTP OUR NOR"..Cac
he-Control: no-cache, no-store, must-revalidate, proxy-revalidate..Pra
gma: no-cache..Expires: Thu, 23 Sep 2004 17:42:04 GMT..Set-Cookie: ADG
RX_CM_APPNEXUS_BRIDGED=1; expires=Saturday, 31-Jan-2015 06:28:53 GMT; 
path=/; domain=.adgrx.com..Location: hXXp://ib.adnxs.com/setuid?entity
=94&code=42a09b72-a849-11e4-a60c-78e7d1f6c9c0..X-RealServer-NX: h017..
Access-Control-Allow-Origin: *..0..

GET /banner?sid=2659948&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=-1&h5s=0&wi=593011552&ac=1&screen_res=undefined&wpt=J&clickurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: aa.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589071970330


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/javascript

ETag: 6110017589072101402

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589071970330; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc14=1001a; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/

Content-Length: 1206
document.write('\x3Cdiv style="position:absolute;width:728px;height:0p
x">\x3Cdiv id="obaButton_6110017589072101402">\x3C/div>\x3C/d
iv>\x3C!-- BEGIN ADITIONTAG -->\n\x3Cscript type="text/javascrip
t" src="hXXp://imagesrv.adition.com/js/adition.js">\x3C/script>\
n\x3Cscript type="text/javascript" src="hXXp://ad2.adfarm1.adition.com
/js?wp_id=2554279&clickurl=http://aa.adfarm1.adition.com/redi*
lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/
c=52907/keyword=/sr=0/clickurl=">\x3C/script>\n\x3
C!-- END ADITIONTAG -->\x3Cscript type="text/javascript">\n(func
tion() {\n  var domId = \'obaButton_6110017589072101402\',oba=\'\',btr
 = \'false\',position= \'top-right\'||\'top-right\';\n  if (oba != \'\
' || btr == \'true\') {\n    var oba_script = document.createElement(\
'script\');\n    oba_script.setAttribute(\'type\',\'text/javascript\')
;\n    oba_script.setAttribute(\'charset\',\'utf-8\');\n          oba_
script.setAttribute(\'src\', \'hXXp://imagesrv.adition.com/js/adplayer
/oba_priv.sjs?oba=\' oba \'&domId=\' domId \'&btr=\' btr \'&pos=\' pos
ition);\n    \n    document.getElementsByTagName(\'head\')[0].appendCh
ild(oba_script);\n\n  }\n  })();\n\x3C/script>');..<<< skipped >>>

GET /usersync3/mediamath/1425/dbf254cb-24a3-4e00-920d-6f1d855c1a7b?zderedir=&zcc=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: sync.zenoviaexchange.com


HTTP/1.1 302 Moved Temporarily

Server: nginx

Date: Fri, 30 Jan 2015 06:28:56 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: keep-alive

Location: hXXp://ib.adnxs.com/setuid?entity=227&code=ZU01v04-9561478d62191c1b11d185ac951f145d

0..HTTP/1.1 302 Moved Temporarily..Server: nginx..Date: Fri, 30 Jan 20
15 06:28:56 GMT..Content-Type: text/html..Transfer-Encoding: chunked..
Connection: keep-alive..Location: hXXp://ib.adnxs.com/setuid?entity=22
7&code=ZU01v04-9561478d62191c1b11d185ac951f145d..0..

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ/xkCfyHfJr7GQ6M658NRZ4SHo/AQUCPVR6Pv+PT1kNnxoz1t4qN+5xTcCEGC2x6sSmevembHfY1acIZk= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.verisign.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1697

content-transfer-encoding: binary

Cache-Control: max-age=554212, public, no-transform, must-revalidate

Last-Modified: Thu, 29 Jan 2015 16:27:40 GMT

Expires: Thu, 5 Feb 2015 16:27:40 GMT

Date: Fri, 30 Jan 2015 06:31:13 GMT

Connection: keep-alive
0..........0..... .....0......0...0...A0?1=0;..U...4VeriSign Class 3 C
ode Signing 2004 CA OCSP Responder..20150129162740Z0s0q0I0... ........
[email protected].!......Q...==d6|h.[x....7..`..........cV.!.....201501
29162740Z....20150205162740Z0...*.H.............n)cde....v.2.....Y..1.
L...D..~~cI2.h...qD(.~.btg..x4....]F............')^.L..,....p6..Bv}r.^
H.h,$...... .Y.L.X.M..9>..>B..7..;IEVb.......t.....P.HN..F......
.Jc.._q.x.I4)L..$\,Lx.Y.:...@.?0m......N.s..gi .J.9>..\V]0F4...>
...v).h........uYa..\T........z..P.4....0...0...0..{.........[..I|....
.Zm..0...*.H........0..1.0...U....US1.0...U....VeriSign, Inc.1.0...U..
..VeriSign Trust Network1;09..U...2Terms of use at hXXps://VVV.verisig
n.com/rpa (c)041.0,..U...%VeriSign Class 3 Code Signing 2004 CA0...140
428000000Z..150729235959Z0?1=0;..U...4VeriSign Class 3 Code Signing 20
04 CA OCSP Responder0.."0...*.H.............0.........Y....h..@..>.
....%.-.....O...' y.........x..Gw.xF.....?..Z..u,.X.&..........3C..H.l
.....f..;]s!.\"v...|....][email protected]. ..W..
..n..*..-f?EY.......UN...r...........-_.%..,P;b.....)(.P.4...,.%....&l
t;..6.....[r^X.EV..S...5#'Y.. .TD...........0...0...U.......0.0...U.%.
.0... .......0...U...........0... .....0......0f..U. ._0]0[..`.H...E..
..0L0#.. .........hXXps://d.symcb.com/cps0%.. .......0...hXXps://d.sym
cb.com/rpa0!..U....0...0.1.0...U....TGV-B-1080...U......"...?....`>
q..i1o...0...U.#..0.....Q...==d6|h.[x....70...*.H.............B8@.$..w
o......E.....P52"b*@'C\.y.(...n....h.f..7f.....v...pb<...]..|..<<< skipped >>>

GET /adview.php?tz=142259933223254&pid=789&kid=4&wmid=4015&sid=4&nvc=1&swid=3826&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.3

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /ttj?id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/ttj?id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 0
....


GET /bounce?/ttj?id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 1067
!function(){function n(n){try{if(!window.location.ancestorOrigins)retu
rn;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r  )n.c
all(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}func
tion r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch
(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==
window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.docu
ment.referrer||null,location:n.location.href||null,isTop:n===window.to
p})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top}
)}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,
l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].refe
rrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l
==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c=
"&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="ht
tp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5
ZFPG0.' c '&id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=Tri
balFusion"></scr' 'ipt>')}();....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430847&referrer=freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 14996232

Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 287
document.write('<iframe src=\"hXXp://cdn.castplatform.com/scripts/a
u1107.html\" FRAMEBORDER=\"0\" MARGINWIDTH=\"0\" MARGINHEIGHT=\"0\" SC
ROLLING=\"NO\" WIDTH=\"300\" HEIGHT=\"250\" ></iframe>');docu
ment.write('<scr'   'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersy
nc.js"></scr' 'ipt>');HTTP/1.1 200 OK..Cache-Control: no-stor
e, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:0
0:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP
="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PR
E"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; path=/
; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..
Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; dom
ain=.adnxs.com; HttpOnly..Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUQ
oMmspgUYAA..; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.a
dnxs.com; HttpOnly..X-Creative-ID: 14996232..Set-Cookie: anj=dTM7k!M4.
NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 3
0-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..Content-Type: ap
plication/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:48 G
MT..Content-Length: 287..document.write('<iframe src=\"hXXp://cdn.c
astplatform.com/scripts/au1107.html\" FRAMEBORDER=\"0\" MARGINWIDTH=\"
0\" MARGINHEIGHT=\"0\" SCROLLING=\"NO\" WIDTH=\"300\" HEIGHT=\"250\" &
gt;</iframe>');document.write('<scr'   'ipt src="hXXp://cdn.a
dnxs.com/ANX_async_usersync.js"></scr' 'ipt>');...
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DF7/.XDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/S6aPHH9q)kTnJ!7 !!(xI $oV=


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.FDYRWSDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/SHKDc^PfPZpsQhBj).8'y!!@8vS[`i/; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 118
ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=333867031873412
5865&Red3=MSAN_pd", "c":9, "tagtype":"iframe"});HTTP/1.1 200 OK..Cache
-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat,
 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/po
licy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS C
OM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318
734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnx
s.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 
06:28:49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.FD
YRWSDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/SHKDc^PfPZpsQh
Bj).8'y!!@8vS[`i/; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; doma
in=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset
=utf-8..Date: Fri, 30 Jan 2015 06:28:49 GMT..Content-Length: 118..ANX_
async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=3338670318734125865
&Red3=MSAN_pd", "c":9, "tagtype":"iframe"});....
<<< skipped >>>

GET /pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.CwKyvPkDi2)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?W KdC

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.PLv]@UwMNC)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?WA>qU; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:49 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/0D>6NRDgEREg(Pm?gvnX.PLv]@UwMNC)(_rf>kqWsT(p*J-NduzNSSL01#`CG7uQb7oPD 6#xbV8f5Uuf9?F)S%o%m?WA>qU


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.gDunaTDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw<Bh>bvRiM4DQLfHq#H':[4NRk4^POYh1**c*_Y[.rtq; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 150
ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86af
cfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":6, "tagtype
":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private.
.Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policy
ref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSA
o PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection:
 0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr
-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; p
ath=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpO
nly..Set-Cookie: anj=dTM7k!M4.gDunaTDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-&
lt;Uy(oT(p*J-I4>FNSPB?j>nh#Nw<Bh>bvRiM4DQLfHq#H':[4NRk4^PO
Yh1**c*_Y[.rtq; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=
.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=ut
f-8..Date: Fri, 30 Jan 2015 06:28:49 GMT..Content-Length: 150..ANX_asy
nc_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436
104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":6, "tagtype":"img"
});....
<<< skipped >>>

GET /ymapuid?xid=gQUnQK98s6B95xi8KbAeDULC HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M41$CxrEQDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw7v>oKgP/DrPb.EK<-KPeofC<R1P9OO>fg:Q3_QnJ!7 !!% A4x_1'

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 0
....


GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M41$CxrEQDgEREg(Pm?gvnX.PLv]@UwMNC)(c>-<Uy(oT(p*J-I4>FNSPB?j>nh#Nw7v>oKgP/DrPb.EK<-KPeofC<R1P9OO>fg:Q3_QnJ!7 !!% A4x_1'


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Prov
ider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3338670318734125865/gif
?meta=appNexus", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Contr
ol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 No
v 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p
3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV
 DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125
865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com;
 HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:
49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*eTF>
 e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>
;K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<; path=/; ex
pires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly..Cont
ent-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan 201
5 06:28:49 GMT..Content-Length: 182..ANX_async_load({"url":"hXXp://dps
.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52A
C15EB7D4/User/3338670318734125865/gif?meta=appNexus", "c":5, "tagtype"
:"img"});....
<<< skipped >>>

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4NAaI`!Ome[(%pdi:udz^j).8'y!!@7*XlOcz; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 148
ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?s
rc.platformID=AN&src.visitorID=3338670318734125865", "c":6, "tagtype":
"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..P
ragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyre
f="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo 
PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0
..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2
015 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pat
h=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhfl
gxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4
NAaI`!Ome[(%pdi:udz^j).8'y!!@7*XlOcz; path=/; expires=Thu, 30-Apr-2015
 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/
javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..Conten
t-Length: 148..ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com
/tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865", "c
":6, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4N/xEe59::j$P)Zu/w2MKsQ4uVNN/t]SL>( D


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40mhgVC6e6AqeU2k_YVvO89'^:30/=Xr<8yhfljpO4w)50[0<^!?C8s$A<owh%BYlx0_PwgnYiWU*-p=5'0-uU)a'VIRM-Z _8a_vj8eBm4*BIev^Y)[J=aMF=:IZvV`[<qqY)RMr_-#5q[!6HZb7XKLc; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 130
ANX_async_load({"url":"hXXp://pixel.rubiconproject.com/tap.php?v=4894&
nid=1986&put=3338670318734125865", "c":5, "tagtype":"img"});...
.


GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40mhgVC6e6AqeU2k_YVvO89'^:30/=Xr<8yhfljpO4w)50[0<^!?C8s$A<owh%BYlx0_PwgnYiWU*-p=5'0-uU)a'VIRM-Z _8a_vj8eBm4*BIev^Y)[J=aMF=:IZvV`[<qqY)RMr_-#5q[!6HZb7XKLc


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40Le8)4*e6AqeU2k_YVvO89'^:30/=Xr<8yhfljpO4w)50[0<^!?C8s$A<owh%BYlx0_PwgnYiWU*-p=5'0-uU)a'VIRM-Z _8a_vj8eBm4*BIev^Y)b*NL7 6InvV Di$y!Xp]%>.N#ua!Dh>b.CnY55hZdDY; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 148
ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?s
rc.platformID=AN&src.visitorID=3338670318734125865", "c":2, "tagtype":
"img"});....


GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40Le8)4*e6AqeU2k_YVvO89'^:30/=Xr<8yhfljpO4w)50[0<^!?C8s$A<owh%BYlx0_PwgnYiWU*-p=5'0-uU)a'VIRM-Z _8a_vj8eBm4*BIev^Y)b*NL7 6InvV Di$y!Xp]%>.N#ua!Dh>b.CnY55hZdDY


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/bdWIy(e6AqeU2k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nYqJi!T:oRXyhPj/WWIyJLfW#ze'?uVl!*0Y3%QF'8-LtlBN0C@Xc([2X$-7M=RCup_x`Mg89pk!$:(B>G8a)bro3 jBkpjyCW.Q`x[V<9uh; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 118
ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val
=3338670318734125865", "c":1, "tagtype":"img"});....


GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M416epbG-e6AqeU2k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5^()<YQK02H(V#f(*JoK51j?mh5p'lM#`xo'$bjcmJJy3#Fa*Y=>saUG344H^ta?sTqJCY1:EGQ*$H6!^!-ka:G(j89


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40uCy@^UDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$R[?:Eh_6Pg-pR%Tg_ *(?xr gopqeR'hVvSTHGi5(3o3Yzjyf:HFP='pmP_--61?dm`'zpGapuKimcFH9AC'0$*bbQME^F *; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 148
ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//i
b.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":4, "tagtype":
"img"});....


GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40uCy@^UDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$R[?:Eh_6Pg-pR%Tg_ *(?xr gopqeR'hVvSTHGi5(3o3Yzjyf:HFP='pmP_--61?dm`'zpGapuKimcFH9AC'0$*bbQME^F *


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/zDYwpWDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$R[?:Eh_6Pg-pR%Tg_ *(?xr gop`NqNaof#OjN5KKeWQINOZ(a83B$kWHcRf'bg3ZWqzB)h AeC`f3/xEegOkYoh:fcK@dWME4!!#.EGrpB*; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/
partners/7142/users/3338670318734125865;noCookies=t", "c":0, "tagtype"
:"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..
Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyr
ef="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo
 PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 
0..Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-
2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pa
th=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOn
ly..Set-Cookie: anj=dTM7k!M4/zDYwpWDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/O
e3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$R[?:Eh_6Pg-pR%Tg_ *(?xr gop`
NqNaof#OjN5KKeWQINOZ(a83B$kWHcRf'bg3ZWqzB)h AeC`f3/xEegOkYoh:fcK@dWME4
!!#.EGrpB*; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adn
xs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8.
.Date: Fri, 30 Jan 2015 06:28:50 GMT..Content-Length: 149..ANX_async_l
oad({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/71
42/users/3338670318734125865;noCookies=t", "c":0, "tagtype":"img"});font>....<<< skipped >>>

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40eD>[gVDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/Y80@ZS`Hx0>T_Y49tMfoNxz?y/#4Q6Nl*te#_cLub#x4P4n B0:QTd)6P=@r:QpD#udz^x).8'y!!@6X1[bm:


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DF7TG]DgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/Y80@ZS`Hx0>T_Y49tMfoNxz?y/#4Q6Nl*te#_gK3AQXej=u#HiYe8<.[g-nweNIQ!9(r9Wa)bro3 jBkpjyCW.Q`x[=]=!3; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 104
ANX_async_load({"url":"hXXp://pr.ybp.yahoo.com/sync/msft/3338670318734
125865", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-s
tore, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 1
6:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml",
 CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA
 PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; pat
h=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; 
domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40DF7TG]DgEREg(Pm?
gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<
4iyG8z^YPs)seRD(`[)6*h?qCW6/Y80@ZS`Hx0>T_Y49tMfoNxz?y/#4Q6Nl*te#_gK
3AQXej=u#HiYe8<.[g-nweNIQ!9(r9Wa)bro3 jBkpjyCW.Q`x[=]=!3; path=/; e
xpires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Con
tent-Type: application/javascript; charset=utf-8..Date: Fri, 30 Jan 20
15 06:28:51 GMT..Content-Length: 104..ANX_async_load({"url":"hXXp://pr
.ybp.yahoo.com/sync/msft/3338670318734125865", "c":3, "tagtype":"img"}
);....
<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DDv<yXDgEREg(Pm?gvnX.PLv_V3gGB#XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s H<4iyG8z^YPs)seRD(`[)6*h?qCW6/bBQi G 2ycOwV0=@Z/M>5p'lgQ.*9LhVvSTHGi5(IO?9d]`yKliAh-ebzBj>Vntg:X'nLv-Bf7$FUVdFCpCbK!=w6e^U.^)


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:51 GMT

Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:2
8:51 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Sat, 31-Jan-2015 06:28:51 GMT; domain=.adnxs.com; HttpOnly..Conte
nt-Type: text/html; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:51 GMT
..Content-Length: 0..

GET /adview.php?tz=1422599332803860&pid=789&kid=4&wmid=3826&sid=4&nvc=1&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.11

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /dpixel?source=appnexus&eid=5&id=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cms.quantserve.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Connection: close

Content-Type: image/gif

Set-Cookie: mc=54cb24a3-7fc98-808b4-b008d; expires=Sun, 31-Jul-2016 06:28:51 GMT; path=/; domain=.quantserve.com

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"

Cache-Control: private, no-cache, no-store, proxy-revalidate

Pragma: no-cache

Expires: Fri, 04 Aug 1978 12:00:00 GMT

Content-Length: 35

Date: Fri, 30 Jan 2015 06:28:51 GMT

Server: QS

GIF89a.......,.................D..;..

GET /adscript.php?pid=2344&ord=1422599332&rdclick_0=hXXp://n18.ad.ad-srv.net/c/pfc9mz4nx5zb1se?tprd= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://n18.ad.ad-srv.net/request_content.php?s=8264270407502918&a=ee4d221a

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: accado.adspirit.de

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:52 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 46.163.123.38

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

Set-Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6bb9; expires=Sun, 01-Mar-2015 06:28:52 GMT; domain=.adspirit.de; path=/

x-oread: 1422599332.6915

Set-Cookie: accado_ex=; expires=Sat, 30-Jan-2016 06:28:52 GMT; domain=.adspirit.de; path=/

Content-Length: 3537

Connection: close

Content-Type: text/javascript; charset=iso-8859-1
 if(typeof(document.asm_excl) == "undefined"){ document.asm_excl = new
 Array(); } document.asm_excl = document.asm_excl.concat(String("").sp
lit("|")); .. var asm_ex = false;. var asm_ex_all = false;. for(var as
m_i=0; asm_i<document.asm_excl.length; asm_i  ) { if(document.asm_e
xcl[asm_i] == "333"){asm_ex = true; break;}}. for(var asm_i=0; asm_i&l
t;document.asm_excl.length; asm_i  ) { if(document.asm_excl[asm_i] == 
"w383" || document.asm_excl[asm_i] == "p2344"){asm_ex_all = true; brea
k;}}. if(asm_ex_all){}. else if(!asm_ex ). {.   var adspirit_pid = "23
44"; document.write('<div class="asmbeacon" style="position:absolut
e; left:0px; top:0px;"><img src="hScr' 'ipt" type="text/javascr'
 'ipt">\n<' '!' '--\nvar asm_swf = "hXXp://cdn5.adspirit.de/bann
er/accado/333/2014-12-23/0_OtrivinNight_160x600_GER.swf";\nvar asm_hre
f = "hXXp://n18.ad.ad-srv.net/c/pfc9mz4nx5zb1se?tprd=hXXp://accado.ads
pirit.de/adclick.php?tz=1422599332436976;pid=2344;kid=333;wmid=7152;ws
id=383;uid=132;ord=1422599332";\nvar asm_alturl = "hXXp://cdn5.adspiri
t.de/banner/accado/333/2014-12-23/0_OtrivinNight_160x600_GER.gif";\nva
r asm_alttext = "Hier klicken!";\nvar asm_trackown = "";\nvar asm_h = 
\'600\';\nvar asm_w = \'160\';\nvar asm_fid = \'5223618\';\nvar asm_fl
ashvars = \'&clickTag=http://n18.ad.ad-srv.net/c/pfc9mz4nx5z
b1se?tprd=http://accado.adspirit.de/adclick.php?tz=142
2599332436976;pid=2344;kid=333;wmid=7152;wsid=383;ui
d=132;ord=1422599332;ct=0;target=&\';\nvar asm_overr<<< skipped >>>

GET /ttj?id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=5714350744169141427; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/ttj?id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 0
....


GET /bounce?/ttj?id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=4197282237715168703; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 1067
!function(){function n(n){try{if(!window.location.ancestorOrigins)retu
rn;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r  )n.c
all(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}func
tion r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch
(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==
window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.docu
ment.referrer||null,location:n.location.href||null,isTop:n===window.to
p})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top}
)}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,
l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].refe
rrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l
==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c=
"&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="ht
tp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5
ZFPG0.' c '&id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=Tri
balFusion"></scr' 'ipt>')}();....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1422599328&bdh=oGl7eEGDjG7_f9UEmByxs5ZFPG0.&bdref=http://partners.freeridegames.com/my_games?gameId=659050&bdtop=true&bdifs=1&id=1430727&referrer=VVV.freeridegames.com&ext_inv_code=TribalFusion HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=4197282237715168703; sess=1


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 9486557

Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 603
document.write('<iframe frameborder="0" width="728" height="90" mar
ginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http
://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkH
GL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqV
c47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAEC
wAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgA
MAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeride
games.com"></iframe>');document.write('<scr'   'ipt src="h
ttp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');ont>....<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40eCxrEQDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7y!8Gn8IPO.Q`x[G)pL5; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 124
ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=39136398759
4223&m=3338670318734125865", "c":9, "tagtype":"img"});HTTP/1.1 200 OK.
.Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires
: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/
w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo
 BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338
670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain
=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan
-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k
!M40eCxrEQDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7y!8Gn8IPO.Q`x[G)pL5
; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; Ht
tpOnly..Content-Type: application/javascript; charset=utf-8..Date: Fri
, 30 Jan 2015 06:28:48 GMT..Content-Length: 124..ANX_async_load({"url"
:"hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=33386703187341
25865", "c":9, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M40eCxrEQDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7y!8Gn8IPO.Q`x[G)pL5


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7xuSO(en2hurZozfKKZ)9'Ey=t tl); path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 144
ANX_async_load({"url":"hXXp://pixel.ad.mlnadvertising.com/sync.ashx?pa
rtner=2591&psid=A1001&puid=3338670318734125865", "c":8, "tagtype":"img
"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragm
a: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="h
ttp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo
 OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Se
t-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 
06:28:48 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/;
 expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..S
et-Cookie: anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY
7xuSO(en2hurZozfKKZ)9'Ey=t tl); path=/; expires=Thu, 30-Apr-2015 06:28
:48 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javasc
ript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:48 GMT..Content-Leng
th: 144..ANX_async_load({"url":"hXXp://pixel.ad.mlnadvertising.com/syn
c.ashx?partner=2591&psid=A1001&puid=3338670318734125865", "c":8, "tagt
ype":"img"});....
<<< skipped >>>

GET /tt?id=2488352 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://cdn.castplatform.com/scripts/au1107.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7xuSO(en2hurZozfKKZ)9'Ey=t tl)


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 1093
<html><head></head><body style="margin:0;padding:
0"><script>!function(){function n(n){try{if(!window.location.
ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.l
ength;o>r;r  )n.call(null,window.location.ancestorOrigins[r],r)}cat
ch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.
call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isT
op:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.p
ush({referrer:n.document.referrer||null,location:n.location.href||null
,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,i
sTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="
",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l&
gt;0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.
ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeUR
IComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write
('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1422599329&bdh=SO
02yqyQkNY1WzO0jjXO3C2hywU.' c '&id=2488352"></scr' 'ipt>')}()
;</script></body></html>....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1422599329&bdh=SO02yqyQkNY1WzO0jjXO3C2hywU.&bdref=http://cdn.castplatform.com/scripts/au1107.html&bdtop=false&bdifs=4&id=2488352 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M40DErk#WDgEREg(Pm?gvnX.%phwSNS v_o5U_uNN4b'Q.QlY7xuSO(en2hurZozfKKZ)9'Ey=t tl)


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 18232338

Set-Cookie: anj=dTM7k!M40DF7/.XDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/S6aPHH9q)kTnJ!7 !!(xI $oV=; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 733
document.write('<a href="hXXp://ams1.ib.adnxs.com/click?Jm3f6PTrYz_
K_u-gdtVgPxsv3SQGgaU_yv7voHbVYD8lbd_o9OtjPx9Cpc0NW_EnKatJQvdWVS6hJMtUA
AAAACD4JQB2AgAAnwMAAAIAAAASNBYBivQFAAAAAQBVU0QAVVNEACwB-gBqlQAACO0AAgU
AAQIAAIYAESnnugAAAAA./cnd=!nQZoPwjd6aACEJLo2AgYiukXIAA./referrer=htt
p://ib.adnxs.com/tt?id=2488352/clickenc=http://track
.popmog.com/c/2047054/click?subid=2488352&sspdata=ams1CK
nWppL03tWqLhACGJ-Ele3c4db4JyIPMTkzLjEzOC4yNDQuMjMxKAEwocmspgU." target
="_blank"><img width="300" height="250" style="border-style: non
e" src="hXXp://cdn.adnxs.com/p/47/d1/cc/6b/47d1cc6bf034a7bd1124aee8bed
80309.gif"/></a>');document.write('<scr'   'ipt src="http:
//cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');
....
<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40DF7/.XDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/S6aPHH9q)kTnJ!7 !!(xI $oV=


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.FDYRWSDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/SHKDc^PfPZpsQhBj).8'y!!@8vS[`i/; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 118
ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=333867031873412
5865&Red3=MSAN_pd", "c":7, "tagtype":"iframe"});HTTP/1.1 200 OK..Cache
-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat,
 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/po
licy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS C
OM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318
734125865; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; domain=.adnx
s.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 
06:28:49 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.FD
YRWSDgEREg(Pm?gvnX.CwKyvPkDi2)(c> XPj#_T(p*J-T=]W!G`/SHKDc^PfPZpsQh
Bj).8'y!!@8vS[`i/; path=/; expires=Thu, 30-Apr-2015 06:28:49 GMT; doma
in=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset
=utf-8..Date: Fri, 30 Jan 2015 06:28:49 GMT..Content-Length: 118..ANX_
async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=3338670318734125865
&Red3=MSAN_pd", "c":7, "tagtype":"iframe"});....
<<< skipped >>>

GET /mapuid?member=364&user=3025970665045060 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:1[3[Hoa0/F)8.O-$603R5q6i1/2#/lJ?/VpOZL9.==pg3Z1o>K?Sinn[iS[.`h>x=S7a5IPX/JZLPeW[*4>.VDs!]t)L9Xc^<

DNT: 1

Connection: Keep-Alive

Host: ib.adnxs.com


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4NRk4^POYh1**c*_YHiBKs; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:28:50 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40*eTF> e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4NRk4^POYh1**c*_YHiBKs


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)50[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4N/xEe59::j$P)Zu/w2MKsQ4uVNN/t]SL>( D; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.plat
formID=AN&src.visitorID=3338670318734125865", "c":7, "tagtype":"img"})
;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: 
no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http
://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OU
Ro SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-C
ookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:
28:50 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; ex
pires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Set-
Cookie: anj=dTM7k!M4/AgN>u2e6AqeU2k_YVvO89'^:30/=Xr<8yhflgxB-Y)5
0[0<Xf?d0S*Cx_>Twf4E-fyEG6gQ[8u0afNZHcFLkER)ZYrAfHq#H':[4N/xEe59
::j$P)Zu/w2MKsQ4uVNN/t]SL>( D; path=/; expires=Thu, 30-Apr-2015 06:
28:50 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/java
script; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..Content-Le
ngth: 141..ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sy
nc?src.platformID=AN&src.visitorID=3338670318734125865", "c":7, "tagty
pe":"img"});....
<<< skipped >>>

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M4/bdWIy(e6AqeU2k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nYqJi!T:oRXyhPj/WWIyJLfW#ze'?uVl!*0Y3%QF'8-LtlBN0C@Xc([2X$-7M=RCup_x`Mg89pk!$:(B>G8a)bro3 jBkpjyCW.Q`x[V<9uh


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M416epbG-e6AqeU2k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh5^()<YQK02H(V#f(*JoK51j?mh5p'lM#`xo'$bjcmJJy3#Fa*Y=>saUG344H^ta?sTqJCY1:EGQ*$H6!^!-ka:G(j89; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 177
ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=b
z0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338670318
734125865", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: n
o-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 200
8 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xm
l", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM 
STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; 
path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; Http
Only..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GM
T; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M416epbG-e6AqeU2
k_YVvO89'^:30/=Xr<8yhe@@av*yQ)dC)/^r13.=nZ:IQ!H2oSV'.4r)c'6CbVjbCeh
5^()<YQK02H(V#f(*JoK51j?mh5p'lM#`xo'$bjcmJJy3#Fa*Y=>saUG344H^ta?
sTqJCY1:EGQ*$H6!^!-ka:G(j89; path=/; expires=Thu, 30-Apr-2015 06:28:50
 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascrip
t; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..Content-Length:
 177..ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?v
code=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3338
670318734125865", "c":6, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=3338670318734125865; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUKEgjI0QwQChgBIAEoATChyaymBRChyaymBRgB; anj=dTM7k!M40uCy@^UDgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$R[?:Eh_6Pg-pR%Tg_ *(?xr gopqeR'hVvSTHGi5(3o3Yzjyf:HFP='pmP_--61?dm`'zpGapuKimcFH9AC'0$*bbQME^F *


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3338670318734125865; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/zEs8>[DgEREg(Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$R[?:Eh_6Pg-pR%Tg_ *(?xr gopqeR'hVvSTHGi5(3o3Yzh'zYd1/#jfHKDc^Pt.v@iXbTE)C?fsOY5<h:QpD#udz^x).8'y!!@7sBE^$V; path=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Length: 104
ANX_async_load({"url":"hXXp://pr.ybp.yahoo.com/sync/msft/3338670318734
125865", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-s
tore, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 1
6:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml",
 CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA
 PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3338670318734125865; pat
h=/; expires=Thu, 30-Apr-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:50 GMT; 
domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/zEs8>[DgEREg(
Pm?gvnX.PLv_V(N4v[XM'F1]0r/Oe3/4R(m!-W(0Mo[aFkfVIuK((VePyRW1PlGm@/s A$
R[?:Eh_6Pg-pR%Tg_ *(?xr gopqeR'hVvSTHGi5(3o3Yzh'zYd1/#jfHKDc^Pt.v@iX
bTE)C?fsOY5<h:QpD#udz^x).8'y!!@7sBE^$V; path=/; expires=Thu, 30-Apr
-2015 06:28:50 GMT; domain=.adnxs.com; HttpOnly..Content-Type: applica
tion/javascript; charset=utf-8..Date: Fri, 30 Jan 2015 06:28:50 GMT..C
ontent-Length: 104..ANX_async_load({"url":"hXXp://pr.ybp.yahoo.com/syn
c/msft/3338670318734125865", "c":5, "tagtype":"img"});..<<< skipped >>>

GET /pagead/conversion_async.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 16812024849658634379

Date: Thu, 29 Jan 2015 18:48:02 GMT

Expires: Fri, 30 Jan 2015 18:48:02 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 2921

X-XSS-Protection: 1; mode=block

Age: 41917

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=86400
...........Yms.8..._a..G\.....9.\O.M..........P.-kcK.%.Mb...H.:Lvo.f2.
.. H....... ....w..;3.....f..k.....Hg...3...."..c>.. ..;q..<.P..
...J..eB8~!....RR.u|...LS..L...t..c..$r..X.^......5N.t;.KD.[a[KL...v;.
......<...I..{=.NB1....n..V.8..q......yv......d.f.E.2B..Me.Yq....m.
2.O&......d/.....d.2.."[email protected]..)......V.-&.C...B..=Mc.0. ....O.f..
[email protected].]l......d......&......1.....&a[.`.K.%.J..l.$|.G<O%...N..
..YgB..D.#...........d...!Z.K.d..s@..~..z..qBw.C.o....:..$..61,x....V.
:\....S..~2..AV.K.B....h-...u..X.......b.....Y....^l.o.e.7s.I........2
.5v3..!\.....^.}6..K.....z.>.......'.\...EKwrC'ngzO.u.g..W......u..
O.....8.....E`..v....!U..........R ....>.OC.......2.g...`<.kt.|8
..ZT..i 1....M.....$A..>...q......<....}.....?..S.B.gv..g......&
..6.Roiq..M[.....Y..9... ...7.Di.-..h*.v.g.O.C,yn``......4.Z.$Z...j..k
.=XK)......%. 1m...IW.HeI.....j..m>..:..,).\^..<~.&....n.*.\.s.F
q..YE_gy......b..<7.<..&...U.....<.Bd.yp.IW.U.....h.\......3.
[..Z......H.._.S...S.;X^ .."[email protected]_-zoX..v.....C......W],t...RN.
].h...{W6.@....#eN.6a.....4t_.Z....q(.u.._.5t.2nq.N.)V...k`.".\^..A.4.
k...1B....V..g....)r..k.J..V...-.L...A.$.!_.\..o.]..........[eCP.Vb].;
...z.....~?......&.....h.B.Rs......X..:T.-.7.;...P.../X..i=`..z.>8.
....D.. ....^...OB.F...D....P.>.8...Wi...[5<.{..e..m.D.v....k'L.
.....[VS0.........5..]@......^.......L.M.FD..0.....:.|.7h...y...M.....
..<...gW....N..f.k ...X...n...>....y....K........a.0.v.G.P.B...P
^....)D.........jN....8.C.`79[.l.0..0.Z.7<^.1-......<...*.k.<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=1 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 2564

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA4AAbAKqAlAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:05 GMT

Server: Apache

Set-Cookie: JSESSIONID=05476F06A19909C94435A29F9D3C22E7; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=2429367150&ipr=y HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com.ua


HTTP/1.1 200 OK

Content-Type: image/gif

Date: Fri, 30 Jan 2015 06:26:40 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Fri, 30 Jan 2015 06:26:40 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic,p=0.02..GIF89a.............!.......,...........D.;.
.

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEApfEU0DWxeRF9Lv1AOMPzs= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=513433

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:26:40 GMT

Etag: "54cb0a52-1d7"

Expires: Thu, 05 Feb 2015 18:26:40 GMT

Last-Modified: Fri, 30 Jan 2015 04:36:34 GMT

Server: ECS (ams/D1DC)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0.......>.i...G...&....cd ...2015
0129200000Z0s0q0I0... ............([email protected]....>.i...G...&...
.cd ...._.M.[........?;....20150129200000Z....20150205200000Z0...*.H..
...........P.m.%E.......c.q..2g...m/ ..?./<B.....y..d..B....B.V-...
h32.....1...`j.{...........l.&.......N{.Ui ..$.....|...s.8.n.]@....F.7
.`;...!..dX...q......r..,.....I<.......o...J<.$......=..w.FW@u..
C-...6...e..A......N/H...p...eu....,k..K.&Z.Vq............5....HTTP
/1.1 200 OK..Accept-Ranges: bytes..Cache-Control: max-age=513433..Cont
ent-Type: application/ocsp-response..Date: Fri, 30 Jan 2015 06:26:40 G
MT..Etag: "54cb0a52-1d7"..Expires: Thu, 05 Feb 2015 18:26:40 GMT..Last
-Modified: Fri, 30 Jan 2015 04:36:34 GMT..Server: ECS (ams/D1DC)..X-Ca
che: HIT..Content-Length: 471..0..........0..... .....0......0...0....
...>.i...G...&....cd ...20150129200000Z0s0q0I0... ............(..A.
[email protected]....>.i...G...&....cd ...._.M.[........?;....201501292000
00Z....20150205200000Z0...*.H.............P.m.%E.......c.q..2g...m/ ..
?./<B.....y..d..B....B.V-...h32.....1...`j.{...........l.&.......N{
.Ui ..$.....|...s.8.n.]@....F.7.`;...!..dX...q......r..,.....I<....
...o...J<[email protected]/H...p...eu....,
k..K.&Z.Vq............5........
<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=513316

Content-Type: application/ocsp-response

Date: Fri, 30 Jan 2015 06:26:40 GMT

Etag: "54cb02dd-1d7"

Expires: Thu, 05 Feb 2015 18:26:40 GMT

Last-Modified: Fri, 30 Jan 2015 04:04:45 GMT

Server: ECS (ams/49E2)

X-Cache: HIT

Content-Length: 471
0..........0..... .....0......0...0......P.s..)...... ..y.H....2015013
0035000Z0s0q0I0... .........H...{....*.....04....P.s..)...... ..y.H...
..p.x.f..7.L.%o. ....20150130035000Z....20150206040500Z0...*.H........
..........W......q.Zg.l.."...q.]7.F.#.`.X...h..g2..:[email protected]......
...y.i...ocx... ..G|N`3.......-....n..[.......k.0....L.X>:.......3]
%H..=.p>..w.kBH.CUK.N....P2Y......z.h.v....D_"d..`...Q.....D.3-(.!j
=.l.~h ..-V...ug.A.p..G....L..}Fq*tzX:..."..s.....u...s.LHTTP/1.1 200 
OK..Accept-Ranges: bytes..Cache-Control: max-age=513316..Content-Type:
 application/ocsp-response..Date: Fri, 30 Jan 2015 06:26:40 GMT..Etag:
 "54cb02dd-1d7"..Expires: Thu, 05 Feb 2015 18:26:40 GMT..Last-Modified
: Fri, 30 Jan 2015 04:04:45 GMT..Server: ECS (ams/49E2)..X-Cache: HIT.
.Content-Length: 471..0..........0..... .....0......0...0......P.s..).
..... ..y.H....20150130035000Z0s0q0I0... .........H...{....*.....04...
.P.s..)...... ..y.H.....p.x.f..7.L.%o. ....20150130035000Z....20150206
040500Z0...*.H..................W......q.Zg.l.."...q.]7.F.#.`.X...h..g
2..:[email protected]... ..G|N`3.......-....n..[.......k.
0....L.X>:.......3]%H..=.p>..w.kBH.CUK.N....P2Y......z.h.v....D_
"d..`...Q.....D.3-(.!j=.l.~h ..-V...ug.A.p..G....L..}Fq*tzX:..."..s...
..u...s.L..<<< skipped >>>

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=2fd197815403&r=9474794&cr=58636&sc=14046&re= HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=2fd197815403_73_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /site/4229?id=18072662458704962385&redir=http://a.tribalfusion.com/i.match?p=b3&u=$_BK_UUID HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://a.tribalfusion.com/p.media/avmPwnWHFXomUZdmVjnodfB3qni2tym3AZbFpFUZd0GMUYcZbY0VvMmaBS3bYWTFbZaUPv4PEbXSsFtQdFr1drnVA3M2GMYXbZbBUAir2PvcR6bK2Wrt1WBKndTM363Y4VnaUs38Uc78RAFuWd33UFMS5bIqWaMrVTMlQEJKSG3ZdQbesRHnbUVbaeua0Go/2713736/frame.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: tags.bluekai.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:48 GMT

Server: Apache/2.2.24 (Unix)

X-XSS-Protection: 0

P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="hXXp://tags.bluekai.com/w3c/p3p.xml"

Pragma: no-cache

Expires: Thu, 01 Dec 1994 16:00:00 GMT

Cache-Control: max-age=0, no-cache, no-store

Location: hXXp://a.tribalfusion.com/i.match?p=b3&u=QGc9Yy99999kB1+D

Content-Length: 0

Set-Cookie: bkc=KJ0nRsHQmsfJpnO98Ux/A1790zU9Lczb98Qw8ev6YM9y79NZxrWn1Sw02lmM3G2Cx49O tzupQ==; expires=Wed, 29-Jul-2015 06:28:48 GMT; path=/; domain=.bluekai.com

Set-Cookie: bkdc=wdc; expires=Wed, 29-Jul-2015 06:28:48 GMT; path=/; domain=.bluekai.com

Set-Cookie: bklc=0; expires=Wed, 29-Jul-2015 06:28:48 GMT; path=/; domain=.bluekai.com

Set-Cookie: bkst=KJhMRVQPRs9xREY61e9l1M1p1MsN1ezyLExp1gRyUSO0mQx9PWXsgQ==; expires=Wed, 29-Jul-2015 06:28:48 GMT; path=/; domain=.bluekai.com

Set-Cookie: bku=CH999v9A0NxcAz9n; expires=Wed, 29-Jul-2015 06:28:48 GMT; path=/; domain=.bluekai.com

BK-Server: a1ea

Content-Type: text/html
HTTP/1.1 302 Found..Date: Fri, 30 Jan 2015 06:28:48 GMT..Server: Apach
e/2.2.24 (Unix)..X-XSS-Protection: 0..P3P: CP="NOI DSP COR CUR ADMo DE
Vo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="hXXp://tags.bluekai.com
/w3c/p3p.xml"..Pragma: no-cache..Expires: Thu, 01 Dec 1994 16:00:00 GM
T..Cache-Control: max-age=0, no-cache, no-store..Location: hXXp://a.tr
ibalfusion.com/i.match?p=b3&u=QGc9Yy99999kB1+D..Content-Length: 0..S
et-Cookie: bkc=KJ0nRsHQmsfJpnO98Ux/A1790zU9Lczb98Qw8ev6YM9y79NZxrWn1Sw
02lmM3G2Cx49O tzupQ==; expires=Wed, 29-Jul-2015 06:28:48 GMT; path=/; 
domain=.bluekai.com..Set-Cookie: bkdc=wdc; expires=Wed, 29-Jul-2015 06
:28:48 GMT; path=/; domain=.bluekai.com..Set-Cookie: bklc=0; expires=W
ed, 29-Jul-2015 06:28:48 GMT; path=/; domain=.bluekai.com..Set-Cookie:
 bkst=KJhMRVQPRs9xREY61e9l1M1p1MsN1ezyLExp1gRyUSO0mQx9PWXsgQ==; expire
s=Wed, 29-Jul-2015 06:28:48 GMT; path=/; domain=.bluekai.com..Set-Cook
ie: bku=CH999v9A0NxcAz9n; expires=Wed, 29-Jul-2015 06:28:48 GMT; path=
/; domain=.bluekai.com..BK-Server: a1ea..Content-Type: text/html..<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQxsL2eHTbKwjJcY2gHLbXTx2GdSQQUp6KDuzRFQD381TBPErk+oQGf9tsCEAKOMv/kt6CYURxbwlEF3S8= HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: tb.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1365

content-transfer-encoding: binary

Cache-Control: max-age=408156, public, no-transform, must-revalidate

Last-Modified: Tue, 27 Jan 2015 23:47:24 GMT

Expires: Tue, 3 Feb 2015 23:47:24 GMT

Date: Fri, 30 Jan 2015 06:28:54 GMT

Connection: keep-alive
0..Q......J0..F.. .....0.....70..30........T..I\....zk.v.*4.8..2015012
7234724Z0s0q0I0... ........1....6..2\ch.-...a.I......4E@=..0O..>...
......2.....Q.[.Q../....20150127234724Z....20150203234724Z0...*.H.....
........C0q...H.9.N!.v.a.(......7.{...E.......mwH6..F...O]..Of.O...}R.
.u."E.B.......a..S.$.A...[.4.Z.p.Q..B....).....P.$...5_..w...,c..../O.
..R./O..I&v....|[.....e<.....Y2.1$.z..WR.,.d\p...1........G`a....A.
v..6.g.GI `}.4...a5...>.....x.0Yw....|...^p......f^...L">...z0..
[email protected]...*.H........0<1.0...U....US1.0..
.U....Thawte, Inc.1.0...U....Thawte SSL CA0...141204000000Z..150304235
959Z0H1.0...U....US1.0...U....Thawte, Inc.1"0 ..U....Thawte SSL OCSP R
esponder0.."0...*.H.............0...........1nD.D....f.!F..-..D...w.r.
^...'..n;.s#.9]Yc..Kx.....L......E...z...\..g.35a4S......E..v t..g....
.:..q.'..............Y/.)"....5..S....f.(]b...2e... ...Z..i`..qO..G..d
.x d5.at.1\.>.O...D./..=?..{^..........T...M8.......a. y.b,..KH....
)B.ph.........*A..........d0b0...U....0.0...U.%..0... .......0...U....
....0... .....0......0"..U....0...0.1.0...U....TGV-B-24610...*.H......
.......y.....0.PU..>f...>...s..........*..^.U...N.y'?nt.-..H..o.
.....A...1H......|....:(..l$l:......g....Z...d.nn.....P....t.g.M./....
.6f..N>.}[email protected]..../.....Wm$U.?.....u.|.....j..)0..k..,.(.....9..
%p.........'a_*..J&.a......lv.....~..O./.......R.|......(V.W....<<< skipped >>>

GET /UTNAddTrustServerCA.crt HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crt.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-x509-ca-cert

Content-Length: 1162

Last-Modified: Tue, 07 Jun 2005 08:09:10 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0..n.......RB.JO7.CiHz.g.]'0...*.H........0o1.0...U....SE1.0...U..
..AddTrust AB1&0$..U....AddTrust External TTP Network1"0 ..U....AddTru
st External CA Root0...050607080910Z..200530104838Z0..1.0...U....US1.0
...U....UT1.0...U....Salt Lake City1.0...U....The USERTRUST Network1!0
...U....hXXp://VVV.usertrust.com1.0...U....UTN-USERFirst-Hardware0.."0
...*.H.............0...........8?....9.Qg.m...X... ...T..8....!yH..at.
..<jr.<.g:9. ..f...3.l......uy.F^...j..*U..T.......]..m..q.k....
...1w...z.2. ..8n..^#.E.{P..0... z.[.3@...........].......i.....!...i.
.3.).F...I4.iQ....h.fL.>.a......=.|.L..^k.....(..M..s.n.......vD..c
...I.....2.H[........0..0...U.#..0......z4.&...&T....$.T.0...U.......r
_&.(.C.].7....K..E0...U...........0...U.......0....0...U. ..0.0...U. .
0{..U...t0r08.6.4.2hXXp://crl.comodoca.com/AddTrustExternalCARoot.crl0
6.4.2.0hXXp://crl.comodo.net/AddTrustExternalCARoot.crl0...*.H........
.....`d9Y.Ce......3..S....#.l..dYSS..6....Ny/.....*Amq..x8#.pK....."b.
...Q.-...E....~..2...5^n.,hh.....U../.@..."\m......3(f...3......y.....
..R.?....>...._..IC.9}./..u]~gg..Y @.7"..C.0.C...]m.)....bc...7.og.
.bW9..M.*a=....w ./..r....x.'..`.......k$.....Kh.....?..

GET /AddTrustExternalCARoot.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 494

Last-Modified: Fri, 30 Jan 2015 05:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0.....0...*.H........0o1.0...U....SE1.0...U....AddTrust AB1&0$..U.
...AddTrust External TTP Network1"0 ..U....AddTrust External CA Root..
150130053254Z..150203053254Z.00.0...U.#..0......z4.&...&T....$.T.0...U
........0...*[email protected]..*..: ..../.5....a]..-q...}.s4..Q...
.....X.m..3I!.....G4.;*[email protected].,R.B..F9..........
.T......L.^..kDPv."..QA.z0CNm..T...r...NO...'.R5!.o}..<q.....x.$Ol.
EL..d...xy.0..N...*...2.q..4&\.b=6u_..?.v...._.O}...&...8'..@.\.......
.q ......

GET /js?wp_id=2566327&&clickurl=hXXp://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58416_a_gpr=AA==_a_w3hr=73_a_w3hurl= HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad4.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:49  0100

Connection: close

Cache-Control: max-age=600

Content-Type: application/x-javascript

ETag: 14365449

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:49 GMT; path=/; domain=.adfarm1.adition.com;

Content-Length: 1105
if(typeof(ad_wid) == 'undefined'){ var ad_wid = Math.round(Math.random
()*2000000000); var ad_count=0;}try{adjsver=Adition_Environment.getVer
sion();}catch(e){adjsver=0;}var iframe, ref;try{a=Adition_Referrer();i
frame=a[0];ref=a[1];}catch(e){iframe=0;ref='-'}var os;try{os=Adition_O
SId();}catch(e){os=''}var browser;try{browser=Adition_BrowserId();}cat
ch(e){browser=''}var h5;try{h5=Adition_Environment.H5('611001758907203
5866');}catch(e){h5=new Array('','')}var screen_res;try{screen_res=Adi
tion_ResId();}catch(e){screen_res=''}var fvers;try{fvers=Adition_Flash
();}catch(e){fvers=''}var prfstr;try{prfstr=Adition_Prfstr(2566327);}c
atch(e){prfstr=''}document.write('<script type=\'text/javascript\' 
src=\'hXXp://ad4.adfarm1.adition.com/banner?sid=2566327&adjsver=' adjs
ver '' prfstr '&co=1&fvers=' fvers '&iframe=' iframe '&ref=' ref '&os=
' os '&browser=' browser '&h5=' h5[0] '&h5s=' h5[1] '&wi=' ad_wid '&ac
=' (  ad_count) '&screen_res=' screen_res '&wpt=J&clickurl=http..

GET /xre/107/1078532/922460/image/922460.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: flashtalkingad1="GUID=258658AC9B8964"

DNT: 1

Connection: Keep-Alive

Host: cdn.flashtalking.com


HTTP/1.1 200 OK

x-amz-id-2: yc6G6yd4knM8NS4f5F0SX60dNRigRAiWTyDV0eTrIffWHsFipAnlOE72kVU WL1tyqPs3tLygPE=

x-amz-request-id: 3AE12336DE85C8B0

Last-Modified: Thu, 22 Jan 2015 10:08:17 GMT

ETag: "639c9edd245180f07fbc923883e24803"

Accept-Ranges: bytes

Content-Type: image/gif

Content-Length: 19150

Server: AmazonS3

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive
......JFIF.....H.H.....C..............................................
.........          ...C................                               
                  ........,..........................................K
...........................!..1AQ"4Rqs....2STa...#3Bt$5r....Cb..&6G...
...................................F........................!..1Q2Aq..
."Sa.....4Bs.....#3Rr...$Cb..D.c..............?.. ...Q......I(Ns...1V&
lt;..Y.z.&....f."~U9..}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....
D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...G
W..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.
?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}&
gt;o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u
|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5..
..D7...GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7..
.GW..._.?*dC}>o.u|..5....D7...GW..._.?*dC}>o.u|..5....D7...GW...
_.?*dC}>o.u|..5....D7...N{P..SP..........>.^...`d.5.S.6;-..-....
.3*Q...........h....jZ1...a.7o.z......hBs.yJ).:|Z...z......:.......>
;R...3.{...QZ.../.O,v...a..#vg.......}.._..X.?K....F..E.O..Ej.....<
..~....<.......:......:yc../...y..=..?.u...?R.t..i._v.(.7fz/z.0. W.
~.........>Q.n..^..a.V...K......}.|..........._a.....;O....G..3.{..
.QZ.../.O,v...a..#vg.......}.._..X.?K....F..E.O..Ej.....<..~....<
;.......:......:yc../...y..=..?.u...?R.t..i._v.(.7fz/z.0. W.~.........
>Q.n..^..a.V...K......}.|..........._a.....;O....G..3.{...QZ...<<< skipped >>>

GET /xre/107/1078532/922460/image/922460.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

If-Modified-Since: Thu, 22 Jan 2015 10:08:17 GMT

DNT: 1

Connection: Keep-Alive

Host: cdn.flashtalking.com

If-None-Match: "639c9edd245180f07fbc923883e24803"

Cookie: flashtalkingad1="GUID=258658AC9B8964"


HTTP/1.1 304 Not Modified

Content-Type: image/gif

Last-Modified: Thu, 22 Jan 2015 10:08:17 GMT

ETag: "639c9edd245180f07fbc923883e24803"

Date: Fri, 30 Jan 2015 06:28:53 GMT

Connection: keep-alive

HTTP/1.1 304 Not Modified..Content-Type: image/gif..Last-Modified: Thu
, 22 Jan 2015 10:08:17 GMT..ETag: "639c9edd245180f07fbc923883e24803"..
Date: Fri, 30 Jan 2015 06:28:53 GMT..Connection: keep-alive..

GET /banner/twiago/761/2014-12-18/0_NCR_NE_Kampagne_Performance_1114_00_000_300x169.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: cdn5.adspirit.de

DNT: 1

Connection: Keep-Alive

Cookie: accado_uxid=8fc00634a8649e9d2fd1d495b77044622498817d5ae25d62a1f34042120d6ab9; accado_ex=


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: image/jpeg

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

ETag: W/"438958732"

Last-Modified: Thu, 18 Dec 2014 14:37:29 GMT

Expires: Mon, 09 Feb 2015 06:28:53 GMT

Cache-Control: max-age=864000

Strict-Transport-Security: max-age=31536000; includeSubdomains

X-Frame-Options: DENY

Content-Encoding: gzip
9899.............zuT.O........5.....5.k....'.C.....5...>@pwM.$...v.
.w.....s....W...so.]...x-..............'..Y7K......<l....Dq.uuu...t
.s.[9ZXsX:.8=..8.9.8....N..PkW......1...ot4. 1:}.*.....-D...Z.[M...j)d
E'!N#.)..s.Y...x......bt......g...._$.P1:...4...42...4 .......F@....'.
............G...-.' [email protected].?t=?....S..........8....8.x8yx...@
.....'..N...d.....'W....?..-..\...-.....TU.-...-.....E.w.../3.Gj....5.
.5...............C.l.....yQ..e.-.`...J.bt... .......<H.._..$...--#.
 .#. - %$#% ..2.'^..9>Yi.g*i.7...../.............y..............?x.
.W^a..ksWG..GG.....[GWG.........>.........._ge.] ..V...0..M.0..P/$.
....1..XZ.....,.B..\@k>.^n..........[..L...A.........z............k
..M...;...p.......]...... ....{...-22....EE...>...../........<.&
lt;..0.......h....n..&...-..........o.`[email protected]..)...........|. ..?8.g[.
0...X..$..dT.4.tlt..4..3.....A.M.).Id.L.C.H.../.EOZ...%.....*.^F..0m..
....b...._0XVG...Y"2*2..:.:.*2.....A}..&.i....O.^.}...bSZ......2(...T 
[email protected][email protected]...#.c....0B..=Sy.....9]=.Mm].S..W.g
.:..a1~........8ch2i.....j._.n.h.zK...I..i.3......Q. vg`..X.........).
.%......~T...i0...Z.)[email protected].#^T..e...}
..]...mU;.d.!."j.....$..xg.>o.O:...._.iJM/3.d..x#..... .2..........
..H.~S..p.I.."..y..m...;..,Qw......W.8.EY...Wx..t...jk......T)<*...
.w.u...X."..s..#.6?.at.d.d..nl..9..DNs..*..nz5....j.D..K..x..ifXv.....
...a.....4!.....W...$..."..J.......GeK...b.j....L#..y.=tx...F.......i]
..,...C8.#~NV...h...5..K/lr.....c=...3........y..DJ..b.KTj..-.e...<<< skipped >>>

GET /rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6+MgGqMQQUYHtmGkUNl8qJUC99BM00qP/8/UsCCwQAAAAAAS9O4UUM HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.globalsign.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: application/ocsp-response

Content-Length: 1514

Connection: keep-alive

Set-Cookie: __cfduid=d64ec4b2c798119623175276f88c7e8071422599333; expires=Sat, 30-Jan-16 06:28:53 GMT; path=/; domain=.globalsign.com; HttpOnly

Last-Modified: Thu, 29 Jan 2015 16:30:16 GMT

X-Powered-By: Servlet/3.0; JBossAS-6

ETag: 7b29ae1b1bb3659ef51be7354d0197767ef2663d

Expires: Sat, 31 Jan 2015 06:28:52 GMT

Cache-Control: public, max-age=86399

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9cac2d370485-FRA
0..........0..... .....0......0...0......"... H([email protected]|.`......2015012
9163016Z0n0l0D0... .........W......#....*..2..1..`{f.E....P/}..4....K.
......./N.E.....20150129163016Z....20150130163016Z0...*.H............d
x4D3.&;X2....3w........m.c.Zh.....kl.n.S.o.R2k....G[..4..^..V..(.L....
.`,n...9..._...M...5.;..hD.{.x&.X.Wu4m&S.|.4./.=..*2f&...c....b."....j
/....)....C..%..~.|.......L...2........"`v.jY....-R..'K.r.Z.`.3.~.6.Y/
.............TF.m.F._...}..P7....o...J..B.......0...0...0..........E..
...i..y... 0...*.H........0W1.0...U....BE1.0...U....GlobalSign nv-sa1.
0...U....Root CA1.0...U....GlobalSign Root CA0...150106000000Z..150331
000000Z0Y1.0...U....BE1.0...U....GlobalSign nv-sa1/0-..U...&GlobalSign
 OCSP for Root R1 - Branch 10.."0...*.H.............0.........V-...b.%
.q.A$..D..2wh..5.......}o..rB.s.....jj........cO...q.......8r?.F(....S
....?!......F-.F(.EEe.\(mF...E...[.3.6.Z.h.q.?g..L....Gb.9h...(n......
..{-.....U$.N.;.Qx.a..n..YQ.*).....Sl..t.6........2..W....4?...5sb..8.
.>.,. ..^.y>..@%..ql.[.....1.!..$...5........0..0...U...........
0...U.%..0... .......0...U.......0.0...U......"... H([email protected]|.`....0...
U.#..0...`{f.E....P/}..4....K0... .....0......0L..U. .E0C0A.. .....2._
0402.. ........&hXXps://VVV.globalsign.com/repository/0...*.H.........
.....Cz.$8.....^l.Z...[..X.7].Ig.......b.s{.M m.....wp..{w..`.1..*....
9e......@B,Z.....G.W...g  .-b.....#.....H&&.8.}.K1a...~L?....0Y*rhg..!
..i..\sl...5.o...^.k..M.....J.......{8....8/.......L.1.hT.>.....WG.
......5.[.9.'.....*............W......X....UA..9.#w)...<<< skipped >>>

GET /pixel.gif HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: load.s3.amazonaws.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

x-amz-id-2: 3vnf ZkCzVLgw6cXperl9HOuDeDXaTsGvF6WJh50c4ySF15QoVLyD9vU5Pjrn1SLE5IJfpB08Os=

x-amz-request-id: 7DA14F31EEBD6CF5

Date: Fri, 30 Jan 2015 06:28:59 GMT

x-amz-meta-s3fox-modifiedtime: 1297679395316

x-amz-meta-s3fox-filesize: 43

Last-Modified: Mon, 14 Feb 2011 11:09:26 GMT

ETag: "fc94fb0c3ed8a8f909dbc7630a0987ff"

Accept-Ranges: bytes

Content-Type: image/gif

Content-Length: 43

Server: AmazonS3

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..x-amz-id-2
: 3vnf ZkCzVLgw6cXperl9HOuDeDXaTsGvF6WJh50c4ySF15QoVLyD9vU5Pjrn1SLE5IJ
fpB08Os=..x-amz-request-id: 7DA14F31EEBD6CF5..Date: Fri, 30 Jan 2015 0
6:28:59 GMT..x-amz-meta-s3fox-modifiedtime: 1297679395316..x-amz-meta-
s3fox-filesize: 43..Last-Modified: Mon, 14 Feb 2011 11:09:26 GMT..ETag
: "fc94fb0c3ed8a8f909dbc7630a0987ff"..Accept-Ranges: bytes..Content-Ty
pe: image/gif..Content-Length: 43..Server: AmazonS3..GIF89a...........
..!.......,...........D..;..

GET /plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1f4ae9d4166d89&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffd050ac5b52afc&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.facebook.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Location: hXXps://VVV.facebook.com/plugins/like.php?app_id=170803223095607&channel=http://static.ak.facebook.com/connect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1f4ae9d4166d89&domain=partners.freeridegames.com&origin=http%3A%2F%2Fpartners.freeridegames.com%2Ffd050ac5b52afc&relation=parent.parent&href=http://VVV.facebook.com/pages/FreeRideGames/148336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&show_faces=false&width=100

X-Content-Type-Options: nosniff

X-UA-Compatible: IE=edge

Vary: Accept-Encoding

Content-Type: text/html; charset=utf-8

X-FB-Debug: kkUpOgfWsQkEQHF4B puJczPFgJAE8IQx KqCRMW4VBZC0 kH4vwWGg0TPpnHfjDB0M234LBnNuGr4ZFp8RbhA==

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive

Content-Length: 0
HTTP/1.1 302 Found..Location: hXXps://VVV.facebook.com/plugins/like.ph
p?app_id=170803223095607&channel=http://static.ak.facebook.com%2
Fconnect/xd_arbiter/DU1Ia251o0y.js?version=41#cb=f1f4ae9d4
166d89&domain=partners.freeridegames.com&origin=http%3A%2F
%2Fpartners.freeridegames.com%2Ffd050ac5b52afc&relation=parent
.parent&href=http://VVV.facebook.com/pages/FreeRideGames/1
48336198517456&layout=button_count&locale=en_US&sdk=joey&send=true&sho
w_faces=false&width=100..X-Content-Type-Options: nosniff..X-UA-Compati
ble: IE=edge..Vary: Accept-Encoding..Content-Type: text/html; charset=
utf-8..X-FB-Debug: kkUpOgfWsQkEQHF4B puJczPFgJAE8IQx KqCRMW4VBZC0 kH4v
wWGg0TPpnHfjDB0M234LBnNuGr4ZFp8RbhA==..Date: Fri, 30 Jan 2015 06:26:40
 GMT..Connection: keep-alive..Content-Length: 0..<<< skipped >>>

GET /MEQwQjBAMD4wPDAJBgUrDgMCGgUABBSxtDkXkBa3l3lQEfFgudSiPNvt7gQUAPkqw0GRtsnCuD5V8sCXEROgByACAwI6dg== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: g.symcd.com


HTTP/1.1 200 OK

Server: nginx/1.4.7

Content-Type: application/ocsp-response

Content-Length: 1363

content-transfer-encoding: binary

Cache-Control: max-age=455915, public, no-transform, must-revalidate

Last-Modified: Wed, 28 Jan 2015 13:01:57 GMT

Expires: Wed, 4 Feb 2015 13:01:57 GMT

Date: Fri, 30 Jan 2015 06:26:40 GMT

Connection: keep-alive
0..O......H0..D.. .....0.....50..10......7).nj./P(.3.\\.;.B....2015012
8130157Z0f0d0<0... ..........9.....yP..`...<.......*.A.....>U
....... ...:v....20150128130157Z....20150204130157Z0...*.H............
.t.L~...vz..h.22..lK.iK...'ec...FR.... ....!..q*......1E..5r*,...]M..|
'..`e.UJ..S.._.jnGy......tT~.f..8.N.g0.V....!3........E...]b..........
d..6.......z?.........Y....6........a%......T|...-]D.2[.......4.%.A.w.
...................2. Jsa.Jb.R,.f.....>J....6o.....0...0..}0..e....
....:}0...*.H........0B1.0...U....US1.0...U....GeoTrust Inc.1.0...U...
.GeoTrust Global CA0...141201130534Z..151216130534Z02100...U...'GeoTru
st Global CA TGV OCSP Responder 30.."0...*.H.............0............
\.hpc..J.a.j-.t......F`Aw...)L.YE.2..~..-...2.Y(.".CZ.w..T..Y. syd....
.x..YE..<....lwv.:J.76>U....uF.a.|8N.. ..1p...`f.X...B>x.....
.........6..m.&...'..W.plK....[.m.V..h..lI.........?~.....>.|'....o
...A!.Pm.*.N ...<.....3...*|.x._..1..m.W<*....._S.............0.
.0...U.#..0....z.h.....d..}.}e...N0... .....0......0...U.%..0... .....
..0...U...........0...U.......0.0!..U....0...0.1.0...U....TGV-B-2830..
.*.H.............~....2!...V..0...Y....L..k....z}~a.3Y.x..dS.L...Dk$a.
..nR9_......B......m....Y....U.5....'.....<{....v&=.2].....j*.r(7..
.=..w.I...z....\.#.J.ac.....I.[.[....6.X....0...g.3d...z.i.H..f...v...
..\.....^.N..1.J<.)`Z.....4.-.E..n.E.~t....v.e.T...?. ......i..%...
.<<< skipped >>>

GET /r/dd/id/L2NzaWQvMS9jaWQvMjg0NjAyMTcvdC8w/url/hXXp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=$!{TURN_UUID} HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://dmp.theadex.com/r/104/6/?c=100315090728510000

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: d.turn.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily

Server: Apache-Coyote/1.1

P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0

Pragma: no-cache

Set-Cookie: uid=3614204343869728150; Domain=.turn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; Path=/

Location: hXXp://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid=3614204343869728150

Transfer-Encoding: chunked

Date: Fri, 30 Jan 2015 06:28:51 GMT
111..<html><body><p>Redirecting to <a href="http:
//dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&am
p;axd_fuid=3614204343869728150">hXXp://dmp.theadex.com/d/104/i/2.gi
f?c=100315090728510000&axd_pid=13&axd_fuid=3614204343869728150
</a></p></body></html>..0..HTTP/1.1 302 Moved 
Temporarily..Server: Apache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml",
 CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Co
ntrol: max-age=0, no-cache, no-store, private, must-revalidate, s-maxa
ge=0..Pragma: no-cache..Set-Cookie: uid=3614204343869728150; Domain=.t
urn.com; Expires=Wed, 29-Jul-2015 06:28:52 GMT; Path=/..Location: http
://dmp.theadex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_f
uid=3614204343869728150..Transfer-Encoding: chunked..Date: Fri, 30 Jan
 2015 06:28:51 GMT..111..<html><body><p>Redirecting 
to <a href="hXXp://dmp.theadex.com/d/104/i/2.gif?c=1003150907285100
00&axd_pid=13&axd_fuid=3614204343869728150">hXXp://dmp.thea
dex.com/d/104/i/2.gif?c=100315090728510000&axd_pid=13&axd_fuid
=3614204343869728150</a></p></body></html>..0.
.<<< skipped >>>

GET /tags/FreeRideGames/ROWROS/tags.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: tags.expo9.exponential.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: CP="NOI DEVo TAIa OUR BUS"

X-Function: 151

X-Reuse-Index: 1

Date: Fri, 30 Jan 2015 06:26:40 GMT

Last-Modified: Fri, 21 Nov 2014 17:25:27 GMT

ETag: 4408853015460759652

Expires: Fri, 30 Jan 2015 07:26:40 GMT

Cache-Control: max-age=3600, public

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Content-Length: 2305

Connection: keep-alive
...........Y.o.F..L...~(.Z.d..h.p..)` >.....3.....R$.\Y.]....7..s.)
@L..kg.3;.|.%a.?.t.....x...]....m..j|t.M.y....7./,... S.1.._.e?...i..l
)...a.F\..,..?..dAB. X..V..tJ.M6g.$cs?"G.....Bhw..I.p._..b .67O.".;.L 
.YB..,.I.......5......3.G.c..u..V#Y..........B.....k...R.}...>P...k
"".{1....)Z.#h.d...N..a.. !.(..d...<.......x.'9"4i/.......%.].....i
......\`R]}.)o.VR16....c..</..(~ge....s.t.........\..)(.<\.....T
.<_...M(.|.7.,..........L.....P.....W2.)3..8/F..O...i........6...pk
....bS.`...D...;...U-...H.2t..y.`.n2.b.@h..<.7kt....2|.>[email protected].
@lvMT.YK.0:.r.)..|.b..p......._*...O,..:.!...e.]K...T.`..:$..(`..$.x.b
..'..0v6%C.{r"..E..V =v[....O..U...,...8.f1...~..U.t...`T{.....e"tt.T.
F)..(..........d>I.9..q..."...#. "..p..vH.;...."|.3..k`p.|..x.?..k&
lt;..#f#.."Mx.C"..O1y.hk.....IS %r....^.x.....a........|.I.jQ.3.|WrK..
.eo.....b.r.;S.........R.~.. n..(<{.8....r...E.a..4....i.IS..!{.9..
..?mf ..~.....#:..t.........s8..Oc.....~.......u...'....{..Y...YJ.?}..
.~...>........kZ..L.m:$4M....g.O..\)..*..xx..B....3....y.B-6.r.....
[email protected]*...E.._.....'8 ...gd...\.Y ._......m.....v.....)&>.
..gp.K>..^.g......q.}.]......$.-l..D...T=..6..g.z...i.S\C.dP..p.~..
T...,..}-...cW'J...lq..[.....`Y..;...C..n.8. .Z .!...g...b..~.X....A..
f.7..)L|.c~d...".W;.qK.N[[email protected][..s.W."...Z.u...$~ c.M.m
jh...Z.......,...4.....ad.{.T.L........zQ.1...M..,S~c.......<.LZ.:P
.e......xu.1<w..n.>...d.9l.`..3..........<.?......o.....G....
l..gt....4............u.S..akt7..Y.le..........c2.T.....5}........<<< skipped >>>

GET /adview.php?tz=142259933223254&pid=789&kid=4&wmid=4178&sid=4&nvc=1&swid=3826&target1=- HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: a.twiago.com

DNT: 1

Connection: Keep-Alive

Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; deuxesse_ex=586=1422599632|579=1422599632|580=1422599632|585=1422599632|582=1422599632|583=1422599632|446=1422599632|447=1422599632|449=1422599632|450=1422599632|451=1422599632|452=1422599632|453=1422599632|454=1422599632|564=1422599632|566=1422599632|567=1422599632|568=1422599632|569=1422599632|570=1422599632|571=1422599632|584=1422599632|462=1422599632|581=1422599392|623=1422599392|624=1422599392|680=1422599392|681=1422599392|679=1422599392|671=1422599392|625=1422599392|730=1422599392; deuxesse_tgt=000000000


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Server: Apache/2.2.15 (Red Hat)

Last-Modified: Fri, 30 Jan 2015 06:28:53 GMT

P3P: policyref="hXXps://help.adspirit.de/w3c/adspirit.p3p", CP="NOI DSP COR NID PSAo PSDo IVAo IVDo OUR STP UNI COM NAV DEM"

Cache-Control: no-store, no-cache, must-revalidate

Expires: 0

Pragma: no-cache

x-own: 80.237.180.11

Access-Control-Allow-Origin: *

Access-Control-Allow-Credentials: true

x-pr: -1 / -1

Set-Cookie: deuxesse_uxid=8fc00634a8649e9d2fd1d495b7704462e02780d10de5fad08bc5d70725814a55; expires=Sun, 01-Mar-2015 06:28:53 GMT; domain=a.twiago.com; path=/

Content-Length: 43

Connection: close

Content-Type: image/gif

GIF89a.............!.......,...........D..;..

GET /gsorganizationvalg2/MFMwUTBPME0wSzAJBgUrDgMCGgUABBReGXQV/tqUV3SNMRE+s25eR/vhjwQUXUayjcRLdBy77fVztjq3OI91nn4CEhEhsdKok21jslbiISkSn7ME6Q== HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp2.globalsign.com


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:53 GMT

Content-Type: application/ocsp-response

Content-Length: 1499

Connection: keep-alive

Set-Cookie: __cfduid=d64ec4b2c798119623175276f88c7e8071422599333; expires=Sat, 30-Jan-16 06:28:53 GMT; path=/; domain=.globalsign.com; HttpOnly

ETag: b4925491c4fa563b81fe34d05f3a704f7bad5d28

Expires: Sat, 31 Jan 2015 06:28:52 GMT

Last-Modified: Thu, 29 Jan 2015 07:40:14 GMT

Cache-Control: public, max-age=86399

CF-Cache-Status: HIT

Server: cloudflare-nginx

CF-RAY: 1b0b9cad4fd80485-FRA
0..........0..... .....0......0...0........1..aq.....P%]....<..2015
0129074014Z0u0s0K0... ........^.t....Wt.1.>.n^G.....]F...Kt....s.:.
8.u.~...!....mc.V.!).........20150129074014Z....20150130074014Z0...*.H
...........$."...*.......(r(2.........J..l........V(.......H8.f..RJe._
........2... .\.?.z....!>...0O.^.H......:i..O....{......t_?4uk...`&
gt;.v...aK[(..j.........;..0d.........Y.`.;.K}..../[email protected] t.T...
-92.).......iC\z.R.(....S8-...O.......y....]Nn..*....Cj5..{>.......
0...0...0...........!m...Oq....-d)..#0...*.H........0]1.0...U....BE1.0
...U....GlobalSign nv-sa1301..U...*GlobalSign Organization Validation 
CA - G20...141212164309Z..150312164309Z0..1.0...U....BE1.0...U....Glob
alSign nv-sa1F0D..U...=GlobalSign Organization Validation CA - G2 OCSP
 responder - 11.0...U....201412121742000.."0...*.H.............0......
....{`D|L.......T..Sfj..[8....\...!...k..@>...H..T,...K.vI.v.kZ....
...'.^....4.d....dx.X......>X...O9>.p.....=..d#;@.......x.].#.$.
..I...5Z|z:....tY..6o2 7.......7X#.....c.......Z~|...Zk..c.o(.z.*,..y}
.....w.......72.25.!.K.}.......vc..?...Y.........S.M._..[........0..0.
..U....0.0...U...........0...U.%..0... .......0... .....0......0...U..
......1..aq.....P%]....<0...U.#..0...]F...Kt....s.:.8.u.~0...*.H...
...............YJ....KU1... g...N.a.?"Z......>O..o .G~..U.H......k.
.7.(nz/......"u..#. .m!.k.HjZ.3..G.J.9....i.................i.....4>
;...!.c..U...Du...x...0.....6..@u....&.......4<./..[...M.f....o.<
;.....o6.s"w.L....#..4~./.u..v.i.y.=.gR_=.sm.;iK.0.w..g......oq..)<<< skipped >>>

GET /c.gif?anx_uid=3338670318734125865&Red3=MSAN_pd HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c.bing.com

DNT: 1

Connection: Keep-Alive

Cookie: SRCHD=MS=3187714&SM=1&D=3093912&AF=MSN005; SRCHUSR=AUTOREDIR=0&GEOVAR=&DOB=20131118; MUID=1785AC2FD94664211AC0A9A6DD466620


HTTP/1.1 302 Redirect

Cache-Control: private, no-cache, proxy-revalidate, no-store

Pragma: no-cache

Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Fri, 30-Jan-2015 10:28:49 GMT; path=/;

Set-Cookie: MUID=1785AC2FD94664211AC0A9A6DD466620; domain=.bing.com; expires=Sun, 29-Jan-2017 06:28:49 GMT; path=/;

Set-Cookie: MR=0; domain=c.bing.com; expires=Wed, 29-Jul-2015 06:28:49 GMT; path=/;

Date: Fri, 30 Jan 2015 06:28:49 GMT

Content-Length: 0
HTTP/1.1 302 Redirect..Cache-Control: private, no-cache, proxy-revalid
ate, no-store..Pragma: no-cache..Location: hXXp://ib.adnxs.com/pxj?bid
der=108&action=SetMSCookies("MUID=1785AC2FD94664211AC0A9A6DD466620
|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")..Server: 
Microsoft-IIS/8.0..X-Powered-By: ASP.NET..P3P: CP="BUS CUR CONo FIN IV
Do ONL OUR PHY SAMo TELo"..Set-Cookie: ANONCHK=1; domain=c.bing.com; e
xpires=Fri, 30-Jan-2015 10:28:49 GMT; path=/;..Set-Cookie: MUID=1785AC
2FD94664211AC0A9A6DD466620; domain=.bing.com; expires=Sun, 29-Jan-2017
 06:28:49 GMT; path=/;..Set-Cookie: MR=0; domain=c.bing.com; expires=W
ed, 29-Jul-2015 06:28:49 GMT; path=/;..Date: Fri, 30 Jan 2015 06:28:49
 GMT..Content-Length: 0..

GET /free/frg/products/680950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 27 Sep 2010 13:17:16 GMT

Content-Type: image/jpeg

Content-Length: 17864

Accept-Ranges: bytes

X-Varnish: 2052680186 2052559201

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......S......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?..y7..k.5.......P .$...................^.D.......=:....V...
6..<..{x.u..g2..J.a...../....SE..f&.Q"..9y...%1,.......X..|..O%y..I
..[.... .......0 ..5.d&2F.\...%w$^k./...1].........K...i$r)R}.....e...
...6.S......M....Y...4..dp.O8L,....u..x-....6...?h.l4../hw"..-!J.5....
.....Ij.#.P.....?....`.a#"...(.......5.9SP.J..l&.Mv...T.( .f.l....b^`.
d....X.J...n.Fs..n.Z=..r.^........1...0l.>g...5&..z.....Pt...y... .
...z.=.Y1....1 .E.......By..<T......Z.........K..#)...w..S....W...5
[email protected].}.k,i:... ...:.x.K..(....8qu...1.......&..,..%..{.KP.X..?...q..
..^...g.x.&n-......M~yZ~a~tj.e.OM&............G..6..S.......n.N.....,.
P.<.H......b]Y.Okl..^..7...2.%<x.n..kJ}.....U.O.C.....IdQ.......
:..(.K`..|2....!(.{.../ZS2#..\..bj<..k...p."J......./..2N,4P.x.Vb .
.6;u..........I..)....'.s.6w#.4..U".Kl..]6m...U.UNv-5.H...g$.A...U3S.&
..O.........2..S.....c...!.../]f.E$..H>...V..m......0I.((..9Ts2<<< skipped >>>

GET /free/frg/products/558350/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 06 Dec 2010 09:43:23 GMT

Content-Type: image/jpeg

Content-Length: 25436

Accept-Ranges: bytes

X-Varnish: 322100293 321464524

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......P......Adobe.d....................
......................................................................
......................................................................
......................................................................
.............!.1.A".Qa2#....q.R.$....B.3S.%..rC4..b.cs.T.5U'..........
.............!1..AQaq."......2...BR..b#.r..3..CS...$4%............?...
....\....l....)(.*J......oK...F...@..)....^r..uD...Q1...&3h.....Z N.D.
....:..}.}$e..9....U.-(..KpR8R..M.$.xsT4..<@8*...P...-k.....2.Q5D..
.O...we=..L..u..}.. .....pp....}B......"|.<.'tr.X.YO....gm).S.1....
&m..:.*....zN8\.].h...Vd..)..D......."4..l2~........h&...-.&...Li.-...
.5..e.ql...... ...7.(=E"k..c........;-..D...W.U.y.U..UN8...Q....^.../L
].m...u.<[email protected].....[h....../.62......8.)# ...Fa...lv|..y..>..[..f
...#."z...;.........V.\[email protected]..?6.......XY.b."L. .b.b...T./
.M[?.c...0.P8.!<@....$..r.O...^....l.^A.!.3\SbI.;.....f:..Dj....%%.
.....'.. ..[l^.........5<.....T....8...z.z\UW.O..'...8..s......d...
a.M...N".!8.. ..N...:.%d.f..M.}'...x.FBwDT......Z]h._}....Y.\9....R...
.z\y..=...e.y.&...Ui.N...Wp..[.....!p.4..^.Z.'.L;j$.=.q.l..\J%.)%.)..u
.....O.9.:..R.........h....K.".Cs...5.!........3.}/..I,.....c..>U..
y8f'....l...)...5v?..8...!.=e....a.c...n....&..C.z.7<..m..8.....T..
.........P.........0(!.9...K.4...8..nc....'....rn_.j.e.`...j.. Q...-7.
...H........M.....fG..f..0..`....#........f..np...y..2|jIA...P....w.wE
Y.fp............"E..! }lR...6.`....".@HJ*......w.8...o.....S...!L.<<< skipped >>>

GET /free/frg/products/624150/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 27 Sep 2010 13:16:46 GMT

Content-Type: image/jpeg

Content-Length: 24320

Accept-Ranges: bytes

X-Varnish: 2052680344 2052348253

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......X......Adobe.d....................
......................................................................
......................................................................
......................................................................
..............!..1".AQa...q2.R#...B.t....br.3Ss$%7...c4T.u...CD.5..&6'
8........................!1..AQaq....."r...2B.4.R.#3....bs$%5......Cc.
.............?...w._....YE"]S.Q,@IP..R.t.?]><h....t....GL....d..
..x..D.{}....j........].c.e..Z.a............J.....J...L.. [email protected]'R.h...
[..M.[.....1.Sb=!6....N>..%....y.S....z.....{k...a..D.../...5..P.;D
....D..........].lvo.C..8......l.Ej....R....q.S.$1#.......9...)..6.P.-
2.M..`[email protected].|k...... h0.....,Z.1e.b....%.XuL..2..q.R.C.QJ
...<dUt...6H$i.n..b..).7s.Zv.s.nzDV..hN..6V9...G.\......b.?..\....@
O.$2.......B....<...%jO...<#(.#.o.8....e;...SB$.Z..i.p.T......."
>%.....}......q.i...g{.......J.z....Y...Hqk_Z....m$.I..nq.>$%aR-
.]:m.......Q.%`......x...]...vJ.P....w.0j.....}.9*T.n..8...2.](AQ.!>
;e... ....... N...L.0qUV..V....?.n.......QS.l.^V#..D.W....[...;..Y....
i................j...H&S..%.S......kT...e.{.....Z....j.)..ss.gC...x...
..,.I.b...q.l....{T.'...>.S.a.Wx1..|.o...r.<..>...e.......s..
&*f ....F.mhy..}-..t.h....`x'A...`..Q!...2...bg............&.E.!.8m$EE
m..z...%..0.<.O.4.cN..qI.wFk....J.B...yk...XL`..5....&.=zkM.NG....$
I.W.=.k.....;be.>\a..R.:.......GX:..k..xA.8x....'.|y.."..~.'drB....
......~Q....o#..(..W. ..........t...o.v4......dv.-%E=...2;........<<< skipped >>>

GET /free/frg/products/582150/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Wed, 26 Jun 2013 10:47:21 GMT

Content-Type: image/jpeg

Content-Length: 38149

Accept-Ranges: bytes

X-Varnish: 2052680370 2052221020

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......d.....mhXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6F9A17903439E2119
55FE55656C7D978" xmpMM:DocumentID="xmp.did:2564C0E0DE4D11E2A95ED3BB715
3D468" xmpMM:InstanceID="xmp.iid:2564C0DFDE4D11E2A95ED3BB7153D468" xmp
:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom s
tRef:instanceID="xmp.iid:5F9B6107DCC611E295048EF1D728ED69" stRef:docum
entID="xmp.did:5F9B6108DCC611E295048EF1D728ED69"/> </rdf:Descrip
tion> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>
....Adobe.d...........................................................
......................................................................
......................................................................
................................................."!2#..1ABR3..Qaq.br$.
....CST....cs4%...Dtu&6.....d.5.v.8........................"2..BR...br
#!1...3$...AQ.C4.aq..S%....cs..DT..t5......6.....U&'............?.....
|5..M>.......-...._...x.>........_.|......Yi.Uxz<~....}8.b.M.
..e....."^6I*..r8r..~.m...G....O..n......?.W.......!.M..)..Y.U3.q]<<< skipped >>>

GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTtSK3dy3sA4g6EKqm0CfGsMDTPlgQUUOpzidsp+xCPnuUBINTeeZlIg/cCEAJwu3i4ZpYdN6xM1SVvBys= HTTP/1.1

Cache-Control: max-age = 513316

Connection: Keep-Alive

Accept: */*

If-Modified-Since: Fri, 30 Jan 2015 04:04:45 GMT

If-None-Match: "54cb02dd-1d7"

User-Agent: Microsoft-CryptoAPI/6.1

Host: ocsp.digicert.com


HTTP/1.1 304 Not Modified

Accept-Ranges: bytes

Cache-Control: max-age=513316

Date: Fri, 30 Jan 2015 06:26:40 GMT

Etag: "54cb02dd-1d7"

Expires: Thu, 05 Feb 2015 18:26:40 GMT

Last-Modified: Fri, 30 Jan 2015 04:04:45 GMT

Server: ECS (ams/49E2)

X-Cache: HIT

HTTP/1.1 304 Not Modified..Accept-Ranges: bytes..Cache-Control: max-ag
e=513316..Date: Fri, 30 Jan 2015 06:26:40 GMT..Etag: "54cb02dd-1d7"..E
xpires: Thu, 05 Feb 2015 18:26:40 GMT..Last-Modified: Fri, 30 Jan 2015
 04:04:45 GMT..Server: ECS (ams/49E2)..X-Cache: HIT..

GET /my_games?gameId=659050 HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive



%.. ..L../..|r....ii.....?.(P.n..\.%Ns...f4..ZS&}I%.)%}.......BC....q.
.e.....'U...o...\N.L...Q.Yn(.......&.T*..6..c..o.W]A.6..GQ.*....F../..
..n.$.r...(.*&k:..RP.g.!T.j|o<c....Y.i.X!.yIV...K....P..<lH*..Y.
...Y..)*...B.d*..@V!..P!...P!ST...B.d*..]k....9{si...0c..Po.O..d.O...!
A...).......H....%Y...>..O../TI.JN...rr..L..d.If.$'..VI...'.8.S....
d.I..d.&9=_h.L...h4.CM>.Y(..BY(.)...d^...g).%T...7.{4...(....)..I..
.n..*A.rY?.?{%.iD7.,..-.[....../..u.-i..D$...48..........g..<i )...
.......A.]..... Y!......8...3.*...,..X.N..J.....l*2JH..AR.....9..Y..?T
....../...3..a.W.T..~K............q....L.p.mg.q.w...........Ck..b v...
.?...{......#6..V..X.|.V...P.X..p...5o0f.....K/{{.l.Vv.%,dl..M.l..Bc.K
...v..z.........fe..w.Wo.....,.%q8.5.}9................f...^C&.....{.w
.F....H...B..[.q7....,.R..D.....y.ou<z.Z.G."x..g.U8`0.jr.]....K..}N
..0...)c.iy.~..D..2.q.E......%CO".ny...c.....A..].r..........I^? ...4G
.[A.;...[....x..Y.G.W%W.)...&*p..7...t..qBX..a..!.G..x...sG......g..8x
.......t}.Cw..I.RT..VS.Qg...Ex$.M...h.Y...dcx.:kGVm......<....e..YV
xK.C..gJ..TB.`....V*$..V...\[4_.\......./.TK..=!H;A..q^.48Tq). .....V.
..O.N.>I.L.iT..l9..i.}....Z..H.......a3..>u{.X....7.....G....m..
CD]...]Hv.d....;@..I.p.......O..[.S..I..B.....V.... .....W....s..;=S"Q
. .yg.(..MO....,...._......... .4...Wi...1.3,O...fU..|...,.5..."Y.....
<....M..2...u.......HL.Q.Z&.AZ4..V.....Z..s...L...hZ.z*..M'AJ2]..&l
t;.Zy.XV...S.L.U .8o0........ <p........tC...=... .....EjBC>k..g
..V..pe...3..7j..:.o6:..........O.D......F.)...>'..K/.F....d`h.<<< skipped >>>

GET /system/modules/com.exent.owned.cms.utils/resources/js/utils.jsp?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/html;charset=UTF-8

Content-Encoding: gzip

Content-Length: 3577

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
............io.F....?L.FDA.%.h.H...G.l..N.]..hr$MM.*I.R]..}....D...._6
E#....]3..'O .}.D...._......4......D2..h...H...E.z........rB2.1..5.Xv.
....{....\}Y.w.._._w...'=.<j...x*.J.S.9.x..y._..7%...z.....;.9F=g%.
... ...#..9y.<'..>>.s.<g.O...W.........9.x.;.....;.....v0.
"O..k.......s1:.Df.c1O..B...q1.......n.,[email protected].].......y.'-Kc..y.
 ..W..).H..w<;.r...DU.._a..Y...9..R.i:.3vZ.s.]..8.............?....
...5*..y.....x.....G.T<..K..0.A.....2..'....y.r...!.rU...7G........
.Q..f...Z.....M..|.y.....D....[M...,.q,f../...X.T..MC3,...U..&.....p..
.W$._...QdK.....1....D.-..d<)....E.:.$.<J.."c.1<.c."....|.b..
{>,f.V`..m3.I...#.)...zr..4m...A.ZM 91r:^..bZ...%.{.....`1....W.])&
gt;LW.W..."....T^...X|N.4..N!...=0.p..[I.8..=...... .o..v...v(r.....v4
..!....>1... ...A...m.T......P...'...xY..NG..Q ..V...X.j.E....3.y.A
:.K.u.......{...E....,.d'_...v.i4.!g.t...l...%<..i..qG:...<.....
...X...X&w.e.2/..............[...b..f'...yQ......A.r....X1..{9...}'.KC
%]~3.?}b..;..r..]..7..=.......gY:s.J./(.I.8.$.A0GR..RLgo....:.......6=
.c.TJnS.i.W.k.B....b<)........x..$..c[....d.%R.Z....Iw=C.,..V..v...
u. ...}8u.7.a...O..C.;m.Am....]rY..ZFW;...l=&. .......;O..a..H.G.V..Z.
....P~".......{...?..(.Bw*R.........\...2.D....k.. ....\.l..t...q;[[..
.`a.]t~.......:cs..q......d.'*....(.....U.u..;N.ds.L..9.z,M...bwc.w...
....u.......3....\ig h.U....."...t.R....|..3..3DB...&^....~..a$F#..!.]
.:.....X_.a...R../!...$M..7)....k.....I..K.....^.......z.P.&..1..B.d.4
........u.........Ruj.5X..M.f.......n.WJ....!.]..H.U@5a$.p.....ng.<<< skipped >>>

GET /system/modules/com.exent.owned.geo.templates/resources/js/crossDomainCookieSync.js?version=38 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: application/x-javascript;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1428

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:37 GMT

Date: Fri, 30 Jan 2015 06:26:37 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........WmO.H...$.....]"...)i.J.T..PAhuB(.........B............c...
.<...y....^.~.E,`.'.8...9...2.e..!d.)....R`<..$.g..J[.$.YXU..4.)
.....;DlE.T.....o..![.I#..Q_....|%...5O>[email protected].....\."4.......
9.Z.sP.......U......vx.....&&..T..:h..C.....Y..q.........'.7W..5....u.
D.g.y.40L...P}.....:.....`..zrwq;..=..[.c..j.JVj........*.e\W. ....^..
....xts]1Yc.."a!.1K...2% Z..K?.L.s......\.....V.?.O...S...8[...8$l...T
7U.C....=>........U...g..J....$C.^....{..........?n[.].n...w.7..u.c
.....I...f..;m..^.m._;.*.....7d.,..F.zF.azV....u.D..LY$...-.&....d.0.g
.{.|..h|[email protected].].....D...s..#.1.G...=...........ON....)..
)cq*Q..... N#.r3.....Zm.<K.r?....B. I....p'p.....|m]...D}D?..v.U.N.
..eA.d.X.p....*..@.;[email protected]...#.......y{(">..v.q b."
oV)Q.z..jq...H.....u.!3.......o.|N$1.(cIW...m...7lW..g]....:...<...
.V......X.b..........[5.%(.....jC..q..GPd.H8.V)./.^.y`.;.....E..p.....
.w^r.....Fj. w.......,...# R...D[.d..l-.pv.?...'.MF..R.4s..~E\.81LI.TY
..%[email protected]..\.{.........p.B'~...m...|......<..H.E..K...E...#.}.....?]
....H...........m...&.D].w...R ..:zM.V.....2..5u..n........b,O!....F1.
;..]7e)u.)[email protected]:v...q3oE......3.%)((...i(.R....8.s=7..z
......w...d.......N..6J.Rx..$."..OoH/.li:..ei.e...7(.,.D.....T..r..2Y.
d.s.:.{;xX>. ..]A...{;t.B...P[..".m.~...d.Xv........P.w...*Z.u.ei..
.!....dZ.Rw.i.&..qND.......o...5../...R...; G7.....I.....\...........F
>OWo..T....C|.Z...........M.P...*5..S..V.......^..S........
<<< skipped >>>

GET /static/marketing/main/css/main.css?version=38 HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 2803

Cache-Control: max-age=13224

Expires: Fri, 30 Jan 2015 10:07:02 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........Zmo.6.....b."M..._...z..mw..n...h..@[...,........_%R")....a
...p...P|.7Y..`..?.h...DEoQ..7.[.o.7h.>.z.,.%..5B..{.>.<D1...
,..J......).S...(p!i..OG|<...z...Wp ...>..{.L.._.../..x..x7.g...
~.....G.m........3......S.....?}..3....6.PZ...4._..-....wB..7....m.(.P
...1..Cg..{p{J.K..o...,u.2."11i../.W.m.........'.W.r..........n|%.....
n..x.......%[email protected]...&.[.. ..t...)..8..9}..&X.....\.a...a..
.{47.0`....)[email protected]..)...y=......Gpw.o....@._...`..Dp.?..Ml.2.Q.3.
\g...U.l...Xl...#..i..3p:...'..P....}...&^:Y.x...o....<.&..7p.8...z
}2....e......E.2..Y...zo....i2[....tF. .k7.I.....t......".a.=.......HH
r..4|.\R6i..|V.1.@@.z.]...%.".!hy.....9.....q.L.G.j.15...LT{...p2..24.
QDt..j..B.>..0..(..7[...<.....H\.`[email protected]...'.y.......
a.^..#&&A...D....E.Cf$...T.r.r.#......l$Y..6..1...G[9...Mo.#...?30O.5.
.Y.._.#..{9ikVBU......9. ..E..1..o....`N.H.x.Q........-.&..Gm.....z.$.
X...H..4.w...jP..75..z.K.;.k}..F....G.......-K.x#..(.`..H...M.b..UN.A.
...B..8e.5%.r ....W..../}............n..Ix.......*l..6......!I.Iz..*.`
.2.&..'..$..Y<h-Kj.i.....,R.....;=..J=6..1xvw.......^.\8'.{[...iF..
..K.........&n..9L.........NU.d0.|...t..SU....2Ud...4.I...n..[./......
.=PZ[c..a.>.0.P^cI.a..k....VCb...A.~.#{.@.... ..\.4....d.....(..Q..
kena.c...h{.2R.PV..I........&...<H=Gqu(jA...(.:....u..u|7.l... V.Gm
..|i3..S.J*.F,....i.=.6n..j.\m1..R"A [email protected].
O....pt$...Q.....y.X....'.(1.N....%..........h....5uKk......Ph.7..XGBN
.<v.<.<..D&.9?I...>.......}.kT<.k&l.m..c.@U[..',...<<< skipped >>>

GET /static/marketing/main/css/templates.css HTTP/1.1

Accept: text/css

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: text/css;charset=UTF-8

Content-Encoding: gzip

Content-Length: 1650

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive

Vary: Accept-Encoding
...........Ymo.6.....[..I.G.{....4i.uN.z..e.d.....!.M...}|[email protected].
.x.{.............}r.:zqlY..G.,.p..j~.K..l.....*g..k.m.at ..-k.fM...CGX
.B..T.../. .h..eJ...f......hZ.u.m..b.,.d.D#...Yy..Ds..f-.2<....E...
.n...h...>... j-P0_.....G.H...o.:..ny.......Y.x8..Q.G.uVl)](.o.o.p~
=.\.'...y}.K/....(.t......B....Hk.[....A.....`o.J../....G..&..8.(.....
.I..Nc..%. .....b......e.1...?.t..PY.|1.^.4.......7.c.N[ .G.UG....f...
. ..]..3._g.]...kz5l...|U....\^_O.'...6....pC7..x..W....%4s.._..3vj...
 ....w3.Qz][email protected]~...'.<;.<...1...=...H.........W.=V...?.k.~
y.F.`.{K...#w...:O..iZ....!.r.8^U.P..T8.?...;.=<....2.E.....T.g....
3.l....1...B.Qz?Z...".....1......sQ.3E..X!.,S...eH.L.."..g..m..E......
..Q..~{..xuJL(..,%.A.H..Hi........Q.`-.K.n.l...s..O.<.........?..o.
x.X.?..U.`/.J%x...z...$^G.h..w..;..W..-fj!.Sr..L...k.....-.....C....Bj
...a.....'.j..GG.w.J...C.....8*~7.J|.a.Y...JJ\mV..G..Cd..Q.Y..".n.....
7.#..6Bk6;.g....ITE...U......4..5F...5.v>.;"..r5.2.%..aQ...........
T.....6.g.n.#.?..g..r..J...H0.Lp$.....e....~8..s....F.%..u...I.v.l...i
.......B25.e....D#.....L:.M..l.lZ.Y.8...w..L.".?.sF...yGiKu.J!.UYr8.,1
.K.f..R.R..Q.......J......0..6....._..H..;W.{.^_.qXV...j~j..../......}
`.%.......D-.(#.b._....v..,..;..B.b.5.....R...}u........gk....R..Ca^9.
2.2Q..XP/.y.....m...}. .W.^.*....],...._p.....Kf..A.:.)P.e..:AR.E(.;.j
....y..R.7;a.G-..Vh ..........*..-.X.1%.......G....3A...5..W...3....r&
gt;!4..|Q>.(.-.,.S0.....g.D.e..k.k.k ....!.u}50...R..h..\u.../...J#
.~..L......$.......I.0.......D..).....S.q..dDt.>.......kw..._..<<< skipped >>>

GET /static/marketing/header/img/ui_elements.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 26274

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
.PNG........IHDR..............."T....pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......<<< skipped >>>

GET /static/marketing/header/img/logo.png HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 26369

Content-Type: image/png;charset=UTF-8

Cache-Control: max-age=86400

Expires: Sat, 31 Jan 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
.PNG........IHDR................Z....tEXtSoftware.Adobe ImageReadyq.e&
lt;...diTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap
/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#"
 xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xm
p.did:B3983B1C9B50E111B59EE6C32F2CA589" xmpMM:DocumentID="xmp.did:D417
35F6522711E1BBABC9A21DA171C9" xmpMM:InstanceID="xmp.iid:D41735F5522711
E1BBABC9A21DA171C9" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> 
<xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5079397E5F51E11183EA8A
A91EE6894C" stRef:documentID="xmp.did:B3983B1C9B50E111B59EE6C32F2CA589
"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> &l
t;?xpacket end="r"?>......c3IDATx..}.x....;.]....^.{.........C0=$..
HB .BH.PL...B5.....m..\$.jV.]..2..3 i..-2$_..}4..v....s.S....w:~|../..
.<......&.G............._...r#8........."p....t.~.....#m....H[W@...
[email protected]<.G...J.7..G.ZW..F.b.G...XO..#.,...p.NO.....?....
./.*9`.. .A....._....=?M..i./A.{....?......?._..H:..D..|....w.h..... U
..h..G..?Z.Ft.HMX.R.W.....A......8......{.......<$...|...Ep...g9.;^
..................49....To....j.....t%..H.q..@V........<h......v..'
[email protected]. .!.............^..]O..s..'.......M.%.Pp.F..........<<< skipped >>>

GET /static/marketing/main/img/containers/labels_rib.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: partners.freeridegames.com

DNT: 1

Connection: Keep-Alive

Cookie: 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_TURNKEY=Default-481422599182472568; 143_FIRST_BROWSER=Default-MSIE 7.0


HTTP/1.1 200 OK

Server: Apache

Content-Length: 1313

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Content-Type: image/jpeg;charset=UTF-8

Cache-Control: max-age=15205

Expires: Fri, 30 Jan 2015 10:40:03 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......Exif..II*.................Ducky.......P.....)hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
0 61.134777, 2010/02/12-17:32:00        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Windows" xmpMM
:InstanceID="xmp.iid:A53B9BFC558811E1BDBC91B6FE137091" xmpMM:DocumentI
D="xmp.did:A53B9BFD558811E1BDBC91B6FE137091"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:A53B9BFA558811E1BDBC91B6FE137091" stRef:doc
umentID="xmp.did:A53B9BFB558811E1BDBC91B6FE137091"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
......................................................................
..................c...................................................
.................................Qa.b....V.."....U....................
...Q..........S..TU.............?.....;...dz..r$Y..&.C.s5.H...v.=W<
G..-...:X=..rV...Z.QWv.O ..'.<.2...<..&...R..pH0....=2T.z.,I....
.Bv........1.r.....4.e..-|G$.TBj&xt.....;.......<<< skipped >>>

GET /free/frg/products/661050/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Mon, 13 Sep 2010 08:36:31 GMT

Content-Type: image/jpeg

Content-Length: 17879

Accept-Ranges: bytes

X-Varnish: 322100255 321473029

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......R......Adobe.d....................
......................................................................
......................................................................
......................................................................
......s.......!.1AQ..a"q..2.....B#.R..3.b.$r..ÄS...cs.5D'...6.Tdt...
.&.......EF..V.U(........eu........fv........7GWgw........8HXhx.......
.)9IYiy........*:JZjz........................m......!.1A.Q.a".q..2....
...#B.Rbr.3$4C...S%.c...s.5.D..T......&6E.'dtU7....()...........eu....
....FVfv........GWgw........8HXhx........9IYiy........*:JZjz..........
..........?.......n7...5.9.}.o........9.`.... v[-.......1s.0...U......
.[..7..5,_.......{ mZj........[q..}C..8.bW.f.....>%..._.....3.#....
c..7...-kK|.f.mA~...,.V6$.i.j...U>u.........V.Nh...&.....3...4.Sr..
..[....Q)....61'..........;..k{r.O]z.d#...,..JrA.^.X^$.Z.d..j.UHf...s.
!.. S..=.*.[....3.3t......R........n..q....G. k ........ ...&.,\.|....
..>h...........&..~_._...;.......X......B..?...I.....&..U._L..Ei\..
.2}.onM.=>....`....s...|.X..qBz.zy..!......2~....a. ..}...jX.......
MIe......^...x.....".._... .r.HG...sp..5..{|..\.Q..}..?.[...-.<>
..ZR_../Ox.C,.H.X.^-.....w.5z....w}.r.t...C....y.4&..|.d90.....k1"....
.....,.... .R.."N..l.k.. ..AM...........l......n%..... VQ!....|.......
....n.... ...z..\.`.k..2........H..&..X....M.X\|$..v.....9..x....'....
................;......K-W.~}.k..?#..u....G.r$=......I..Z........o8.8b
..h....Zf..H|...C.....I...y<.?I.*A....%..KF.<[email protected]*<<< skipped >>>

GET /free/frg/products/616950/boxshot.jpg HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: img.exent.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

Last-Modified: Wed, 13 May 2009 07:04:16 GMT

Content-Type: image/jpeg

Content-Length: 15113

Accept-Ranges: bytes

X-Varnish: 2052680257 2052294469

Cache-Control: private, max-age=259200

Expires: Mon, 02 Feb 2015 06:26:38 GMT

Date: Fri, 30 Jan 2015 06:26:38 GMT

Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
......................................................................
......................................................................
..........!.1.AQ".aq2..B#...R...b3$...r....CS%........................
!1.A.Qa"....q....2B..Rb#...3..r...$............?.u.kg..e..W..e`.@...:.
......~C..1.7]....f...8..r....5......dn..AVF......9@.>...^..g....Or
[email protected].@$...E......-..(&}.~.......WrY....:...yWI%.....=#.0W....i....H
...H.{....Q.zj<~cI...k...V.h....e.........3.m....'kUc9....[.Un?...`
|.n](...3.jZ....O.u.6.....8.p.v........A...2..^C.....#.8.>"s...K{.-
....fajx...B...Q.NDyj...l.u.W.e8_.......... v..v.. ..A Dm..V..W`T.)"..
.u....m..Tua.A{...Y..E....B....gMm$od....nD....Z..A...{... ha..1...9.m
.l~..........`a...I..4.j...U.p|..\.^....|.g2.......9D.).3.GC.;kg......
g.;.7........=4O(.c.N.. .L.Y3 P../ ...}.s..CB.....qy*[email protected].=
h .GMv.p.p.N..]."../..)....[Y$...(.6.|u..k:.t.......vP~..@.:..b.i.>
......<..p.q..}Q.....6Z...e.U..N?.6.G9y%.{v.........[...-....ww....
b.X,x..@..&j..F.#...(...Et. .LkW.........3.l..x.@w?P.{{.r.$...,...p...
.5......J;.M..n#.6...1,=.f....We....wq..V.h..........#....k.....s.....
........V....{i...~(/23.& .*[px.o..W....od...3[.k.?t.....&}.P......Zw.
.d.{v?.J......v4.....c..t.|g..v.r..7......2.v..#..w.\.k.r..?..s..w....
s7._..~.~.O..|...\{s7....J...h.W......Xkr.......||{.dn..0....7v.......
&....G3A..5......:...K.. V.u.cR...^w&b.........k...64..P|..#......<<< skipped >>>

GET /pagead/conversion_async.js HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: VVV.googleadservices.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 16812024849658634379

Date: Thu, 29 Jan 2015 18:48:02 GMT

Expires: Fri, 30 Jan 2015 18:48:02 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 2921

X-XSS-Protection: 1; mode=block

Age: 41917

Alternate-Protocol: 80:quic,p=0.02

Cache-Control: public, max-age=86400
...........Yms.8..._a..G\.....9.\O.M..........P.-kcK.%.Mb...H.:Lvo.f2.
.. H....... ....w..;3.....f..k.....Hg...3...."..c>.. ..;q..<.P..
...J..eB8~!....RR.u|...LS..L...t..c..$r..X.^......5N.t;.KD.[a[KL...v;.
......<...I..{=.NB1....n..V.8..q......yv......d.f.E.2B..Me.Yq....m.
2.O&......d/.....d.2.."[email protected]..)......V.-&.C...B..=Mc.0. ....O.f..
[email protected].]l......d......&......1.....&a[.`.K.%.J..l.$|.G<O%...N..
..YgB..D.#...........d...!Z.K.d..s@..~..z..qBw.C.o....:..$..61,x....V.
:\....S..~2..AV.K.B....h-...u..X.......b.....Y....^l.o.e.7s.I........2
.5v3..!\.....^.}6..K.....z.>.......'.\...EKwrC'ngzO.u.g..W......u..
O.....8.....E`..v....!U..........R ....>.OC.......2.g...`<.kt.|8
..ZT..i 1....M.....$A..>...q......<....}.....?..S.B.gv..g......&
..6.Roiq..M[.....Y..9... ...7.Di.-..h*.v.g.O.C,yn``......4.Z.$Z...j..k
.=XK)......%. 1m...IW.HeI.....j..m>..:..,).\^..<~.&....n.*.\.s.F
q..YE_gy......b..<7.<..&...U.....<.Bd.yp.IW.U.....h.\......3.
[..Z......H.._.S...S.;X^ .."[email protected]_-zoX..v.....C......W],t...RN.
].h...{W6.@....#eN.6a.....4t_.Z....q(.u.._.5t.2nq.N.)V...k`.".\^..A.4.
k...1B....V..g....)r..k.J..V...-.L...A.$.!_.\..o.]..........[eCP.Vb].;
...z.....~?......&.....h.B.Rs......X..:T.-.7.;...P.../X..i=`..z.>8.
....D.. ....^...OB.F...D....P.>.8...Wi...[5<.{..e..m.D.v....k'L.
.....[VS0.........5..]@......^.......L.M.FD..0.....:.|.7h...y...M.....
..<...gW....N..f.k ...X...n...>....y....K........a.0.v.G.P.B...P
^....)D.........jN....8.C.`79[.l.0..0.Z.7<^.1-......<...*.k.<<< skipped >>>

GET /CRL/Omniroot2025.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: cdp1.public-trust.com


HTTP/1.1 200 OK

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 29 Jan 2015 06:15:01 GMT

ETag: "2015b-6ca-50dc46885cd67"

Accept-Ranges: bytes

Content-Type: application/x-pkcs7-crl

Connection: Keep-Alive

Date: Fri, 30 Jan 2015 06:30:27 GMT

Content-Length: 1738

0...0......0...*.H........0Z1.0...U....IE1.0...U....Baltimore1.0...U..
..CyberTrust1"0 ..U....Baltimore CyberTrust Root..141203203511Z..15042
8204011Z0...0....'k...120111220757Z0....'k...120111220847Z0....'.C..13
0130174530Z0....'....130807173059Z0....'....140122185220Z0....'....140
212185542Z0....'....141112202254Z0....'....100217174732Z0....'#...1003
03201301Z0....'!...100312202204Z0....''q..100414175202Z0....'L...11022
4181251Z0....'Pn..110309142119Z0....'....100216203312Z0....'#...100303
201213Z0....'3#..100908172555Z0....''n..101208175627Z0....''m..1012081
75749Z0....''p..101208175916Z0....'H...110114162156Z0#...'X>..11081
5145134Z0.0...U.......0#...'Z2..110818184101Z0.0...U.......0....'g...1
20111164333Z0....'g...120111164409Z0....'g...120111164519Z0....'....10
0216213519Z0....''s..100414175225Z0....''k..100414181839Z0....'3"..100
908172705Z0....'3$..100908172728Z0....''o..101208175645Z0....''l..1012
08175727Z0....'H...110119195142Z0....'Nz..110302154045Z0....'c...11120
7220933Z0....'g...120111164445Z0....''r..100414175143Z0....'8...101012
182723Z0....'e...120111163041Z0....'VJ..110714160903Z0....'s...1301231
62633Z0....'....130904190524Z0....'....131024214319Z0....'....14012917
2435Z0....'....140129172453Z0....'....131024214310Z0....'....131101204
601Z0....'....140219171632Z0....'.^..140409155638Z0....'i...1407091719
30Z0....'/:..141119193302Z0....'k...120111220827Z0....'8...14071619120
3Z0....'....131219195909Z0....'....140219171545Z..0.0...U........0...*
.H.............7.im~...|.....3........]..Cm...Y.[.......c.J[.....^

<<< skipped >>>

POST /opTools/errorReport.jsp?t=1&e=65&p=0&sty=0&dty=0 HTTP/1.1

User-Agent: AHTTPConnection

Host: player.freeridegames.com

Content-Length: 1856

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: geoCountryCode=UA; gfad_300x250={"refreshCount":2,"sessionRefreshCount":0,"lastRefreshTime":1422599221862}; 143_TURNKEY=Default-481422599182472568; 143_CAMPAIGN_SERIAL_ID=Default-FRG_Website; 143_FIRST_BROWSER="Default-MSIE 7.0"; 143_CT=1; __utma=1.2032673383.1422599207.1422599207.1422599207.1; __utmb=1.1.10.1422599207; __utmz=1.1422599207.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; 143_UDOM=partners.freeridegames.com

tAQAAAAAAADfew-AeQABAAYA2wAuAFAAlAAAAAYAAAAeAAAAqW0AAAIAAAeTZXxGa8NlIFehYGqCMQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAiFeQcAAAAAAAAAAA-AAAeiMUWeN0FiNzdDMUIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:27:24 GMT

Server: Apache

Set-Cookie: JSESSIONID=1589D0DCA44DEE0B8FFDA6064E443A26; Path=/; HttpOnly

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 1

P3P: CP="IDC CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV"

Keep-Alive: timeout=3, max=800

Connection: Keep-Alive

Content-Type: text/html;charset=ISO-8859-1
0..

GET /request.php?zone=kw470o566d2z&nw=33&renderingType=javascript&namespace=e124e8caee&subid=&uid=undefined&screenSize=1716x901&screenSizeAvail=1716x857&clientSize=728x90&scrollPos=0x0&extData[]=&redirectClick=http://c13.w3hoster.de/adsc.php?sw3=14046_a_cw3=58700_a_gpr=AA==_a_w3hr=73_a_w3hurl=http%3A%2F%2Fadfarm1.adition.com%2Fredi*lid%3D6110017597666427860%2Fsid%3D65567%2Fkid%3D1221974%2Fbid%3D3994675%2Fc%3D3001%2Fkeyword%3D%2Fsr%3D0%2Fclickurl%3D&documentReferer=http://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==&ancestorOrigins=null&random=1275017335058&isIframe=1&container=&adPos=0x1970&adPosCheck=1x1971&adtagId=undefined&uidRedirect=1 HTTP/1.1

Accept: application/javascript, */*;q=0.8

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=73&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MjA4OTkxMw==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad.ad-srv.net

DNT: 1

Connection: Keep-Alive

Cookie: uid=27e21e2c0ada99f8


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:52 GMT

Server: Apache

Cache-Control: no-store, no-cache, must-revalidate, max-age=0

Expires: Fri, 30 Jan 2015 06:28:52  0100

Pragma: no-cache

P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"

Set-Cookie: 69b3d346ac=afe30d%3DfQXLE2O3KiDyQNcbF8FSZY5w6Fi4lkGdX5QUslu3%2Fm73SPvly89THKzfBLCj%2FWNvLxY6h9BqYpxRD21ytT2AwXYVTRPwswdC9GKLx5go3FJm%2FxEdyBcwiYvbPuvNgEOXF50qzVcwG8Rv%2FBEZNwjBfHw1RNr; expires=Fri, 06-Feb-2015 06:28:52 GMT; path=/; domain=.ad.ad-srv.net

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 311

Connection: close

Content-Type: application/x-javascript; charset=utf-8
...........R.n. .<.R..qh.C.GS..!......*...........C..af`......-X...
.<M...,............a=`......].....*thG...h....i..vV..P....[e."9.*\D
BgE$....1z.Nbm\..j0....I..@.\2..w.=j.....ss.....p....j.....|..&....J..
[email protected]......{.uY..E>...y.V..J..uY...*.....0.h/y./.C 
W|.f.b..1.Q....e6&v.....d.._.......AH.....

GET /sync.ashx?partner=2591&psid=A1001&puid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.ad.mlnadvertising.com

DNT: 1

Connection: Keep-Alive


HTTP/1.1 302 Found

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Expires: Fri, 30 Jan 2015 06:28:48 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:48 GMT

Location: hXXp://pixel.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A1001&puid=3338670318734125865

Server: Microsoft-IIS/7.5

P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"

X-AspNet-Version: 4.0.30319

Set-Cookie: uuid=RVNWQS1QRERBVDAxOjNhNjk1NTc1LTZmMjYtNDFlMS05N2Y5LThkNTYwOThhMzQ2ZjoxNDIyNTk5MzI4Ljc4Njg4OjA; domain=ad.mlnadvertising.com; expires=Sat, 30-Jan-2016 06:28:48 GMT; path=/

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 230
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://pixel
.ad.mlnadvertising.com/sync.ashx?cktst=1&partner=2591&psid=A10
01&puid=3338670318734125865">here</a>.</h2>..</b
ody></html>......


GET /sync.ashx?cktst=1&partner=2591&psid=A1001&puid=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/default/300x250_INT_ROS_tribel.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: pixel.ad.mlnadvertising.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid=RVNWQS1QRERBVDAxOjNhNjk1NTc1LTZmMjYtNDFlMS05N2Y5LThkNTYwOThhMzQ2ZjoxNDIyNTk5MzI4Ljc4Njg4OjA


HTTP/1.1 200 OK

Cache-Control: private, max-age=0, no-cache

Pragma: no-cache

Content-Length: 43

Content-Type: image/gif

Expires: Fri, 30 Jan 2015 06:28:49 GMT

Last-Modified: Fri, 30 Jan 2015 06:28:49 GMT

Server: Microsoft-IIS/7.5

P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"

X-AspNet-Version: 4.0.30319

X-Powered-By: ASP.NET

Date: Fri, 30 Jan 2015 06:28:48 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Cont
rol: private, max-age=0, no-cache..Pragma: no-cache..Content-Length: 4
3..Content-Type: image/gif..Expires: Fri, 30 Jan 2015 06:28:49 GMT..La
st-Modified: Fri, 30 Jan 2015 06:28:49 GMT..Server: Microsoft-IIS/7.5.
.P3P: policyref="hXXp://ad.mlnadvertising.com/policy/p3p.xml", CP="NOI
 DEV PSA PSD IVA PVD OTP OUR OTR IND OTC" ..X-AspNet-Version: 4.0.3031
9..X-Powered-By: ASP.NET..Date: Fri, 30 Jan 2015 06:28:48 GMT..GIF89a.
............!.......,...........D..;..

GET /log/tecjslog.php?c=24&s=1716x901&p=none&u=244535336147&r=2383948&cr=55818&sc=14076&re=hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQw93JipD60ZN4GKnWppL03tWqLiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ad2.adfarm1.adition.com/banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=191&wi=593011552&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072101402/sid=2659948/kid=0/bid=3934002/c=52907/keyword=/sr=0/clickurl=

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: c13.w3hoster.de

DNT: 1

Connection: Keep-Alive

Cookie: W3HUnique=244535336147_142_07_20150130


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:49 GMT

Server: Apache/2.2.22 (Debian)

X-Powered-By: PHP/5.4.4-14 deb7u14

Content-Length: 82

Connection: close

Content-Type: image/png

.PNG........IHDR.............%.V.....PLTE...........IDAT..c`.......qd.
....IEND.B`...

GET /cookie.php?url=http://dsp.active-agent.com/cookie/?ssp=2&userid=%COOKIE% HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://c13.w3hoster.de/only.php?skrel=0&c=55818&r=YW1zMS5pYi5hZG54cy5jb20=&w3r=YW1zMS5pYi5hZG54cy5jb20=&w3hur=142&gpq=cz0xNDA3NiZ3PTcyOCZoPTkwJnQ9X2JsYW5rJmdwdHM9NjExMDAxNzU4OTA5MTIzNzk0NQ==

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: dsp.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc1=103d4


HTTP/1.1 302 Found

Date: Fri, 30 Jan 2015 06:28:52 GMT

Set-Cookie: UserID1=6110017589072035866;Path=/;Domain=.adition.com;Expires=Wed, 29-Jul-2015 06:28:52 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://sync.active-agent.com/cookie/?ssp=2&userid=6110017589072035866

Connection: close

Server: Jetty(8.1.3.v20120416)

GET /banner?sid=2554279&adjsver=3&co=1&fvers=&iframe=1&ref=http://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html&os=10&browser=13&h5=&h5s=134&wi=200732349&ac=2&screen_res=undefined&wpt=H&clickurl=http://aa.adfarm1.adition.com/redi*lid=6110017589072166938/sid=2659948/kid=0/bid=3934002/c=13050/keyword=/sr=0/clickurl= HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://ams1.ib.adnxs.com/if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ad2.adfarm1.adition.com

DNT: 1

Connection: Keep-Alive

Cookie: UserID1=6110017589072035866; fc3=10039


HTTP/1.1 200 OK

Server: ADITIONSERVER v1.0

Date: Fri, 30 Jan 2015 07:28:48  0100

Connection: close

Cache-Control: no-cache

Content-Type: text/html

ETag: 6110017589092089913

Expires: Sat, 01 Jan 2000 00:00:00 GMT

P3P: policyref="hXXp://imagesrv.adition.com/w3c/p3p.xml",CP="NON DSP ADM DEV PSD IVDo OTPi OUR IND STP PHY PRE NAV UNI"

Pragma: no-cache

Set-Cookie: UserID1=6110017589072035866; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/; domain=.adfarm1.adition.com

Set-Cookie: cc=; expires=Sat, 01-Jan-2000 00:00:00 GMT; path=/

Set-Cookie: fc3=10039; expires=Wed, 29-Jul-2015 07:28:48 GMT; path=/

Content-Length: 1008
<HTML><HEAD><TITLE></TITLE></HEAD><BO
DY topmargin="0" leftmargin="0" style="background-color:transparent;ov
erflow:hidden;margin:0;padding:0;"><div style="position:absolute
;width:728px;height:0px"><div id="obaButton_6110017589092089913"
></div></div><script language="JavaScript" src="http
://ads.w3hoster.de/adsi-j.php?s=14076&w=728&h=90&t=_blank&gpts=6110017
589092089913"></script><script type="text/javascript">.
(function() {.  var domId = 'obaButton_6110017589092089913',oba='',btr
 = 'true',position= 'top-right'||'top-right';.  if (oba != '' || btr =
= 'true') {.    var oba_script = document.createElement('script');.   
 oba_script.setAttribute('type','text/javascript');.    oba_script.set
Attribute('charset','utf-8');.          oba_script.setAttribute('src',
 'hXXp://imagesrv.adition.com/banners/533/oba_priv.sjs?oba=' oba '&dom
Id=' domId '&btr=' btr '&pos=' position '&cid=12452&aid=54647');.    .
    document.getElementsByTagName('head')[0].appendChild(oba_script);.
.  }.  })();.</script></BODY></HTML>..<<< skipped >>>

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3338670318734125865 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://ib.adnxs.com/tt?id=2488352

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: gmtdmp.mookie1.com

DNT: 1

Connection: Keep-Alive

Cookie: id=3025970665045060; mdata=1|3025970665045060|1422599330; OAX=IAz1ClTLJKIAATbP


HTTP/1.1 200 OK

Date: Fri, 30 Jan 2015 06:28:50 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=3025970665045060; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Set-Cookie: mdata=1|3025970665045060|1422599330; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Keep-Alive: timeout=1, max=9696

Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Fri,
 30 Jan 2015 06:28:50 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR
 STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id
=3025970665045060; Domain=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28
:50 GMT; Path=/..Set-Cookie: mdata=1|3025970665045060|1422599330; Doma
in=.mookie1.com; Expires=Sun, 01-Mar-2015 06:28:50 GMT; Path=/..Cache-
Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 
30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43.
.Keep-Alive: timeout=1, max=9696..Connection: Keep-Alive..GIF89a......
.......!.......,...........D..;..

GET /if?e=wqT_3QLeAajVAAAAAgDWAAUIoMmspgUQ9YKixvuKqvkHGL_7xojQvu-fOiABKi0JAAAABQIAEQUGFAAAABnNzAEBCOw_IQEOAQEAKQEFAQHwiTDHqVc47A5A7A5IAlDdgcMEWLPiDmAAaNunAnAAeACAAQGSAQNVU0SYAdgFoAFaqAEAsAEAuAECwAECyAEA0AEA2AEA4AEA8AEA2AKXBuAC8Z0K6gIVd3d3LmZyZWVyaWRlZ2FtZXMuY29tgAMAiAMBkAMAmAMAoAMBqgMAsAMAuAMAwAOsAsgDAA..&dlo=1&referrer=VVV.freeridegames.com HTTP/1.1

Accept: text/html, application/xhtml xml, */*

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Host: ams1.ib.adnxs.com

DNT: 1

Connection: Keep-Alive

Cookie: uuid2=4197282237715168703; sess=1; icu=ChIIw88MEAoYASABKAEwoMmspgUQoMmspgUYAA..; anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db


HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Sat, 31-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

X-Creative-ID: 9486557

Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0qzzSX8Db; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Fri, 30 Jan 2015 06:28:48 GMT

Content-Length: 302
<!-- Bannercommunity Vermarktung (bannercommunity.de) -->..<s
cript type="text/javascript" src="hXXp://imagesrv.adition.com/js/aditi
on.js"></script><script type="text/javascript" src="http:/
/aa.adfarm1.adition.com/js?wp_id=2659948"></script>..<!-- 
// Bannercommunity Vermarktung (bannercommunity.de) -->HTTP/1.1 200
 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Exp
ires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.
com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo 
OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=
4197282237715168703; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; do
main=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Sat, 31
-Jan-2015 06:28:48 GMT; domain=.adnxs.com; HttpOnly..X-Creative-ID: 94
86557..Set-Cookie: anj=dTM7k!M4.NDunaTDgEREg(Pm?gvnX.%phwSNai4xO3g#l!0
qzzSX8Db; path=/; expires=Thu, 30-Apr-2015 06:28:48 GMT; domain=.adnxs
.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Fri, 30 
Jan 2015 06:28:48 GMT..Content-Length: 302..<!-- Bannercommunity Ve
rmarktung (bannercommunity.de) -->..<script type="text/javascrip
t" src="hXXp://imagesrv.adition.com/js/adition.js"></script>&
lt;script type="text/javascript" src="hXXp://aa.adfarm1.adition.com/js
?wp_id=2659948"></script>..<!-- // Bannercommunity Vermark
tung (bannercommunity.de) -->..<<< skipped >>>

GET /gx.png?APN=3338670318734125865&google_gid=CAESENmAYpTPZntugDgw3jO6nz4&google_cver=1 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/banners/DE/Tribal/728x90_ros_de_tribal.html

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

DNT: 1

Connection: Keep-Alive

Host: t.a3cloud.net


HTTP/1.1 200 OK

Content-Type: image/png

Content-Length: 169

Connection: keep-alive

Date: Fri, 30 Jan 2015 06:28:55 GMT

x-amz-meta-s3cmd-attrs: uid:1003/gname:brao/uname:brao/gid:1003/mode:33188/mtime:1410299679/atime:1410299679/md5:6710654eca7b7742b7b9238e23caef52/ctime:1410299679

Last-Modified: Tue, 09 Sep 2014 21:54:55 GMT

ETag: "6710654eca7b7742b7b9238e23caef52"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: Miss from cloudfront

Via: 1.1 2b7e0587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)

X-Amz-Cf-Id: l2MN3Ve28_skOEeljNGcXB7ckdCD106AL1Co4povLXeP4ocxUeEWmg==

.PNG........IHDR.....................sRGB.........bKGD..........pHYs..
........e......tIME.....*,...z....tEXtComment.AccordantMedia.2Z.....ID
AT..c``...... .......IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png.
.Content-Length: 169..Connection: keep-alive..Date: Fri, 30 Jan 2015 0
6:28:55 GMT..x-amz-meta-s3cmd-attrs: uid:1003/gname:brao/uname:brao/gi
d:1003/mode:33188/mtime:1410299679/atime:1410299679/md5:6710654eca7b77
42b7b9238e23caef52/ctime:1410299679..Last-Modified: Tue, 09 Sep 2014 2
1:54:55 GMT..ETag: "6710654eca7b7742b7b9238e23caef52"..Accept-Ranges: 
bytes..Server: AmazonS3..X-Cache: Miss from cloudfront..Via: 1.1 2b7e0
587e76bdc8afc2d63bea659b942.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 
l2MN3Ve28_skOEeljNGcXB7ckdCD106AL1Co4povLXeP4ocxUeEWmg==...PNG........
IHDR.....................sRGB.........bKGD..........pHYs..........e...
...tIME.....*,...z....tEXtComment.AccordantMedia.2Z.....IDAT..c``.....
. .......IEND.B`...

GET /UTN-USERFirst-Hardware.crl HTTP/1.1

Connection: Keep-Alive

Accept: */*

User-Agent: Microsoft-CryptoAPI/6.1

Host: crl.comodoca.com


HTTP/1.1 200 OK

Server: nginx

Date: Fri, 30 Jan 2015 06:28:50 GMT

Content-Type: application/x-pkcs7-crl

Content-Length: 4376

Last-Modified: Fri, 30 Jan 2015 04:32:54 GMT

Connection: close

X-CCACDN-Mirror-ID: h6edcacrl1

Accept-Ranges: bytes

0...0......0...*.H........0..1.0...U....US1.0...U....UT1.0...U....Salt
 Lake City1.0...U....The USERTRUST Network1!0...U....hXXp://VVV.usertr
ust.com1.0...U....UTN-USERFirst-Hardware..150130043254Z..150203043254Z
0...0!..^....t..30...{C...060927070327Z0"....}...G,..x6vcX& ..10011522
0539Z0!..V...1.pj.u...r<...100128214246Z0!..S..W.....,....v...10020
1155305Z0"....x....G0..X*.<.R..100209213528Z0".....}w.Z..H'r...&...
100301205223Z0".....`...*F......SS..100301222500Z0"....].>?'K...\..
>....100330175849Z0!..|.R..gge/...Kj....100405140057Z0".....'A.....
-eB?8.F..100407141829Z0"........hG.o..}A.....100505184113Z0".....l....
..^...b.'..100506202534Z0"......Mi.A...Q..-....100511230708Z0!..Zg...v
.:..\<?.....100525185217Z0"....Q....K........p..100526081011Z0!...}
....v..\...!.a..100528120357Z0".....m...3du>OP.mm7..100608151048Z0"
....9.........O..|O..100609180604Z0".....%.MD....J.z Q...100611122131Z
0!..<..........&......100629140452Z0!..w(...M.......Q5...1007141745
48Z0"....KG...#.OD.:U.....100723145923Z0"......)...p.u".......10072608
1911Z0"....r..X..Pr. .).....100805203159Z0!..:S1..:Uo.Z.....P..1008172
04713Z0!..8.....{..g........100820194555Z0!..U.\.i`............1008201
94711Z0!.._...z)....ym.   ..100825153759Z0!...M...OT.E......1..1009210
61635Z0!..j....O...,.|~.8...100922022250Z0!..o~..(..j_...c..E..1009271
73105Z0!...n(.&X.."...7$.S..101004174308Z0!....].......hM......1010181
42346Z0!..:....O..q..T......101019043227Z0".......=...R.6...q...101019
122714Z0!..I..l........Z.....101021135958Z0"[email protected]. ..1

<<< skipped >>>

GET /ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=2429367150 HTTP/1.1

Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5

Referer: hXXp://partners.freeridegames.com/my_games?gameId=659050

Accept-Language: en-US

User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)

Accept-Encoding: gzip, deflate

Cookie: NID=67=vOr3KMkRgKzKK96sxJpxyEczA3umKOcncI--3SgTGRoblhdA9puvOrwBffL0b0Jj_CIR-FG07pJNcRIPtOc-BQNOTfg9OdWidnppEWcEVE_ZiWA-bcBNJCiwTSNfkqdd

DNT: 1

Connection: Keep-Alive

Host: VVV.google.com


HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&cv=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=659050&random=2429367150&ipr=y

Cache-Control: private, max-age=43200

Date: Fri, 30 Jan 2015 06:26:40 GMT

Expires: Fri, 30 Jan 2015 06:26:40 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 386

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic,p=0.02
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/1057751771/?fmt
=3&num=1&cv=7&frm=0&url=http://partners.freeridegame
s.com/my_games?gameId=659050&random=2429367150&ipr=y">h
ere</A>...</BODY></HTML>..HTTP/1.1 302 Found..Locati
on: hXXp://VVV.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&cv
=7&frm=0&url=http://partners.freeridegames.com/my_games?gameId=6
59050&random=2429367150&ipr=y..Cache-Control: private, max-age=43200..
Date: Fri, 30 Jan 2015 06:26:40 GMT..Expires: Fri, 30 Jan 2015 06:26:4
0 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options:
 nosniff..Server: adclick_server..Content-Length: 386..X-XSS-Protectio
n: 1; mode=block..Alternate-Protocol: 80:quic,p=0.02..<HTML><
HEAD><meta http-equiv="content-type" content="text/html;charset=
utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY&g
t;.<H1>302 Moved</H1>.The document has moved.<A HREF="h
ttp://VVV.google.com.ua/ads/user-lists/1057751771/?fmt=3&num=1&
;cv=7&frm=0&url=http://partners.freeridegames.com/my_games%3
FgameId=659050&random=2429367150&ipr=y">here</A>...
</BODY></HTML>....<<< skipped >>>

The Malware connects to the servers at the folowing location(s):

IEXPLORE.EXE_2448:

.text

`.data

.idata

.rsrc

@.reloc

u\j.Xf9

j.Xf9

USER32.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

IEFRAME.dll

SHELL32.dll

iexplore.pdb

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->

<assemblyIdentity version="5.1.0.0"

name="Microsoft.InternetExplorer"

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<!--The ID below indicates application support for Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

KEYW

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

imm32.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Kernel32.dll

"%s" %s

kernel32.dll

IEXPLORE.EXE

{00000000-0000-0000-0000-000000000000}

\\?\Volume

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

IMTravelLogMVC_TravelURL

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

Windows

10.00.9200.16521

IEXPLORE.EXE_1032:

.text

`.data

.idata

.rsrc

@.reloc

u\j.Xf9

j.Xf9

USER32.dll

api-ms-win-downlevel-shell32-l1-1-0.dll

IEFRAME.dll

SHELL32.dll

iexplore.pdb

api-ms-win-downlevel-shlwapi-l1-1-0.dll

iertutil.dll

api-ms-win-downlevel-advapi32-l1-1-0.dll

KERNEL32.dll

msvcrt.dll

_wcmdln

_amsg_exit

RegOpenKeyExW

RegCloseKey

<!-- Note: This manifest needs to be kept in sync with iexplore.exe.manifest -->

<assemblyIdentity version="5.1.0.0"

name="Microsoft.InternetExplorer"

<windowsSettings>

<dpiAware xmlns="hXXp://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>

</windowsSettings>

<!--The ID below indicates application support for Windows 8 -->

<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>

KEYW

.ENNNG.

a.ry.v

l.igM4

?1%SGf

xh.JW^

.97777"7" " " !

3.... ))

8888888888888

8888888888

.lPV)

úW1

.ApX/

H.ZAf

ð[U

%s!FK

1YYYY1YY9GEAA=77YRNNNW:.VT1

888777777

Y.hilkRROMLK=C,

..(((($$

3...((((%

3....(.''$

3.2...((((%

33.2....(,'

55323222...

(%&'00443445?

00.,,,4(

000.,,9(

0020..9(

003200;(

(#'( (''''!'!

Microsoft.InternetExplorer.Default

Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe

{28fb17e0-d393-439d-9a21-9474a070473a}

imm32.dll

Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}

Kernel32.dll

"%s" %s

kernel32.dll

IEXPLORE.EXE

{00000000-0000-0000-0000-000000000000}

\\?\Volume

Imaging_CreateWebPagePreview_Perftrack

Browseui_Tabs_Tearoff_BetweenWindows

Browseui_Tabs_Tearoff_BetweenWindows_TabProc

Frame_URLEntered

Imaging_CreateWebPagePreview

WS_ExecuteQuery

Shdocvw_BaseBrowser_FireEvent_WindowStateChanged

IdleTask_Execution_Time

Shdocvw_BaseBrowser_FireEvent_BeforeScriptExecute

IMTravelLogMVC_TravelURL

10.00.9200.16521 (win8_gdr_soc_ie.130216-2100)

Windows

10.00.9200.16521

Remove it with Ad-Aware

Click (here) to download and install Ad-Aware Free Antivirus.
Update the definition files.
Run a full scan of your computer.

Manual removal*

Scan a system with an anti-rootkit tool.
Terminate malicious process(es) (How to End a Process With the Task Manager):

GoogleUpdate.exe:3496
GoogleUpdate.exe:3556
GoogleUpdate.exe:3612
cmhelper.exe:2792
cmhelper.exe:2988
cmhelper.exe:476
cmhelper.exe:2676
GPlayer.exe:1140
GPlayer.exe:600
GPlayer.exe:3460
GPlayer.exe:888
GPlayer.exe:2644
GPlayer.exe:2836
GPlayer.exe:3300
FreeRideGames.exe:1440
Regsvr32.exe:700
RegEdit.exe:3432
RegEdit.exe:204
%original file name%.exe:3900
setup.exe:4068
setup.exe:3264
taskeng.exe:628
40.0.2214.94_chrome_installer.exe:3052
Free Ride Games.exe:3700
Delete the original Malware file.
Delete or disinfect the following files created/modified by the Malware:

%Program Files% (x86)\Google\Update\Download\{4DC8B4CA-1BDA-483E-B5FA-D3C12E15B62D}\40.0.2214.94\40.0.2214.94_chrome_installer.exe (312970 bytes)
%Program Files% (x86)\Google\Update\Install\{5D8BBC2E-D20F-40E5-A8E7-225F2F6C618F}\40.0.2214.94_chrome_installer.exe (331841 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Low\WT3G2UFC.txt (109 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Low\H0HH7P9Y.txt (217 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\Low\XO2ANQBU.txt (324 bytes)
%Program Files% (x86)\FreeRide Games\Info\2.clg (1105 bytes)
%Program Files% (x86)\FreeRide Games\Info\1.clg (15493 bytes)
%Program Files% (x86)\FreeRide Games\Info\13.clg (15517 bytes)
%Program Files% (x86)\FreeRide Games\Info\14.clg (1107 bytes)
%Program Files% (x86)\FreeRide Games\Info\11.clg (15517 bytes)
%Program Files% (x86)\FreeRide Games\Info\12.clg (1107 bytes)
%Program Files% (x86)\FreeRide Games\Info\8.clg (1105 bytes)
%Program Files% (x86)\FreeRide Games\Info\7.clg (15493 bytes)
%Program Files% (x86)\FreeRide Games\Info\5.clg (15493 bytes)
%Program Files% (x86)\FreeRide Games\Info\6.clg (1105 bytes)
%Program Files% (x86)\FreeRide Games\Info\9.clg (15493 bytes)
%Program Files% (x86)\FreeRide Games\Info\10.clg (1107 bytes)
%Program Files% (x86)\FreeRide Games\Info\4.clg (1105 bytes)
%Program Files% (x86)\FreeRide Games\Info\3.clg (15493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\ISSetup.dll (11297 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.exe (16089 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\0x0409.ini (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.zip (4508 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.ini (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\pftw1.pkg (24322 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\data1.cab (14367 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\plf43D3.tmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\ext43D4.tmp (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\data1.hdr (1941 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\layout.bin (515 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\data2.cab (157015 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.inx (6224 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setupapplet.jar (541 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.iss (256 bytes)
%Program Files% (x86)\FreeRide Games\AppLoader2KEx.dll (966 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\resourceDll.dll (161 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_uninsep.bat (174 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\Free Ride Games.exe (989 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\ExentCtlInstaller.dll (200 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\000A25F7 (948 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\cmhelper.exe (192 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto4b80.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_a4af4.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop4eea.rra (181 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\dl_i4dc1.rra (32 bytes)
%Program Files% (x86)\FreeRide Games\FRGN4ad5.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\DIFx45d5.rra (86 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\cmhe49fa.rra (4456 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e4e4e.rra (11 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\pb4db2.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c7a.rra (47 bytes)
%Program Files% (x86)\FreeRide Games\Skin\NIBmps\NetI4b13.rra (3780 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\help4c1c.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\upda4bce.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\eror4da2.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs4eda.rra (13 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d64.rra (51 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pids4b23.rra (58 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bott4d06.rra (1 bytes)
C:\Users\Public\Desktop\Play My Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\load4e8c.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\glut4920.rra (4314 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_04c3b.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\myGa4ae4.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_g4e5d.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\game4eea.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\skin4ce7.rra (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\GPla492f.rra (154846 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\skip4bbf.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\repo49fa.rra (364 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\fram4de1.rra (14 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\canc4b90.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\spla4e00.rra (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu45b6.rra (6043 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\exs45b6.rra (12834 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Serv4d83.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\clos4b9f.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgRi4d06.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Sett4ae4.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\MyGa4d93.rra (4298 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\canc4bfd.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_45c7.rra (2104 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a29.rra\exs44a39.rra (2335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{811A1279-A06D-4182-A972-4A2A4B4D0E40}\0x0409.ini (21 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu48d2.rra (14400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG49fa.rra\AppL4a0a.rra (32102 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\myGa4db2.rra (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a19.rra\frg-4a19.rra (4456 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\flas4dd1.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\chan4eda.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\help4c2c.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\GameInfoDefault\md4b03.rra (383 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Regi45b6.rra (29 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\load4d25.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\play4e8c.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4ca9.rra (18 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\trac4e00.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\back4b90.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\erro4cd7.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_c4af4.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\GameInfoDefault\Game4b03.rra (12 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\logi4b03.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\erro4cc8.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\gplayer\gpla4d35.rra (4329 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\adGa4cb8.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_14c4b.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Sett4d83.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_i4e5d.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\play4e0f.rra (144 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\yesn4e0f.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\atta4cf7.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\layo4da2.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\clos4e7d.rra (1106 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{811A1279-A06D-4182-A972-4A2A4B4D0E40}\setup.ini (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\og_i4cd7.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\erro4dd1.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\og_i4df0.rra (625 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\main4ebb.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\logo4d25.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Chan4d45.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\lice45b6.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_a4e3e.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\sear4ef9.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\load4d16.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\GPlrLanc.dat (20 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\ok_24c4b.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\MyDo4d83.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\dl_i4cc8.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\exs46cf.rra (7168 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\logi4cd7.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Data\Loca4a96.rra (13 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\MyGa4d83.rra (17 bytes)
C:\ProgramData\FreeRide Games\layo51a8.rra (515 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\laun4e8c.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin4f19.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\favi4d54.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b71.rra (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\ISBE45d5.rra (4314 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\hide4c2c.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\auto4cc8.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\spec4f19.rra (807 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Conn4d45.rra (296 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d65.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b51.rra (25 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_s4e6d.rra (12 bytes)
C:\ProgramData\FreeRide Games\setu51c7.rra (5800 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\logi4de1.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Help4d73.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Win84f86.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\spla4ce7.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\righ4ebb.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\data4b80.rra (31 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\logi4e0f.rra (144 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\retr4d25.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\skip4bce.rra (3 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu4910.rra (6040 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\play4df0.rra (729 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\info4eab.rra (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\NPGa45c6.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\Skin4f09.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c89.rra (46 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Langs\0409\EXEt4bde.rra (843 bytes)
%Program Files% (x86)\FreeRide Games\Skin\inde4ae4.rra (34 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\logi4e3e.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\drop4dc1.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\preRoll\invi4e7d.rra (262 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FreeRide Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\debu4b03.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\more4c3b.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\Loca4a97.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\gmt\cls_4d35.rra (10 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\GATr4d93.rra (2326 bytes)
%Program Files% (x86)\FreeRide Games\X5XS4a48.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Data\Loca4aa6.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b32.rra (22 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_u4e6d.rra (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\DMF8LOSK.txt (1580 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\main4ef9.rra (18 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\clie4dc1.rra (509 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Onli4d83.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\core45d5.rra (2334 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG49fa.rra\wh_P4a19.rra (4456 bytes)
C:\Windows\Downloaded Program Files\Exen4ab5.rra (32172 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\fram4cd7.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\ExentComponents.ini (1169 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\ISBEW64.exe (110 bytes)
%Program Files% (x86)\FreeRide Games\Clie4ae4.rra (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isr45e5.rra (18974 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_m4af4.rra (24 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\clos4c1c.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_l4e6d.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\GPla4d73.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\Game49bc.rra (65287 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\sign4e00.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_d4af4.rra (15 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\MinC4ecb.rra (6 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setup.ini (5176 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Tray4ad5.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\mg_i4cd7.rra (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\BN58NRCY.txt (1580 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\setu4920.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_d4e3e.rra (22 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a19.rra\3rdP4a29.rra (26 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\post4df1.rra (966 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\buy_4bfd.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\titl4ecb.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\nobu4baf.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d73.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a29.rra\DoDl4a29.rra (4456 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b23.rra (4 bytes)
C:\ProgramData\FreeRide Games\data514a.rra (158522 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\icon4da2.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c99.rra (21 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\defa4b23.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_e4e4f.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Stri45e5.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Skin4ae4.rra (352 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\mg_i4de1.rra (20 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgBo4cf7.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\X5Ex4a39.rra (20620 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a19.rra\lice4a29.rra (9 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_4c0d.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\Chec4b80.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_m4e6d.rra (18 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\clos4b90.rra (1 bytes)
C:\ProgramData\FreeRide Games\exs5198.rra (7168 bytes)
C:\Windows\SysWOW64\d3dx4aa6.rra (32512 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d55.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\yesn4ce7.rra (2 bytes)
C:\ProgramData\FreeRide Games\setu51a8.rra (14400 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\_isres_0x0409.dll (561 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\Loca4a96.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Langs\0409\Stri4bed.rra (11940 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\ok_14c3b.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\erro4e0f.rra (144 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\IAF4d73.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\yesb4bde.rra (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\4578.rra (100 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\FRGL4d54.rra (68 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\exs.dll (380 bytes)
%Program Files% (x86)\FreeRide Games\Play My Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\GPlr4d73.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\swit4e00.rra (3 bytes)
C:\ProgramData\FreeRide Games\data513b.rra (14400 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\pl\pl_o4e6d.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\npGa4f19.rra (13264 bytes)
%Program Files% (x86)\FreeRide Games\FreeRide Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\play4e3e.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\subm4c4b.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgLe4d06.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\canc4bfd.rra (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\dotn45d5.rra (11 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\nobu4b9f.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load4ef9.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b42.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\skin_events\PreR4f09.rra (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\Game49db.rra (8760 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp4eab.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\Most4d93.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\btn\chk_4c1c.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4ZF5FJ2F.txt (1580 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\jque4de1.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topL4d25.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\defa45e5.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\conn4e9c.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bott4d16.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrt.dll (262 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG49fa.rra\AX3249fa.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\anim4b71.rra (13 bytes)
C:\Windows\Downloaded Program Files\ExentControl.ocx (1 bytes)
C:\ProgramData\FreeRide Games\setu51b7.rra (6477 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\disp4e9c.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\load4eea.rra (2334 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\ap_p4af4.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\bord4e8c.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann4e2f.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\flas4d16.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\OffL4d45.rra (396 bytes)
%Program Files% (x86)\FreeRide Games\report.ini (102 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\GPlr499d.rra (32516 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\topR4d25.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\pft43D5.tmp\setup.log (323 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\erro4dc1.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\dott4eda.rra (35 bytes)
C:\Users\Public\Desktop\FreeRide Games.lnk (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\yaho4b80.rra (2334 bytes)
C:\ProgramData\FreeRide Games\0x04513b.rra (21 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Langs\0409\Erro4bed.rra (15 bytes)
%Program Files% (x86)\FreeRide Games\exs.dll (380 bytes)
%Program Files% (x86)\FreeRide Games\Data\vers4a96.rra (5 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\layo4db2.rra (2 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\pinb4baf.rra (4 bytes)
C:\ProgramData\FreeRide Games\ISSe5198.rra (10504 bytes)
%Program Files% (x86)\FreeRide Games\Skin\icon\Exit4d45.rra (17 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\GPla45c6.rra (17 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\mg4b23.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\mask\upda4e1f.rra (96 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c5b.rra (40 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\spac4db2.rra (49 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4cb8.rra (23 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\logo4ef9.rra (14 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dialogBox\bgTo4d06.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\Popups\1\pinb4bbf.rra (4 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\key_4de1.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\prvd4b61.rra (40 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\tabs4f09.rra (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4920.rra\Repo49eb.rra (31560 bytes)
%Program Files% (x86)\FreeRide Games\exs.ini (6228 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\dial4cc8.rra (3 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\preR4df0.rra (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SFG4a29.rra\exs44a29.rra (12834 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\post4df0.rra (966 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\layo48c2.rra (515 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\AC_R4dc1.rra (8 bytes)
%Program Files% (x86)\FreeRide Games\npEx4ad5.rra (8760 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\GPlr4cf7.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\js\YUI\auto4b71.rra (32 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\dial4da2.rra (1 bytes)
%Program Files% (x86)\FreeRide Games\Skin\GameInfoDefault\Spla4b03.rra (29 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\isrt45e5.rra (8434 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\Font45d5.rra (39 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\Subs4ecb.rra (10 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\0x044910.rra (21 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\settings\emai4eab.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\dl4b23.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\css\sett4ce7.rra (6 bytes)
%Program Files% (x86)\FreeRide Games\Skin\dat\Loca4aa6.rra (7 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\masks\bann4e1f.rra (6 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\data48c2.rra (15968 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Provider\img\skinUI\drop4eda.rra (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\{DB884DA0-396F-478C-8459-84EAA2CC4D5D}\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\FRG_45c6.rra (3404 bytes)
%Program Files% (x86)\FreeRide Games\Skin\html\Skin\Exent\classes\cls_4c6a.rra (47 bytes)
%Program Files% (x86)\InstallShield Installation Information\{6C26A305-4549-4A8A-9F03-25719C03B0FB}\ISSe48f1.rra (10504 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\cs.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\xinput1_3.dll (162 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome.dll (30950 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\chrome.exe (1686 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\de.pak (496 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\VisualElementsManifest.xml (400 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\kn.pak (1309 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\default_apps (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_100_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\he.pak (660 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\drive.crx (53 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\en-GB.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\hu.pak (604 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\en-US.pak (479 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\youtube.crx (47 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\it.pak (561 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sr.pak (868 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\hi.pak (1175 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\pt-PT.pak (568 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sw.pak (481 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libegl.dll (423 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\nb.pak (521 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\lt.pak (564 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\VisualElements\logo.png (7 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\nl.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\Locales (8 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ja.pak (693 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\external_extensions.json (5 bytes)
%Program Files% (x86)\Google\Chrome\Application\chrome.exe (17554 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libpeerconnection.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\zh-CN.pak (465 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\zh-TW.pak (471 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\pdf.dll (58 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fa.pak (817 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\metro_driver.dll (1013 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\te.pak (1276 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\VisualElements\smalllogo.png (21 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ca.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\uk.pak (897 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ro.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\pt-BR.pak (555 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\id.pak (520 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\chrmstp.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\wow_helper.exe (146 bytes)
C:\Windows\Temp\chrome_installer.log (7903 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sl.pak (530 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ko.pak (580 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ml.pak (1503 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\vi.pak (653 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\PepperFlash\manifest.json (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ru.pak (892 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\docs.crx (12 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\icudtl.dat (59 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\search.crx (54 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Extensions\external_extensions.json (103 bytes)
%Program Files% (x86)\Google\Chrome\Application\40.0.2214.94\Installer\setup.exe (22234 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\PepperFlash\pepflashplayer.dll (63 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fr.pak (611 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\pl.pak (569 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\default_apps\gmail.crx (48 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\tr.pak (570 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ta.pak (1375 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ms.pak (432 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\d3dcompiler_46.dll (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fi.pak (540 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\fil.pak (585 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sv.pak (529 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\et.pak (504 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_child.dll (32722 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\mr.pak (1159 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\widevinecdmadapter.dll (285 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_200_percent.pak (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\secondarytile.png (641 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\es.pak (586 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\es-419.pak (572 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\bn.pak (1211 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\lv.pak (577 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\delegate_execute.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\ffmpegsumo.dll (50 bytes)
C:\Users\Public\Desktop\Google Chrome.lnk (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\ar.pak (766 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\hr.pak (538 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libglesv2.dll (50 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\am.pak (792 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\libexif.dll (621 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\nacl64.exe (50 bytes)
%Program Files% (x86)\Google\Chrome\Application\35.0.1916.114\VisualElements (4 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\resources.pak (64 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\40.0.2214.94.manifest (226 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\sk.pak (596 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\th.pak (1153 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\chrome_elf.dll (268 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\da.pak (521 bytes)
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk (6 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\nacl_irt_x86_64.nexe (52 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\VisualElements\splash-620x300.png (22 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\nacl_irt_x86_32.nexe (51 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\chrome.7z (270363 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\bg.pak (949 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\gu.pak (1137 bytes)
%Program Files% (x86)\Google\Chrome\Temp\source3264_31323\Chrome-bin\40.0.2214.94\Locales\el.pak (1040 bytes)
C:\Windows\Temp\CR_E9170.tmp\CHROME.PACKED.7Z (44833 bytes)
C:\Windows\Temp\CR_E9170.tmp\setup.exe (17361 bytes)
C:\Windows\Temp\CR_E9170.tmp\SETUP.EX_ (375 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\bubbleLeft[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\index[1] (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\progressFooter[1] (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\initialized[1] (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\SDM_DB_148.xml (556 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\SDM_PROGRESS[1].css (732 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\minimize_up[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\defines[1] (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\Exent\GI20150130062650GMT.Log (28 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\FO5KAIEW.txt (555 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\defines[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\util[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\defines[1].js (25 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\close_disabled[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\ga[1].js (22248 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\ZQLSBFFB.txt (1493 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\SDMLog.log (2600933 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\configuration[1] (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\bubbleRight[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\controller[1] (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion4[1].jpg (3875 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\progress[1] (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\H9MVJRIA.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\header[1].htm (331 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion1[1].jpg (3210 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\initialized[1] (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\header[1].jpg (1909 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\beacon[1].js (750 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\util[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\conversionTracking[1].htm (95 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\FreeRideGames.exe (3202 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SDM_PROGRESS[1].css (732 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.tmp (224382 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\conf_defines[1] (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SDM_PROGRESS[1].htm (120 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\conf_defines[1] (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\close_up[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\servicePromotion1[1].jpg (3642 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SDM_HEADER2[1].css (471 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\defines[1] (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\offlineheader[1] (199 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\PYQZ88UC.txt (335 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\functions[1] (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\OJSXLTFR.txt (987 bytes)
%Program Files% (x86)\FreeRide Games\GPlayer.exe (485 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\SDM_PROGRESS[1].htm (1417 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\EULAFooter[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\measurements[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\pageURLInfo[1] (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\Cookies-journal (6361 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\boxshot_sm[1].jpg (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\_uninsdm.bat (370 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\offlineheader[1] (398 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Exent\DACC\SDM_DownloadAcc_148.acc (853 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\7AOES2Y2.txt (297 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\RYDODTTC.txt (1580 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\initialized[1] (401 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\13[1].gif (43 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion3[1].gif (6898 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\TG08AQ3A.txt (299 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\pageURLInfo[1] (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\conf_defines[1] (510 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\emptyFooter[1] (817 bytes)
%Program Files% (x86)\FreeRide Games\GameInst.dll (146 bytes)
C:\Users\"%CurrentUserName%"\AppData\LocalLow\Temp\ietemp1.dat (760 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\gamesInQueue[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\F7QBP14P\SDMHTMLInterfaces[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\M98OPKUM.txt (111 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\1FODHOFN.txt (1580 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\10L2XWWX.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROWYV75Q\servicePromotion2[1].jpg (6611 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Google\Chrome\User Data\Default\cookies-journal (13980 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\4ZD31FGP.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\783GTYVS\connecting_anim[1] (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\2NBE45IM.txt (719 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\util[1] (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Roaming\Microsoft\Windows\Cookies\JQGFUK9R.txt (1195 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\extrnalHandler[1] (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\connection[1] (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\046C1ZNT\connecting_anim[1] (4 bytes)
Delete the following value(s) in the autorun key (How to Work with System Registry):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Exent_SDM" = "C:\Users\"%CurrentUserName%"\AppData\Local\Temp\SDM148\Free Ride Games.exe l 'Startup' u 'http://player.freeridegames.com/do/SDMC?action=config_7_5&type=EN_NO_TB&contentId=%d' p '148' c '659050'"
Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Permalink

Back to the blog

e-mail

Google+

Twitter

Facebook

Sample_18e0f8faca

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet

Sample_18e0f8faca

E-mail

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Discover the new adaware antivirus 12

Our best antivirus yet