MD5: 154401ce6da2678b766ac52796ece0ee
SHA1: 80185ffbef84f401f9548fe461ea66859b902109
SHA256: d523318ca8b178e365a9521d8dc97e1b730470ae2503a5cbc5068abe793df747
SSDeep: 6144:Hq3asTI2ExWUZnT357SyC2Vs8877pG2CPRg1Xf639tMx24XfXhSVZ1L ToRDaepE:K3tvExlm2v1g1v638xlpSNKuH/8
Size: 737592 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2009-11-25 19:56:03
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:224
ShopAtHome_Toolbar_Installer.exe:468
SelectRebates.exe:952
SelectRebatesDownload.exe:1508
SelectRebatesDownload.exe:1988
regsvr32.exe:380

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:224 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (17138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\UL60SU90.exe (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (3689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (3624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (2128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (7104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (13304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (3963 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (3553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (2804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TD3TDJDC.tmp (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\UL60SU90.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\2PGADUK5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TD3TDJDC.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (0 bytes)

The process ShopAtHome_Toolbar_Installer.exe:468 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\SelectRebates\FFToolbar\chrome\sahtoolbar.jar (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (4 bytes)
%Program Files%\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (4 bytes)
%Program Files%\SelectRebates\Toolbar\CashBack.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\GroceryCoupon.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebates.exe (6841 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\TD3TDJDC.tmp (146 bytes)
%Program Files%\SelectRebates\Toolbar\ReviewSite.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Scissors.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_24.bmp (6 bytes)
%Program Files%\SelectRebates\FFToolbar\install.rdf (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_HotSpots.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-icons.bmp (8 bytes)
%System%\config\SOFTWARE.LOG (6075 bytes)
%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (5441 bytes)
%Program Files%\SelectRebates\Toolbar\logo.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-alert.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebatesApi.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\AddtoList.bmp (1 bytes)
%Program Files%\SelectRebates\FFToolbar\chrome.manifest (271 bytes)
%Program Files%\SelectRebates\Toolbar\i_magnifying.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\icons.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (2352 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRFF3.dll (673 bytes)
%Program Files%\SelectRebates\Toolbar\basis.xml (20 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-go.bmp (1 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (1 bytes)
%System%\config\software (3822 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (10965 bytes)
%Program Files%\SelectRebates\SelectRebatesUninstall.exe (1425 bytes)
%Program Files%\SelectRebates\SelectRebatesDownload.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\Blank.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Coupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRebates.dll (673 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (0 bytes)
%Program Files%\SelectRebates\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (0 bytes)

The process SelectRebates.exe:952 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpprf4i1qdejn.tmp (2 bytes)
%Program Files%\SelectRebates\srtmpprf458slvl1.tmp (2 bytes)
%Program Files%\SelectRebates\srtmpsqujau7froe.tmp (4 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (7 bytes)
%Program Files%\SelectRebates\srtmpprf8rbi7me7.tmp (2 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (167674 bytes)
%Program Files%\SelectRebates\SelectRebatesB.dat (7345 bytes)
%Program Files%\SelectRebates\SelectRebatesBT.dat (16 bytes)
%Program Files%\SelectRebates\srtmpsqut1e945p2.tmp (6 bytes)
%Program Files%\SelectRebates\srtmpgfic5cgasld.tmp (7285 bytes)
%Program Files%\SelectRebates\SelectRebatesA.dat (6 bytes)

The Trojan deletes the following file(s):

%Program Files%\SelectRebates\srtmpprf4i1qdejn.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpsqut1e945p2.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpgfic5cgasld.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprf8rbi7me7.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprf458slvl1.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpsqujau7froe.tmp (0 bytes)

The process SelectRebatesDownload.exe:1508 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpprf4i1qdejn.tmp (1 bytes)
%Program Files%\SelectRebates\srtmpprf458slvl1.tmp (25 bytes)
%Program Files%\SelectRebates\srtmpsqujau7froe.tmp (460 bytes)
%Program Files%\SelectRebates\srtmpprf8rbi7me7.tmp (1 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@sahcdn[1].txt (262 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Program Files%\SelectRebates\srtmpgfic5cgasld.tmp (121825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (72 bytes)

The process SelectRebatesDownload.exe:1988 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\2PGADUK5.tmp (452 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@shopathome[1].txt (270 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (964 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (235057 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (172089 bytes)

Registry activity

The process %original file name%.exe:224 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5F CB DA D6 0E 5F C6 77 6C 06 A9 E1 26 74 CC 3D"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process ShopAtHome_Toolbar_Installer.exe:468 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A C9 37 4D A3 F1 3B F1 CE 21 95 10 48 D6 F9 30"

[HKCU\Software\ShopAtHome\Toolbar]
"TBHideFirst" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ShopAtHome_Toolbar_Installer.exe,"

[HKLM\SOFTWARE\ShopAtHome\SelectRebates]
"SelectRebatesLocation" = "%Program Files%\SelectRebates\SelectRebates.exe"

[HKCU\Software\ShopAtHome\Toolbar]
"TBShowOnce" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"
"DisplayName" = "ShopAtHome SelectRebates"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SelectRebates" = "%Program Files%\SelectRebates\SelectRebates.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"
"URLUpdateInfo"

"URLInfoAbout"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SAHAgent"

The process SelectRebates.exe:952 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B D5 24 09 DB 7D 7E 78 A9 B5 F5 BE 21 70 7E C8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayName" = "ShopAtHome.com Toolbar"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"

[HKLM\SOFTWARE]
"test"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"URLUpdateInfo"
"URLInfoAbout"

The process SelectRebatesDownload.exe:1508 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1C 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 22 E0 4B 2D 55 67 F7 FD CD 26 DB 28 11 DC 95"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SelectRebatesDownload.exe:1988 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 9F 05 A0 34 A1 1A 37 35 7C 82 6E 0E BB 71 62"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process regsvr32.exe:380 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\ShopAtHome\Toolbar]
"EditWidthcombo1" = "1"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\VersionIndependentProgID]
"(Default)" = "ShopAtHome.IEToolbar"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCU\Software\ShopAtHome\Toolbar]
"KeepHistory" = "1"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\HELPDIR]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\"

[HKCU\Software\ShopAtHome\Toolbar]
"RunSearchDragAutomatically" = "1"
"corruptedMsg" = "One of the XML files is corrupted or invalid. Press OK to uninstall."
"lastVersionMsg" = "You have the latest version of the ShopAtHome Toolbar."
"ShowExternalSearches" = "1"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\VersionIndependentProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}" = "00"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\ToolBand.ShopAtHomeIEHelper.1\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\ProgID]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"PopStop" = "Untitled Toolbar has blocked a Pop-up window"

[HKCR\ToolBand.ShopAtHomeIEHelper]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"autoUpdateMsg" = "New version of ShopAtHome Toolbar is available. Would you like to download and install new version?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\0\win32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\ShopAtHome.IEToolbar\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"firstTime" = "1"
"ErrorMsg" = "Error"
"#EditWidthcombo1#" = "Widthcombo11"
"versionError" = "Can not find current version information."
"UpdateAutomatically" = "0"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\ProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCU\Software\ShopAtHome\Toolbar]
"DescriptiveText" = "1"
"OpenNew" = "0"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"AutoComplete" = "1"
"closeAllWindowsForUpdate" = "All running IE Windows will be closed before updating the ShopAtHome Toolbar. Continue?"
"RunSearchAutomatically" = "1"
"toolbar_version" = "undefined"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"updateMsg" = "This will try to update the ShopAtHome Toolbar from the server. Continue?"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "10 7D 12 98 01 63 BE 4B C2 20 8F E2 F4 9F D2 54"

[HKCU\Software\ShopAtHome\Toolbar]
"toolbar_id" = "{59BB6685-5695-4a58-810E-EC57F26F8FDA}"

[HKCR\ShopAtHome.IEToolbar.1]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"contextMenuItemName" = "ShopAtHome Toolbar search"

[HKCR\ShopAtHome.IEToolbar.1\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"ShowFindButtons" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CurVer]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCR\ShopAtHome.IEToolbar]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCR\ToolBand.ShopAtHomeIEHelper.1]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCR\ShopAtHome.IEToolbar\CurVer]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"AlertMsg" = "Alert"
"uninstallMsg" = "This will remove the ShopAtHome Toolbar from your computer! Are you sure?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0]
"(Default)" = "ShopAtHome Toolbar 1.0 Type Library"

[HKCU\Software\ShopAtHome\Toolbar\tb_items]
"Widthcombo11" = "1"

[HKCU\Software\ShopAtHome\Toolbar]
"connectionError" = "Can't establish a connection."

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"ThreadingModel" = "Apartment"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper"

The Trojan deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 5, 0, 3, 0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 5, 0, 3, 0
File Description:
Comments:
Language: English

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 46
ccdee7e5ce7f75133ec23bf5aec1089e
7235d1e83c63771b02b9004660040898
3bfb48e66f97c2e1bf7d5aa8f8837c4d
48468c6739a8ee26fa3c12c13d86b743
641a55bf4395917bdf207fa97e038c77
8da9f773b57cf52d844e9ec84e0d37bf
3a7a54a65bd94e914218af7601e31c5d
13aa42c06f227a9156afd0ec7f14d22e
802f21cd4aecb43d72148148a1ca7680
a4b40dc2d3ae76331ada96173e06701f
8bda018fcdda3fac69804ada1dd03929
aefb0e5a64c847b0a91e337ef4385b08
ceb286ced814f6bb894bb5f1e0dfeead
fc6d4f4aac9bb11c2f8e7105b0f4ec64
1e13b1770889c1f30176040eea8b0cc9
27ff5faa0ed3cffbdd222d5e643efa20
5eacedda12f737d53ed835f29383cb9c
36edef918f61857ff415999d7816b687
1d873e3c522e9caf7655249dafd67cb9
5d9ef68b82cc66e44222d1427cfc4105
83fbce3953e26e65d778e950456d6d7b
33d553bd170abcf332362389c4145dde
0d2530449c2b189fe9138970aefeec1a
76c19af2cafd953bc935452ad5a480b0
2ed7f7859c16952d8f7ddaa184b97888

URLs

URL	IP
hxxp://tbws.shopathome.com/RequestHandler.ashx?MfcISAPICommand=set&param= I-7cOM4DjELPNbPrsCiqF8g-b5TS0FXeryNjwotKuuOL2oGcbQSu0UP62hf3P9LsHEXfO1fNX0pAaa6vD3Xd1Dstam5CxfSe4fMB9PLMsy2x76i5-H0QLwESo8oQGeGMjnorlnYCICAMezJqtyHrSV_dCINac3RvCZK3KLMPTgB0tCB2KOTvaSESpNs4GWtDc-Kb2T48q7HucD9-R3WdFJCAku17M_T1yj2ozvFn2ISj5ClK37W3yQuBPZ9ZnW1GyG3vNq65RtQQ3sCCv6LPhgOinTeTUJXlcnt9Gvr0I82NyCsrmJ8QB9dIBRXHVqePNDChKqO-_sEfvTVfrUB85m	74.63.145.160
hxxp://wysqk.x.incapdns.net/install/setup5200.cab
hxxp://wysqk.x.incapdns.net/install/toolbar5200_ff.cab
hxxp://wysqk.x.incapdns.net/agent/agentprefs_.sah
hxxp://kfgw3.x.incapdns.net/agent/toolbarprefs.sah
hxxp://tbws.shopathome.com/RequestHandler.ashx	74.63.145.160
hxxp://kfgw3.x.incapdns.net/agent/bce_.sah
hxxp://tbws.shopathome.com/RequestHandler.ashx?MfcISAPICommand=installstatus&param=à frtXFiqIX4J2ckkuYnx87dThQusjeLs04yrY7GEpj9SKnGH86Z9hrR7efdQVWyPA6MJPne3LiNlCNJJQpmZRCJyR2y9pYgp_ElULUIzpSnWZDELceUBO7Uv5toWKl9cqYkBuWdnBF2aYajRze-47ZQRfceFirJMefQXemQtvbhvq7hah0Qo7o1yW3-1pajwaFiECmKRdGsaLxnCw5uKlu5gsFm128iGhHq0DGUGfhkKMUW1zSHPQ0Ee7ogFVD2KS5Bgnz9IsR6xjoBryXfdQsoAA_G-wR3wGBHJBr0nu0_6k2sOoOyO0KF40-Lz1XMzsWDUs9njEywHC3ks1nEKzxpzJm-QQn7kI2p93i4wbJq_YCJwtOneY5vJ5NU6653Rhwom2o4mAUYl5xMhqNRlc6fRdYodVHA9o5-p_yZbWWUyibUht6aHI1xrMh5voOxlmnL4sAujTfUu0TkWDk_IR5TG5RjlFPo5tRgV9ObbyQq0pTjQo4WgZ1Feh6ze5_iKcDfEOVMqHWOEfMeYBtknLMO4WiG9-vgfYdPCE0yXE_MQn8pIhScO6gULIogkkNbR-Qmv62EDfxycag9T3K3VZNx4ZDAjoPWQfb7PWSTCgvSM1RsecFva6DMeIFJEb6Yh2	74.63.145.160
hxxp://discounts.shopathome.com/toolbarpostinstall.aspx?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=	74.63.145.186
hxxp://wysqk.x.incapdns.net/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=
hxxp://vip0x07f.ssl.hwcdn.net/utag/shopathome/main/prod/utag.sync.js
hxxp://kfgw3.x.incapdns.net/dist/js/require.min.js
hxxp://wysqk.x.incapdns.net/Content/FlickityCssBundle?v=9
hxxp://kfgw3.x.incapdns.net/dist/js/bundle/Global.js?v=9
hxxp://googleadapis.l.google.com/css?family=Roboto:300,400,500|Fjalla One
hxxp://svip-usa7.sli-systems.net/autocomplete/sli-rac.css
hxxp://kfgw3.x.incapdns.net/Content/SiteCssBundle?v=9
hxxp://wysqk.x.incapdns.net/dist/js/views/Home2015/Index.min.js?v=9
hxxp://gstaticadssl.l.google.com/s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot
hxxp://gstaticadssl.l.google.com/s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot
hxxp://kfgw3.x.incapdns.net/dist/js/bundle/Home2015.js?v=9
hxxp://kfgw3.x.incapdns.net/images/sah-logo-stacked.png
hxxp://kfgw3.x.incapdns.net/images/sah-nav-logo.png
hxxp://svip-usa7.sli-systems.net/autocomplete/sli-rac.config.js?v=9
hxxp://e54.g.akamaiedge.net/meter/www.shopathome.com/32.gif
hxxp://kfgw3.x.incapdns.net/dist/js/bundle/Flickity.js?v=9
hxxp://kfgw3.x.incapdns.net/images/search-icon.png
hxxp://kfgw3.x.incapdns.net/images/scheduler/090816-summerend-carousel.jpg
hxxp://ei.rlcdn.com/360817.html?xs=&c=des-ede	216.74.32.88
hxxp://kfgw3.x.incapdns.net/images/scheduler/091216-wanderlust-carousel.jpg
hxxp://kfgw3.x.incapdns.net/images/scheduler/090516-couponmonth-carousel.jpg
hxxp://ei.rlcdn.com/360817.html?redirect=1&rl=9dec34e1e9e5984db8eda8a16349c39d	216.74.32.88
hxxp://e250.b.akamaiedge.net/js/autocomplete/sli-rac.stub.latest.js
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/amazon.jpg?w=130
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/target.jpg?w=130
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/gap.jpg?w=130
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/home-depot.jpg?w=130
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/omaha-steaks.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/l.l.-bean.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/jcpenney.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/walmart.jpg?w=260
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootseq.txt
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/macys.jpg?w=260
hxxp://a767.dspw65.akamai.net/msdownload/update/v3/static/trustedr/en/authrootstl.cab
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/saks-fifth-avenue.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/bloomingdales.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/old-navy.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/staples-lg.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/hsn.jpg?w=260
hxxp://kfgw3.x.incapdns.net/images/grey.gif
hxxp://wysqk.x.incapdns.net/_Incapsula_Resource?SWJIYLWA=2977d8d74f63d7f8fedbea018b7a1d05&ns=1
hxxp://kfgw3.x.incapdns.net/images/shopblog-header-text.png
hxxp://kfgw3.x.incapdns.net/images/shopblog-btn-sprite.png
hxxp://wysqk.x.incapdns.net/customermessage/sitemessagecontent?pagecode=8112&siteslot=6&isfirstvisit=true&originalurl=http://www.shopathome.com/?page=http%3a%2f%2fdiscounts.shopathome.com%2fDiscounts_and_Coupons%2fGoSearch.aspx%3frefer%3d76258%26st%3dToilet%2bPaper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID=%7b4AB058F7-2007-43EE-9FFA-1E1D9C2CC718%7d&ae=no&source=76258&subsource=SEPDSE&setupguid=%7bc462bc39-9cee-47aa-b97e-420b260526fa%7d&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=&_=1474062588060
hxxp://kfgw3.x.incapdns.net/images/email/black-seal-96-50-belcarogroupinc-3102.gif
hxxp://kfgw3.x.incapdns.net/images/[email protected]
hxxp://kfgw3.x.incapdns.net/images/merchantlogos/1800flowers.jpg?w=260
hxxp://kfgw3.x.incapdns.net/dist/js/bundle/Hashes.js?v=9
hxxp://wysqk.x.incapdns.net/_Incapsula_Resource?SWKMTFSR=1&e=0.2596657034262577
hxxp://prod.c.ssl.global.fastlylb.net/nr-974.min.js
hxxp://bam.nr-data.net/1/eabd37c669?a=442317&v=974.7d740e1&to=YlVRZxFXX0VWVkMPDVsffmUgGXlZWlAFVlMAc1xdF0ReWltQRUkrW1RWSw==&rst=4766&ref=hxxp://www.shopathome.com/&ap=350&fe=4547&dc=4547&tt=FF59D062042464A5&af=err,ins&jsonp=NREUM.setToken	50.31.164.166
hxxp://images.sahcdn.com/images/merchantlogos/staples-lg.jpg?w=260	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/l.l.-bean.jpg?w=260	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/saks-fifth-avenue.jpg?w=260	107.154.119.91
hxxp://images.sahcdn.com/images/scheduler/090516-couponmonth-carousel.jpg	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/walmart.jpg?w=260	107.154.119.91
hxxp://www.shopathome.com/_Incapsula_Resource?SWKMTFSR=1&e=0.2596657034262577	192.230.78.126
hxxp://images.sahcdn.com/images/grey.gif	107.154.119.91
hxxp://tags.tiqcdn.com/utag/shopathome/main/prod/utag.sync.js	205.185.208.127
hxxp://shopathome.resultspage.com/autocomplete/sli-rac.config.js?v=9	74.205.67.232
hxxp://www.shopathome.com/dist/js/views/Home2015/Index.min.js?v=9	192.230.78.126
hxxp://images.sahcdn.com/images/scheduler/090816-summerend-carousel.jpg	107.154.119.91
hxxp://j2.sahcdn.com/dist/js/bundle/Flickity.js?v=9	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/hsn.jpg?w=260	107.154.119.91
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab	212.30.134.176
hxxp://www.shopathome.com/_Incapsula_Resource?SWJIYLWA=2977d8d74f63d7f8fedbea018b7a1d05&ns=1	192.230.78.126
hxxp://images.sahcdn.com/images/scheduler/091216-wanderlust-carousel.jpg	107.154.119.91
hxxp://images.scanalert.com/meter/www.shopathome.com/32.gif
hxxp://shopathome.resultspage.com/autocomplete/sli-rac.css	74.205.67.232
hxxp://j2.sahcdn.com/dist/js/bundle/Home2015.js?v=9	107.154.119.91
hxxp://j2.sahcdn.com/dist/js/bundle/Hashes.js?v=9	107.154.119.91
hxxp://j2.sahcdn.com/dist/js/require.min.js	107.154.119.91
hxxp://images.sahcdn.com/images/email/black-seal-96-50-belcarogroupinc-3102.gif	107.154.119.91
hxxp://images.sahcdn.com/images/shopblog-btn-sprite.png	107.154.119.91
hxxp://fonts.gstatic.com/s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot	216.58.214.195
hxxp://images.sahcdn.com/images/merchantlogos/target.jpg?w=130	107.154.119.91
hxxp://fonts.googleapis.com/css?family=Roboto:300,400,500|Fjalla One	108.177.14.95
hxxp://images.sahcdn.com/images/merchantlogos/gap.jpg?w=130	107.154.119.91
hxxp://xml.sahcdn.com/agent/toolbarprefs.sah	107.154.119.91
hxxp://www.shopathome.com/customermessage/sitemessagecontent?pagecode=8112&siteslot=6&isfirstvisit=true&originalurl=http://www.shopathome.com/?page=http%3a%2f%2fdiscounts.shopathome.com%2fDiscounts_and_Coupons%2fGoSearch.aspx%3frefer%3d76258%26st%3dToilet%2bPaper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID=%7b4AB058F7-2007-43EE-9FFA-1E1D9C2CC718%7d&ae=no&source=76258&subsource=SEPDSE&setupguid=%7bc462bc39-9cee-47aa-b97e-420b260526fa%7d&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=&_=1474062588060	192.230.78.126
hxxp://images.sahcdn.com/images/merchantlogos/old-navy.jpg?w=260	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/1800flowers.jpg?w=260	107.154.119.91
hxxp://xml.sahcdn.com/agent/bce_.sah	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/jcpenney.jpg?w=260	107.154.119.91
hxxp://www.shopathome.com/install/setup5200.cab	192.230.78.126
hxxp://js-agent.newrelic.com/nr-974.min.js	151.101.12.175
hxxp://images.sahcdn.com/images/merchantlogos/amazon.jpg?w=130	107.154.119.91
hxxp://c2.sahcdn.com/Content/SiteCssBundle?v=9	107.154.119.91
hxxp://images.sahcdn.com/images/[email protected]	107.154.119.91
hxxp://assets.resultspage.com/js/autocomplete/sli-rac.stub.latest.js	23.7.195.122
hxxp://j2.sahcdn.com/dist/js/bundle/Global.js?v=9	107.154.119.91
hxxp://images.sahcdn.com/images/sah-nav-logo.png	107.154.119.91
hxxp://www.shopathome.com/agent/agentprefs_.sah	192.230.78.126
hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt	212.30.134.176
hxxp://www.shopathome.com/Content/FlickityCssBundle?v=9	192.230.78.126
hxxp://fonts.gstatic.com/s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot	216.58.214.195
hxxp://images.sahcdn.com/images/search-icon.png	107.154.119.91
hxxp://www.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=	192.230.78.126
hxxp://images.sahcdn.com/images/merchantlogos/macys.jpg?w=260	107.154.119.91
hxxp://images.sahcdn.com/images/sah-logo-stacked.png	107.154.119.91
hxxp://images.sahcdn.com/images/shopblog-header-text.png	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/omaha-steaks.jpg?w=260	107.154.119.91
hxxp://www.shopathome.com/install/toolbar5200_ff.cab	192.230.78.126
hxxp://images.sahcdn.com/images/merchantlogos/bloomingdales.jpg?w=260	107.154.119.91
hxxp://images.sahcdn.com/images/merchantlogos/home-depot.jpg?w=130	107.154.119.91
www.google.com	173.194.113.210
data-secure.circulate.com	8.33.74.9
seal.websecurity.norton.com	23.9.5.158

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

POST /RequestHandler.ashx HTTP/1.1

Accept: */*

Content-Type: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Content-Length: 714

Cache-Control: no-cache

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; incap_ses_184_621395=GoLWPdzcfVTkNQxoRuWNAuho3FcAAAAAO4NkfS1u68XWq3f3M506wQ==

MfcISAPICommand=update¶m=ø

bs63oxSW_Byc_tPf2NkG3j4TZMoxuK6Q3tsSzi22ceqG9nfQ-45oRpzQ08CeruRS1I3hhvxgzWqBzdGdJILMd-1qqIJFEwGqjItCqWAhqRivJRmCESOwqfA4kq_edrJmpKk-ArEZpwWa36bX6PpK-x2xGYQRPxq3jXKdun4yqPceoScTsANaypY4lDGNNuBNhHTt2Kn-1ZAaltSCW4GPNYcytlyxJqZhMZcX0ONBNas54d6Hz81_RMvr0IoDMAI1Fs_Lzuswn3lr8FYw-Qe_GdVBJqCEJAggxoiqVes_6ZSEaUUF-MzvFnIl4ZhMZj2DD2CLpj1_2X1X_vtIFGHI0f44vjZMegxuOV-TqZq4KWAs_2IgAl8tZODeL3Nvdm9XHysEuXb49SVahP0B-7j0oulr2rPUl1lVV0pPb1ZuEBMoI84bXQ0V_7fCgmK5aIWagpXNhlK7sHU8KrxVOMsODfSuW5i9a8OkaZRNjS5ikCBljnIAdmR-kLlo0h_RONqYChOF45CuN9VIQ0A0KiuL7md3DFsxA9yy3YpNa9s45rawbv8EQZegUlixS1bIya2pOKQIOZAThNXstHqyC2evBURqECp_F-aJyuB6Q791KuV59MJSC6YdBkzi7KVfJgBJweaYGyRU6DJ8xDkbtUfgxhTTEAlrnrMi.
HTTP/1.1 200 OK

Connection: close

Date: Fri, 16 Sep 2016 21:49:30 GMT

Server: Microsoft-IIS/6.0

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Farm01

Etag:

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 460
.....a... ..&.vi.{.....l..A..}.......'.Z.Aro] ..,[email protected]..
^8.....s..^.5....).0V.N^.....Z'...L..........m..0..."J...h5.J.Xh...)e.
Gk..GJ. .......n...~.j...V@&O..... ....y.L&..g.y..;.EY}AD.e..p.....&..
.....x....UR$.U..{.x....8....O...Tn........^.{.. .(.Z.h.Y#Z.dn.A...@,.
n.nV3j..>.......C..&4I.p...&.L..R..._.8 W...{.S.nG0i.cL....P).P....
.b./l.......#V<....3K.S.(.9.(Y@!%....h............V@&O..... ....y.L
&..g.y..;.EY}AD.e..p...I..n.U.z.............F!..

GET /360817.html?xs=&c=des-ede HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ei.rlcdn.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: nginx

Date: Fri, 16 Sep 2016 21:49:39 GMT

Content-Type: text/html;charset=UTF-8

Content-Length: 0

Connection: keep-alive

Keep-Alive: timeout=5

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Location: hXXp://ei.rlcdn.com/360817.html?redirect=1&rl=9dec34e1e9e5984db8eda8a16349c39d

Cache-Control: no-cache, no-store

Set-Cookie: ck1=ck1;Domain=.rlcdn.com;Expires=Wed, 15-Mar-2017 21:49:35 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT
....


GET /360817.html?redirect=1&rl=9dec34e1e9e5984db8eda8a16349c39d HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ei.rlcdn.com

Connection: Keep-Alive

Cookie: ck1=ck1

HTTP/1.1 200 OK

Server: nginx

Date: Fri, 16 Sep 2016 21:49:39 GMT

Content-Type: text/html;charset=UTF-8

Content-Length: 998

Connection: keep-alive

Keep-Alive: timeout=5

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Cache-Control: no-cache, no-store

Set-Cookie: rlas3="cdt/w4/5Ff8h6X2qD3GiSoW91R0zM91KxKyOZlg/XHqMyA9jEACu5w==";Version=1;Domain=.rlcdn.com;Expires=Wed, 15-Mar-2017 21:49:39 GMT;Max-Age=15552000

Set-Cookie: rtn1=31a0ef1b583cdcc5017794508dd0e0d6131bf47b79d07b8d319c9bab86166cddebf51870956f78461537b5ed68a716294a3de9a54a0a1191072f86b10033a6fbb1a637af95cb12827a01253c7b702435a47de8f759ddbea7d8c09ae41fa5ebd3ab38c64188b6a9a7;Domain=.rlcdn.com;Expires=Wed, 15-Mar-2017 21:49:36 GMT

Set-Cookie: ids=939748b9f4154231c3ec3b0aca73203d;Domain=.rlcdn.com;Expires=Wed, 15-Mar-2017 21:49:37 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT
<html><body><img border='0' hspace='0' vspace='0' width
='1' height='1' src='hXXp://e.nexac.com/e/liveramp_sync.xgi?na_exid=75
7969b21f6639b2fd4db96189aa0529ede9aa3f7bc322f929295676bf9be1e23b87cd2c
0007efc4' />..<img border='0' hspace='0' vspace='0' width='1' he
ight='1' src='hXXp://ib.adnxs.com/getuid?http://idsync.rlcdn.com
/52154.gif?partner_uid=$UID' />..<img border='0' hspace=
'0' vspace='0' width='1' height='1' src='hXXp://sync.mathtag.com/sync/
img?mt_exid=10017&redir=http://idsync.rlcdn.com/47154.gif%
3Fpartner_uid=[MM_UUID]' />..<img border='0' hspace='0' vs
pace='0' width='1' height='1' src='hXXp://dpm.demdex.net/ibs:dpid=477&
amp;dpuuid=029b46253b05fd456de42c15203acf32ca14a92dbdaa7db570f1b5a2fa0
0db53b0da87c991749652&redir=http://idsync.rlcdn.com/362248
.gif?partner_uid=${DD_UUID}' />..<img border='0' hspac
e='0' vspace='0' width='1' height='1' src='hXXp://cm.g.doubleclick.net
/pixel?google_nid=epsilon&google_cm' /></body></html&g
t;..
<<< skipped >>>

GET /s/fjallaone/v4/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Tue, 16 Aug 2016 12:24:59 GMT

Expires: Wed, 16 Aug 2017 12:24:59 GMT

Last-Modified: Thu, 28 Aug 2014 18:23:59 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Content-Length: 17801

Age: 2712279
..........|.UP.....a.........%.{....5.C...............i.j.<.......S
w.,..).......?........R`...........H..O............ .p.X....%....p....
..Z..=...s....@.?....8......p........3...........>i....2...j.....e.
.b....GXG...az9...Y....I...*jt,.....B....U.jj..e....(.)..<[email protected]
.{[email protected]?.....2j...a..%.....1r..<.....;........7....r....
.3...D.>.... [.Lw.&....Vp..([email protected]#,6U1.`.t..6~...T..
D.A....p....5..'..E.T.....Z..?...}..D.[..iyyA&8..3..W.V.....J.90.7 ...
......LQ.5.FN..~..X..d..j...y...)?.i......-}.qZ.H.. .R.x........AG..\8
(%|./.t......b-`......VM...%7...n..)....Ym......g.l. 1.u.7.]{Mje...Y.A
....y.%.aG...idV..so XD.ai....e7k..Y....v...iA(.......w...F..L..(...1.
Y.<..$...Y..\...c5.:/E.s.y..N!.|%...........,Xf.Y{.#...i.9.....N.&l
t;.M.W3.g.A!..^....5,j...{......(8...Q.i...=.....m:.. .a/FO....<.Y.
o..S.g\.%`._. . .;...r.0..L&]...A.R...N..>......Q:..).$..=....;P...
,..F$.>".9 .....:&j....e.p..z{.,.'Z9.(.."..c............?.7.......%
.x,.....7,.......o3<..v..U....(E_d..H.28.....G.a5....@*......g=...5
.......].>........z4..-..\[email protected].`fK.../'..ew...MiM.
..9.* >p.J.5.....N........B3..3.4...J.V..L.]../.....D...T...\.Qr...
p.......8l...n(.../...]s{.s.l.0e.v..K.S.o.....j..D..4Hl...B..c..Uh-...
.tu].j.0.W..C.-..B.U.4..$..T.....Oq...s...t^.:&....-|b."4.]H...E.."e7k
U......2X.j.<.....s.....N.......H..N...9...%\...?.{4...$......x..m.
.....Fv.3..A....s.....(_....m..W..v.s0.\c.......T....C..D.%..v...... .
...W^y.c...E...(.tr......|r.<.!...>.6Q.~4....VM .!mN.G.[...d
<<< skipped >>>

GET /images/sah-nav-logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "d522b257"

Content-Type: image/png

Content-Length: 7363

Cache-Control: max-age=416165, public

Expires: Wed, 21 Sep 2016 17:25:43 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=zdoDdsxnCjR/zQ6lLaKCBPJo3FcAAAAAueCfpVMJ egMnsaHOA9JYA==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=XBjzXwvnwqu; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=knU.EUYG; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=bZC

    XQtOGalR: Tts; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 46) q(0 -1 -1 1) r(0 -1)

X-CDN: Incapsula
.PNG........IHDR...(...K........Y....IDATx.....MU...AB).=I.EH.F..\B..[
...).o..x..A:..-N..q)....S..a..e2...1.0...g.}.g...^..>........g={.}
9.{.Z.Y.DE.[^O!tMt...t"z..4.L>.NA.........;..-%%........S.........U
.B....:..!... V\6z.z0.2:W..DJJ.eE.P^.}..z..*\.&..*?N..KfA._.A.i...Sh..
.>q!|.."..j)tD..u..a.g.`.k...........B.....yR..e.ZH..Ho.....9...2.n
...mM............9....!.5X]A.@?..#.......(..!t.....T.AB...H.......!../
.....1?.K.x.RRR!Ph....AwC_ 0.K...,..=.%.-.;.$V..8c...._a^.^.s....~..^H
...N..}.....P..xG... .........#.....B.(...z......V}..FH0]w.4Xw.0.*..~.
:k....&.......'....... gSJJ.U..P^Okt....A...da0...c3..?k...k..^m..8s..
..zKO>............n......[5.RS.......s..Y....h1c...8..N....3......3
3....;..&..}..'.R..M.. z......TPr.Ptc{=..F.p.h...g...'W..%.....i~.9.~.
..8......z~.t...a............B..1..EL.X.Br.......@y=..k|..........O.v.
9...m....C.r.dv..1p..E.:f...Qc?s.."........Y....R.......n...r..pQ(|.w.
.X..<....!.'.... .....Z..&..<_.V[}.....)......r.(.'.....o`......
..<...s........E....1..[P&Hm.cRRR.SN.56X8.t.=..].e....9:6.......A.K
 .ogG..Y......%..IIED....iE7.......f:[email protected].#.k..E.6n._..3.A.~.@T
.......[......\.)))?..(..4:...t].\..v..-'.......s.'.W.....!.E...D...Q.
. e2...r......*...r.~..Oh.[......4..(J.x.........W.o..h.".............
.HI....P].....hJ.=.rz..MZ...e).\....../.'q.....R.. E...OS}.....#%u....
(7..I.....]gN......]..y.n.....4.....1.....J.o(..........Sa.JRR....jBN.
....`.._.v.P=.....?l...(..F....*.&C.....=....~...nQ....O..s...,.....}.
[email protected]..!....*?pl8..u8....=.
<<< skipped >>>

GET /images/search-icon.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "3fd89799"

Content-Type: image/png

Content-Length: 340

Cache-Control: max-age=416166, public

Expires: Wed, 21 Sep 2016 17:25:44 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=9NUmVUDvoA9/zQ6lLaKCBPJo3FcAAAAAwseQSY/jCZwyKCSCiGK1XA==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=oAtKVvNMyck; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=KDI.ClXA; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=RZq

    XnKOAalg: dtP; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 209) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.PNG........IHDR..............z,>...3PLTELiq.......................
.................................tRNS.. 0@P`p........#.......IDATx.}..
....E..Z........V.'.......6..a..T.......e4..uKnF......,p.ft?..-....l..
oC..@_....%T.M..S.b...Q7.3....h..H..N2w..ez.q:...)Z..x....S.07...cK%:.
.w{..J...s....).z.hO.#...`..=7...`..^...6..7C...-......IEND.B`.
....


GET /images/scheduler/091216-wanderlust-carousel.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "cfaf891d"

Content-Type: image/jpeg

Content-Length: 98277

Cache-Control: max-age=448660, public

Expires: Thu, 22 Sep 2016 02:27:18 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=sDY6QwVuUlJ/zQ6lLaKCBPJo3FcAAAAAEv67/6B8hgRT53FPW8vh/Q==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=VePPCNregij; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=Otf.vThO; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=iZE

    XIuOnalH: itx; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 283) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C.......................................................         
 ...C................                                                 
...................................................._.................
.........!1."AQ..2aq.#B...Rb.....$36Urt.....5CSTs....Nc.......&du..D
....ev................................F........................!..1AQ.
2aq."3R....B...#r..b.$4.......DS..............?...N..I.YI%......3B.
.P.I#.5............6..am.L....K..U./.....o.c..o%..U./.....o.c......E..
#........(...2........[.S...y..Y.C.q5...G....E.W...h...........u .....
.=..='N-.<.$U....u7...j..../........>P...:....4v....l;5/.?$../..
.....M..../...K............o.Gh..K...R.#[email protected].#[email protected]...
......4v....l;-/.?$..w.............K.....#.A.F.u.....4v....l;-/.?$..W.
'....{F.4o..R..........|N=jl..h.>.7.~)|.vZ_.~H?./.......M..../...K.
...........o.Gh..K...R.#[email protected].....*|R........>P...:....4v....l;
5/.?$../.......M..../...K.....D.....C....l..;..P.X......Zp..9k'.......
&.....4]..>.....V.....\....4_.._.#.Z3...U.."h.....G..g.V.W@|.......
.Q....]Xe]..&...k.D..Fyu...>D........h...2....E.....?..<......M.
.>.....V....*...4_.._.#.Z3..e]..&...k.D..Fyua...M..:.....V....P>
D........h...2....E.....?..<..e]......k.D..K<.........k.D..Fyua.
......k.D..Fyua...M..:.....V.yub...&...k.D..Ky..yP>C........h.K..T.
.z/.u.......ua...=..:.....V...........k.D..F.]XeA.....Z..Q....]X..|...
[email protected].....?..<....4=..:.....V....*..z'.u.......uad..Z'.u
.....-...Y..-..:.....V.......z'.u.......uad...O.._.#.Z[.uad..h..n.
<<< skipped >>>

GET /images/merchantlogos/amazon.jpg?w=130 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3901

Cache-Control: max-age=419007, public

Expires: Wed, 21 Sep 2016 18:13:06 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=c8ltC8BrWmd/zQ6lLaKCBPNo3FcAAAAAEGxwCDQSiZbcL1OTTIVTOg==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=BWOJdHivUVR; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=qUb.SFQD; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=CZA

    XvHOoald: Ytm; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 541) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
......b...............................................7...............
................!"1.2A.#Qab...q.59BSv.................................
7..........................!1A..2Qa."B...#CRbq...r................?...
@(......P..@(......P..@(......P..@(......P..@(......P..@(......P..@(..
....P..@(......P..@(.........^..K.s7N......t.3..v.. ..(.u..p6.H".....(
....C..0...9x:.m..~../..S...b.........$.n.{M.m^..#..O... .j....4.$..o.
.B/.,.3..m|[email protected]....(.^.;.2QS..C....
.Kv.^..v...V..Hm..d...3.v..&.L$#Br|.......w..W.....x...Y.L.~........r.
..Z..x..C..6.mp........S,8...[..Zl.....G..T.ou*.,...q....'..U..`...=..
7p...<a..n.~.(".1;..5....."CV...... E......\:.z.....N..~1.....N....
q.Dk.......a...6.(..m.......U6..7".........5..nr;N..>....K.3....h.e
1b....}.Q..I.^....)....kd..r.............&. .o.5.doHb...4...V.I..".]p[
.q.W.P.LG.u.Ur..4..2.Z:.o^5t]........<...2.`....g..#.<v./4...F..
%)[email protected].<[email protected].!........
K....P.L.....T:.u...{...9..7.g.m..<@...s.....]v1..4.%.1.._"DV...tZ.
.R...#."[email protected].....}......&.uzn2,.....Fa...F......u..T..x.\.3.
...9U....8{.....1...a-..X...J.....a.....u..I..O.TO...&.R...z..........
.:hq.Z...fgvl...]..r.2....G..J...=#...l...)......O.Jp.:[email protected]..)t.1...
.qo..b]....V.....I...........=.0h..I....j.. ...=...D....P....c1..y....
G'.y.v..wN.....J.....2...\.4.w.is...\.UW..W....xxi...H..0i.#...j..
<<< skipped >>>

GET /images/merchantlogos/target.jpg?w=130 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 7774

Cache-Control: max-age=419007, public

Expires: Wed, 21 Sep 2016 18:13:06 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=hKYRA24Hk1R/zQ6lLaKCBPNo3FcAAAAAPuumKKHtvgqp y9j7x0tfw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=MuxnTGJGQiL; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=LBJ.zsNO; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=eZY

    XhFOKalv: EtW; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 611) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
......b................................................9..............
...............!.1.AQ.."2a.#BRbq.t$Îdrs.............................
......E...........................!1A."Qaq..2..#BR...br..35....$'7C..s
................?...DM.4D..DM.4D..DM.4D..DM.4D..DM.4D..DM.x$.I<..G.
.....d.......[#!.........r=f..... .[|.nuf.={l..j$....x.....Ilc.f..@Of.
..?..;.|...._v.c.......B..l9.@.(.......\...4V.Px.z...:.5.w..j~..w.....
.od..a.....b. .........l.T.6=I.^;[email protected].....'....
._d......25.7.k...iR.._.Ga....-k..qm.....m].lS.p..**l.M ~..F...k.....&
'...............j7U....7.0......q.az..3.....S.G...../2...mC....... ..k
(...#.*[email protected]!r....DM.4D..DM.4D..DOm.bs....{...>.vss.e...
..{.XS.W}.N...L......O.G..).........mv.89...|.ONC.-.... ...-e."..wz...
A.IGV....;..`;.y.......Fd..Z[.zC...]........-j$.I$...os....$..AO.4-. .
........8....&.#./Q..R!..~..Kn...u...)...A..m.KC.I....A..W..f.......=]
....%...m..i..KYsl...lA.....Z....Wv.......?Y.....v...6...T.?........?.
..{%.....w..?N......... }s.'..)....p...D.....Ut.l..f]X....Ne*...R...e.
[email protected].....?B.......# .s.x..=..i.sI.c:Ru......X.'T..'j2.%..g
\/I.....R..)...qy......=.#h-..j.A9/.=:......*.v..Qh...]m,m=..!..f.&K.y
..>&...F..;....}.k.<.qR..&....*....'Fu!Hq...G.....#R...9.l....d.
...Z.a....n..b.'....-sN.>.U..*Bh..&.."h..&.."........._.....<.\q
...J.s.)(Y2......|x#.....c..R.]..0.....=~C%Jn.{.n........ f..6....
<<< skipped >>>

GET /images/merchantlogos/home-depot.jpg?w=130 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 7539

Cache-Control: max-age=419007, public

Expires: Wed, 21 Sep 2016 18:13:06 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=wQe9DuBcmC5/zQ6lLaKCBPNo3FcAAAAAu/S9FQ77zffGyEBKBacpdw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=rflnlCpHemh; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=IJL.Gaaj; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=NZU

    XgsOmalN: dtd; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 813) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
......b..............................................E................
............!."1Q...2A.#56UWuv......%.$37Caqs.........................
...............B...........................!1".2A..4.....#BQSUart...$q
6CRbcs................?........JR..)JR..)JR..)JR..)JR..)JR..)JR..)JR..
....4...i.Jp~..4...i.Jp~..4...i.Jp~..4...i.J.yJR..)JR..)JR..d{.z)V..w.
0,SI.cJ..(.u..x.6..[....Jh.[..R....!><...j..Q..ll., ...H. ....E.
......TS.......5..,S..c1..#..:6$......J.?.N.~...ei...-.e..I..[..K..._^
/...R................_./....s.R.....}*X..1:.......|...k.%..?...j]}x..O
.K..'B?wO........~.....%..K....k..w...y6,?m.9.....y.,...x......'.G.<
;.......m.V]^...v.o#.X..f..y..g..w'... ...l:E....b.4$(.$#,|(&.d...w$.H
..U.e/..E.N0.j...H.l...V.l.E$...B$w......8BB....M:...v..M......dh'....
..r.3......Nj..,:.../..:Y..Dk<..3..L|d*..T.....VM>.q\.?.qK..h.V.
....J..=.R..... ....Y..x<{...{..P.ml'...K,h.YA.8S.....c......o.4...
5;.qF..h...a..FFGq.....v.].....3-.P.....$r~..TQ...<...f... T.e)...o
,.O...... &..)JR..)JR...x.G.T..........F.R.........Zz.67.5O.[.0.;Q.Hu#
i....K.hO]...*.......S......uc.u..B.... ...l..&.t#i.0..I_..1..?..e..|.
2G..w.zE..c3NU.q'.!Q..y...{.x.....=.K.L~.0..-...$0.v.....1....!....1.=
7.D$..KD.....n...Z-.H#.2..=H.......2.a..=..g. U...dMb..C. J..G.t.e....
0..*.......j....j.]....~-:6v..1:4.......>..K ....PRz..9.4>......
.@E....`.yf>...=..8."..w.Z%..7...j.....>.G...v....8.&.u;J..P
<<< skipped >>>

GET /images/merchantlogos/l.l.-bean.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 7999

Cache-Control: max-age=448658, public

Expires: Thu, 22 Sep 2016 02:27:17 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=c5GlKUXwKTt/zQ6lLaKCBPNo3FcAAAAAIupuSmHpugcrFpzIpOzZSw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=OxVpgXKrXNa; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=Sot.amXm; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=pZB

    XTvOralB: ntw; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 886) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
......................................................M...............
................!1.".AQ..#29aqv..hBERtu..$()35b..HSVe...............
.......................G..........................!1..AQq"2a.....Rr...
...#356B.....&4s..%Tb..............?..................................
......................................................................
......................................................................
......................................................................
...........................................................T......sR..
..|Q....J...~.....n).y.W.;.Zy.Rb...y.y...puE....3.:<z.....Z|.]3u..u
FK....w#F.]Z..BK.3R...&B.....{o..;..(..JC........bFm.-9...>?.[#..-.
..........\G..!.B.{..."?....sz..&x.Y...0w:.M.h..e.T>..9nj.....?^k..
.. A......%...m!?Z...$_Y...~..;.k.\.-...j.Q..2>}...r..........S.9.&
lt;a.KZ...C.r\...J`.h7[C.$..Q.{.....WV.N?=.a*.1Wi.g.EUDp.....h..nv....
._....;[email protected]?.6............,......[..m._..R...y....|}j..nW\.N"...O.e.
..K.)...Z...*Cd.yQ^K..A.).$.*I..fB...oSr....'.8......................*
...8G ..w.W^;..y...DU.s....[j..'.C.23ed.....~s>9....d...Y..E.......
&."4....]....a.....;6c.o&....Vm..v|..*.RI..d.U:.i=..2O&d\...kqUS.F...a
q8..1.ESM<5..;.."....b...^O.n.a;.D.n.Vq..':[....].g.....f[\St.5.i..
.j....p~..".i..]6..[.5.etD..wJ.|..z..4...3.o.[./..w!..hV.F.UU..j.9.R.r
.i_/....j......&-...3...>..&..z...EU[....y..........u......./7l
<<< skipped >>>

GET /images/merchantlogos/walmart.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 15809

Cache-Control: max-age=448658, public

Expires: Thu, 22 Sep 2016 02:27:17 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=QaGKJSTtMXN/zQ6lLaKCBPNo3FcAAAAAwLNeYnPNTE3JhIGq89yFbg==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=PwCCojJDOid; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=ZKv.HPez; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=WZu

    XTtOaalE: gtz; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 972) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
.......................................................P..............
................!.1"AQ..2aq..#.R..7CDb...$*9BGScfrstuv................
............................R..........................!.1A.."Qa2q....
#.BRbr.......$57s...&46Et.....%'3CDSc..............?..................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
....................................................................P.
{..h.*.-e.[..../..jW.....K..DC...........D04..... 9.. .....U.EL...h...
. ...IZyV..l..W(.D.....B..i2......r=.....%.......zh$.`....C.._v.b...NE
l....C..ml.6F...{[email protected]... ". ". ". "..MMi..Y.nV.....1d......-H.!*
...iN...W.i2......X......."...A.`..z.B..8.3:.j.Z......<.A7...p.....
...7..Rm...0....G...]PQ!.$....7y..........4Y .|bfRJXE...kZ...ko.%...,.
9M;....b.#...k^....}.q...... R.y....:&w.U..D.D.6%...O.....R..Nn...-.#.
29.n1.&.ZI....,p.y.k[.bt....qM.lN.....\O.....4.qe.......v.E-...,,x..8.
j..#.)jA...7..f.RL...r......W..(_..zZ]k.....c9....N!P.u^...........n..
.........r...R..B.9.q.4...C....J.i=........)e0UF..9.....c...1jZ.EE...3
..!..cb.6; .Q... ". ". "./.V.M..j...B.&.....*K.i...&....d..$Ff.2""
<<< skipped >>>

GET /images/merchantlogos/saks-fifth-avenue.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 23557

Cache-Control: max-age=466537, public

Expires: Thu, 22 Sep 2016 07:25:16 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=jAPsZ7Ha ld/zQ6lLaKCBPNo3FcAAAAAUMJXlgExowwCqVfx /w/JQ==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=AJVtLdCDopm; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=PEx.Onwi; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=sZU

    XDhOmalO: Stv; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 1062) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
..................................................I...................
...........!.."1#2AQ.$a.Bq.......7....b...k.J.# e..A.n....Z....j........y.....Q.<.l..k..34r....
I..*.r-.]....O.....9..:D......Mc....B.K......DO..R........2.)k=}..z...
[email protected]...*M[...O..~$....q.~'...Y-;c.[......u.~.w!(...n.Dv.W...
5.....Z...bZ...P.I..3F.v..6...,!..[wb..KWR..........X%....C.)M.{.DkE..
O.....O...6s.!.Ye.....IBR;*Q$..$....x..l1F....Ay....X.......-p........
}..e.J..Sc.4.-.R._mi%...Q...sp.........s.4...r..k......).7.K..-..;>
o.....n.:...7).. wg.....(......l...]v......!.Z..B..2.W~..a......>..
5.F..4h..F..4h..F....N8.s.N.x.......].n.X?..K...O..u..=.7Y...2.....g.B
.&.......M.|!........J2....v.Cj...#L!.F....>....o....%`.,g.....-.s.
]2.j..d?F.!m....'.u..4.%..6..#.>.MM.]PB{*'....Y...pC..I.!.o..".A.1.
 .......L[HC%.V.%...". ._.D..yG..'><.^....m..>.k.....vU...U\|
v.W*.~..IPi....W..kuJb.m....}Z...Z... Wg.K.Q.qU"]N[..m.ZH.KQ#..I..t.;.
.,.9vsK...\...?...w...J4.....f.....Oiy.o..}c.e(.GKBc.._~... ......U...
....)...&J.*!...Z..'...'..sv`..`...}.L.e...`..[.!.. ..z.............O.
F..4h..F..4h.....)f....p.9....4.......).O`}..J.~....$.5xL...7....n....
U.V.I.....C!Q.3.C.Pe.=.{..Axx..Z.T...}...W.....}.U*<.qOh^...^.../..
(.$X...M...dE.jB....|.>.B. ..w-..#{].de...?..km..}c..K...S..zM9.U..
...6=........k..55/.K.(.....;..J=O.Zu2.:....f.......j.9......rJ}...*P.
...1.*........ThE.....H"d.....$..q...${...g.M..w..a....Js...../9Q[
<<< skipped >>>

GET /images/merchantlogos/old-navy.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 5198

Cache-Control: max-age=465499, public

Expires: Thu, 22 Sep 2016 07:07:58 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=ruh7ctStQCF/zQ6lLaKCBPNo3FcAAAAARc2xtVIgnZKFtK6UNY0Zeg==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=cqgfEKPhzKN; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=JQK.EwqQ; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=vZh

    XgROfalY: Qtk; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 1138) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C........................................................ ".."...
....C.................................................................
.....................................................L................
............1.!Aa.Qq.."2b.....#BRr......378Sstu...'CF.................
....................................1!.A.............?................
......................................................................
......................................................................
......................................................................
...................8.z.7A..:..:..z.;h..-.XA.8;.......A..8.z.r.........
............lm.s.h..N....U..i.9... Ls...M...9#.;.PC........{=.. ...).&
gt;....Qq....,.w8Yp.U#OGV.I9...._..]8.....av.....K{...9...p.;U.Nq.=.3.
..F.?Q..k5...\....!.~...c... .6Aw.$.v.....r;....}T.|..w.H.....{Y.I..E.
.;.\'x..Y..8~....e.......w.....o.r...Y.....gY$@to..\>.....m|Tj....5
.....!...f...,.tju..M..so.kH..}.x.b..l?.0.......-..............7..VW.,
.;.........}{"eL..{..P.\. ...F.RU2G.kA.{.#b..............s.....TddW...
..e....O.F..<...ARs.=o..KM.Xi.p..k.G.........F.[r.V......Qt.F..`..!
........=.4l......................M%4......;.X.Z..'...`.x......>I-.
...D...Y...?.{...g....n...3KD.:.l.m!5.........j&->=.Y..dW;....o..TR
.$a..t>G...@@@@@@@A...Z;%...q.....7K4.<5.....=....<i....l.y$.
.@%.....T.\`..4...g..R*MED.s.Q<.M<./.Y.\......|. ...&.c..W...\`.
........Si.x.<.w...&.}B.L.K*..*.MB....5.X&#.l.$..v>H..i..f....q;
du..#5..1........~S.........9.}..N.{...s... c.C..i ......./Z...c..
<<< skipped >>>

GET /images/merchantlogos/hsn.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 10366

Cache-Control: max-age=448658, public

Expires: Thu, 22 Sep 2016 02:27:17 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=TET3AzFqN25/zQ6lLaKCBPNo3FcAAAAAMC9jILq9 nt7bla 2A/zwQ==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=siWoVBUSKqW; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=oEF.wgzP; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=HZN

    XzfOyalk: mtc; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 1213) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
......................................................B...............
.............!1..AQ."a.#2q..BR...r..$&(3SUbs..........................
..............G..........................!1...AQ"aq..2B.....Rr..#Cb...
46SU.c..................?...........................................
......................................................................
......................................................................
......................................................................
.......6.ku......fz"/s?a.M.#.rQYo..;...>.1.......G.....e.....%....#
...~....$....x-n...iim..P../,[email protected]~0..^.....%........2.w..%.e.....
.....gqxz.....eSlx.p/w>... ..<}?.!..D.Sy...}..`{..qT..^.B_..*._z
].y%.:.S......H..7"....U,[...i.%y..h}$G.|.z.E..tK...w..N^.M~e..76..S.t
....X...".....................................1..........I.....o.5....
.... ..{.)..]......Ws.V....Y.?tW....w..6m7Bo..k.8...>._.W.$<F...
Rt.n..u.g.fmP..*4v...D|...g......7ohPN..R....o.|..n...n..Q.......=....
..X......Ju.2.{R.Q.J.......b....,%Z.............x>...`...e...k.....
.....%..).l..F.T_C#.Mkm.j4...1.....I...:..Z7.myR.z8.....3.....b..]..t.
..Tie.T.t.G....~2....0.....g.^m.bK...'...f.v/...%....(..b..|...Tl.h^6.
.oS..>.L....%..!.N4..........GM... k.8T..O.6c.k6.../,.*.....i.0..@.
............................H..x.D.V.N9.."..ux.S..RhQ...8_....~.O.....
.....}...7..../w......GiY...$..U.....?..4..nZ..].\.E^.^.&....Jp.u.
<<< skipped >>>

GET /images/shopblog-btn-sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "1812484f"

Content-Type: image/png

Content-Length: 3051

Cache-Control: max-age=416165, public

Expires: Wed, 21 Sep 2016 17:25:44 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=bScQS iV7Td/zQ6lLaKCBPNo3FcAAAAAyiG5 Hgt3nHDMl6nv7zhJw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=rDoAcvEkEeq; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=VCt.KGSR; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=rZi

    XThOBalm: etw; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 1384) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.PNG........IHDR...E...s......p?.....PLTE....{...*.Y4....{.B@@..*.Y4..
..{.B@@..*.Y4....{.B@@..*.Y4....{.B@@..*.Y4....{.B@@..*.Y4....{.B@@..*
.Y4....{.B@@..*.Y4....{.B@@..*.Y4....{.B@@..*.Y4....{.B@@..*.Y4....{.B
@@..*.Y4....{.B@@..*.Y4....{.B@@..*.Y4....{.B@@..*.Y4....{.B@@..*.Y4..
..{.B@@..*.Y4.../..z...PtRNS..........     00000@@@@@PPPPP`````ppppp..
......................................x......KIDATX....[*K...XzQ...l4.
.F..m..../[email protected].}......(......1.L.Ft...F.4
7Z.A....P(T'.$ G.t.pnS^...>..q/G}4.2...R...^ ..,....=.|.7.<m.WF.
..Qw.{_...V........\u.KC..e.H...mJ./...o....;?.c. [}.cyE...J/.e..#...=
a}...\.. .......2*G........s.........8[.eAN....Fa....EjN..`..V4.IA...)
@.<Z0..e.....C^../."..R0PJ..gTPd.ZB.4bC....n....*..E.s.......6...[Z
[email protected]|.'.`..........}.../.........U..SP.4^...U..E.
[email protected]..%Y`oM...cR-....C......>~i.%Z(p.....i..vr.:..d..Z.
.g.}.Q..E..$z.L.u...;.8..r. .S.....hky.r`L.2.c).....#c..9......6......
..g..p.l5.w5m=...S.k4.9..QY..P.....Z.;.\...r..H....Z....)O..i..].5.=4.
.....<...(9,1'.O{(.x..y...........>iL9[.....<...e.y...6Oj....
M.v.6P..M.C}.;rl`e..r./(..U.i>O"vD...%.'g....q!...!.}.....;..k.t.9.
...ckCk....2gN.....az...Ejv.:...V4.I..y.R..y8....r...k.._<.......R"
.<..b..!.L"6.j.....}.]....b..R...m.fXB}K ..;.BT.]...1..6....~......
......v.o.ZNnxP......X...........SP.$^...EY.......hg....5....g4o...{cD
..i.r...t.r.8I=.u.K...\.k....N....;.~.#.Y...]..C.%N^.!.....P...w......
}>.../....Z.1.....#.L.X..v..yt,T6...O....._.....I....jj.......?
<<< skipped >>>

GET /images/[email protected] HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "093708da"

Content-Type: image/png

Content-Length: 14580

Cache-Control: max-age=419007, public

Expires: Wed, 21 Sep 2016 18:13:07 GMT

Date: Fri, 16 Sep 2016 21:49:40 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=kPRePS/JlQB/zQ6lLaKCBPRo3FcAAAAACbczBIJVSJBivP7sr6FwvA==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=IyHNpedzNvm; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=QDJ.KzMa; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=zZf

    XbtOJalJ: ntR; path=/; Max-Age=900

X-Iinfo: 9-27272225-0 0CNN RT(1474062578599 1492) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.PNG........IHDR..............Ao... .IDATx....x.U......f.g..oz...n....
.....G......]...De.A.U@6QAP...}.[....%. !.d.nAH .}'.....n.....[..NU...
[email protected].[.:.{.sN..]7..R..|..a........2.e..tC......#....O..0.c....B.qL.
2} .{...o3.......*I.ZO....|.!E..I.....QdX...QCH.0....HY.NJQ..3..>a.
... ....&0.....r.e.....u4e.^..i...XOo..O.h..~7m.^J...M%5T.1.r...../...
....(.&..HY.."o..H..(r.o.}....I..{.2.cRr.....4..?Z3...?...i.....w..m{i
.....z..g....G....4zC=-.....]F..3.k.....[\iWYAJ.l...L..nq.....O..o..y.
..3.~...d.....Le<t...Q.e.].g.G...2....:*....wk.....I{s...#."cFP..?.
....<E..Y.TW......d..]......W..C.3..o>@g.v........t...'[email protected]..
[email protected]........)K.a.......Ag&@?.U.[Jkx.S..M...R/'.....E.
.].......vr......d.P ..k.f...V........U...3L=C..]...C]..".....D...).st
'.gz&L..._.......E.....X..Y.....|.F.^[email protected].{R".h.w...l.b..2.....
L..4..;..^.........\..Ak.......tc`../..L.....P.o...r.!.I)/......A...k.
..,.^.6.....:....E...E..|..q5....n.B.....$/z.!Rr..N......Po.UG.zwC}. y
.b.sr.......DG3......y4..._z.vR....X.t._.j.......!t.di..}.q..(|.......
....G......Ku.F.........'.z.2.....E.LUO.i.E..S......B..%|...........p.
.|FaX..P.M(..Zm(..)....A..$........^.T........?tH...c..ML7x....i.d...y
.]...!V. [6.N...@.....\[email protected]..!...#H...RR.k.x....5.$.
........=.....0..[03| .P... {..?s.....-.MO,n}q>.B.Xq..]wG...^....X.
...a.I.....W;..}..z..gz.....7.4..C3.4.... .-.62....Z..e:.h...gN.S;...z
..'.....X.d[v.....4.....!.[h~h.[ ..G....)r.o.=...'...5..s.^.v.......@.
.N.......}....g......K. .......e...k....^F..tmO..rM.CI.8p&R....8].
<<< skipped >>>

GET /toolbarpostinstall.aspx?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: discounts.shopathome.com

Connection: Keep-Alive

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz

HTTP/1.1 301 Moved Permanently

Cache-Control: private

Transfer-Encoding: chunked

Location: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web08

X-Powered-By: ASP.NET

Date: Fri, 16 Sep 2016 21:49:34 GMT
0..

GET /customermessage/sitemessagecontent?pagecode=8112&siteslot=6&isfirstvisit=true&originalurl=http://VVV.shopathome.com/?page=http%3a%2f%2fdiscounts.shopathome.com%2fDiscounts_and_Coupons%2fGoSearch.aspx%3frefer%3d76258%26st%3dToilet%2bPaper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID=%7b4AB058F7-2007-43EE-9FFA-1E1D9C2CC718%7d&ae=no&source=76258&subsource=SEPDSE&setupguid=%7bc462bc39-9cee-47aa-b97e-420b260526fa%7d&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=&_=1474062588060 HTTP/1.1

x-requested-with: XMLHttpRequest

Accept-Language: en-us

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept: text/html, */*; q=0.01

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; SAHSessionID=1721e748-09c3-464b-ac7a-6005713c
HTTP/1.1 200 OK

Cache-Control: private

Server: Microsoft-IIS/7.5

Set-Cookie: .GLOBALFORMSAUTH=BA87283D6F8BCD7BE90B8C742E934151E18E82266421241608BC6B6EF97500BB487177ABCC771E66217D93F26D386FB83A28C1393AA83E07C821A4F8443796BA2491204041CC8AB260BBD963BB5919295B753C49C93F2796B1B404547A769D6D894FFF4677B997AB9E36394C7852830422A8515293F105286A273AD7C589D1FCAAC03BB0; domain=.shopathome.com; expires=Sat, 16-Sep-2017 21:49:40 GMT; path=/

X-AspNetMvc-Version: 5.2

X-AspNet-Version: 4.0.30319

Set-Cookie: .GLOBALFORMSAUTH=BA87283D6F8BCD7BE90B8C742E934151E18E82266421241608BC6B6EF97500BB487177ABCC771E66217D93F26D386FB83A28C1393AA83E07C821A4F8443796BA2491204041CC8AB260BBD963BB5919295B753C49C93F2796B1B404547A769D6D894FFF4677B997AB9E36394C7852830422A8515293F105286A273AD7C589D1FCAAC03BB0; domain=.shopathome.com; expires=Sat, 16-Sep-2017 21:49:40 GMT; path=/

Set-Cookie: DeviceDetection={"DeviceType":0,"MobileOperatingSystem":0,"IsIos":false,"IsAndroid":false,"IsPhone":false,"IsTablet":false,"IsDesktop":true,"DisplayType":1,"IsKindle":false,"Browser":"IE"}; path=/

Set-Cookie: [email protected]&points=0&userid=&username=&cashback=$0.00&checkamountmsg=You are $20.00 away from receiving a check.&verifyaddressmsg=; domain=.shopathome.com; expires=Sat, 16-Sep-2017 21:49:40 GMT; path=/

Set-Cookie: SAH=SRC=REBATE&REFER=000026016; domain=.shopathome.com; expires=Sat, 17-Sep-2016 21:49:41 GMT; path=/

Set-Cookie: CookieCheck=Y; domain=.shopathome.com; path=/

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web02

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Fri, 16 Sep 2016 21:49:40 GMT

Content-Length: 0

X-Iinfo: 8-70090695-70090722 NNNN CT(138 -1 0) RT(1474062580301 10) q(0 0 2 -1) r(6 6) U2

X-CDN: Incapsula
<<< skipped >>>

GET /dist/js/require.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc

HTTP/1.1 200 OK

Etag: "6534cacb3add21:0"

Last-Modified: Mon, 12 Sep 2016 21:15:32 GMT

Content-Type: application/x-javascript

Content-Length: 6278

Content-Encoding: gzip

Cache-Control: max-age=604800, public

Expires: Fri, 23 Sep 2016 21:49:37 GMT

Date: Fri, 16 Sep 2016 21:49:37 GMT

Set-Cookie: visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuXtOp=jQirOSfOqVp; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuXtOp=Wal.cyab; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuXtOp=zZf

    XTbOHalN: Gtr; path=/; Max-Age=900

X-Iinfo: 3-6986011-0 0CNN RT(1474062577442 1) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
...........[.s.Fs. $.a..LII;m.\X.q:...k..w:........ .(.........$....-.
.........!.{......k.-..Z......b....oV.u.J.]E/o~u.T.\ ...hZ^.....W.HJY6
.....<[..v.........\...*...J..9_....G>^.u...q....Tq.o......l....
.".*I..P^$.}w...A.....n........_......Y... 3..*..{,..P...Q.o......5...
......r.L...w..n.Ir]..s;.:..yZl..Sk..f.....E.....v."...~..E..Q_.m..eO.
.v;.o.P...=j,..Y1.......j...L.4._.....D.u...5IP...\...C>..vW...V.=.
.7..*t...k.u^..m.(..j...Y)....cv.G.Vqd.G..q...J. ..5..A..u..S.>...*
z.6.UbgScb.....]-K...V...Q.............f....q...d..{...FW...Uzv.....o.
...LQ.ft......*qk)F..GpX....m...T#k........E...d...].V..,.z..._....%.C
.B.q....X..$.8.8.......C...t^[email protected].*..;...8...1.?..U;...
....](,9.,O[..R4b.6..... q .............r;Zg.x.....4z....t...!5..f. ..
....$F.Q.K9.k.. .R.cW....QQ..o.........r.\.O....jH!T3..~%..7.U.y..E.%4
..qY.3b..?.......O.s^<N.zzG.G%.N..\.....c j..o...S.<..m.UJ.od...
..|..n%.nP.h.$..b.P..t....mN.. .V.>.....{"2,.7....|^.L,e3f.........
.6zB#[email protected]!W....<....sH...W.....s.mG.....E.."...k....j.Q.
Q...\..fz..z.A.....Zd:{i....m...` ..rn. 7...'...W.UVC;.........m.Z`...
..4d..y..L..V..@V[.A.2..........[.w.g.....n.bhE..O...E.I ..(Ia........
..p..$.......g....s...&sIsz. ..j%.RO....S~^B..d....E^............a...K
"6....6PZx..^.D.5W2.I...h.u.DE...N ..A..P..U..j.......c%G.......V.2/..
/..,..........o..m....W.]....(J.?7..}..}.......}J ....F..fU.E.#..A.z..
.Y...t)......J.........6.M.......iX@,,...".8......a.y?2..]...c...5..f.
...N.}........A.....f.kR. ..$.$-....0....e..<..I.#Kx.....0....&
<<< skipped >>>

GET /dist/js/bundle/Global.js?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

Cookie: ___utmvbOPuXtOp=zZf; visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; ___utmvmOPuXtOp=jQirOSfOqVp; ___utmvaOPuXtOp=Wal_cyab

HTTP/1.1 200 OK

Etag: "6eb937bd3add21:0"

Last-Modified: Mon, 12 Sep 2016 21:15:08 GMT

Content-Type: application/x-javascript

Content-Length: 124065

Content-Encoding: gzip

Cache-Control: max-age=604800, public

Expires: Fri, 23 Sep 2016 21:49:37 GMT

Date: Fri, 16 Sep 2016 21:49:37 GMT

Set-Cookie: visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvaOPuXtOp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

Set-Cookie: ___utmvmOPuXtOp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

Set-Cookie: ___utmvbOPuXtOp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

X-Iinfo: 3-6986011-0 0CNN RT(1474062577442 251) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
.................0.......sHQv.....xK.....YZ..."A.1.0..%".g..2 .JN.....
...f=s..g..fU.g........>..4;{...y..7.q.ID.M."...ls.d....^...*.|o...
..(]..y:...Q...Q:....eR<.....>._.x.h..>V.G.Q.8.....Z..^/H.t.O
U...D5Xo...@;p3I&..4..].T.".T....EQf....>.~,.2_'YR..t..`...d......F
:JVerS..E...Y..E.I).*.6%].I......~1 ...>.....ZF_.e(.Iz.../.CoD..]..
<..`.....u...V....$^..".\&.e2..iu=......,??...a..?,Rhy1_....<.g.
....\...Z...~u....(.<..........'pt0...?Q..r..$..`..D..........*/...
u./:..|......$Wk.{9vo.d.@g\A..a...h...HP-....%...E....B..)._7).A'....O
..;.%.....v.._..d.d.f.......c...eZ.w...R. .b..`0.`......d......R.6(..?
R.P.........w...o..n.l....E|.3.....~....6..Ia..:8....O...f.$.....c..4R
._..TA .......JZ....~..V.Y.Z.3..8.].[....."U..:t.|...K.QP..0wIY.......
.D.#.U..(.}J.8..)N&-..h.]13%.v.CO.I5.].aK.....h0J......d.L....4..3@P..
.........5..:.$.F...P..5.$.H..|.....uZV...><,..."q.....o..Y...x.
 -..=.... ($..!V:O*.*...< .x~....-.g$P.......@[email protected].....
..J.....=.vqk.,.L>..VV.h.....:.........U..z....o........y.{.!p.P.YR
=..FO7U...h.,.[q.....:.{.[.pT.}..V]......^.......%........".....p...nF
...7;x.}....Q.I#.....L.R.".......OS.].$.(.....~K..G..`..*.nP9...G...Bu
;3.."..-.l..........R..].....Da..XE..|.....X.m2..!.98.q!........|.. ..
.A...9. .5.DN..P..6.u...>|..b..{.0..V............aO.5lIu.u-.k.t....
.T...@[email protected].[.S ...Z..,*a...a.e.)
>.......lg.y.. -...Xg{a.......db.`..k\.xRL.....6.>....8.!`e.]..*
..).`.`...5...@`...9..!.>...8.f.%.}.......A.....3...Q0O.?u.I5..
<<< skipped >>>

GET /dist/js/bundle/Home2015.js?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

Cookie: ___utmvbOPuXtOp=zZf; visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "bd5f73ab3add21:0"

Last-Modified: Mon, 12 Sep 2016 21:14:38 GMT

Content-Type: application/x-javascript

Content-Length: 16687

Content-Encoding: gzip

Cache-Control: max-age=604800, public

Expires: Fri, 23 Sep 2016 21:49:38 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvbOPuXtOp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

X-Iinfo: 3-6986011-0 0CNN RT(1474062577442 1199) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
...........}.w.6..W.....Q..l..R.uR'm..mr..v..o.-.6.........z..O.f.....
$'.n..wN...1........J...K>....3..?..n...s.S.eL...,..R........e..u..
=f.U:a..,....VL..\.M.a.:).Y...,...T.I.....E>.).}...........A......f
B..G..O.3..`P.dz.W-H.,~.{....!.. J/.\%....E>e.i...v,n...o.....$....
<)J...W?.,.u......).NJ..*..v...e...2-.5.b...2|>......o.$.E......
...&...4.2.rp....7,[email protected].]...;;.n.L.........4...A?x..$br.....Z.
f.,.....-_...&bg..4../....'....~-.V...E.?..<.'.1.. ......W.I0I.G...
...CBh..a...Y.......~....Q.J$..e....;...p=&0Jx]..8......`...... |..^.h
......G6Y..n>.|..#.f._..).Y..,.M... W....W...4k..q....._5.5.).a0.N.
.._r[.....d..f7.4..,.X..V:..|..0...... &a}.....'0_.z ...WM^...n.1.Q.k.
..t.....Mm..8.;[email protected]\..n.D.Sk...0y..M.4....K....".."..!..]1.7....
.#.....T.`.V......);..F..|...A.k.....H...#....^8I&.8faR.....B...|....f
h$..z).......kBg....k"....DT"-.h#..d>..I..]lx....B!..8...[*y.;...,.
..[. .........#.g.-".ph..jl^.:.tp.......2E...s.d.X.....6......f.c P~..
.Z.X....sA......?..W...\..*'.....>...cU4jd(...t.h...Q`....G.\..V.*.
.C...5..f......#.j~....W0....9j.f...z.e....z.. k?..u..7.5oB.'..A?.....
N....bkp.-..B.O.{.<AN.......H...........4....C..C...<NN..v.$.t. 
).....u...........E...H.'4...v.Z.$B...S....6.X~!.i..r.@R.(..Q.....i...
..?..n;..c..!7....P.Xh..}.{]...mgg..V.D..H.... O...:!.x.ul.l...>...
i...m.k..|.....7..L....<"..].S.....G.G..B...`I.I.j>{u.6.4...e .~
.gi.H..A.o....y...I.KV.h.1...Uq..........~.L.........U ..].(.....?~...
...R9...7 }.R...~h}.0~".N..O4G.P.....#6( .. F.....$..=~.._..o...g.
<<< skipped >>>

GET /dist/js/bundle/Hashes.js?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

Cookie: ___utmvbOPuXtOp=zZf; visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; incap_ses_325_926707=kPRePS/JlQB/zQ6lLaKCBPRo3FcAAAAACbczBIJVSJBivP7sr6FwvA==

HTTP/1.1 200 OK

Etag: "3244aba53add21:0"

Last-Modified: Mon, 12 Sep 2016 21:14:28 GMT

Content-Type: application/x-javascript

Content-Length: 6168

Content-Encoding: gzip

Cache-Control: max-age=604800, public

Expires: Fri, 23 Sep 2016 21:49:41 GMT

Date: Fri, 16 Sep 2016 21:49:41 GMT

Set-Cookie: visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvbOPuXtOp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

X-Iinfo: 3-6986011-0 0CNN RT(1474062577442 3850) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
...........[.s.8.. ..VE...'...........w.={x....LedQKS>.....=..)'.vW
.T........w....v}Y.....\._.......xU...,O..X....r..G...*]_......H......
...c....lVL.yzVz...$....i.....83F..qR.F.qb.%.......t4J..TZ.F^....`....
jT............0...i.../....pQ...jV...@ .~.B...<99.FJ0!.....^4.y....
v.r$.....T....P...<7..n.h.6.`.j.....H.m.~..jDX>.!...-..)..L..H.$
K8{*.m#O.......v..}...(x..c.8....t.R.H.drT...K....S/.2...=;.......Zln.
....1......... ..gG......a...c.\{{{~...[...7M<...5....."...Z.we.L..
............."Z......D...%...I.".l....Ri..Q|........Q....r......Y .q..
....v-4...P........W.`.K....%J.i4. .".e..X.....b.>X..uf.i.>(.I..
4.e`;..7..ss-.sE....b.../.....*&.(.....y9E}...xL< ................*
9..7.l....%.......*...|Q......2]..%|#}...._...q6&.....C'....=>}..a'
.......V.......k"7K.x9ma.....-..*G...Kt<H.7...6c?>.'....../.I..W
.....Fo?..%..4...|...qp./...j..0.[.,i.......U~..l..i^........gny..<
...e-.e ...(.=gq...?........}.o.y..........r..*[~...z.o...)..w.......o
.`...Ek......{.^-.....zb.I....$z....$d.....,...%..5...z\....vhG..8i.yZ
.e5.sr.o<uP.p....~"............?...C~h...f7i..:.......`..2...Q...a.
....f.JR.v#&...6v.[..\&....G. ..f.......5....B..i.4.......f..-f...[.l.
.........(.......1z.......b....ma v.n.....7U..z...v.%W..A..t..]...w...
^..~....o{....Z.....x...%[email protected][}...3m7...../m...(.....p..
.v...-..2.X/.g.N.du.9....m.#Kr......>......[.R/;n..ZL.d..N.@~Zzs.h^
..&-...{...F....T-....].)..Oh....h...E....z/I..M./^.).O........9.n.ND.
FeerVo.......Go...w]2|..I.....ek.Hm1..(..c....;..\yEo|.v...}.U....
<<< skipped >>>

GET /agent/agentprefs_.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: VVV.shopathome.com

Cache-Control: no-cache

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz

HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Last-Modified: Tue, 12 May 2015 17:09:39 GMT

Accept-Ranges: bytes

ETag: "80bfe6dd68cd01:0"

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web08

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Fri, 16 Sep 2016 21:49:28 GMT

Content-Length: 1080

Set-Cookie: incap_ses_184_621395=GoLWPdzcfVTkNQxoRuWNAuho3FcAAAAAO4NkfS1u68XWq3f3M506wQ==; path=/; Domain=.shopathome.com

X-Iinfo: 5-62907653-62904311 2NNN RT(1474062568504 0) q(0 0 0 1) r(2 2)

X-CDN: Incapsula
..1....?"[email protected]&d../....=d;....]z.`.*.... .....d..(..$%..R]......
...8w-..n. ...Up.Z.TKOX.p..P....=9..M..?.."...$j.H..;..gw..f.U........
pf..[\.....r......hE.....a=.o.]P,..f.5..6...D.;5BP.wTH.....Z..P,:....&
gt;..4.8...3...jg.$...n.....3]...l.T<....3.S."...2.[...k.~.NB...=..
....j.YFcJ[..%...Y...ES<........'..dh.S...A}R.oa<.M9.m.. ...(..t
...O.k..T22j........-3j,...b...(m=.14.."..mO.n.>[email protected]...
.U..-.Nu. .^..0.S........Q...$!4.....:..p.!......s...wo..f.....n?Ft..?
..O.cP......{.I.,..m.Pd,.V........."..c.....v..s..%.....l...2j........
._....._1-...U........i ......>.k&([email protected].?....{.}......ei-..
&].`.-U. s.....V..^............I..E}.A_.b1.X!.Zy..Ig.G....^.TJ7.?.l..V
..<.KZ....|.....dDZ.f....U;.s.2...='Cw......I......G.....s@>....
K....1.t..rH.8k....q.... .{.q>.....88.....S..TH.O..<!....u].....
...<.w......(l.(.......%D...].....o....Y.:...E..g9.....x.....].K{.Q
....u.d..u..R "n}kVCC .;.b2d..W (........k.1.&.......f.9..^.V`.l...IN.
.>.C.{.0.D.J%.?......'! 7z..........4Q@;.. ..8|..............I....{
.:.H.Z#.b.<.~.k....S.....6.=3.B........5.y.'.VD..-~UJ.....s.hZA....
.
<<< skipped >>>

GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Etag: "0e663c656f2d11:0"

Last-Modified: Tue, 09 Aug 2016 15:57:48 GMT

Content-Type: application/octet-stream

Content-Length: 1008

Cache-Control: max-age=32133, public

Expires: Sat, 17 Sep 2016 06:45:02 GMT

Date: Fri, 16 Sep 2016 21:49:29 GMT

Set-Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_924498=zf8jYJ7PKnASyA6lLaKCBOlo3FcAAAAAakykWxSwpdq2rz/vcOJICg==; path=/; Domain=.sahcdn.com

X-Iinfo: 2-4994292-0 0CNN RT(1474062569075 1) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.|..A...k}......@1......$L..X:u.F5..m..hI$.@.'.(ka.NxK;~.E......l...)V
.dI.%...o9....j=.=.6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.....
<<< skipped >>>

GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; incap_ses_325_924498=zf8jYJ7PKnASyA6lLaKCBOlo3FcAAAAAakykWxSwpdq2rz/vcOJICg==

HTTP/1.1 200 OK

Etag: "0e663c656f2d11:0"

Last-Modified: Tue, 09 Aug 2016 15:57:48 GMT

Content-Type: application/octet-stream

Content-Length: 1008

Cache-Control: max-age=32132, public

Expires: Sat, 17 Sep 2016 06:45:02 GMT

Date: Fri, 16 Sep 2016 21:49:30 GMT

X-Iinfo: 2-4994292-0 0CNN RT(1474062569075 1045) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
.|..A...k}......@1......$L..X:u.F5..m..hI$.@.'.(ka.NxK;~.E......l...)V
.dI.%...o9....j=.=.6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.HTTP/1.1 200 OK..E
tag: "0e663c656f2d11:0"..Last-Modified: Tue, 09 Aug 2016 15:57:48 GMT.
.Content-Type: application/octet-stream..Content-Length: 1008..Cache-C
ontrol: max-age=32132, public..Expires: Sat, 17 Sep 2016 06:45:02 GMT.
.Date: Fri, 16 Sep 2016 21:49:30 GMT..X-Iinfo: 2-4994292-0 0CNN RT(147
4062569075 1045) q(0 -1 -1 -1) r(0 -1)..X-CDN: Incapsula...|..A...k}..
....@1......$L..X:u.F5..m..hI$.@.'.(ka.NxK;~.E......l...)V.dI.%...o9..
..j=.=.6.h6b........0)._..al...eZ.e...S.....W....7.1.....i.......Y
<<< skipped >>>

GET /agent/bce_.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; incap_ses_325_924498=zf8jYJ7PKnASyA6lLaKCBOlo3FcAAAAAakykWxSwpdq2rz/vcOJICg==

HTTP/1.1 200 OK

Etag: "09a28cb56f2d11:0"

Last-Modified: Tue, 09 Aug 2016 15:57:56 GMT

Content-Type: application/octet-stream

Content-Length: 250664

Date: Fri, 16 Sep 2016 21:49:30 GMT

X-Iinfo: 2-4994292-0 0CNN RT(1474062569075 1250) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
...v.a.5uq,:..=w2..b....M..T>.!.S.......W.&...W?C'..w. .C........!.
...G.'........P....p(bPA.;.x..l. .}3#..5.............s.....J.h;.at.|..
...h...M.5.....J.?. dP....f....f.(Hj...#.,U.:..l3..k.X...}...K...|I...
s>(.o^<...*K.........t.l2$.q.....ZX..u,.qO-....f...gE{...x}"R.%(
..<)}[email protected]%6I...3V..A......$...`....
.J!&..^D..>.x..>..4.8..........0.(3?...;9...;...0.....N\.....6K.
..A.G.4.p..y=Xuf..a.P.....03vk?.I..u..L.....6...8...ce..:._.."!....J.B
.._..~...t.>M.....V.u0........Oei...*[email protected]
..Ex@.."M%...$....9.6...'.P.?..n%~..[..c)Q*....RA....|=A`}mW.xf. .....
r..PhH..S..7o._...0Ey...>..;.l..L)7PS.,...S.Y'.W.........c<s\#. 
.....E........RX.<U...A....,.e..............u.iS......7.].5......#.
'..>...........=U.Kc5..d..?.EbO....i...x..z.....vRu..[.4Y..F..".X..
......3T.5a.N/.N.C&....9.%Y..&..N........ ..xc`..=n...QB.....A$.S87...
....8~*E!..yU.."k...9.OX..K....YH....<..;.{..4hg.J..*..eS...l. ....
.W.Z..2..3L.1..X...H....p.G.Kq..g|.......z)85...LrFlh.$=g.I.[.eQ.v.\Dz
.7.A..5$.UVS!=..2...9...&..6..h....b..Y.%....ZM....:...G..~..%...F..3=
H... .[|?.e.{.......n|...:..0..z.b....=....~.WpS.I...r..F...b......<
;.QND..Z.W.....09.f.g!.%m..'y....)..[.I.%..IH.w}..'...k...a...xP......
.PT._..g\.'......]Oe...3NH.@[...\.4..k.........i. ....).....3.2......w
T......R..[[email protected]|...W.0|...u.L...G.c...wm.x. .U..G..v..T.
.....qv...c........%.C.ZFE.A........F>y...\; ..Y 8...Dz.9..K"_.....
...YA...J...Y.0.E1=.....p..`'..JS..Q....<.1..c3E{..4..Y.h.=.E..
<<< skipped >>>

GET /s/roboto/v15/5YB-ifwqHP20Yn46l_BDhA.eot HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.gstatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Type: font/eot

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Date: Wed, 24 Aug 2016 16:17:35 GMT

Expires: Thu, 24 Aug 2017 16:17:35 GMT

Last-Modified: Wed, 14 Jan 2015 22:47:37 GMT

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: sffe

Content-Length: 16223

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 2007123
..........m.UT...=83.3....N...-....K....!..w...5h A........uO...].....
,>..9....?..............?T.^..@...~)..(....$......4.......?..0....6
./.#..................._1n.;..?p....".......OE.@RSV.....`j.. .pl...qf.
.',6uPl...:.Sp...X2.=.;.......h..P...*...YSc.vj.....J........yyN].8.z(
.......E...&.. ..mP...4....^....h...ww........^`.5C.(.....y.5.|.nT/6s.
^.*.G..ny.`.-..`..|....|(R.\...l,A<'...T..cp...U......zb.t........^
.6...>.9.;.W-.&......W...:...m".I.....%...K/B....~4..#Z...k.E......
 ..pSz...1I.:......"...D.....#.2U.5..I..I...Zh...D.Q.0.I'.nn..m{.~R.|.
."2.........]_x.(J....(...(.&.!.....$..YS. S..RU.f'....5..~=.Gj..!.9(.
......WqU`{ic....9...]...|v......j.k..s3....N.......S.Fb.W2..X...u9o..
Q|^D<G. .9.../...z .BB.zm..$.*.g4....:..*........{{Q,5..uw.....'.h?
~.....BSI4s....0.....0.h.^...v......^...7........1^;i.....rqF...d.....
x.fRf....#x.v......-|..]..|x........Jf....;.}...E. yx...9.....t.{[;"..
.~.qz.T.[.x...C....K-9...l.........@F.;[email protected]."......<89.....
........`....?...Wq...k....B..J.N\.X.......k......E.......A*?..{q.Y.YR
.<..sM.,.5..@..)..-1..r.%..Nr..aR]*..du*.n..w.....R....HUT..\.F6...
0e...t*G...L.Ki.'Y........$...hG..k..C...5$..g.!.<#..$)HB...^..d.ye
[..f.]...... ..V..g:..5.....N...K.q.~o.n..E/"...A7Mx)...w....#..j..R.V
.Y....ij.Z<[email protected][..L...Tr....B.lq........[.9..Y.......y..".
>J..M.-..m..M.. ...>3Ru.{..N..g]....a..wf.......*.o...=#%d.. .B.
. 7.l.}.KO..Z...K....&!..O .. .~.:...5W...p.0/C.:.K...'.)i...f'......,
......}.0..[...$.W?B..V'.....>U.......`.aL...........l..):.:VL8
<<< skipped >>>

GET /RequestHandler.ashx?MfcISAPICommand=set¶m=

I-7cOM4DjELPNbPrsCiqF8g-b5TS0FXeryNjwotKuuOL2oGcbQSu0UP62hf3P9LsHEXfO1fNX0pAaa6vD3Xd1Dstam5CxfSe4fMB9PLMsy2x76i5-H0QLwESo8oQGeGMjnorlnYCICAMezJqtyHrSV_dCINac3RvCZK3KLMPTgB0tCB2KOTvaSESpNs4GWtDc-Kb2T48q7HucD9-R3WdFJCAku17M_T1yj2ozvFn2ISj5ClK37W3yQuBPZ9ZnW1GyG3vNq65RtQQ3sCCv6LPhgOinTeTUJXlcnt9Gvr0I82NyCsrmJ8QB9dIBRXHVqePNDChKqO-_sEfvTVfrUB85m HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Connection: close

Date: Fri, 16 Sep 2016 21:49:17 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 452
.....'...P.I....d.......\.KV...i9(8&mP:$^ly...X.`/C[.s..!...I..b=1./..
.g.....:I....G./......[KL....^..,... .K:..*...P. ./....;br.........8..
L.v.>..HY....6h.~6)Ko.u.\JX....C..,e...xa...k.($....H...I..b=1./...
g....#8.ht...0.s....,..D..d..JM.v...}f.....c...e. ..x....a-F. ....../.
-......yb....c.....K.d.&}b.}....o.....\.....I...........a.2..).Y....6h
.~6)Ko.u.\JX....C..&......n4q...)mw... ..k.V..uc..N.....t..P..z*..w..n
.../..`r.s5.hZU].u..^F....l...!.R....

GET /1/eabd37c669?a=442317&v=974.7d740e1&to=YlVRZxFXX0VWVkMPDVsffmUgGXlZWlAFVlMAc1xdF0ReWltQRUkrW1RWSw==&rst=4766&ref=hXXp://VVV.shopathome.com/&ap=350&fe=4547&dc=4547&tt=FF59D062042464A5&af=err,ins&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: bam.nr-data.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: JSESSIONID=7ebe41882e9c1a90;Path=/;Domain=.nr-data.net

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 57
NREUM.setToken({'stn':0,'err':1,'ins':0,'cap':0,'spa':1})HTTP/1.1 200 
OK..Set-Cookie: JSESSIONID=7ebe41882e9c1a90;Path=/;Domain=.nr-data.net
..Expires: Thu, 01 Jan 1970 00:00:00 GMT..Content-Type: text/javascrip
t;charset=ISO-8859-1..Content-Length: 57..NREUM.setToken({'stn':0,'err
':1,'ins':0,'cap':0,'spa':1})..

GET /dist/js/bundle/Flickity.js?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

Cookie: ___utmvbOPuXtOp=zZf; visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "20d4e5a43add21:0"

Last-Modified: Mon, 12 Sep 2016 21:14:27 GMT

Content-Type: application/x-javascript

Content-Length: 14561

Content-Encoding: gzip

Cache-Control: max-age=604800, public

Expires: Fri, 23 Sep 2016 21:49:38 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvbOPuXtOp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

X-Iinfo: 10-31263904-0 0CNN RT(1474062578703 1) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
.............r.V. ..{.._7..A.L:....X./iO..'.;.... rKDBa..P.".j^k.q.If.
}...lwOM...E....^......Z.%..6...{$N.v.....1I..hS.....2..|..../s.:.iGe.
f]......E.....]..(.......Z.G.....$.%z@4&i..^Tgd.;..]y.GM[..e..8.z.....
.......hQ..qQ_n.H.6.$I.|..s...T..*[..Y1.$wXi.>...t.C\.m./`H...J.?..
.9.........Q...bU.O.x....9~.....6^..k......./......-wd..^.G..5...wE..]
..... .S.....d....i.jA.$.u.EU........../..K..R.X.e.../p.Y.h[r.i..?....
(..a.2..G.X.b..|..\#,..T..J.$.PZ..c.q.L.*..../,....i.v}. ....h[-.EY...
..@.].....,..H]...............nZ....uJ..]...v|NO...5..Y...E..=.>.~.
...W....G..cK...h..?....L......2.(;'.ir..u..j..mY...d..~...3....jI?$i.
..'....?...7.8......g3H.A;.b.y..$2N\..........)..{.F)M.,Z...yU6mT....;
e#........g.....#....E...P..Y.X.Y.zO..\.k......K.9..d....E....P... <
;.Xn..S.g..P......m...F..H.2.2...nU4O...Ja..'.3......^^..S.B.^X.SE....
 ..X.c.7..5... ......y3.s,I........7./...%[email protected].{V.Gk.WR.:.s".g)N.p
../.....cg.D...(..............._#H_..9....)~%......F.b...1.. .........
b.#..6..e..%|.UI5....C....R...*.~.......$..............g.D"@...|.F|_..
/Tb# .8#..M .|.....Y.F......{0W.I.i~...&fi..Z2...`.),MJpVp\..=...^6..:
...~...?.N..K6....&.]...|8A...Y.(....|].Y9.........G....#.0l........&g
t;...FhB..\s..QwID.c............Yg.i.....=...Q..!yxC..Z4j2(.V....{...o
W.."......@.......#.6...X.....Q.A..W...{vq.ki.P.[.D..vUT.f.'..E=....pg
.......g.1g%g.M....ei...x%..m.T.)bq.O.......pR!..9........q..$.......K
.....3.a.{2m.........x.m...2...%Y..../..t...{;.?.....&.hR...!l$.9=Y.5p
(.fcg M....V.`. .A..S. .n..(v...g.@.^1..1X...a.>.!V.t..Y?......
<<< skipped >>>

GET /nr-974.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: js-agent.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: aB3fktQATI41XoKbVU9S7XZo9iJHr6Vc/bCB8RziCUblQ5dlSSc7l8ARSMgvNCCxvcLxYPUoVqA=

x-amz-request-id: E0E7CA91BF6F38FA

Last-Modified: Tue, 16 Aug 2016 00:15:00 GMT

ETag: "634571f9ce8c2fed916ddca30914f48a"

Content-Type: application/javascript

Server: AmazonS3

Content-Length: 22761

Accept-Ranges: bytes

Date: Fri, 16 Sep 2016 21:49:43 GMT

Via: 1.1 varnish

Connection: keep-alive

X-Served-By: cache-fra1226-FRA

X-Cache: HIT

X-Cache-Hits: 163

X-Timer: S1474062583.294102,VS0,VE0

Vary: Accept-Encoding

Cache-Control: public, max-age=3600
!function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var a="function"=
=typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return
 o(t,!0);throw new Error("Cannot find module '" t "'")}var s=e[t]={exp
orts:{}};n[t][0].call(s.exports,function(e){var o=n[t][1][e];return r(
o||e)},s,s.exports)}return e[t].exports}for(var o="function"==typeof _
_nr_require&&__nr_require,i=0;i<t.length;i  )r(t[i]);return r}({1:[
function(n,e,t){e.exports=function(n,e){return"addEventListener"in win
dow?addEventListener(n,e,!1):"attachEvent"in window?attachEvent("on" n
,e):void 0}},{}],2:[function(n,e,t){function r(n,e,t,r){p("bstAgg",[n,
e,t,r]),l[n]||(l[n]={});var i=l[n][e];return i||(i=l[n][e]={params:t||
{}}),i.metrics=o(r,i.metrics),i}function o(n,e){return e||(e={count:0}
),e.count =1,c(n,function(n,t){e[n]=i(t,e[n])}),e}function i(n,e){retu
rn e?(e&&!e.c&&(e={t:e.t,min:e.t,max:e.t,sos:e.t*e.t,c:1}),e.c =1,e.t 
=n,e.sos =n*n,n>e.max&&(e.max=n),n<e.min&&(e.min=n),e):{t:n}}fun
ction a(n,e){return e?l[n]&&l[n][e]:l[n]}function s(n){for(var e={},t=
"",r=!1,o=0;o<n.length;o  )t=n[o],e[t]=u(l[t]),e[t].length&&(r=!0),
delete l[t];return r?e:null}function u(n){return"object"!=typeof n?[]:
c(n,f)}function f(n,e){return e}var c=n(30),p=n("handle"),l={};e.expor
ts={store:r,take:s,get:a}},{}],3:[function(n,e,t){function r(n,e,t){"s
tring"==typeof e&&("/"!==e.charAt(0)&&(e="/" e),d.customTransaction=(t
||"hXXp://custom.transaction") e)}function o(n,e){var t=e||n;c.store("
cm","finished",{name:"finished"},{time:t-d.offset}),i(n,{name:"fin
<<< skipped >>>

GET /images/sah-logo-stacked.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "3e62b226"

Content-Type: image/png

Content-Length: 5614

Cache-Control: max-age=416165, public

Expires: Wed, 21 Sep 2016 17:25:43 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=HeiRddSCqGB/zQ6lLaKCBPJo3FcAAAAALZvkU/4cKgl3b MJEfxNug==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=HBeFHgMjZtO; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=VEl.cMOn; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=FZx

    XqiOgalq: StF; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 46) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.PNG........IHDR.......c.....}.)u....IDATx..].x...........$...KMB... .
.. ..T.._. H...R. .^D.Z...z..._...$...Q.`A. ......0g..9...r.{..9{.|3..
.3.....).f.xiY=` ......8.\.T.W.....V.I...Q..aK......0...ZB._....,.:...
.<m....K...#.."!.o_.&.............9...y.....j.....;.......Zs.r'....
.."..hT..nK..."`.pAl.../........v.w..J.T{..j...~......k.Z........-l.C.
.......a.......<z......D.~...$f.........-.....8.7d...... RcF&/....#
0...z...Q.[3."..~s..r..b...Q.m'[.....p.o<.C..I&{..{[email protected].
zO...K|.Ew.S.....-.....\.....MV....I@...}....rZ.yQ...l...P5.6...a...|#
..Y.].....P_.;[email protected]=......@`.. ....\...o-[<....pHo$.\......
. L)`.p.P%..,.*I.3.l.tc...[.....z...Cs.|.7.....m.B.c.25....$.[..[..<
;....ixn......: ...F&Z...7b.....N.C...$......K....b.[V.....j.>.9...
Z4...sN2..\..}../.....)b..| ..~..f.....i....<....a(.m...n..;.8Ie...
.u..%... ...PC.....'.m.n........Z........\.=.'......:..S.$............
..:.....qo..Bk.0..6]7z.?.Q..w..P.x.h.{. .".....9...7.cL.-..;[email protected]....
Z..N7.d..,\|=h.1.$.a..?F. 7..cVH...^.B3..0../..c.uh.d..)..Z....a....Q.
..3 ."..O..'...n../.{1/.,^?.Z..R.!G.F.......Y^/.{....r...#.L...y./f...
.rh;E=.1..E`.H.[..........D..B9n...=!...i...2....@!....k.s.s...d....u.
a_.........n..5.L.MKnx.;....-.Km...(D....8.>..}.z.u.%.G.......Oj.,.
H..H%{..............~..9.-.u.1 ..L.....}]3.]..q....A...^..8..:...[j.0.
....!..L.9By...3.}Y..E.x:....U.m!m..]`..:.h.P.....G#..2.^....5..q.@..&
...@....],0.s....~..t.....g..PG.sB.O&.}[email protected]
[email protected]#.L..9...s..K..).....],.........O.....Kp......n.
<<< skipped >>>

GET /images/scheduler/090816-summerend-carousel.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "04cf8205"

Content-Type: image/jpeg

Content-Length: 99104

Cache-Control: max-age=448660, public

Expires: Thu, 22 Sep 2016 02:27:18 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=KNvQONEss2d/zQ6lLaKCBPJo3FcAAAAA/dUTRnY7fYf20ABELZJLww==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=ArVSODxQczD; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=Zmv.SPxf; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=CZR

    XbSOOalb: Ztr; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 211) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C..................................................#"""#'''''''''
'...C..................................................!! !!''''''''''
..........."........................................_.................
........!1.."AQa.2q#B....R..3b...$4CTrs......5SUt.....6....%&Dcdu.....
.Ee'..................................V......................!..1A.Qa.
"q..2.....BR....#r...$3CSbc...4Dd..Tt....%5s..&6EUe..............?...r
.:J......%!..m.4...<.1.FX...n.M.J..a=.......u.....t.@>gq..jKp#\.
.R.7"..,..e.......Qa....6.j.....u.WWWTQuuu_.3B../h`..$.(e.Y..@|...7...
...'Au`.@..*.........%.f.d.......ou#...g~..V:.c{:.k..w..Q....Cv...R7..
...3.....1~Z"...nk.]ZN.i=..o.J.'....A....1....Y....."..f/..B....=7C.y.
..D.KB..[`m;..$T5.$...P0....U...&..i6.6..N..p.n.#..^....2pZ?..i...L.. 
..H .]]]]V.uuuuE.S..e.>..2q.Q....;kD......}..T....f..p...#P..C.C...
YV....1...1..v.e.1....mm..K..i&%.R..b...#.3..~...^.}=.....:Z...d[..20H
.H...F..5W,..L.m..u-.a.....vz.zno.R..][$...<.2..!NY....#.r.....h.m.
wr{.zY..1.......c..R...Css......{.,.....r8.3V.>.r....dX.Q...q.a...8
..-[.eO....2.q...bB...F..Vw.........$1......?0 q.*.EA.}N..i..{.Q-.jM..
u.m2.........T.m.l..2.......y5.z...ga't......5!...].-FT..O).wD6z.]V..!
..-|.q'........!.,.s.....U..~.A*.... ....}...|......?gi...>.t:.)...
djD.o.....}.X.S.......I...1!..Q#.!%3..|.sO$.4. .Q.L...2T.<...Zb..J.
`....".......74..n......5.e...[..P.b...7.........I.....$6.9..i$.....H.
7 ..i.........*......]...)3.CV.v....x....|...W..6.....TT.P......!..1(.
#..\m#...d.....g.y...c.@../...Mue.*A....dA......ZZ@2 .'..m\.<..
<<< skipped >>>

GET /images/scheduler/090516-couponmonth-carousel.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "8c89246a"

Content-Type: image/jpeg

Content-Length: 90814

Cache-Control: max-age=448659, public

Expires: Thu, 22 Sep 2016 02:27:18 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=JeoQGcPFyB1/zQ6lLaKCBPNo3FcAAAAAkptNqDrv3PLVcmoemHoo6Q==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=uzqUsGHCABg; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=cup.GDHt; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=VZS

    XsMOZalB: qtV; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 421) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C..................................................#"""#'''''''''
'...C..................................................!! !!''''''''''
..........."........................................[.................
.........!1."AQ.2aq..#B.....Rr..35Tbs.......$CScdt......%&4D..6EU.....
..................................K........................!1..AQ"aq..
..2BRr....345.#Sbs...t......CT..$6.%c.............?..2y.c5...~9.k.#...
'..^.w.....&._.;....v.o..Msv.HmB..........(...~.....e..Y..DL..VN[.....
xg[M...p.mp.&.2T.....<E.E.h.2G<wv.1.#f...>.x...\......e....tA
...^.f......2LG.#. .K......^G....jX6a.#q.j...H...A....V.....9.k.z&.t.Y
.=......P..N....n#..._..fkY.<.9*:2.....MO#.B.."..,V..Z.Y......H&.:|
.Nk:..v.....m.P.J"@..P....3..Tdc...I.....7..sZ...6.k....z.M[S3.. .y...
.S*.$`.t.....:>.`...m.........5.t;...K{q.../.......g....P.:64.@$.s.
....JY4.s.$5.7.f~aWM.h.A,.X......c..g.k."..*........C......=%....n.@..
w....Dr...U.2..|...6...V}.R.4p..`i...n....h7........O.~..K(......D.m'.
ieG..........;5A.......y...m......y.Vu.J.{......k..{ .Bi.KK..Ku....=..
.]J/QPq{.....`....f[.Ym..$..8...d8q.........]o.K.....0.A.6n..$....6.Yv
...r..\z%.W..Zz..t...4X.....0. dg........... ..hKl.#\............emqt-
..~...X.b.<..2p=b1U6.r..{..Y.&.k......Z.....1.cn...\....x..ci.-..v-
s...i...P,...f...v1....h.5...TD.Y.[.....\L2....v.{.......$`.iV>.<
;.FH.d/r_.#........t.#MM*.;PC..%....y...?......N.e......v..o....Z...n.
............O..E..d.[........m ..........SI.Z......A7`.0[..{N.......g.
....ei.j.4..6..H......gk4goys.4...m#....1..f.lHV.......t..t.bC.j}/
<<< skipped >>>

GET /images/merchantlogos/gap.jpg?w=130 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 3955

Cache-Control: max-age=419007, public

Expires: Wed, 21 Sep 2016 18:13:06 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=3Og5PV7ZygV/zQ6lLaKCBPNo3FcAAAAAagJtwuWD6w/LEKoosYKMTA==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=kaVJBOTSEkX; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=cad.PseX; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=VZg

    XfPOWalG: Dtp; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 614) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
......b..............................................D................
...........!.1...."AQa#2Rq...$&....*6bv3:BDFUcef......................
.............?..........................!1..AQaq..&3...."#26B.....S.CR
b................?...}.|n .....r1X0T....a.'.3....=...l#.....Fw..`6....
...C.c.......@l!...........a......l.i...... ..........rFL..$...@......
[email protected][email protected]..'..@... ..v0/C......Q$...O.........
...@.......[Jx ....g..H4..4..G.G.dv.8 .............(..@... ..}.....8. 
..(.....x|h_Z...n.u!k.Q..JmV M....e..9.2Y.e...v."[email protected].,.S.l
[email protected] VYT.q....G.............^..k[,.F....R..7l1R.b]..F..Il
bq.....-h..R....8......T..'NmFJOk{..ozo.=...W.i~...M).6.....gn.....Z..
...-L.D.y).1,G..\E*.K.Y.W.>..]Jx....Z.m....r.i5.T..CP..........H. .
..sZ..;m.Z.7.%........;..t.,..?...0.JZI......Z...]....6.^.....^]n6./..
..{N..G...... Z.G*...%&....=|....v),&.<QB.kC.!......s...w.e`...-.v.
......ax.It...:....'3QU....iW;..........9.YWs.....k..k..iv..)..Y1....Z
C.[}..w~GX.w...:..C.x.iN..zv.;V.."..[.SF......j....]x.L}<..ZXo)u;p.
.m.~.....D...NKsx...ec=<{.N....:'..8.MqY.....vv..) ..DJ.b@d...~P...
.@... .ds..8..Qq.*O./.;..>..5..9[...... ri..{..<..y..ln.4.6..*..
xZ.h....-z......XW..........S..I.....o......^g..k.#O.s....:..9....]...
..j.wH:.....t....os...../[email protected].....%...t..5J..z`....=..v....
'Kz..P..:k3L..p.....s..j..3.....K.Y...:.Th.z.^...l.f{.bb"....q....
<<< skipped >>>

GET /images/merchantlogos/omaha-steaks.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 18814

Cache-Control: max-age=448658, public

Expires: Thu, 22 Sep 2016 02:27:17 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=IRIHeF6iGgV/zQ6lLaKCBPNo3FcAAAAAV BK1m9IQ0/QvcQNFzDunQ==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=IkEvQogHmFg; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=OxY.TcKR; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=KZy

    XuaOxalt: Oth; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 813) q(0 -1 -1 1) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
.......................................................]..............
................!."1A..QR....#2Yaqr...$37BSX.....)9CGTWbwx..'(45D.Is..
.........................................O.........................!..
1AQ.".2Raq....3U.......#Brs.......6DTt.45C...%Sbc............?.....D.%
.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ
"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...
D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(
.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q
...EN@=..DT./.."..9./.(B...._.._.D..#.....H....4U- .......F...Q.;.....
..DJ"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...D.%.(..g=..z.e9...,X8..K....4....9.
...r...4...p.Z...w...a.%e|...N.......r....W[.9...=tW?.$.J~....X.H...X.
[email protected]>|.8.../.]........d...yd...A.O..;<u*..G/.l.W...U..*
Zx*.q....?.*....k......qQ:G....k....`{....s.....L.......-r?S..|......&
...%X._...7......J? .....-..~[..t.;vX.e......d...,[......G.U..c.......
[email protected].=.[M>.......c..#...p.z...*..:1..O..F......e8...^..-
...P.1.}0.exm..=6..L..G.f....u.6A........`..}....qq...^.N.v......i ...
4Y...:.c.8H.7....5..F.e1;K....xkJ./rA..x{9....C...~........f......,...
...?.O....\.....&.(&S9...!$2m...X.......M@.|.....#7....\...<.......
.........=.t..V.,.....;.c.g.0&.;..J...J...F...poo..)...:.8..V.........
...H.{..q........eN.%Z"Q...D.%.(.DJ"Q...D.%.(.DJ"Q...".."..E.\.=.g
<<< skipped >>>

GET /images/merchantlogos/jcpenney.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 10169

Cache-Control: max-age=448658, public

Expires: Thu, 22 Sep 2016 02:27:17 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=TshGbM6FRQV/zQ6lLaKCBPNo3FcAAAAA8jjWZoBi7f3xXVnrcl4crQ==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=ulkhiGfKeXT; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=SDN.cbEW; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=KZK

    XPEOhalO: EtY; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 887) q(0 -1 -1 1) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
......................................................E...............
..............!.1.AQ.."#a2q.(9:Bbrv...$)36Rs..........................
................S...........................!.1AQ.."aq......#25BRr....
4St.....$678bs....%&(3CU................?..... .... .... .... .... ...
. .... .... .... .... .... .... .... .... .... .... .... .... .... ...
. .... .... .... .... .... .... .... .... .... .... .... .... .... ...
. .... .... .... .... .... .... .... .... .... .... .... .... .... ...
. .... .... .... .... .... .... .... .... .... .... .... .... .... ...
. .... .... .... .... .... [email protected].....@....@....@....@....@....@.
...F.........O4.e6.3N.t..s..*.5Q...._.t.c. ...~.Z.Uf^n:..8.. ....Tl;..
...g..|C.....P.(..>../.4.3..TL......xfG.Z..[1L2.K%m..Y'dT......|...
$..$ ..xS..7.....{r..X....t.Z...a...7.......p.....w..7]4.....iO.-...l.
.....1.k..,g.gy'........y.zu.o.y.=...g.]2...5uE....Nj1O.y.s...$p.L..p.
.....9u.JqL......Mg..K..%..4.b~\4..........a}...c.W.'....(..Su ..Z.9..
l..:.....TZ.......sT..K12.n.....I....I;.....q [email protected]....}..."....n
...-...._.%.%.....:pn5!...4...6l.U...V...M../.p...y...h.q..b...K....{.
..'..^...T....I...>Y."....4.$k.Zf.Z.*tiz.....<c..Ic...k..V...i..
..[..^..j..V.&.QK[...)Y)k.x<.H...{.S.T.C).<I..fj...x'cuR..r:U...
FW...d..N.M........G&C.l>.67./.........$.R..8...\Kv.Q.*._.#........
.O..u..*7..m..Y$s..X]...E..e...]i.....}..6..`.x....J...'.H..;....n
<<< skipped >>>

GET /images/merchantlogos/macys.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 5602

Cache-Control: max-age=448658, public

Expires: Thu, 22 Sep 2016 02:27:17 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=Qs21ItNFXzx/zQ6lLaKCBPNo3FcAAAAAfqO26s57HujPIkMXhT 6cQ==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=XzNhUKEVCyg; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=KqI.rxAM; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=yZp

    XRkOhalH: PtF; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 972) q(0 -1 -1 3) r(0 -1)

X-CDN: Incapsula
.....C........................................................ ".."...
....C.................................................................
.....................................................E................
...........!.1A.."Qa2q..#7BRb...6ru....%'34Vv.8S......................
..............3........................!1.AQ..."aq......BRT2.r........
......?...............................................................
......................................................................
......................................................................
......................................................................
X..L.An....{..o.S.X..9.~.STU..-..,W.......q.,.\B. 6".......M/{.xkZ.$.|
.._On^.....2..'...d..t.Vu.4...<..#...f(Z.=.n...q..G3]$..h<...=.Q
..-..e...Xs3$....<r.On...=l..t.. ..P.;:.d...#~m...P.....T../.X...$.
. ][email protected].|...].o...o..(i..Y. w..>M..V..S^...0...3[!h......
...Pci.KGWa..c............p....s.........................5...... 7.q..
.=..d=.?......Q5x6<#.s.mcG......mJ.$j...f...z.Q..q...d.k...'......3
D.;.....Y....UG.?.zy}."./<.yY..`....l.--p..G........4.F.......mXfc.
...`.ut..X..|..A.Hm^S..hZ.i...Mnh.{....n......z.w/x%...@L3l!vb.Bz....z
.ZW. ^.K...r[............C..Je.........^.}[email protected]@.o...s..P...r..T
..Zz..C!z.....l.l.N.#..... .-....[..*..h..;'Z)h`.._me.^n;....t..:.:.
..h.=..ce6.'w'...c$.....9Y^.|.....7..G.Z.u....<|A........a.l...X...
../[email protected]......    ........ft}.,..J..E...a|.|R.?..#.e..}.:].Avr.....
...Q....4u.S.f"....ll.x..0Cx?...n_.....k..3........S.r.B..?.o..VQ.
<<< skipped >>>

GET /images/merchantlogos/bloomingdales.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 5838

Cache-Control: max-age=466622, public

Expires: Thu, 22 Sep 2016 07:26:41 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=bPpFdIM3JxN/zQ6lLaKCBPNo3FcAAAAAcHiuQcOKHZ9AaInom va3g==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=IUyMtSydgVd; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=FoI.soAm; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=LZl

    XCaOWals: AtR; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 1068) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
.......................................................2..............
................!1..".2A.#Q%BRa3.............................. .......
...............1!2A."Qq............?..................................
......................................................................
......................................................................
......................................................................
......................................................................
........................A.W.8.,n..h........Q.U..bQG.6..I...".\7|.K"W..
]..f........A...X.....}..q[.M.:........#4n-.}E%.fE.y(........<.n...
.......v..m..4.5/O..1%.q....H."Q......0/k........f|.K...*f*.6.X.Zv.N..
....%.q\....2O...d.#"... ..K.....^.;Qa..5.h^....S.$.M....^/. [~].g....
/pm..J.`......c.....|[email protected]..$c.F.xT.R.?...O..6..\7.D........3...i...A
{.|.....{.j..|J.W..Q..V.(.......[[/..Oz.6Te..OF]..d.............(...K,
...hw:..;e. .d6.!P1...,z..*.USMa.....z.6..j2J.e.DDJZ...1?^.?S.....3Z..
..II.s.B..Mi,.vl.z....._..25|...f...K1."<=rj. ...;.dc.........-*.Dt
.......m.C.)>.ZT.)=..k(..\.c>:x{.FUF...V|.1..B.X../*..Q.6H.=%F..
7.%...v...-J".)...e....p. ....*`.6....i.W..mz....*z.....|....)$%d.8...
.d.g.~,...-._)...ihv....&...*..Y..P.T.R[.dEa.eG.j...h.Im.,.e...1..=r..
gqN...(..Z.Mk....i.r..Q\.6..F..4.....T.%)J....J...f...kqrw....bl......
...;.P....9_....;...nUQ.)*S.#%.~H"%5..:..d..$.\......c\|.k.....^.3
<<< skipped >>>

GET /images/merchantlogos/staples-lg.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 16152

Cache-Control: max-age=448658, public

Expires: Thu, 22 Sep 2016 02:27:17 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=ntFqJMleWHp/zQ6lLaKCBPNo3FcAAAAAw21olZU4Zp7Dl3xk hVepA==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=iPJJiHalKNe; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=nNu.hooE; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=JZc

    XkNOBals: HtQ; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 1141) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
.......................................................D..............
................!1AQaq..."2...#Rb....$BCr......Sd.....................
.................E...........................!1.AQq..."a.....23r....#B
CRb...$4S....D.............?..........................................
......................................................................
......................................................................
......................................................................
................................).D\.....9..?.".. ....1...y..)...o....
...O...9 .._z..#.........<....\V..w..GK$.f7.......8F.Y..`.~/.X[;..u
...e?....."%..$.9.r..U.3w.pp..!x.z~.l..np>.p...,v.#..pz............
..................D..pH....a;..<....I....W.8.......\...$.(.....Q.Hb
.u3N.......KN.I...k...c.{....k.w...*Ie.....T..o..e.../.....?'....S....
.O.Q..6...P....RE..f.......=.9..uA..W...[..e..%..Z.......Z..R..M....p?
...].v.R2.w..r.?..:...OhV.#,........ -=;.~sT5......[~.^.....m..]{7....
.G...#....._..&J1m....|..r.)iX}...).*L.e..p8....I...M...m.&}..w..(/ ..
.U.8..y..U?.B.{..p?..8.Ty..?..h.q?..m... F ....D..\...}n..y..E...A....
e........Ti..tw....O.."...........F..F>*......#...y.P..e..o....;.T.
..y....h.%!.z.....[.g..G.........<...y...TF........G.......j....P.}
.|..l...h.i......q..yAw.A....r,.;.;...}...8..|..I..Q'...w....m.V.G.$..
?......t.......%..=... .Ny...-.....m..Y.u.N.1.....V.8..MKK(...x.d~
<<< skipped >>>

GET /images/grey.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "32c07c8e"

Content-Type: image/gif

Content-Length: 43

Cache-Control: max-age=419008, public

Expires: Wed, 21 Sep 2016 18:13:07 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=osO0MOALSyp/zQ6lLaKCBPNo3FcAAAAA7O3LuhTTmm7Gk2lCQR2JMg==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=njkGyunRFUo; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=wzE.BeQE; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=wZu

    XnhOUalm: etv; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 1213) q(0 -1 -1 2) r(0 -1)

X-CDN: Incapsula
GIF89a.............!.......,...........D..;....


GET /images/shopblog-header-text.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "c4def74b"

Content-Type: image/png

Content-Length: 3484

Cache-Control: max-age=419008, public

Expires: Wed, 21 Sep 2016 18:13:07 GMT

Date: Fri, 16 Sep 2016 21:49:39 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=Miy0O/Lyqk5/zQ6lLaKCBPNo3FcAAAAALBQKTnLXX3wMpWtr0khSLw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=NhPFKxTEaXV; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=XoW.HIVj; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=jZz

    XYwOvalE: Stb; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 1329) q(0 -1 -1 0) r(0 -1)

X-CDN: Incapsula
.PNG........IHDR.......C......m.:....PLTE.........B@@...B@@...B@@...B@
@...B@@...B@@...B@@...B@@...B@@...B@@...B@@...B@@...B@@...B@@...0XSB@@
........w.}r!me%g`)a[-\W:KIB@@.w.....!tRNS....  00@@PP``pp............
.....\.......IDATx...i........Q...q.x......&M....3.....H....iZ'x..7...
;0.P.P.62..mdB..H.U...l...t.F._.......{1\.........;2X.dT.!3........K."
&.BHj..!....[..X...u]......h3....3.'ceS  U.J*..t.V.yu.,n.j........(u..
T.ie.w..c..JE.....3*..7k..KQ..E..]Ha.* .....b.A..../.......Z...5k..f..
.).p..|..cmL..@.>.U..e.3.(.$..8R..V.F~.,[email protected]~TR..V.&.Y.'nXB..
...7I/...d.......k...q...,..h...f.Z..B...3../r...Nw^.K..s..H.......S..
...Du?0...E3 ../...."uV....|.......Z..;/*....Z..8.g.q.Q.z.NEq!..J...-.
.r.zP.f..K,.i....y.6...>.....P...X.[g....Hcj.(v.......=..;..|.d).{.
Eu..UE..4p...!......n.'.A..q...)...){P...t..P.d..&.l......k%.........B
o6-.)5....eT....?.j.NTZQ0.Z{....l<.2.]....Q..1/.F.j.g......D.*6..U.
[email protected]^!,.....d.:rz%&e,.M.........zQ.9.Ct*.......j.A.V4..~T....et..h*.*
.F...Y3 .m..`.........Mo;.....R5*.....-C........s)RY..*..-.xEk.*.5...|
u9[[email protected].`......Vnc....zP1e.EUkTi.*....U
Pf..*|...cO.P.=it.j......RZ../.i.............~......A.B..Q...]E.. ....
q...gJ..........w)#._.........Z[J)`.:...n].!.Y..o.........}[email protected].
.U.F..9....e.*....6.6*t.p.!.m..s..)..B.{ZV.r....(......H.0~.U.).UT".K.
.7*h2..?..e.B....S<.p.p2..G.....>.]..\.=..=..F..q.K.......!..<
;@......pm....,......U..{....t..<.yT.#.:s!B..:.."...T.....n..9_..Jn
..~T..H.[W.u....!.T..`....Z..'H..J..B..<zR.. ..1..=r..BE.....T9
<<< skipped >>>

GET /images/email/black-seal-96-50-belcarogroupinc-3102.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Etag: "aefc1c72"

Content-Type: image/gif

Content-Length: 2058

Cache-Control: max-age=416163, public

Expires: Wed, 21 Sep 2016 17:25:43 GMT

Date: Fri, 16 Sep 2016 21:49:40 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=BB5EaxKxEDZ/zQ6lLaKCBPRo3FcAAAAAoaBy8B7DyfvisAq3 WZUnw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvmOPuiMYp=CgYkxbqfghW; path=/; Max-Age=900

Set-Cookie: ___utmvaOPuiMYp=DXc.FvWO; path=/; Max-Age=900

Set-Cookie: ___utmvbOPuiMYp=NZS

    XkZOTalu: utd; path=/; Max-Age=900

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 1449) q(0 -1 -1 1) r(0 -1)

X-CDN: Incapsula
GIF89a`.2............................!..XMP DataXMP<?xpacket begin=
"..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:
ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57
:01        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-r
df-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://
ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" x
mlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:Creato
rTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:F94036
FA74D111E3BEA8CF791A45B470" xmpMM:DocumentID="xmp.did:F94036FB74D111E3
BEA8CF791A45B470"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:
F94036F874D111E3BEA8CF791A45B470" stRef:documentID="xmp.did:F94036F974
D111E3BEA8CF791A45B470"/> </rdf:Description> </rdf:RDF>
 </x:xmpmeta> <?xpacket end="r"?>.........................
......................................................................
...................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\
[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ....
.............................!.......,....`.2....x...0.I.......`(.dH..
`[email protected],.Ci..F([email protected].*@ ..?....".P. ......M..RYZ.x."G.....f.9n.J.
...y} ]3~.l.D= s0..b.D...t6q.... .@....?..[>.X0L./...s..XxeD*....S.
-*..P........_....P.?........2q..:Du....._._Y..... _.M...Mq......4.).A
.>t.68j....x.j..Gl.<^.^p.........}a.. .&.v...2....,.\.PCFT......
..bCVe.........j..............Wud.:.kV.Z.z.h....^.u.........i{..N.
<<< skipped >>>

GET /images/merchantlogos/1800flowers.jpg?w=260 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.sahcdn.com

Connection: Keep-Alive

Cookie: ___utmvbOPuiMYp=HZN; ___utmvbOPuiMYp=rZi; visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==; visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; incap_ses_325_926707=bScQS iV7Td/zQ6lLaKCBPNo3FcAAAAAyiG5 Hgt3nHDMl6nv7zhJw==; ___utmvmOPuiMYp=rDoAcvEkEeq; ___utmvaOPuiMYp=VCt_KGSR

HTTP/1.1 200 OK

Content-Type: image/jpeg

Content-Length: 14547

Cache-Control: max-age=588495, public

Expires: Fri, 23 Sep 2016 17:17:56 GMT

Date: Fri, 16 Sep 2016 21:49:41 GMT

Set-Cookie: visid_incap_926707=puemv8QLTfeJYHXH0n5sffJo3FcAAAAAQUIPAAAAAAC0lPA2BcbfFO5p5fvEz9Wy; expires=Sat, 16 Sep 2017 11:14:04 GMT; path=/; Domain=.sahcdn.com

Set-Cookie: incap_ses_325_926707=bScQS iV7Td/zQ6lLaKCBPNo3FcAAAAAyiG5 Hgt3nHDMl6nv7zhJw==; path=/; Domain=.sahcdn.com

Set-Cookie: ___utmvaOPuiMYp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

Set-Cookie: ___utmvmOPuiMYp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

Set-Cookie: ___utmvbOPuiMYp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

Set-Cookie: ___utmvbOPuiMYp=a; Max-Age=0; path=/; expires=Tue, 13 Sep 2016 11:11:26 GMT

X-Iinfo: 9-27272224-0 0CNN RT(1474062578599 2638) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
.....C................................................................
....C.................................................................
.......................................................J..............
................!1.."AQ.2B.#abq...38Rw.....9rs...$%(7G................
......................K........................!.1..AQaq.".....2r...#$
5BRb...s...346c......&CS..............?...............................
......................................................................
......................................................................
......................................................................
..................g............ ...h..b.....E.m...B.N....l..N2.<..Q
..j.j%x.......wUi.N.z..xx..dT...j....O...\c...........................
.............[......|^u....H.".U.Js.0b2.... ...*3......j..IfRi$...#..7
9(.e...,..(.:.......R...^rn.u.Q.......B=.eqZi..=..R...n...B.h.......e.
.......m...q.......G....Qj.KK..Q..v..\4.r.O'.gI.4.j\E....m....O.~!..Q.
.4.B..]....]...).J.v..B|.........A.0O.................................
:=: .e..x.6.]qj.....J3.......9...$|.j1r..G.j][email protected]}v.s[S.'...!/.%..H
ZL...........(..%(Kt....7.ni*..S..4.....e.`..<..B.qICdFjQ.../....F~
.}a`j"MoFz`.S7.A....hN...-...../.Oi.....!......._..F2.Q./....E........
...W.=..Uu.>I.x..B....d.....;.m*...n...K.......KZ..m.$....$..R..!x.
...........o...&7WT......[z..lC..it..I..V:...v.......,..Xi&..Iw.c.M.,y
...p.....3...5.?.J...%...ZIr..}...o..zu]b...u).......*[email protected].]T.v
r-.....r.P.:._.&<...y,.......%..?.j:[.,4jtt.:.....OyK}.o...X\.1
<<< skipped >>>

GET /msdownload/update/v3/static/trustedr/en/authrootseq.txt HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: text/plain

Last-Modified: Thu, 14 Apr 2016 22:20:39 GMT

Accept-Ranges: bytes

ETag: "8095d7df9b96d11:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 18

Date: Fri, 16 Sep 2016 21:49:39 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2
1401D1969BE01E11A6....


GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab HTTP/1.1

Accept: */*

User-Agent: Microsoft-CryptoAPI/5.131.2600.5512

Host: VVV.download.windowsupdate.com

Connection: Keep-Alive

Cache-Control: no-cache

Pragma: no-cache

HTTP/1.1 200 OK

Cache-Control: max-age=604800

Content-Type: application/octet-stream

Last-Modified: Fri, 15 Apr 2016 17:23:18 GMT

Accept-Ranges: bytes

ETag: "0c730803b97d11:0"

Server: Microsoft-IIS/7.5

X-Powered-By: ASP.NET

Content-Length: 49640

Date: Fri, 16 Sep 2016 21:49:39 GMT

Connection: keep-alive

X-CCC: RU

X-CID: 2
MSCF............,...................I..................HaR .authroot.s
tl.%.u3S8..CK...<T.......4v.e.3h.......l...kICY*7-viS.ZH{i.."QY...H
.T$!..L..g......k^.w.s..y?..}....4.......d.4...0....)[email protected]. 
0Y......#p.&;..,..L....._.....ppSf^.....\x....PSSC........4..Apw..:..*
....."(..6..............".3..6#.*9..yx>.w..aX....U..:.*G?..3......w
Y.Z=G..^...J.......Qt.U.xiD2..o....1f.a.9...&...T..\.X<u.WU/.]=./8.
 .sK.......(.<.A$H.............5...y......"...\...IP..A(y....]..fc`
.r)Y.$..<.V.............'....f..X.Y.<......R...zq.5nfO,..NE.....
*/ud.7.=.".3..........%.. ....F.......,.e.3.e.....  ..T...=x.BD.......
..R.0..3D.....W......v<\{...Oj>.$YT)LQ..........{.......s=.vs...
.......dY].<.v..<..w[.{.Z..qV.............= ......5.5........tm.
.. ...SZ.....e-1e<.rX..K3>..~]{b#..&......b.e......;...?......7.
..!W......e\..a>!{....t.....r...TV...h....4...........Bx...aBp.....
..........F....kx. V.q....g.?.q\.z.?h>V..ORz.....t...%.{w...4..(...
....m.|..X\,./.4w.6?M$.q;q.............x?...Auip.... 8..".4...a}E.98T.
.*...N...7]p<[email protected].#.%.:..TE7....d..b. .E.V...-.=1.
........j.)t...Z &.e.o..m..L.s.2.\...j4.d..............4.....9...3...0
3...-2c)L.."..y.7.|... !O.1.....i:....J.:.P..5...6.W...XP..J..^.....u.
v....|..U..-..Q..CF.r ..........`.V~.C...=.=.m...6N.,..OV.Z...d.K.-...
.".D.8.V,}X.P.D..X"8.....;DD."../x.(M..O........1V6R./.3|I...9,.......
.eh..........k...W.....t.*...K..a.....x.0#.t..F.!...7Vk ........7....X
......2.t!...AB..b...1.&..S.`[email protected]."...vl.g.}Rs....y.z}....}.
<<< skipped >>>

GET /css?family=Roboto:300,400,500|Fjalla One HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: fonts.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/css; charset=utf-8

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

Expires: Fri, 16 Sep 2016 21:49:38 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

Cache-Control: private, max-age=86400

Content-Encoding: gzip

Transfer-Encoding: chunked

Server: ESF

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN
db..............=o.0.E...o..8..H5.D...U.....q............D..u..^].^..:
.T.}y..R].I........nu.KG'......;mt.)H.0...Y%..B. .../..o.I*.......s4..
Bn...UZ......^G4..a..0s.........d.L}......._.K..........#..I......S..0
..dP..~?.......a....k...[.....0..HTTP/1.1 200 OK..Content-Type: text/c
ss; charset=utf-8..Access-Control-Allow-Origin: *..Timing-Allow-Origin
: *..Expires: Fri, 16 Sep 2016 21:49:38 GMT..Date: Fri, 16 Sep 2016 21
:49:38 GMT..Cache-Control: private, max-age=86400..Content-Encoding: g
zip..Transfer-Encoding: chunked..Server: ESF..X-XSS-Protection: 1; mod
e=block..X-Frame-Options: SAMEORIGIN..db..............=o.0.E...o..8..H
5.D...U.....q............D..u..^].^..:.T.}y..R].I........nu.KG'......;
mt.)H.0...Y%..B. .../..o.I*.......s4..Bn...UZ......^G4..a..0s.........
d.L}......._.K..........#..I......S..0..dP..~?.......a....k...[.....0.
.

GET /meter/VVV.shopathome.com/32.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.scanalert.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Cache-Control: public

Expires: Fri, 16 Sep 2016 22:18:02 GMT

Content-Encoding: gzip

Content-Type: image/png; charset=UTF-8

Content-Length: 3038

Vary: Accept-Encoding

Date: Fri, 16 Sep 2016 21:49:39 GMT

Connection: keep-alive
.............8..PNG........IHDR...s..........)!b....IDATx..[yTU...)L..
..)....3.f....9....sj.....=..B..h,.D...^D .0.A.y.AF%......;{..y.M.e...
............=........~A..x.j.:... pxa.......Uz.f....fcS.*..._T...,D.&"
 <.>[email protected]...%e..-....\$.e!>...R3
.$..r .).9H..Fbz&b.....I._...W@.~..C`d............k0}C"..KB....VQ.....
..m...................;..B[.dgg...[...d^]]...h....544.....o.v..e...!  
.M..y....vvETB...55.1^...=.._`.l....yyy.....W(a....;~.8.....hU....(.g.
..Os9......n.j.`Z9....t..m..q....>..........z#~Z............ .....l
...u._..63.....p[....F..Y...nPP.x..'Of... E....Z=.I.&.\...1r.H.?l.0...
..U...<.(...e.......>.....H.jC:m!.M.'l.......|.....f...x8.j....p
T.........H..`.vvv"p}..Auu5.".....\bb"..[...Gc.... --e.....E...|AA....
..{w^#~qq1...0q.D.....x...|.....;.S.N...g...N....d......^..?........;E
9.-.pW....KD^....U..................D*.....A.3f._%...A.....;....=Y....
9..,...WWW..;w..7nD..]..Q.FAOO..V.^......8}.4..m........4..L.._.......
....{.....9..........V..D.K.........U}...............}E.e...!R.BW...d1
].t.....5yL..g.}.|CCC......./.5MMM.O4w.\1.....|..M.1c....>..[...:$.
Tb\....#.'U..`z.....(W.[....Fit......S=...A....`.;d......(Q.,...,EMM..
.G..HKKC.^..5...3...}......_.~.;...A.z...........1.M.6.....7.|.[[[...0
......a...]p....N1.....9/...Pv..jZ(..."/S|...AU........?.v..qRY.....?z
..d...ymm-...={.......p...x}..A.....D...Y.....,.]*mh......q......|....
;..<.......K.,a>.Z.?..`.f..j.v.f.p..f.P....S.6.~.u.=x.........,.
u."..RQ.....*....Sp...8)$G....mn......o.=w.......v.Z.'wG.HW.-[.`..
<<< skipped >>>

POST /RequestHandler.ashx HTTP/1.1

Accept: */*

Content-Type: application/octet-stream

User-Agent: SelectRebates

Host: tbws.shopathome.com

Content-Length: 565

Cache-Control: no-cache

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; SAHSessionID=1721e748-09c3-464b-ac7a-6005713c1967; SAH=REFER=000026016&SRC=REBATE; SaagId=2385ecba-09a2-4370-b0b6-7dce49922d22; CookieCheck=Y; DeviceDetection={"DeviceType":0,"MobileOperatingSystem":0,"IsIos":false,"IsAndroid":false,"IsPhone":false,"IsTablet":false,"IsDesktop":true,"DisplayType":1,"IsKindle":false,"Browser":"IE"}; SAHSelect=CustomerId=34539780; CustomerMessageSessionId_6=34539780; LiveRamp=; sm_dapi_session=1; incap_ses_184_621395=VJMjZ8d6UFuKUwxoRuWNAvBo3FcAAAAAEnLCKcDijxGerEZJBVYdcw==

cmd=ar0&xml=<?xml version="1.0" encoding="utf-8" ?><AlertRequest><Cust><GUID></GUID><Id>34539780</Id></Cust><Dog><GUID>{4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}</GUID><Ver>5.2.0.0</Ver><TbVer>5.2.0.0</TbVer><Prefs>1</Prefs></Dog><Requests><Request><Type>Favorites</Type><Id>5</Id><Src></Src><String></String><LastFavorites>-1</LastFavorites><LRFav>-1</LRFav><OpenTime>0</OpenTime></Request><Request><Type>Checkin</Type><Id>6&
HTTP/1.1 200 OK

Connection: close

Date: Fri, 16 Sep 2016 21:49:38 GMT

Server: Microsoft-IIS/6.0

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Farm01

Etag:

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/xml

Content-Length: 138
<?xml version="1.0" ?><AlertResponse xmlns:xsi="hXXp://VVV.w3
.org/2001/XMLSchema-instance" xmlns:xsd="hXXp://VVV.w3.org/2001/XMLSch
ema" />..

GET /?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz

Connection: Keep-Alive

Host: VVV.shopathome.com

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

Set-Cookie: SAHSessionID=1721e748-09c3-464b-ac7a-6005713c1967; domain=shopathome.com; path=/; HttpOnly

X-AspNetMvc-Version: 5.2

X-AspNet-Version: 4.0.30319

Set-Cookie: SAHSessionID=1721e748-09c3-464b-ac7a-6005713c1967; domain=shopathome.com; path=/; HttpOnly

Set-Cookie: SAH=REFER=000026016&SRC=REBATE; domain=.shopathome.com; expires=Sat, 17-Sep-2016 21:49:36 GMT; path=/

Set-Cookie: SaagId=2385ecba-09a2-4370-b0b6-7dce49922d22; domain=.shopathome.com; expires=Sat, 16-Sep-2017 21:49:37 GMT; path=/

Set-Cookie: CookieCheck=Y; domain=.shopathome.com; path=/

Set-Cookie: DeviceDetection={"DeviceType":0,"MobileOperatingSystem":0,"IsIos":false,"IsAndroid":false,"IsPhone":false,"IsTablet":false,"IsDesktop":true,"DisplayType":1,"IsKindle":false,"Browser":"IE"}; domain=shopathome.com; path=/

Set-Cookie: SAHSelect=CustomerId=34539780; domain=.shopathome.com; expires=Sat, 16-Sep-2017 21:49:36 GMT; path=/

Set-Cookie: CustomerMessageSessionId_6=34539780; domain=.shopathome.com; path=/

Set-Cookie: LiveRamp=; domain=.shopathome.com; expires=Fri, 23-Sep-2016 05:00:00 GMT; path=/

Set-Cookie: sm_dapi_session=1; domain=shopathome.com; expires=Fri, 30-Sep-2016 21:49:36 GMT; path=/

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web06

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Fri, 16 Sep 2016 21:49:36 GMT

Set-Cookie: incap_ses_184_621395=VJMjZ8d6UFuKUwxoRuWNAvBo3FcAAAAAEnLCKcDijxGerEZJBVYdcw==; path=/; Domain=.shopathome.com

Set-Cookie: ___utmvmXIuitfm=AMuUWNnppYa; path=/; Max-Age=900

Set-Cookie: ___utmvaXIuitfm=yNi.XKnN; path=/; Max-Age=900

Set-Cookie: ___utmvbXIuitfm=rZz

    XuiOValq: WtU; path=/; Max-Age=900

X-Iinfo: 2-44731469-44731473 NNNN CT(135 -1 0) RT(1474062575340 1) q(0 0 1 0) r(14 14) U2

X-CDN: Incapsula

Transfer-Encoding: chunked
15ea..............QS.8...;....%t.....P...@).1.....&.....d.HrH......'..
.y93.".~..]I.........>#..y.......:P,1D..w<............Kq...L..d.
^L...%..MG/D..j......g........tF.Q.7..0}...'c.5|y.........z..CG..t'd.y
.S..2......_.M5...M.~.~E...j.U...J3...m.....C..|.....,48^!e.s...Z.....
...OMf....g).-^_.........(..0.(..s.G4c.i9..,..yDO.!.s6........wW......
a..V.m..H..t.$.kY.r.3...!.*....U...2`U...... ..4.V.k.......7....r..4..
ij$.M8..4g...rq..g...LKI.p.........zi...L.G.S~K.......Zc..b3.R.,N...k%
Zcp..3.p.w"JI.....a....n.D.1.u..SJ..S.l"....Tdm...#.R.fMRU..m.J..q7LzU
.......<R..&[..Q.;...c Q......84q."\[........!.L^..s.].v:R.......G.
.f..M......8..2.;...... ;...........E..gD.A.....O!.%..2.d......o.ch...
.Z.w..#....... ...s..*..aj..9..n{.P....{...^a9..TS_.1..f%.o.....m9U].U
.u..X.O..D*.u.....?Q.hy%?..M.......7.{.......w..B.....4.m.M..m2NE`..d.
m....T.2........{...u.....Ty..#w.n.T.kpU0.4W..w!B.g.-gH23.$c0......wR3
v...-..........{{..._.....!.*...tq.C....<Av.*h...|.j."..B..!6.....6
a..F.......&1..8............]4.p...I.....4.$}..&.Hv...,........g..D...
.9.............}4.?;...Z;.q.;.,p.D...,......ZC[..Vi.El ctXw&RN8......G
c.3..o.H.y.q.....~....uJ9....J.M...e..O.oZ!...J)`N.....T.f..&K.2UD.p..
..t...Mt".....z..Xg=.............).......FF.........Z.S.H..W..PI.Xe...
.l..&a/<.....E...VbK*=0^......d...^..w..........TF>.U(..P..z..0E
.d."...)..9....C....=oL.S..d..;R1...}{.1...J......:...q.............yw
..CE.........F3N...<.g..b ..~.?..#...B....8.V.Y.DQ.].....'Hd..../.g
|..?8..vxt..6j.V.`.......V............n..m..z.a9.Kf.8.g........N$.
<<< skipped >>>

GET /Content/FlickityCssBundle?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; SAHSessionID=1721e748-09c3-464b-ac7a-6005713c1967; SAH=REFER=000026016&SRC=REBATE; SaagId=2385ecba-09a2-4370-b0b6-7dce49922d22; CookieCheck=Y; DeviceDetection={"DeviceType":0,"MobileOperatingSystem":0,"IsIos":false,"IsAndroid":false,"IsPhone":false,"IsTablet":false,"IsDesktop":true,"DisplayType":1,"IsKindle":false,"Browser":"IE"}; SAHSelect=CustomerId=34539780; CustomerMessageSessionId_6=34539780; LiveRamp=; sm_dapi_session=1; incap_ses_184_621395=VJMjZ8d6UFuKUwxoRuWNAvBo3FcAAAAAEnLCKcDijxGerEZJBVYdcw==; ___utmvmXIuitfm=AMuUWNnppYa; ___utmvaXIuitfm=yNi_XKnN; ___utmvbXIuitfm=rZz

HTTP/1.1 200 OK

Content-Type: text/css; charset=utf-8

Content-Length: 652

Content-Encoding: gzip

Cache-Control: max-age=604800, public

Expires: Fri, 23 Sep 2016 21:49:38 GMT

Date: Fri, 16 Sep 2016 21:49:38 GMT

X-Iinfo: 2-44731469-0 0CNN RT(1474062575340 2620) q(1 -1 -1 -1) r(1 -1)

X-CDN: Incapsula
...........U.n.0.|...R#...&wgt.r?.6`..Z..GQ........;E..{=.vv..T.x..H.f
...5.......y...w9...q-4^I-h2..I.7`}.;aK.{ZK....`.Z....5I.G.NI.........
l/.....'O.b......SK.".]..!5.R.$)@...2...B......q..'.(<..EF..1....o.
...MT.h.Cf[.nv..f.e.....G.....H..^..7.RW.[...&c..hq.$o..=...C.(b....9.
zvq........2.....Y.^Yh4.OeY..k..K.L.../....b zz.....%.m/1....B....7..x
k.......p.;p3_X..q5CQh.........,. ....T...)S..0.....d..b.ofP.. ..(Q..3
......4.W........C.?0..;....\[email protected].}.. =....i. K....
...D.}Z.V.Z..,z/..Y...'?.M7.%[email protected]%)._f..8...[f .1P.!.?*....l.Z
....&0.3.....g:\Zt.......(..LsF.#... WP..._........6.....w...H...H.7&g
t;..g0....5.......w. ..f....HTTP/1.1 200 OK..Content-Type: text/css; c
harset=utf-8..Content-Length: 652..Content-Encoding: gzip..Cache-Contr
ol: max-age=604800, public..Expires: Fri, 23 Sep 2016 21:49:38 GMT..Da
te: Fri, 16 Sep 2016 21:49:38 GMT..X-Iinfo: 2-44731469-0 0CNN RT(14740
62575340 2620) q(1 -1 -1 -1) r(1 -1)..X-CDN: Incapsula.............U.n
.0.|...R#...&wgt.r?.6`..Z..GQ........;E..{=.vv..T.x..H.f...5.......y..
.w9...q-4^I-h2..I.7`}.;aK.{ZK....`.Z....5I.G.NI.........l/.....'O.b...
...SK.".]..!5.R.$)@...2...B......q..'.(<..EF..1....o....MT.h.Cf[.nv
..f.e.....G.....H..^..7.RW.[...&c..hq.$o..=...C.(b....9.zvq........2..
...Y.^Yh4.OeY..k..K.L.../....b zz.....%.m/1....B....7..xk.......p.;p3_
X..q5CQh.........,. ....T...)S..0.....d..b.ofP.. ..(Q..3......4.W.....
...C.?0..;....\[email protected].}.. =....i. K.......D.}Z.V.Z..,
z/..Y...'?.M7.%[email protected]%)._f..8...[f .1P.!.?*....l.Z....&0.3..
<<< skipped >>>

GET /dist/js/views/Home2015/Index.min.js?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; SAHSessionID=1721e748-09c3-464b-ac7a-6005713c1967; SAH=REFER=000026016&SRC=REBATE; SaagId=2385ecba-09a2-4370-b0b6-7dce49922d22; CookieCheck=Y; DeviceDetection={"DeviceType":0,"MobileOperatingSystem":0,"IsIos":false,"IsAndroid":false,"IsPhone":false,"IsTablet":false,"IsDesktop":true,"DisplayType":1,"IsKindle":false,"Browser":"IE"}; SAHSelect=CustomerId=34539780; CustomerMessageSessionId_6=34539780; LiveRamp=; sm_dapi_session=1; incap_ses_184_621395=VJMjZ8d6UFuKUwxoRuWNAvBo3FcAAAAAEnLCKcDijxGerEZJBVYdcw==; ___utmvmXIuitfm=AMuUWNnppYa; ___utmvaXIuitfm=yNi_XKnN; ___utmvbXIuitfm=rZz

HTTP/1.1 200 OK

Etag: "69c796c03add21:0"

Last-Modified: Mon, 12 Sep 2016 21:15:13 GMT

Content-Type: application/x-javascript

Content-Length: 1666

Content-Encoding: gzip

Date: Fri, 16 Sep 2016 21:49:38 GMT

Set-Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; expires=Sat, 16 Sep 2017 11:52:41 GMT; path=/; Domain=.shopathome.com

Set-Cookie: incap_ses_184_621395=VJMjZ8d6UFuKUwxoRuWNAvBo3FcAAAAAEnLCKcDijxGerEZJBVYdcw==; path=/; Domain=.shopathome.com

Set-Cookie: ___utmvbXIuitfm=a; Max-Age=0; path=/; expires=Sun, 11 Sep 2016 11:47:27 GMT

Set-Cookie: ___utmvaXIuitfm=a; Max-Age=0; path=/; expires=Sun, 11 Sep 2016 11:47:27 GMT

Set-Cookie: ___utmvmXIuitfm=a; Max-Age=0; path=/; expires=Sun, 11 Sep 2016 11:47:27 GMT

X-Iinfo: 2-44731469-0 0CNN RT(1474062575340 3120) q(1 -1 -1 -1) r(1 -1)

X-CDN: Incapsula
............io.6...l`H.,$ ...6.j."m.(.......fB..I.q-......c....h"...c4
.L...;. Et'..y....o......T7\.G.\Gc....Id.J.p.V/..XM.-.....M....A..DX..
....5....]E.FcG.K.&1.E.1k.v1.5l.....gs~s...tv@>~.j......D....- J.y.
."..%..j..W .?.....l>.l..7H..`H....D.B...REw..k.x.}.}.z{N..t..u}.&l
t;^8k..r.ab2.%..`n.K*.;K;.`.J..w...o*@.X....e.g-)..W>pL..L;....."*.
.=..!/.............b$..,.S..FGdG;....EyX&..$...P....P..n_...&$#;.}.]..
U..Q....T,b..A.jG..U....RR....Xrc..Q...g .m0S"n..k.J.>......U...H..
c...ZMc5O....JH...T...p,k....x.y..~.>.. (xu..k....-.........W.#...h
..2/..B.k..E...RQdO.P.J`.tll(...{h......r!.z..G........H.Z.b.T.Z...k..
r..f...N..O.g..EM...f....4.......;.z..#...Y..&...@"...a.TU......p.t#.U
.]..%..J1Jz,...f46-RQ....e...\..!.%q..0...r.Z.c6/..........-..S)5.2c..
.h.0..zw.o.BW.q.")*.f..3....f.8...7...i44Gl1..XPoM."5|G.0.b.`.Rr.....5
$.._a.X..?..G4/...8.'j.Qx._..q...^..I...).z...ML...%mj..<..(.t.. ..
....tS..;S.......r=.....>]}9s.......;.ye.n...w7.h....X......lt.OL..
....G..5N..p...Lz.o.....8....\.q.Q......`...0wx....7WJ....t...E.N..c..
.....B.%.A..q=..P.:.....H.$......%..G.G...V.b.(...8...4./....yY|...R..
....0......q..h....T.u .lB....j.U.w.*...).....U...  9..Q.[......i#...9
...A..uVk.Y....D...#...!.w.G..6.V........2.F_"8.0f{.?O.1M..C.E..g..*..
.E...3.......!.k.Fg4.dY._.K...c/a....q`u.,'.j.,......G.R7."V.p.......:
.o...D.s......d8.Rp..........y.._..P.l....].4.kb>........o.N.U..gp.
....e......Se.0uj..-.....&B.....8.. ...R.... .V8|-....6.....3d..j.o...
..Z......:../....[.}.2."..A.w<.A..........9^...t......*=R...KD&
<<< skipped >>>

GET /_Incapsula_Resource?SWJIYLWA=2977d8d74f63d7f8fedbea018b7a1d05&ns=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; SAHSessionID=1721e748-09c3-464b-ac7a-6005713c1967; SAH=REFER=000026016&SRC=REBATE; SaagId=2385ecba-09a2-4370-b0b6-7dce49922d22; CookieCheck=Y; DeviceDetection={"DeviceType":0,"MobileOperatingSystem":0,"IsIos":false,"IsAndroid":false,"IsPhone":false,"IsTablet":false,"IsDesktop":true,"DisplayType":1,"IsKindle":false,"Browser":"IE"}; SAHSelect=CustomerId=34539780; CustomerMessageSessionId_6=34539780; LiveRamp=; sm_dapi_session=1; incap_ses_184_621395=VJMjZ8d6UFuKUwxoRuWNAvBo3FcAAAAAEnLCKcDijxGerEZJBVYdcw==; H1:333d13ea38f717cd74cc7d028ed82=1

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: application/javascript

Content-Encoding: gzip

Content-Length: 1867
...........Z.n.8.}..0.........y..>..X....."M.....3CR.(...M..N-..3.3
.C2{...}9?=...............i.nX....W\.U .zV....)N... .VR....kn....F5...
..E..*5.^Q..O4....w...^...s.....W....}...l5..,.>hUH...4....H.0p....
^....X....U5.....c..R..%V.6.z^@;....z..1.....k.g.I....>.\.......|.h
S....[[email protected]=.`....l...6.......I.g..l(.S4c.ib.D.y\...>Yv.8y..F
....x;..#..O....~.slD.c....YB.\..............'!.:..q.....k.. D.m..K..K
F...........=B.xeg...(...Z...h#7..;K.......%.!..LocD.}..Jb...".!..ZE9.
..|V.K.......0"...c.&.`|..,iY.2.H.k.em....e...N9.1c..........a.;..?.@.
.2ef..i.4g.>..A^.Js..-..Fb..E..f.....0C.:..XI...x.G[y}lGZ.Z....5...
...."<b...sqs.<ge... ...4V....J(......8...... )..W...X.V...4..7!
G"|..B.N.4.F9.\..x....g.-^Y.....[........B..U.,gH........d.i.Y'.Y&.Q.q
[email protected].../d.}[.5.W.B.V%*v.JUA..A.1..v.....%YK.. x^C...*...|.s...
...%.........k.`...W%.Xgk.mz....E. .X...z.w.X.......<.C....7R.S1...
..-.Y...."?&....9...m...?...,........YL.w......G^.>.(.."..^.86.....
a......J.7q...(..9..1......H....RJg"dmF.'.=..o.GC."3j.kOA.k.Oi........
W.Q...#.........:k#s:...........l..k4N..e]...f..[..k...T....Z.n....W.#
Nw..j.....:..lu..2V......C....=L"...(.....T..w....sa6.....k....'-..p\.
.Z.g).asu...-..e.z....i^...At".9.}.?3.y..z6.........b}.<&X&...xcUXd
P&'..T99.,xOg...W,k...2.L....t....VG...Q.9G.gjGC,5..`!AT.)IQ..U..,.|.I
.[.s.......x..~u..'.{Q{64.4N.t.....;...MF....Ae.....lHiR......."......
...B..^..7,........B.....*}.<S.U64 a..m.......a......rqT.*..A.....C
..nR...}$(*...".p/p.. .^..........KM5.i.....fT.......'e!.......P..
<<< skipped >>>

GET /_Incapsula_Resource?SWKMTFSR=1&e=0.2596657034262577 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; SAHSessionID=1721e748-09c3-464b-ac7a-6005713c1967; SAH=REFER=000026016&SRC=REBATE; SaagId=2385ecba-09a2-4370-b0b6-7dce49922d22; CookieCheck=Y; DeviceDetection={"DeviceType":0,"MobileOperatingSystem":0,"IsIos":false,"IsAndroid":false,"IsPhone":false,"IsTablet":false,"IsDesktop":true,"DisplayType":1,"IsKindle":false,"Browser":"IE"}; SAHSelect=CustomerId=34539780; CustomerMessageSessionId_6=34539780; LiveRamp=; sm_dapi_session=1; incap_ses_184_621395=VJMjZ8d6UFuKUwxoRuWNAvBo3FcAAAAAEnLCKcDijxGerEZJBVYdcw==; .GLOBALFORMSAUTH=BA87283D6F8BCD7BE90B8C742E934151E18E82266421241608BC6B6EF97500BB487
HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Type: text/plain

Content-Length: 1
1HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Type: text/plain..C
ontent-Length: 1..1..

GET /autocomplete/sli-rac.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: shopathome.resultspage.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 16 Sep 2016 21:49:38 GMT

Server: Apache

Last-Modified: Wed, 10 Aug 2016 03:47:48 GMT

ETag: "ba5-539af8345c100"

Accept-Ranges: bytes

Cache-Control: max-age=432000

Expires: Wed, 21 Sep 2016 21:49:38 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 957

Keep-Alive: timeout=2, max=100

Connection: Keep-Alive

Content-Type: text/css
...........VM..:...W.&..R.H.$..i7..z.....}..16.MB...?..!.0.V.h....8..k
..........`a...M..ZT...(QY.9.R.#.JB.3D..&........=.....3.$.K.9...R%...
.d.......L.J..).4..i.'Js.dY....<.q.....3.0Quhr...D...YF.1c..oNy.n..
....6..ce...q1.1.../......O..l^.q...e...<..AP.{.Z.h?..Be..P.....>
;.B....YO...1U.....R.W.Z.....k.....J.Gd.PZ.....r7.......d.r.m...(..|.d
..D.^^~.....6.|".c..(xs.....6.e....... .s...so...r....B....\...3.-!.2~
zz.Q...%t=n.~K......<.....a..7.=Xd4..*x.........*Mh@czWE.\...6'^<
;C..>.(X.<L3...h.4m..Nv..ng..v...{D&Z..>.x..l.....M...."?....
BQ....v"".........[| 9r.2.j1..}0h..m........w[..4...~U.n;.h........y..
g....^...|....w.9.[l.V...k..E..|n...<MG'`..j..n="1.{../...........B
...H....w.s.qU....j...W_u..O...-.?.......BS'....u.#.....>;.O..{4...
..G..8.*(......c".{...2O.%/..>| .#....2.....J.mwe..yg..S. .Q%.<.
^......JPL$.C....T.R9..k.. ..Jfi..N..=.NB.m..._.%.%.^... ./.C..BSR./J.
.]..VM.G..K.....7.."..F.v.....~.,....P...5!..tWK9.m....~..tG9....r.]..
G//...]......HTTP/1.1 200 OK..Date: Fri, 16 Sep 2016 21:49:38 GMT..Ser
ver: Apache..Last-Modified: Wed, 10 Aug 2016 03:47:48 GMT..ETag: "ba5-
539af8345c100"..Accept-Ranges: bytes..Cache-Control: max-age=432000..E
xpires: Wed, 21 Sep 2016 21:49:38 GMT..Vary: Accept-Encoding..Content-
Encoding: gzip..Content-Length: 957..Keep-Alive: timeout=2, max=100..C
onnection: Keep-Alive..Content-Type: text/css.............VM..:...W.&.
.R.H.$..i7..z.....}..16.MB...?..!.0.V.h....8..k..........`a...M..ZT...
(QY.9.R.#.JB.3D..&........=.....3.$.K.9...R%....d.......L.J..).4..
<<< skipped >>>

GET /autocomplete/sli-rac.config.js?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: shopathome.resultspage.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 16 Sep 2016 21:49:39 GMT

Server: Apache

Last-Modified: Wed, 10 Aug 2016 03:47:48 GMT

ETag: "83d-539af8345c100"

Accept-Ranges: bytes

Cache-Control: max-age=432000

Expires: Wed, 21 Sep 2016 21:49:39 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 909

Keep-Alive: timeout=2, max=99

Connection: Keep-Alive

Content-Type: application/x-javascript
...........V.n.8.}.W.DaH.L...!..}X`...oiZ0.XRJ..I.kH...P. q..`K.......
....\.Up.T..Q.....Eo..I........?_v]....^XHY.\...-u-\.....F:[..x..l7.ZI
-.....Fd...F..m;.D......{.c..%,.....K.....q...........u.=...u,..\..,..
.6q..~W..9.^....F..J.f....v..qo....1.D...._.5>x!....5....~..PyD..M6
.........K.KP..z.t.".~..$.X...z.6.:.t;..#2e:..&l.N....Rd.._..:..h...(.
LU.tF..`.>H )`....a...<.$kE....z.'.." .* ..6l.2oFCovCf].....\...
 ....v<.kc.F...`q.s..-.0m-H.\..H..........o.....#..f..7.g.?}.._...#
#...v.......l..kP.....HA..4e<...*...J.{~.. ..3.....n....zZ#Q..1..l"
...|.Q..../[email protected].~...!.G4.
.6........~..`.jT[....~....8..0X\.-.{v.s.......k..X..}%..tx%.u.W?&J .#
....H.............[:#..fP....i..c0..S..oF.Nb.1...61....r.DI&..........
.........x..2.e_}..09O....$.....P.>....%.B..#.^Z......8...Y.....4..
4.2_.`L.f...%`..~.7...V..=.L..,.......E......E*.s..5.i...r..lFB.G-./..
k../e-.}.....=...HTTP/1.1 200 OK..Date: Fri, 16 Sep 2016 21:49:39 GMT.
.Server: Apache..Last-Modified: Wed, 10 Aug 2016 03:47:48 GMT..ETag: "
83d-539af8345c100"..Accept-Ranges: bytes..Cache-Control: max-age=43200
0..Expires: Wed, 21 Sep 2016 21:49:39 GMT..Vary: Accept-Encoding..Cont
ent-Encoding: gzip..Content-Length: 909..Keep-Alive: timeout=2, max=99
..Connection: Keep-Alive..Content-Type: application/x-javascript......
.......V.n.8.}.W.DaH.L...!..}X`...oiZ0.XRJ..I.kH...P. q..`K...........
\.Up.T..Q.....Eo..I........?_v]....^XHY.\...-u-\.....F:[..x..l7.ZI-...
..Fd...F..m;.D......{.c..%,.....K.....q...........u.=...u,..\..,..
<<< skipped >>>

GET /install/setup5200.cab HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: VVV.shopathome.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Mon, 01 Nov 2010 21:15:16 GMT

Accept-Ranges: bytes

ETag: "0a19e197acb1:0"

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web01

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Fri, 16 Sep 2016 21:49:18 GMT

Content-Length: 485875

Set-Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; expires=Sat, 16 Sep 2017 12:15:43 GMT; path=/; Domain=.shopathome.com

Set-Cookie: incap_ses_184_621395=CyzDI5S/yE7aBwxoRuWNAt5o3FcAAAAAc7A8Yh5UXncEZhB5BMh8BA==; path=/; Domain=.shopathome.com

X-Iinfo: 8-70085968-70085825 2NNN RT(1474062558207 1) q(0 0 0 2) r(2 2)

X-CDN: Incapsula
MSCF.....i......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /install/toolbar5200_ff.cab HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: VVV.shopathome.com

Cache-Control: no-cache

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; incap_ses_184_621395=CyzDI5S/yE7aBwxoRuWNAt5o3FcAAAAAc7A8Yh5UXncEZhB5BMh8BA==

HTTP/1.1 200 OK

Content-Type: application/octet-stream

Last-Modified: Mon, 01 Nov 2010 21:15:04 GMT

Accept-Ranges: bytes

ETag: "0fcf1d997acb1:0"

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web01

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Fri, 16 Sep 2016 21:49:19 GMT

Content-Length: 358086

X-Iinfo: 8-70085968-70085825 2NNN RT(1474062558207 1597) q(0 0 0 -1) r(1 1)

X-CDN: Incapsula
MSCF.....v......0.....................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
..................................................................
<<< skipped >>>

GET /js/autocomplete/sli-rac.stub.latest.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: assets.resultspage.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Expires: Sun, 18 Sep 2016 18:27:19 GMT

Last-Modified: Thu, 04 Aug 2016 21:47:19 GMT

ETag: "33f5-53945e4e087c0"

Cache-Control: max-age=432000

Server: Apache

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 4917

Content-Type: application/x-javascript

Date: Fri, 16 Sep 2016 21:49:39 GMT

Connection: keep-alive
...........Z[s.8.~....9*2.)).LfI...qjS......=ekR .I.S.BR..K.}.q!A].9U.
./....F./_78x......Hf..z6..`]..g].../J...;l...Dq......x.....,fU.g.z.E.
.....9/.(..".WU^...oi.....G.rV....0..Z?.....yU-..../[email protected]...
.......].jUd.c..e.. ......U..Z.yf..*.%..7......V....}.....&fI5_.n./..R
X(...../...L..A...`[email protected]../..P..."...R.lU......*....V......E......A
........t.<..U..yTjP....;VXa...OY.. V.x....]..2..p..'.yeIV...l6..X.
.14r..z....s Ag...c.....^n63.g...w.z..l........iJ..c......).U.....l&.,
H...iD,.x.z...".d..-T...K..BC.<.c~.^r?..#).....h:...HM!.Q..|j.....A
p.%G/dv......0M..:.'i.3.;2.t..`l3'......p...s....tM.....;./j...f.>m
..:.4.B..).0I.jM94..\.l../.2O..g.....L:.%~.|....(.0.j....P.p...e.*K...
.....f..........mR.|..1..v|\j..8..o#..x;...;..;....U.....c.......m....
.8.V..J.QGH.e...$...hM.~L....g.....M-......P..I..k..q.8 w.....}......Q
Y^...$...4..=.Ky...#.z.d...<.....v..2/.....2OW.......p8\>.x..._.
.> .b....<N.}.{.H...>Y>8....4......?../...d.A.A....$u.5[.y
..C.G...<./.........s.b._......S8F.....g....e...t..).[.1......z.j.5
..f..!...k..=.....Y..x.....p......f.5..||F..k..Y..1&....q..Mg...U.].^_
../`.6.....N....,X.p.2........]V.3..x.w.0..3...>...p....,... ..N..V
7v..K....p6.7.!.)...E]..A...U.U.........n..3[.........-(..T.!...30..!.
$K.....W.".'..(] `b....,....wI|1..C.\O.....rUa'....-.;.7K/[email protected]....
.^r....,....yP.h...a....\.K0.i...g3P./.......s.d..Z....."..d..rn.:....
o....zLu.<u.8q.TE.r.*P.n.d.-.....0.......3]....V.\. $..8.l.Y..W0...
d...O.h.Z.....`$.......n}...!.q.iz.4.. .....Z......f0...F;........
<<< skipped >>>

GET /utag/shopathome/main/prod/utag.sync.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tags.tiqcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 16 Sep 2016 21:49:36 GMT

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Accept-Ranges: bytes

ETag: "1473706775"

Cache-Control: max-age=300

Content-Encoding: gzip

Content-Length: 5797

Content-Type: application/x-javascript

X-HW: 1474062577.dop017.fr7.t,1474062576.cds021.fr7.sr,1474062577.dop010.am4.t,1474062576.cds029.am4.c,1474062576.cds021.fr7.pr

Last-Modified: Mon, 12 Sep 2016 18:59:35 GMT
...........[k{....>."......&..l..<..t.Z(..&''.8Jkp. ......wI..I.
......-KK...."wwW.0...V..K..0i......q.e7"...^.w.?...hp..........F.g..E
..SC.....C..Z.I.:..Y..g\^.Y...;.E..T..my.....w ..%.z.<;...Er._.bUuU
..K..2.->,.H.V../.........:.I...2.g....yMY..>...M......DKS...(W.
......ol..U5%k.c5Yy. LX..tD...g.)[email protected],&...^...Y.0..4..@Y.,x
:..U.N.X...S.t<%on.k.].u.o..*:w..U..z..^q ...ED...V~....... .<.z
......l:.h..P...4..m.y.......a)/.....7g..Z.o........3....R..m?.%.:....
..$q9t.....,eK..A......nWu.E...n..&/.ez."N......t......g..U.,.9..4..i.
lk..E,....L.......$S2....h*.....Y.55.....K.v.v....%\...a....C3a...O..)
7.j..;.7.r.....tc?.<..D,..,...4.....2.|w#..;..!.......0h.["..F"....
.9.......&.....?.......X.^.................@..?...........r.i...&.u:O5
...m%.....c.G.....c.$.g..l...M..).F.X..D.....5.&.h.Qa8...|..f..z...$%.
#[email protected],k.K..L.?.h.F`e....).....\.l.0...v...'.1..'.xL..1>.2&
gt;......x......g..D....x..*[email protected]@...........h.....<.Y.
\...8#\.i..D...A.U?.%...\.......Fl....'|..c..>....... ..QB......H..
.3E#........_Al.z.P&..$6.X.uaaq......3...P....H...._../."....D`..V-.Z.
..0B....W....da.u.....F.mL#.`......p..w..6&>.v..)..6..e...4.Z`E...j
. ..1...m..*.P.C.|g....0.'4........R..........^NKr......0....*...7p..P
.f.~x..g...{.Z..6.}..c[.e`m....(..x..(.<.1...hj....Q?...oh,..@..=p.
.].....$.Ht........lD.{....%....lQ.w.Vhu}.R.....T......oK(O.m........n
.C...8D.(:.......e/.g......Q...H....."'n..Jv...tX.jEz.!............L..
.$.".\.......:.Ac......Q3.,..b..9..4..V.Bxb....d..).X;..#0.-..&..!
<<< skipped >>>

GET /RequestHandler.ashx?MfcISAPICommand=installstatus¶m=à

frtXFiqIX4J2ckkuYnx87dThQusjeLs04yrY7GEpj9SKnGH86Z9hrR7efdQVWyPA6MJPne3LiNlCNJJQpmZRCJyR2y9pYgp_ElULUIzpSnWZDELceUBO7Uv5toWKl9cqYkBuWdnBF2aYajRze-47ZQRfceFirJMefQXemQtvbhvq7hah0Qo7o1yW3-1pajwaFiECmKRdGsaLxnCw5uKlu5gsFm128iGhHq0DGUGfhkKMUW1zSHPQ0Ee7ogFVD2KS5Bgnz9IsR6xjoBryXfdQsoAA_G-wR3wGBHJBr0nu0_6k2sOoOyO0KF40-Lz1XMzsWDUs9njEywHC3ks1nEKzxpzJm-QQn7kI2p93i4wbJq_YCJwtOneY5vJ5NU6653Rhwom2o4mAUYl5xMhqNRlc6fRdYodVHA9o5-p_yZbWWUyibUht6aHI1xrMh5voOxlmnL4sAujTfUu0TkWDk_IR5TG5RjlFPo5tRgV9ObbyQq0pTjQo4WgZ1Feh6ze5_iKcDfEOVMqHWOEfMeYBtknLMO4WiG9-vgfYdPCE0yXE_MQn8pIhScO6gULIogkkNbR-Qmv62EDfxycag9T3K3VZNx4ZDAjoPWQfb7PWSTCgvSM1RsecFva6DMeIFJEb6Yh2 HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Cache-Control: no-cache

Cookie: visid_incap_621395=JAkSghdBRaqOO/ Ka1a3Sd5o3FcAAAAAQUIPAAAAAAD2LTN3PsaII2kfKW a0eUz; incap_ses_184_621395=GoLWPdzcfVTkNQxoRuWNAuho3FcAAAAAO4NkfS1u68XWq3f3M506wQ==

HTTP/1.1 200 OK

Connection: close

Date: Fri, 16 Sep 2016 21:49:32 GMT

Server: Microsoft-IIS/6.0

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Farm01

Etag:

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 72
...;.E......n.R...[:.4. .|"^..:.0.....I..-.X......].w...w{.....P......
....

GET /Content/SiteCssBundle?v=9 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=http://discounts.shopathome.com/Discounts_and_Coupons/GoSearch.aspx?refer=76258&st=Toilet+Paper&A=SuccessPI&owner=nonbundle&ErrorInfo=&ErrorLevel=1&GUID={4AB058F7-2007-43EE-9FFA-1E1D9C2CC718}&ae=no&source=76258&subsource=SEPDSE&setupguid={c462bc39-9cee-47aa-b97e-420b260526fa}&setupcid=34539780&cid=34539780&refer=000026016&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

Cookie: visid_incap_924498=zawiWed Rp6nzd19Ox7yBOlo3FcAAAAAQUIPAAAAAADwhSVBFYzL6mw9DqHKK7Sc; visid_incap_924504=JnhNip0SQTKCNiHlkk03VvFo3FcAAAAAQUIPAAAAAAC0VL2TG7sKy6Sm7T5dD4Mx; incap_ses_325_924504=MVCCNJySzijazA6lLaKCBPFo3FcAAAAAfkQSn64/OBxavdYF2frzJw==

HTTP/1.1 200 OK

Content-Type: text/css; charset=utf-8

Content-Length: 77007

Content-Encoding: gzip

Cache-Control: max-age=604800, public

Expires: Fri, 23 Sep 2016 21:49:37 GMT

Date: Fri, 16 Sep 2016 21:49:37 GMT

X-Iinfo: 0-8758277-0 0CNN RT(1474062577885 2) q(0 -1 -1 -1) r(0 -1)

X-CDN: Incapsula
..............#.. .*.* ..i.......i.h5.[i.4..Y..[.2.I..5..>D..>.=
.....y.}..o.... .U..S..........p`u.n.....Yf....S...NY...Yg[vN..S.\...d
.......$.f......./......6;..wO.5;...M...u^.....7e{.~Yd..z.....E{....c{
Ud....q.>...z..e..e.P..y 0.......>?.7.........E......q.r,...A4.w
...f. :...C!..6.l.~.=........n.....`.q.).z.P...b.*./......u......b .O.
..f.y..Yvc.?......X.N..).}. 8....B...I6.y5...<.O....|........~..;|j
...".... l.....&g....|......M..>..-....(..)-.334.........gH...2.-..
...m.$.r.m6..D.qy.T....x.n..l.3;......c!.#:....t...:.a.../...n*.../...
G...5@OG1a._$.....'=.W=............x.l.....$.].^.......f..n....k);....
^......nE.........^...h..f.W....,z.k.w....?..|.....-...,.E..z.....0.?.
...<y...z.)l...E-U5....VOQ.!..."....C..7.......XR..|.C.]....!d.C..F
...F2[.....a..l=.&.. %.4.?...........9.JOOj.......w;.K.z.w7Yf.,...&W.z
.3t'..m..?.U..Y.<.z&v.7rI.Y.V.'....;o....O.:..EZ.<.w.8.Qx.-`..!\
.?4.....?.r...b......x..`i.../..$c.u9Z%/..c&...Gj.....i.Z...~..[.z#V.[
.........I.;J...ro../...f.[.x....n.'9{..-V.&;....ef..f`......7..."_g..
Q,.....[..\.,.._....x.v'.;......r.9|.L.".m.....#.$..G-..\...OO.RL....O
oZ..ie...[Y......(...... .../..)..|q\.....v.o........D...........T....
.b(...P.!O...Z..T6..V....GG...$..!{b.e.6.....O .........._...J..S.&...
./W]...n..f...y..w.>4..X..*.[bJ..V.E.L..h~.=w.b......?.......B2w..w
.n.y.ax...n.j.h4.5d.......i%[email protected].=..W..R0J.C.
Yg..Jl-......_...I[...Z6.9..a/.......,..(5....s....n..\g.6...R2..%...n
.<.[. .?3fJ..^1....T...@*....._`[email protected]<..3.9iM[..b.S:..2.
<<< skipped >>>

The Trojan connects to the servers at the folowing location(s):

.text

`.rdata

@.data

.rsrc

PSShh

FtPh

SPSSh

t0Ht(Ht.Ht'Ht

Ht<Ht.Ht%

~!SSh

Yu%C;

<9~^<_tZ<-tV<.tR<*tN<:tJ

PVSSh

t.VhluJ

VSSh&

SSh|~J

SSht~J

SShl~J

SShd~J

SShT~J

uË;U

YYSSh

Yu.Vh4DF

YVSSh

$%&'()* ,-./0123456789:;<=

VERSION.dll

SETUPAPI.dll

WININET.dll

MFC42.DLL

MSVCRT.dll

_acmdln

GetWindowsDirectoryA

GetProcessHeap

KERNEL32.dll

EnumWindows

EnumChildWindows

MapVirtualKeyA

USER32.dll

GDI32.dll

RegCloseKey

RegOpenKeyExA

RegCreateKeyExA

RegDeleteKeyA

RegEnumKeyExA

ADVAPI32.dll

ShellExecuteA

SHELL32.dll

ole32.dll

OLEPRO32.DLL

OLEAUT32.dll

MSVCP60.dll

ERROR: Event WaitForUnhookAll (%d)

{E03777A2-C73D-4a58-A4FB-28F813CA2583}

[INIT]: XML maps loaded status = %s

[INIT]: CheckSite timeout set to %dms.

[INIT]: FireFox status = %s

FireFox disabled

FireFox enabled

MyAccountUrl

[V] Module %s version is %s and the Agentprefs version is %s

[P] Skipping InfoPop#%d, Opt Out Detected (%s).

[Mouradeling] Url "%s" matches regex "%s". Mouradeling on.

[Mouradeling] Reset timeout to %d sec.

[PBM] pid(%d) = Unsupported: AOL.

[PBM] pid(%d) = Unsupported: Mozilla.

mozilla.exe

[PBM] pid(%d) = Unsupported: Netscape 6.

netscp.exe

[PBM] pid(%d) = Unsupported: Netscape 4.

netscape.exe

aexplore.exe

aol.exe

waol.exe

[PBM] pid(%d) = Firefox

firefox.exe

[PBM] pid(%d) = Internet Explorer.

iexplore.exe

[PBM] Browser Process for pid(%d) = (%s)

[PBM] Failed to get module file name for browser check. (%d)

[PBM] 0 modules returned by enum modules for %d. (%d)

[PBM] Failed to get enum modules for %d. (%d)

[PBM] Failed to get process handle for browser check. (%d)

%Y-%m-%d %H:%M:%S

%s_%d

[OO] OptOut for %s at %s

[OO] OptOut for %s and %s at %s

[OO] OptOut for %s removed.

[OO] Remove all OptOuts %s (%d).

%Y-%m-%d

Software\Microsoft\Windows\CurrentVersion\Internet Settings

Failure to write %s to %s. (%d)

%s,%d

[M] Upgrade has run more than %d times already. Skip Upgrade.

Clearing upgrade flags: %s

[XPD] Popup %s impossible: %d pops already today.

[XPD] Popup %s impossible: %d pops already in last %d minutes.

[XPD] Failed to find XPD type %s. Allowing.

Rule %s: Popup(%d), Redirect(%d), DoSlider(%d), AdServe(%d), OldPop(%d), %sInfoPop(%d), HideRedirect(%d)

&global=click.linksynergy.com&afsrc=1

&URL=

&tim=%d

GR_check_site.html

http:

CheckSiteUrl

TTUrl

[A] Load result: http(%d): %s

[A] Error %d downloading image. But image is cached, using cached image. Returning 304.

[F] Copying image from "%s" to "%s"

[F] Load Image File: %s, Cache date: %s

[F] File: %s, Next check date: %s

%a, %d %b %Y %H:%M:%S GMT

[F] It is new BANNER/IMAGE %s, force download.

[A] Load image: %s

[A] Agent tracking %s/%s

agenttracking.asp

[A] Search tracking %s

/agent/searchtracking.asp

searchtracking.asp

[A] %s%s%sTracker result: http(%d): %s

Upgrade: Unable to report (%d,%s): poorly formatted or missing UT url: %s

[A] Upgrade Tracker result: http(%d): %s/%s

Upgrade: Reporting result(%d,%s) to %s/%s

Upgrade Result Report: Reporting result(%d,%s) to %s

[A] %d - Unknown error

[D] %s Url has changed. File is necessary to download. (Cache off) (%s->%s)

[D] Storing CID: %s (%s)

CustomerID funky. Changed from '%s' to '%s'

setCustomerID: '%s' seems to be in error. Filtered.

[D] Registry CID: %s

[XPan] Regexp_exception: (%d) %s

CHTTPLoaderThread

[A] HTTP Loader thread OK

ShopAtHome.com Toolbar

HTTP loader thread. Exit instance

0.0.0.7

[M] Opening install page %s

[M] Opening feedback %s

[S] Parameters: %s

[S] serviceRequest(%s) Command: %s

&os=%d

uniqueBundleKey=nonbundle

uniqueBundleKey=

updateURL

&updateURL=

validateURL

&validateURL=

{X-X-X-XX-XXXXXX}

PopupPassword

regpass=

HKEY_USERS

HKEY_LOCAL_MACHINE

HKEY_CURRENT_USER

HKEY_CURRENT_CONFIG

HKEY_CLASSES_ROOT

Unknown command %s

Clearing cookie %s

Setting cookie %s to %s

Clearing ini %s

Unexpected # of parameters for %s: %d

Setting ini %s to %s

[S] UID: %s

[S] IP: %s

[S] Country: %s

[S] Registry query: %s

[S] Setup filename: %s

lsp_setup.exe

[S] Toolbar Update URL: %s

ToolbarURL

;ffTbUrl=

;toolbarURL=

[S] Update Path: %s

[S] Update Domain: %s

;updateURL=

[S] Auto Upgrade: new value: "%s" enabled: "%s"

[S] Update enabled: %s

[S] ValidateURL: %s

;validateURL=

[S] Validate enabled: %s

[S] NumberOfDaysNextUpdate: %s

[S] NumberOfDaysNextValidate: %s

[S] NumberOfDaysNextHearbeart: %s

[S]%s

%d-%d-%d %d:%d:%d

[XmlDataGC] Deleting Item. 0x%x count = (%d). Delete Count = %d

[XmlDataGC] 0x%x count = (%d). Delete Count = %d

[~CAlert] (0x%x)

[BD] Destroying Xml Data. 0x%x

2000-01-01 12:00:00

2020-01-01 12:00:00

[BCEXML] Parse Status = %s

[BCEXML] Memory Exception parsing XML: %s

[BCEXML] Error loading XML into parser(%d).

[BCEXML] Parse Result = %s

//Bce/tb/maxurllength

urls

urlsec

*shopathome.com,*shopathome.sah.com

[R] Global Ignore found: %s

[X] Specific Suppress "%s" found.

14,%s(%s)

[X] Per Merchant Suppress "%s(%s)" found.

[X] Global Suppress "%s" found.

[B] Rule %d not found. Default = %s

[B] Rule %d = %s

%s xmlData decRef(%d) = 0x%x

%s xmlData addRef(%d) = 0x%x

[CBceXml::releaseData] decRef(%d) = 0x%x

[B] Storing new Xml Data. 0x%x

[B] Parse Status = %s

[B] Memory Exception parsing XML: %s

[vectorSahGC] decReference (%d)

.PAVCSahGC@@

.PAUXmlObject@XML@@

.PAVBanner@@

.PAVCAlert@@

.PAVCCouponAlert@@

UrlEx

[B] Deleting duplicate ID: %s %s

HotImageUrl

ImageUrl

[AlertResponse] ID=%s [%s EXIST] Type=%s Text=%s ImageUrl=%s

.PAVSahSearchResponse@@

[XD] Skipping Global Suppress type %d: %s

Program[%s] has exe [%s]

Data = %s

ChildNode[%d]: Node Type = %d (NODE_CDATA_SECTION = %d)

Data= %s

[CXMLParser::CreateNode] AppendChildToParent failed: %s

(0x%x): %s

Unsupport type

[D] ERROR (%d)! %s loading failed.

[D] OK. %s. Last update %s

[D] OK. %s has not been modified.

[D] OK. %s was downloaded.

hXXp://

[D] No %s Filename. Ini file either blank or not writable.

[D] XML is invalid or damaged, exception thrown by CodeBuffer in GetFile: %s

[D] OK. Bce Xml. Last update %s

[D] Validate Path(b): %s

[D] Validate Domain(b): %s

agent/bce.sah

[D] Failed to copy %s file from %s to %s. [%d]

[D] Upgrade copied %s file from %s to %s.

[D] Bce specified skin file as: %s

[D] Error updating file %s: %d

SelectRebatesDownload.exe

FFToolbar.txt

agent/agentprefs_.sah

VVV.shopathome.com

[F] Error copying %s to %s. (%d)

[F] Getting update file "%s" from "%s/%s"

[F] Install Tracking: %s

.PAVCException@@

[F] Exception thrown by CodeBuffer in serviceQuery, %s

[F] Decrypted buffer: %s

[F] Buffer Size %d is larger than remaining buffer %d.

smartupdater/smartupdater.dll

cidUrlPages

cidUrlSites

[F] OK. preferences loaded. %s

[F] Exception thrown by CodeBuffer reading Prefs, %s

[F] New cab needed, cab dog (%s) version does not match running dog.

[F] New update cab downloaded: %s

_.exe

[F] New toolbar cab needed, cab toolbar (%s) version does not match running toolbar.

[F] Unable to create XML temp file, %s (Error=%d)

[F] exception thrown by CodeBuffer in GetFile: %s

[F] XML Merge failed: Error opening file %s. (Error=%d)

[F] Opened %s, size=%d

[F] Failed to open. Creating file %s

[F] Opening file %s

Error Parsing Temp XML. Count = %d. Reloading bce.

Error Parsing Temp XML. Count = %d. Resetting count and reloading bce.

%s entry found, but file %s does not seem to exist. Removing entry.

%s update failed: file %s seems to exist. Using %s entry.

[A] %s Upgrade Complete: %s New Version = %s

%s entry missing, but file %s seems to exist. Using %s entry.

[A] %s Upgrade to Uninstall Key Complete: %s New Version = %s

Deleting Old Uninstall file %s (%s)replaced by newer uninstall file %s.

SAHUninstallKey

FFToolbar\chrome\skin

[F] Loading SelectAlerts Failed (%d)

[F] Loading SelectAlerts: %s

Removing Excess %s: %s

[F] %s

[processSkinDirectories] Failed to open file %s. (%d)

[processSkinDirectories] Processed skin file %s.

[processSkinDirectories] Error reading file %s.

.SKIN

[F] Skin Directory[%d] = %s (%d)

[F] Skin[%d](%d) = %s Url = %s

[F] Signalling Toolbars: %s

[F] SelectAlerts saved in: %s

%xmlv

Only was able to write %d/%d bytes of Basis Xml file: %s

Saved BasisXml file: %s

*.DYM

[F] File %s is not found in %s.

[F] Looking for unused files in: %s

DefaultUrl

[F] File Added To Toolbar Cache List: %s

[F] Load. Image%s, <%s>, URL: %s, Local: %s

FFToolbar\chrome\skin\

[F] DownloadAndCache: %s

[FFToolbar] Done Processing Command %s

CmdProcessed

[FFToolbar] Command = %s

[FFToolbar] Exception parsing %s

[FFToolbar] Deleted %s.)

[FFToolbar] Error Deleting %s: (%d)

[FFToolbar] Error allocating %d bytes to read %s

[FFToolbar] Error Opening %s: (%d)

SelectRebates.ini

ShowIEToolBarForAll: No IE Exists, adding %s=1

{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}

[A] Show FF Toolbar added toolbar to %d Firefox Profiles.

SelectRebatesSkin.dat

.PAVCAlerts@@

.PAVCBannerAlerts@@

.PAVCSearchAlerts@@

[U] Exception thrown by CodeBuffer, %s

[F] OK. Preferences. Last update %s

[F] Prefs location changed, downloading again: %s %s

[F] Validate Path(a): %s

[F] Validate Domain(a): %s

[F] Exception thrown by CodeBuffer in GetPreferences, %s

[A] Exception thrown by CodeBuffer in ParseXmlFile, %s

[F] Waiting time %d second(s) for next %s...

[F] Repeat counter %d

[F] AttemptDownloadPrefs Success. (Event 0x%x)

[F] Setting up scheduler on %d seconds...

[checkNextUpdate] Retry mode finished: %s

[checkNextUpdate] Retry mode timeout %d second(s). Attempt counter: %d

[checkNextUpdate] Retry mode upto 10 times started at: %s

[checkNextUpdate] Update enabled: %s

[checkNextUpdate] Update Skipped: AutoUpdateFailedCount=%d > %d

[checkNextUpdate] Update needed. _retryMode = %s

[checkNextUpdate] InstallMustValidate enabled: %s

[checkNextUpdate] Validate enabled: %s

[F] Upgrade Path: %s.

[A] SahUpgrade RUN_ONCE key found.

Software\Microsoft\Windows\CurrentVersion\RunOnce

[A] AutoUpgradeStatus is %s, but it can not be cleared so no pop.

[A] Report AutoUpgradeStatus: Auto(%s) Status(%s) Result(%s).

[F] Error upgrading (%d): %s

Failed to extract toolbar cab name from ToolbarURL: %s

[F] Iterate Toolbar Cabinet Failed. Unpacked %d Files. Error(%d %d)

[F] Download Toolbar File (%s)(%s) to %s

Toolbar Upgrade Failed: Unable to find windows temporary folder.

[F] Error launching updater (%d)

[F] Starting updater: %s

[F] Iterate Cabinet Failed. Unpacked %d Files. Error(%d %d)

[F] Path: %s

[F] Server: %s

update911.exe

setup911.tmp

Unable to find windows temporary folder.

0.0.0.0

[F] SelectRebatesUpgrade signal unexpected value = %s(%d) (Error=%d)

[F] SelectRebatesUpgrade Failed: CreateProcess failed (%d)

[F] SelectRebatesUpgrade: Launching %s

[F] SelectRebatesUpgrade. Execute newer SelectRebates (%s). (Upgrading from %s)

[F] SelectRebatesUpgrade Failed. Unable to find new SelectRebates file %s.

[F] SelectRebatesUpgrade. ERROR: %s found on the command line. Infinite Upgrade Loop Diffused?

[F] SelectRebatesUpgrade. New SelectRebates (%s) running.

[F] SelectRebatesUpgrade. SelectRebates running, but version (%s) does not match expected(%s).

[F] SelectRebatesUpgrade COMPLETE! Deleted upgrade file %s

[F] SelectRebatesUpgrade. Failed to delete upgrade file %s. (%d).

[F] SelectRebatesUpgrade. Error: New and Old SelectRebates have the same filename: %s

[F] SelectRebatesUpgrade Failed. Unable to parse module name %s.

[F] Removing %s and %s temp directories.

[F] Delete Upgrade File: %s %s

[F] Delete EulaUpgrade File: %s %s

Failed (%d)

[F] Checking for upgrade files to remove. UpgradeStatus=%s

[F] SelectRebatesUpgrade Copy Failed (%d)... Try again later.

[F] SelectRebatesUpgrade Complete. New file %s copied. Status=%s

[F] SelectRebatesUpgrade. Replacing %s (%s)

[F] SelectRebatesUpgrade. Copying New %s (%s)

ShowWindow = (%d): %s

CCheckServerDialog::MyCreateFont = 0x%x

CCheckServerDialog::OnPaint::serverUp(%d):%s

%s is temporarily unavailable for cash back rebates.

%s is again available for cash back rebates.

[P] Skipping Popup: MID = %d, PopupID = %d

[P] Skipping Older Popup: MID = %d, PopupID = %d

[P] Rule set: DoRedirect = %s, DoPopup = %s, DoSlider = %s, RedirectSuppress = %s (%s)Pop(%d) (Rule: %s)

[R] Rule %d for MID=%d is not defined

[R] Upgrade Rule %d for MID=%d is not defined

[P] Upgrade DoPopup = %s %sPop(%d) (Rule: %s)

[R] Dog NeedsUpgrade. Rule %d for MID=%d.

[P] Rule ID: %d

[P] NeedsUpgrade: %s

[P] Current Browser Has A visible Toolbar: %s

[P] DisableRedirects user: %s

[P] Stealth user: (%s) = %s

[P] Failed fo find popup (%d).

[P] Error loading InfoPop %d for mid(%d). Popup %d not found.

[P] Building Popup for %d: %d

[P] Image is not set for popunderID=%s

[P] Image is not found for popunderID=%s

[P] Building Popunder for %d: %d

<p><a href="app:Close"><image src="hXXp://

<forgotPass

<INPUT TYPE="image" onclick="javascript:registration.action='app:ForgotPass';"

<INPUT TYPE="image" onclick="javascript:registration.action='app:register';"

<inputpass

<INPUT TYPE="password" NAME="pass"

</pass>

<pass>

checkpassword

[P] Unable to write PopupHtmlFile: %s

[P] Do Secondary reg pop option is: %d

[P] Do initial reg pop option is: %d

Error-%s

[P] Do Donovan's Popup(%d) here for mid(%d): %s

XPDX(%d)

BLD(%d)

[P] Error building InfoPop %d for mid(%d). Popup %d replace failed.

XPD(%d)

NF(%d)

[P] Error building InfoPop %d for mid(%d). Popup %d not found.

[P] Building InfoPop for %d: %d

Mozilla

[PT] Warning: No version operator found processing popup.

Unable to create IE control container in PopWindow, Last Error = %d

Shell.Explorer.2

v=1,pid=%d,data=%s,%s

Unable to parse destination url: %s

Unable to open link in PopWindow navigate: %s

Unable to parse url: %s

PopWindow navigate: %s

[CWindowImplBaseT::StartWindowProc] pThis(0x%x) m_hWnd(0x%x) new(0x%x) old(0x%x) StartWindowProc(0x%x)

[CWindowImplBaseT::WindowProc] pThis(0x%x) ERROR!!!! UnsubclassWindow, m_pfnSuperWindowProc == 0!

[CWindowImplBaseT::WindowProc] pThis(0x%x) m_hWnd(0x%x) wndProc(0x%x)

[Luke's Debug] Toolbar HWND = 0xx

[Luke's Debug] Parent HWND = 0xx

Create POP Url!.

[~BrowserDataWrangler] rc=%d

[B] AdServe. Shell windows init %s. (result = %d)

[B] FireFox Document Complete CopyData: %d(%d)

[B] FireFox Document Complete

Exception in SaveFireFoxCopyDataContent

[M] WM_COPYDATA message. Type: %d

Unknown ItemID in Firefox data: %d

Error in Firefox COPYDATA. Data Overflow.

[B] FireFox COPYDATA %d(navPtr=%d, ver=%d)

Exception in ProcessFireFoxContent

[B] FireFox. Toolbar call

[B] searchIE failed to find a browser object: "%s" (0x%x).

[B] Creating new Attribute called: "%s".

Advise#%d-%s

[X] Deleting Attribute called: "%s"

[B] exception 2 thrown by searchIE. exceptionTrack = %d

[B] exception 1 thrown by searchIE. exceptionTrack = %d

[B] Browser FOUND. Top window: 0x%x, class: %s

[B] Checking HWND 0xx against 0xx in searchIE

[B] Window 0x%x was found by old code

[B] exception thrown by searchIE. exceptionTrack = %d

[B] Hidden browser FOUND. Top window: 0x%x, class: %s

[B] Window 0x%x was found by new code

[B] Found %i number of shell windows

[B] %s

Cannot get count. Try to get ShellWindows again.

MException trying to navigate same IE tab to: %s

[BrowseToUrl] Browse to IE tab (0x%x): %s

[IEEvents] DISPID_PROPERTYCHANGE - %s

[E] DISPID_PROPERTYCHANGE: LookupFailed 0x%x

[B] ExtraHeaders: [%s] URL: %s

[B] Headers: [%s] URL: %s

[E] DISPID_BEFORENAVIGATE2: %s

[E] DISPID_BEFORENAVIGATE2: LookupFailed 0x%x

[E] DISPID_DOCUMENTCOMPLETE: %s

[E] DISPID_DOCUMENTCOMPLETE: LookupFailed 0x%x

[IEEvents] (0x%x) %d

[IEEvents] (0x%x) %d %d, %d

[B] CBrowserEvents::toolbar. MAIN Frame URL: %s

[X] remove is removing attribute: "%s"

[X] removeAll is removing attribute: "%s"

[Mouradeling] Canceling redirect for 0x%x to: %s

Removing Mouradeling %d from _mouradelingList

BrowserEventsTimerProc(0x%x,%d,%d,%d)

[Mouradeling] SetTimer(0,0,%d,BrowserEventsTimerProc)

[B] Unhanded Exception in executeMouradelingAction.

[Mouradeling] Browse to IE tab (0x%x): %s

[Mouradeling] Cancelled: No source url.

[BrowserEventsTimerProc] Mouradeling %s(flag=%d). DC(#%d)-> pid(%d) mid(%d): %s)

[Mouradeling] Url matches regex "%s". Mouradeling filter on. Skipping DC. (%s)

MozillaUIWindowClass

MozillaWindowClass

mozilla firefox

windows internet explorer

[P] Error launching api pop: %d

[S] Start Search PopUnder #%s

[S] Unable to update SearchPopunderNumber. Skipping search: LastError=%d

S2> UniversalRequest response: %d

S2> Params: %s

[S] Search url: %s

[S] Search string: %s

[S] Search off, ignoring search term: %s

[S] Secondary Registration Delay %d seconds.

[S] Start session for: %s. %d second timeout then checking for next update

[S] Search: Search123 : %s

[S] Search Disabled: %s

[S] Search pop-under is restricted by Rule: %d

[S] Search pop-under is disabled. Enabled only for countries: <%s>

S2> Unable to update Search2Number. Skipping search2: LastError=%d

[S] Duplicate Search found: %s

[S] ProcessSearchEngine: %s

[S] FindWhat: %s

193.168.0.12

&mt=%s&ip_addr=%s

[S] Search123: %s

src="hXXp://

[M] LibraryHooked (%d)

[M] Hooking Skipped: Running process (%d) matches pid.

[M] Hooking Skipped: Process %d is already hooked (Lib Hook = 0x%x).

[M] LoadLibrary Install Process Hook: hwnd:0x%x tid:0x%x pid:%d

[M] LoadLibrary Install Process Hook Skipped: IE8 IS NOT detected (found explorer.exe instead)! hwnd:0x%x tid:0x%x pid:%d

[LibHook] Remote LoadLibrary %s: hModule=0x%x

[LibHook] CreateRemoteThread failed. 0xx

[LibHook] Found pre-existing DLL in Process ID 0xx, backing out

[LibHook] VirtualAllocEx failed. h=0x%x error=%d

[LibHook] Could not open Process = 0xx

[M] Injecting Hook into process id 0x%x

[M] Hooking Skipped: Process %d hooked itself!

[M] Toolbar Hook Detected: pidA=%d pidB=%d

[M] Unable to remove hook on pid %d, no hLibModule found.

[M] FreeLibrary result = %d

[M] Failed to CreateRemoteThread to unload hook in (%d)

[M] FreeLibrary Remotely run FreeLibrary in process handle (0x%x)

[M] OpenProcess failed. (%d)

[M] FreeLibrary Install Process Hook: pid:%d

[M] Browser Found (%s, %s) Post BEMessage_CheckWindow... enum HWND: 0x%x

[CCheckBrowser] PID = ] HWND = 0x%5x Class = s

[CBP] Image Found: %s

background-image: url(

[TBar] Regexp_exception: (%d) %s

[TBar] RegEx. UrlEx: %s, id: %s

[TBar] Regexp_exception search: (%d) %s

[M] UrlEx AlertRequests are off.

[M] SearchEx and UrlEx AlertRequests are off. Skipping RegEx.

[TBar] CCheckBrowser::RegExToolBar. No url terms.

[TBar] CCheckBrowser::RegExToolBar. Query %s, phrase: %s