MD5: 8850ce92474cdf9dc5892dfdc8f6f0b7
SHA1: 53daaabff56a70ea91e7c8ddd685cc7e11245f33
SHA256: ddbd6993031658456e194c537fcadeb24930d209769f73e7f63a0cff9df894f8
SSDeep: 6144:Jzg0RG1mo3Ehr4JMjQp7ndC2VdJeG2CPRgozxnTZMJY1HMNG2Czq2aWEAoRD5eXv:FNRQdEh/D2bgoFnTs8T2Cz1ucAy
Size: 738616 bytes
File type: EXE
Platform: WIN32
Entropy: Not Packed
PEID: UPolyXv05_v6, MicrosoftVisualC, MicrosoftVisualCv50v60MFC, MicrosoftVisualC50, Armadillov171
Company: no certificate found
Created at: 2009-10-13 00:23:28
Analyzed on: WindowsXP SP3 32-bit

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

regsvr32.exe:1088
ShopAtHome_Toolbar_Installer.exe:452
%original file name%.exe:1976
SelectRebatesDownload.exe:1788
SelectRebatesDownload.exe:1856
SelectRebates.exe:280

The Trojan injects its code into the following process(es):
No processes have been created.

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process ShopAtHome_Toolbar_Installer.exe:452 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\SelectRebates\FFToolbar\chrome\sahtoolbar.jar (601 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (4 bytes)
%Program Files%\SelectRebates\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (4 bytes)
%Program Files%\SelectRebates\Toolbar\CashBack.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\GroceryCoupon.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebates.exe (6841 bytes)
%Program Files%\SelectRebates\Toolbar\ReviewSite.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Scissors.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_24.bmp (6 bytes)
%Program Files%\SelectRebates\FFToolbar\install.rdf (1 bytes)
%Program Files%\SelectRebates\Toolbar\logo_HotSpots.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-icons.bmp (8 bytes)
%System%\config\SOFTWARE.LOG (6515 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\O6RDLOEQ.tmp (146 bytes)
%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll (5441 bytes)
%Program Files%\SelectRebates\Toolbar\logo.bmp (6 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-alert.bmp (1 bytes)
%Program Files%\SelectRebates\SelectRebatesApi.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\AddtoList.bmp (1 bytes)
%Program Files%\SelectRebates\FFToolbar\chrome.manifest (271 bytes)
%Program Files%\SelectRebates\Toolbar\i_magnifying.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\icons.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (2846 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRFF3.dll (673 bytes)
%Program Files%\SelectRebates\Toolbar\basis.xml (20 bytes)
%Program Files%\SelectRebates\Toolbar\sahtb-go.bmp (1 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (1 bytes)
%System%\config\software (4431 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (12225 bytes)
%Program Files%\SelectRebates\SelectRebatesUninstall.exe (1425 bytes)
%Program Files%\SelectRebates\SelectRebatesDownload.exe (673 bytes)
%Program Files%\SelectRebates\Toolbar\Blank.bmp (1 bytes)
%Program Files%\SelectRebates\Toolbar\Coupons.bmp (1 bytes)
%Program Files%\SelectRebates\SRebates.dll (673 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (0 bytes)
%Program Files%\SelectRebates\FFToolbar (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (0 bytes)

The process %original file name%.exe:1976 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebates_.exe (17138 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-wishlist.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_HotSpots.bmp (55 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\basis.xml (1347 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome\sahtoolbar.jar (3689 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\toolbar.ini (115 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\icons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-go.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (190 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo_24.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\defaults\preferences\sahtoolbar.js (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (2128 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\GroceryCoupon.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\chrome.manifest (271 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\O6RDLOEQ.tmp (291 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRebates_.dll (3624 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\ReviewSite.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\FFToolbar\install.rdf (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUninstall_.exe (7104 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Blank.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-icons.bmp (8 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\ShopAtHomeToolbar_.dll (13304 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-grocerycoupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\CashBack.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\SelectAlerts.dat (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (4703 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\I1L2C9J4.exe (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SRFF3_.dll (3553 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesApi_.exe (2804 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-alert.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\sahtb-restaurant.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\logo.bmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\i_magnifying.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Coupons.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\Scissors.bmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SahToolbar\Toolbar\AddtoList.bmp (1 bytes)

The Trojan deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\4QSMKB59.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\ShopAtHome_Toolbar_Installer.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\SelectRebatesUpdater.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.ini (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\I1L2C9J4.exe (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\O6RDLOEQ.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (0 bytes)

The process SelectRebatesDownload.exe:1788 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\4QSMKB59.tmp (460 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\toolbar5200_ff.cab (172089 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\setup5200.cab (235057 bytes)

The process SelectRebatesDownload.exe:1856 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpprf564sb6d2.tmp (1 bytes)
%Program Files%\SelectRebates\srtmpsqumu0meat1.tmp (460 bytes)
%Program Files%\SelectRebates\srtmpprffm9cv4ct.tmp (25 bytes)
%Program Files%\SelectRebates\srtmpgfild7283t3.tmp (221577 bytes)
%Program Files%\SelectRebates\srtmpprfvudis0su.tmp (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\installstatus.tmp (72 bytes)

The process SelectRebates.exe:280 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

%Program Files%\SelectRebates\srtmpsqulj430alb.tmp (6 bytes)
%Program Files%\SelectRebates\SelectRebatesBT.dat (16 bytes)
%Program Files%\SelectRebates\SelectAlerts.dat (7 bytes)
%Program Files%\SelectRebates\srtmpprf564sb6d2.tmp (2 bytes)
%Program Files%\SelectRebates\srtmpsqumu0meat1.tmp (4 bytes)
%Program Files%\SelectRebates\SelectRebates.ini (167418 bytes)
%Program Files%\SelectRebates\SelectRebatesB.dat (11518 bytes)
%Program Files%\SelectRebates\srtmpprffm9cv4ct.tmp (2 bytes)
%Program Files%\SelectRebates\srtmpgfild7283t3.tmp (9607 bytes)
%Program Files%\SelectRebates\SelectRebatesA.dat (6 bytes)
%Program Files%\SelectRebates\srtmpprfvudis0su.tmp (2 bytes)

The Trojan deletes the following file(s):

%Program Files%\SelectRebates\srtmpsqulj430alb.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprf564sb6d2.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpsqumu0meat1.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprffm9cv4ct.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpgfild7283t3.tmp (0 bytes)
%Program Files%\SelectRebates\srtmpprfvudis0su.tmp (0 bytes)

Registry activity

The process regsvr32.exe:1088 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\ShopAtHome\Toolbar]
"EditWidthcombo1" = "1"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\VersionIndependentProgID]
"(Default)" = "ShopAtHome.IEToolbar"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCU\Software\ShopAtHome\Toolbar]
"KeepHistory" = "1"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\HELPDIR]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\"

[HKCU\Software\ShopAtHome\Toolbar]
"RunSearchDragAutomatically" = "1"
"corruptedMsg" = "One of the XML files is corrupted or invalid. Press OK to uninstall."
"lastVersionMsg" = "You have the latest version of the ShopAtHome Toolbar."
"ShowExternalSearches" = "1"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\VersionIndependentProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper"

[HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}" = "00"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\FLAGS]
"(Default)" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\ToolBand.ShopAtHomeIEHelper.1\CLSID]
"(Default)" = "{E8DAAA30-6CAA-4b58-9603-8E54238219E2}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\ProgID]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"PopStop" = "Untitled Toolbar has blocked a Pop-up window"

[HKCR\ToolBand.ShopAtHomeIEHelper]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"autoUpdateMsg" = "New version of ShopAtHome Toolbar is available. Would you like to download and install new version?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0\0\win32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\ShopAtHome.IEToolbar\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"firstTime" = "1"
"ErrorMsg" = "Error"
"#EditWidthcombo1#" = "Widthcombo11"
"versionError" = "Can not find current version information."
"UpdateAutomatically" = "0"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\ProgID]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCU\Software\ShopAtHome\Toolbar]
"DescriptiveText" = "1"
"OpenNew" = "0"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"ThreadingModel" = "Apartment"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCU\Software\ShopAtHome\Toolbar]
"AutoComplete" = "1"
"closeAllWindowsForUpdate" = "All running IE Windows will be closed before updating the ShopAtHome Toolbar. Continue?"
"RunSearchAutomatically" = "1"
"toolbar_version" = "undefined"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"updateMsg" = "This will try to update the ShopAtHome Toolbar from the server. Continue?"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "33 74 B2 5B F4 75 16 3B 87 07 F9 E8 B7 A1 3B C7"

[HKCU\Software\ShopAtHome\Toolbar]
"toolbar_id" = "{B6FBC6B2-8C5B-4b9d-A0CF-1F57A961BE8F}"

[HKCR\ShopAtHome.IEToolbar.1]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCU\Software\ShopAtHome\Toolbar]
"contextMenuItemName" = "ShopAtHome Toolbar search"

[HKCR\ShopAtHome.IEToolbar.1\CLSID]
"(Default)" = "{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}"

[HKCU\Software\ShopAtHome\Toolbar]
"ShowFindButtons" = "0"

[HKCR\ToolBand.ShopAtHomeIEHelper\CurVer]
"(Default)" = "ToolBand.ShopAtHomeIEHelper.1"

[HKCR\ShopAtHome.IEToolbar]
"(Default)" = "ShopAtHome.com Toolbar"

[HKCR\ToolBand.ShopAtHomeIEHelper.1]
"(Default)" = "ShopAtHomeIEHelper Class"

[HKCR\ShopAtHome.IEToolbar\CurVer]
"(Default)" = "ShopAtHome.IEToolbar.1"

[HKCU\Software\ShopAtHome\Toolbar]
"AlertMsg" = "Alert"
"uninstallMsg" = "This will remove the ShopAtHome Toolbar from your computer! Are you sure?"

[HKCR\TypeLib\{462E4AEC-DB3B-4E69-AF61-4F300D76255C}\1.0]
"(Default)" = "ShopAtHome Toolbar 1.0 Type Library"

[HKCU\Software\ShopAtHome\Toolbar\tb_items]
"Widthcombo11" = "1"

[HKCU\Software\ShopAtHome\Toolbar]
"connectionError" = "Can't establish a connection."

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\TypeLib]
"(Default)" = "{462E4AEC-DB3B-4e69-AF61-4F300D76255C}"

[HKCR\CLSID\{98279C38-DE4B-4bcf-93C9-8EC26069D6F4}\InprocServer32]
"(Default)" = "%Program Files%\SelectRebates\Toolbar\ShopAtHomeToolbar.dll"

[HKCR\CLSID\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}\InprocServer32]
"ThreadingModel" = "Apartment"

It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run. It does this by creating the following registry key(s)/entry(ies):

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8DAAA30-6CAA-4b58-9603-8E54238219E2}]
"(Default)" = "ShopAtHomeIEHelper"

The Trojan deletes the following value(s) in system registry:

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations"

The process ShopAtHome_Toolbar_Installer.exe:452 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 8E CD F0 6B 21 28 A2 B6 D7 6E FD AB 7F 50 A8"

[HKCU\Software\ShopAtHome\Toolbar]
"TBHideFirst" = "0"

[HKLM\System\CurrentControlSet\Control\Session Manager]
"PendingFileRenameOperations" = "\??\C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\ShopAtHome_Toolbar_Installer.exe,"

[HKLM\SOFTWARE\ShopAtHome\SelectRebates]
"SelectRebatesLocation" = "%Program Files%\SelectRebates\SelectRebates.exe"

[HKCU\Software\ShopAtHome\Toolbar]
"TBShowOnce" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"
"DisplayName" = "ShopAtHome SelectRebates"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SelectRebates" = "%Program Files%\SelectRebates\SelectRebates.exe"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"
"URLUpdateInfo"

"URLInfoAbout"

The Trojan disables automatic startup of the application by deleting the following autorun value:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SAHAgent"

The process %original file name%.exe:1976 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C4 27 AC E0 9C 23 39 56 79 0B ED 7B A7 E0 DE 59"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The process SelectRebatesDownload.exe:1788 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 16 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "95 80 B9 12 58 C6 4E DE DB 73 2F B0 9B 31 FB 52"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SelectRebatesDownload.exe:1856 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 17 00 00 00 01 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 53 95 D8 6D 4F 10 5A 7D 14 DC E8 23 B3 10 FC"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process SelectRebates.exe:280 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B8 0C 35 6E FA 87 24 7C 87 FD 09 87 CD FB 34 D9"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"UninstallString" = "%Program Files%\SelectRebates\SelectRebatesUninstall.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayName" = "ShopAtHome.com Toolbar"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

The Trojan modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass" = "1"

The Trojan modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

"UNCAsIntranet" = "1"

The Trojan modifies IE settings for security zones to map all urls to the Intranet Zone:

"IntranetName" = "1"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"DisplayIcon"
"Publisher"
"HelpLink"

[HKLM\SOFTWARE]
"test"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SelectRebatesUninstall]
"URLUpdateInfo"
"URLInfoAbout"

Dropped PE files

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name:
Product Version: 5, 0, 2, 0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version: 5, 0, 2, 0
File Description:
Comments:
Language: Language Neutral

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 1
8ed8a9ca3fd5d754a88c8ca0ce13e780

URLs

URL	IP
hxxp://www.shopathome.com/agent/agentprefs_.sah	74.63.145.186
hxxp://gs1.wpc.v2cdn.net/agent/toolbarprefs.sah
hxxp://74.63.145.160/RequestHandler.ashx
hxxp://gs1.wpc.v2cdn.net/agent/bce_.sah
hxxp://74.63.145.160/RequestHandler.ashx?MfcISAPICommand=installstatus&param=Ø frtXFiqIX4GbgcJxPRH7be0DduJjehBXcU_ijoe_Yk7184KcM5uMOzy6qgQ684qQN_n1tdMvaDEdCIEix9lj8WAJRWbWfNqlcClbkQr5_AowVg00oteYSw97Q2RvXtb962-2Ce-cg8g8YE_OCsHQQ3G5w4jEFn84yHBkbb3p2Z_mtWn23kYOCxoptwL1im21L1S92QhBEOqX8BfsSmyGOosfnkfaRfrXr1TTyA_bgr6WfNdIQkE7_NLmso4Q-Av79m0rzX5QYN8YNS_jhcRpm5PzyBfxlAaLc_iv8tkk6wHcgGpPuCBb2ebd3sAO-ei0LJ5UhP6TbDQYbGYBdH8OWkhGWmZZHxDzmjCgYyjZPhwi-hOy4N1ZJ48UCVr2t_cXHx3PS2uufZWx4DrdPBWn3yfcZ1_ezCabcnt9Gvr0I82NyCsrmJ8QB9dIBRXHVqePNDChKqO-_sD1ybT1qbP8aKmyOmUBQclCDQ0dmPMWEkzv06UvsHoRIZcZA8ZvaWnvVAS5bgQZp2DlzFvseqEaKmf1zbclkbToJi332YYsHsEmfwYECBmJMMcZu8xPTrvP5Sx4a8dKb8zEmCCAABP7OmvC51q-mOXBrM6rzaIPGOKLnHtE_HbuzG
hxxp://www.shopathome.com/toolbarpostinstall.aspx?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=	74.63.145.186
hxxp://www.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=	74.63.145.186
hxxp://googleapis.l.google.com/css?family=Roboto:400,500,700,300|Fjalla One|Noticia Text:400italic
hxxp://cs227.wac.edgecastcdn.net/styles/CombinedAll_00874B01C6DC1916FB344FEA317D89E1.css
hxxp://e250.b.akamaiedge.net/js/rac/sli-rac.1.3.css
hxxp://cs227.wac.edgecastcdn.net/js/html5shiv.js
hxxp://svip-usa7.sli-systems.net/rac/sli-rac.css?rev=148249
hxxp://googlehosted.l.googleusercontent.com/static/fonts/noticiatext/v4/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot
hxxp://googlehosted.l.googleusercontent.com/static/fonts/fjallaone/v2/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot
hxxp://cs227.wac.edgecastcdn.net/js/tipped/excanvas/excanvas.js
hxxp://googlehosted.l.googleusercontent.com/static/fonts/roboto/v11/5YB-ifwqHP20Yn46l_BDhA.eot
hxxp://cs227.wac.edgecastcdn.net/images/background_sah_2014.jpg
hxxp://cs227.wac.edgecastcdn.net/images/search-input.png
hxxp://www.shopathome.com/WebResource.axd?d=utXq0EopSmH_wSGx3BdZvDyYLpS5Ff55sDuYcl5aUvI_mXIJL5BpykW6xvZro8cCJWqYDkZtKLBu4ajxaGC76D-cQPk1&t=635195457660000000	74.63.145.186
hxxp://cs227.wac.edgecastcdn.net/images/global-sprite.png
hxxp://gp1.wac.v2cdn.net/js/91114986.js
hxxp://dualstack.log-334788911.us-east-1.elb.amazonaws.com/event?a=91114986&d=21303474&y=false&s172491114=direct&s172437468=false&s172419741=ie&s172406886=none&n=http://www.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID=%7b55575A94-3A40-4D8A-B305-A200D98B105B%7d&ae=no&source=91045&subsource=50193&setupguid=%7b618968ac-6931-4f12-8585-7b1e78e04011%7d&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=&u=oeu1403179387100r0.6311023321519293&t=1403179387178&f=1006681359,1140372338,868243247,1137681340,955580750,1126901197,917044067,1137800424,1004574052,1342541934,786269042,702098547,1244112341
hxxp://cs227.wac.edgecastcdn.net/images/fullwidth-sg-placement.jpg
hxxp://cs227.wac.edgecastcdn.net/images/header_deals-today-gone-tomorrow.jpg
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/383_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/2855_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/hand-peasandcarrots.png
hxxp://cs227.wac.edgecastcdn.net/images/pattern_stripes.png
hxxp://cs227.wac.edgecastcdn.net/images/sponsors/1900_secondary_2014-06-18_16-39-57.png
hxxp://cs227.wac.edgecastcdn.net/js/lazyload-min.js
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/113987_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/sponsors/39371_secondary_2014-06-18_16-40-36.png
hxxp://e54.g.akamaiedge.net/meter/www.shopathome.com/32.gif
hxxp://cs227.wac.edgecastcdn.net/images/sponsors/88104_secondary_2014-06-18_16-41-15.png
hxxp://cs227.wac.edgecastcdn.net/images/sponsors/24032_secondary_2014-06-18_16-38-46.png
hxxp://cs227.wac.edgecastcdn.net/images/sponsors/1537_secondary_2014-06-16_7-53-57.jpg
hxxp://cs227.wac.edgecastcdn.net/images/sponsors/1537_secondary_2014-06-15_22-42-50.jpg
hxxp://cs227.wac.edgecastcdn.net/images/sponsors/1537_secondary_2014-06-15_22-45-40.jpg
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/10150_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/1900_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/112944_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/119457_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/119375_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/6053_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/119629_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/5726_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/18539_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/527_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/38329_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/23436_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/4699_sm.gif
hxxp://cs227.wac.edgecastcdn.net/images/merchantlogos/88x31/58203_sm.gif
hxxp://cs227.wac.edgecastcdn.net/online-shopping-report/wp-content/uploads/2014/06/shopgold_400x400-200x150.jpg
hxxp://cs227.wac.edgecastcdn.net/online-shopping-report/wp-content/uploads/2014/06/1MShopGold-google_346x3461-200x150.jpg
hxxp://cs227.wac.edgecastcdn.net/online-shopping-report/wp-content/uploads/2014/06/drop-earrings-200x150.jpg
hxxp://cs227.wac.edgecastcdn.net/online-shopping-report/wp-content/uploads/2014/06/fireworks-1395846-m-200x150.jpg
hxxp://cs227.wac.edgecastcdn.net/images/category-icon-sprite.png
hxxp://cs227.wac.edgecastcdn.net/online-shopping-report/wp-content/uploads/2014/06/Polar-Heart-Rate-monitor-200x150.jpg
hxxp://cs227.wac.edgecastcdn.net/online-shopping-report/wp-content/uploads/2014/06/anatole-tank-200x150.jpg
hxxp://cs227.wac.edgecastcdn.net/online-shopping-report/wp-content/uploads/2014/06/wedding-dress-ann-taylor-200x150.jpg
hxxp://cs227.wac.edgecastcdn.net/images/hand-browseforthehottestdeals.png
hxxp://cs227.wac.edgecastcdn.net/images/dotted-bottom.jpg
hxxp://cs227.wac.edgecastcdn.net/images/email/black-seal-96-50-belcarogroupinc-3102.gif
hxxp://cs227.wac.edgecastcdn.net/images/claim-SG-reward.png
hxxp://cs227.wac.edgecastcdn.net/js/CombinedJS_BA7D55C3C593FF689E4B47E14B9D6658.js
hxxp://stats.l.doubleclick.net/dc.js
hxxp://sp.it.a01.yahoodns.net/spp.pl?a=1000742424085&.yp=7164&js=no
hxxp://ds-any-world.ngd.ysm.yahoodns.net/pixel?id=2285230&t=2
hxxp://cs227.wac.edgecastcdn.net/js/controls/couponads.min.js
hxxp://stats.l.doubleclick.net/__utm.gif?utmwv=5.5.2dc&utms=1&utmn=606285241&utmhn=www.shopathome.com&utmcs=utf-8&utmsr=1024x768&utmvp=1004x591&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Coupons & Promo Codes + Cash Back Up to 35% | ShopAtHome.com&utmhid=926967008&utmr=-&utmp=/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&ae=no&source=91045&subsource=50193&setupguid=%7B618968ac-6931-4f12-8585-7b1e78e04011%7D&setupcid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=&sahusertype=nonauth&utmht=1403179391772&utmac=UA-2915199-1&utmcc=__utma=212097611.739183431.1403179390.1403179390.1403179390.1;+__utmz=212097611.1403179390.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qBCAAAw~
hxxp://c.global-ssl.fastly.net/nr-411.min.js
hxxp://cs227.wac.edgecastcdn.net/js/jquery.contentcarousel-min.js
hxxp://cs227.wac.edgecastcdn.net/js/jquery.easing.1.3-min.js
hxxp://beacon-1.newrelic.com/1/eabd37c669?a=442317&ap=2&fe=6750&dc=6329&tt=3B8AAD7D039242EF&v=411.b2946c1&to=YlVRZxFXX0VWVkMPDVsfcmAzGVVTUVRCChYbUUBDGw==&f=[]&jsonp=NREUM.setToken	50.31.164.168
hxxp://a221.g.akamai.net/js/socialize.js?apiKey=3_Vl_m_lQAZj4P-b1a9AMG__8t5g7v_KuJnkyitBbfPUeRAXBouqH2FJqhdWu2VXb3
hxxp://e3821.dspe1.akamaiedge.net/en_US/all.js
hxxp://a749.dsw4.akamai.net/connect/xd_arbiter/DhmkJ2TR0QN.js?version=41#cb=fc1ada104106dc&domain=www.shopathome.com&origin=http://www.shopathome.com/f2db3a8e33bb934&relation=parent&error=unknown_user
hxxp://a749.dsw4.akamai.net/connect/xd_arbiter/DhmkJ2TR0QN.js?version=41
hxxp://j2.sahcdn.com/js/CombinedJS_BA7D55C3C593FF689E4B47E14B9D6658.js	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/6053_sm.gif	93.184.216.51
hxxp://c2.sahcdn.com/images/dotted-bottom.jpg	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/10150_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/112944_sm.gif	93.184.216.51
hxxp://connect.facebook.net/en_US/all.js	96.16.47.139
hxxp://ads.yahoo.com/pixel?id=2285230&t=2	98.139.225.42
hxxp://assets.resultspage.com/js/rac/sli-rac.1.3.css	23.206.161.38
hxxp://tbws.shopathome.com/RequestHandler.ashx
hxxp://c2.sahcdn.com/images/search-input.png	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/119457_sm.gif	93.184.216.51
hxxp://c2.sahcdn.com/styles/CombinedAll_00874B01C6DC1916FB344FEA317D89E1.css	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/18539_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/113987_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/119629_sm.gif	93.184.216.51
hxxp://fonts.googleapis.com/css?family=Roboto:400,500,700,300|Fjalla One|Noticia Text:400italic	64.233.171.95
hxxp://i2.sahcdn.com/images/hand-peasandcarrots.png	93.184.216.51
hxxp://i2.sahcdn.com/online-shopping-report/wp-content/uploads/2014/06/anatole-tank-200x150.jpg	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/23436_sm.gif	93.184.216.51
hxxp://discounts.shopathome.com/toolbarpostinstall.aspx?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=	74.63.145.186
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/2855_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/images/sponsors/88104_secondary_2014-06-18_16-41-15.png	93.184.216.51
hxxp://tbws.shopathome.com/RequestHandler.ashx?MfcISAPICommand=installstatus&param=Ø frtXFiqIX4GbgcJxPRH7be0DduJjehBXcU_ijoe_Yk7184KcM5uMOzy6qgQ684qQN_n1tdMvaDEdCIEix9lj8WAJRWbWfNqlcClbkQr5_AowVg00oteYSw97Q2RvXtb962-2Ce-cg8g8YE_OCsHQQ3G5w4jEFn84yHBkbb3p2Z_mtWn23kYOCxoptwL1im21L1S92QhBEOqX8BfsSmyGOosfnkfaRfrXr1TTyA_bgr6WfNdIQkE7_NLmso4Q-Av79m0rzX5QYN8YNS_jhcRpm5PzyBfxlAaLc_iv8tkk6wHcgGpPuCBb2ebd3sAO-ei0LJ5UhP6TbDQYbGYBdH8OWkhGWmZZHxDzmjCgYyjZPhwi-hOy4N1ZJ48UCVr2t_cXHx3PS2uufZWx4DrdPBWn3yfcZ1_ezCabcnt9Gvr0I82NyCsrmJ8QB9dIBRXHVqePNDChKqO-_sD1ybT1qbP8aKmyOmUBQclCDQ0dmPMWEkzv06UvsHoRIZcZA8ZvaWnvVAS5bgQZp2DlzFvseqEaKmf1zbclkbToJi332YYsHsEmfwYECBmJMMcZu8xPTrvP5Sx4a8dKb8zEmCCAABP7OmvC51q-mOXBrM6rzaIPGOKLnHtE_HbuzG
hxxp://91114986.log.optimizely.com/event?a=91114986&d=21303474&y=false&s172491114=direct&s172437468=false&s172419741=ie&s172406886=none&n=http://www.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID=%7b55575A94-3A40-4D8A-B305-A200D98B105B%7d&ae=no&source=91045&subsource=50193&setupguid=%7b618968ac-6931-4f12-8585-7b1e78e04011%7d&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=&u=oeu1403179387100r0.6311023321519293&t=1403179387178&f=1006681359,1140372338,868243247,1137681340,955580750,1126901197,917044067,1137800424,1004574052,1342541934,786269042,702098547,1244112341	23.23.115.39
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/1900_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/online-shopping-report/wp-content/uploads/2014/06/fireworks-1395846-m-200x150.jpg	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/527_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/online-shopping-report/wp-content/uploads/2014/06/shopgold_400x400-200x150.jpg	93.184.216.51
hxxp://static.ak.facebook.com/connect/xd_arbiter/DhmkJ2TR0QN.js?version=41#cb=fc1ada104106dc&domain=www.shopathome.com&origin=http://www.shopathome.com/f2db3a8e33bb934&relation=parent&error=unknown_user	184.84.243.200
hxxp://i2.sahcdn.com/images/hand-browseforthehottestdeals.png	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/58203_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/images/claim-SG-reward.png	93.184.216.51
hxxp://j2.sahcdn.com/js/jquery.contentcarousel-min.js	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/119375_sm.gif	93.184.216.51
hxxp://stats.g.doubleclick.net/dc.js	64.233.171.157
hxxp://c2.sahcdn.com/images/background_sah_2014.jpg	93.184.216.51
hxxp://j2.sahcdn.com/js/html5shiv.js	93.184.216.51
hxxp://c2.sahcdn.com/images/pattern_stripes.png	93.184.216.51
hxxp://i2.sahcdn.com/online-shopping-report/wp-content/uploads/2014/06/Polar-Heart-Rate-monitor-200x150.jpg	93.184.216.51
hxxp://i2.sahcdn.com/online-shopping-report/wp-content/uploads/2014/06/wedding-dress-ann-taylor-200x150.jpg	93.184.216.51
hxxp://i2.sahcdn.com/images/sponsors/1900_secondary_2014-06-18_16-39-57.png	93.184.216.51
hxxp://js-agent.newrelic.com/nr-411.min.js	23.235.46.175
hxxp://i2.sahcdn.com/images/email/black-seal-96-50-belcarogroupinc-3102.gif	93.184.216.51
hxxp://sp.analytics.yahoo.com/spp.pl?a=1000742424085&.yp=7164&js=no	216.109.112.84
hxxp://j2.sahcdn.com/js/jquery.easing.1.3-min.js	93.184.216.51
hxxp://j2.sahcdn.com/js/tipped/excanvas/excanvas.js	93.184.216.51
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/383_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/online-shopping-report/wp-content/uploads/2014/06/drop-earrings-200x150.jpg	93.184.216.51
hxxp://images.scanalert.com/meter/www.shopathome.com/32.gif	96.7.200.80
hxxp://j2.sahcdn.com/js/controls/couponads.min.js	93.184.216.51
hxxp://i2.sahcdn.com/images/sponsors/24032_secondary_2014-06-18_16-38-46.png	93.184.216.51
hxxp://themes.googleusercontent.com/static/fonts/fjallaone/v2/rxxXUYj4oZ6Q5oDJFtEd6lQlYEbsez9cZjKsNMjLOwM.eot	173.194.43.43
hxxp://stats.g.doubleclick.net/__utm.gif?utmwv=5.5.2dc&utms=1&utmn=606285241&utmhn=www.shopathome.com&utmcs=utf-8&utmsr=1024x768&utmvp=1004x591&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Coupons & Promo Codes + Cash Back Up to 35% | ShopAtHome.com&utmhid=926967008&utmr=-&utmp=/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&ae=no&source=91045&subsource=50193&setupguid=%7B618968ac-6931-4f12-8585-7b1e78e04011%7D&setupcid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=&sahusertype=nonauth&utmht=1403179391772&utmac=UA-2915199-1&utmcc=__utma=212097611.739183431.1403179390.1403179390.1403179390.1;+__utmz=212097611.1403179390.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qBCAAAw~	64.233.171.157
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/38329_sm.gif	93.184.216.51
hxxp://j2.sahcdn.com/js/lazyload-min.js	93.184.216.51
hxxp://c2.sahcdn.com/images/category-icon-sprite.png	93.184.216.51
hxxp://xml.sahcdn.com/agent/bce_.sah	72.21.81.253
hxxp://i2.sahcdn.com/images/sponsors/1537_secondary_2014-06-15_22-42-50.jpg	93.184.216.51
hxxp://i.sahcdn.com/images/header_deals-today-gone-tomorrow.jpg	93.184.216.51
hxxp://c2.sahcdn.com/images/global-sprite.png	93.184.216.51
hxxp://xml.sahcdn.com/agent/toolbarprefs.sah	72.21.81.253
hxxp://i2.sahcdn.com/images/sponsors/39371_secondary_2014-06-18_16-40-36.png	93.184.216.51
hxxp://i2.sahcdn.com/images/sponsors/1537_secondary_2014-06-15_22-45-40.jpg	93.184.216.51
hxxp://themes.googleusercontent.com/static/fonts/noticiatext/v4/dAuxVpkYE_Q_IwIm6elsKDoGYR7Z3iWH66EXnaJoKgg.eot	173.194.43.43
hxxp://i2.sahcdn.com/images/sponsors/1537_secondary_2014-06-16_7-53-57.jpg	93.184.216.51
hxxp://static.ak.facebook.com/connect/xd_arbiter/DhmkJ2TR0QN.js?version=41	184.84.243.200
hxxp://cdn.gigya.com/js/socialize.js?apiKey=3_Vl_m_lQAZj4P-b1a9AMG__8t5g7v_KuJnkyitBbfPUeRAXBouqH2FJqhdWu2VXb3	184.84.243.191
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/4699_sm.gif	93.184.216.51
hxxp://i2.sahcdn.com/online-shopping-report/wp-content/uploads/2014/06/1MShopGold-google_346x3461-200x150.jpg	93.184.216.51
hxxp://themes.googleusercontent.com/static/fonts/roboto/v11/5YB-ifwqHP20Yn46l_BDhA.eot	173.194.43.43
hxxp://cdn.optimizely.com/js/91114986.js	72.21.91.19
hxxp://shopathome.resultspage.com/rac/sli-rac.css?rev=148249	63.131.147.11
hxxp://i2.sahcdn.com/images/merchantlogos/88x31/5726_sm.gif	93.184.216.51
hxxp://i.sahcdn.com/images/fullwidth-sg-placement.jpg	93.184.216.51
s-static.ak.facebook.com	96.7.202.110
gscounters.us1.gigya.com	74.120.148.12
www.facebook.com	31.13.69.176

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /rac/sli-rac.css?rev=148249 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: shopathome.resultspage.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 19 Jun 2014 16:57:44 GMT

Server: Apache

Last-Modified: Tue, 06 May 2014 21:20:31 GMT

ETag: "262-4f8c1d15185c0"

Accept-Ranges: bytes

Cache-Control: max-age=2592000

Expires: Sat, 19 Jul 2014 16:57:44 GMT

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 265

Keep-Alive: timeout=2, max=100

Connection: Keep-Alive

Content-Type: text/css
.............J.1...}...(........l2..l&$.Y\..nK..v....g........mE!..G..
......l3vB~..%(&.c............j.......qh..b.D..S.K..... 3nc.IA:y.Atju.
...D.......#_M........{[email protected]%..z..<..6.c ...
'.i*$./...|...."........g..n.........<`......x.b..w'6Ab.....

GET /js/rac/sli-rac.1.3.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: assets.resultspage.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Last-Modified: Wed, 14 May 2014 03:13:05 GMT

ETag: "ed6-4f9538f159240"

Accept-Ranges: bytes

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 943

Content-Type: text/css

Cache-Control: max-age=606515

Expires: Thu, 26 Jun 2014 17:26:19 GMT

Date: Thu, 19 Jun 2014 16:57:44 GMT

Connection: keep-alive
...........W.n.0.}[email protected]..%.I6F.....`..:6.&i...wl !.H...[..5.3..3.J1..
.iiT.....O...*W..(Ih..(....\.7".......W..._(@._.7...[Z. .,.)c S\%J...s
2...aD...P.d~..*.(I.0R...A.....F..&........3.....%..g.3..8..<z.3$2t
.F....2(5.g....f..p...I#q0...o}..90 ..t...=A......._...y<.ah#..|*T.
*._.O...8....= [email protected]..(.. .4
Ym.#.q9....2........>....:..{t..'..p['"...:...96R..p .M.'.|?..n;~..
.....'..N<7..o....Z..F...]Q...I..3....... ...V..%s1D.k.`.....)...LF
...{..Qk=..E..............9.Um....Z].x.`.).j..=P].....E....|Nm.ri..HN.
...gT^/j.L...E.?...`2zZ#.z|.b......b...'.l.....bn ....y.........m..2M.
....^."4.j@/............o.k.a...V..R,..^...nU..[.3.U..~...-}.,....30..
..mg..4.....J{..c\....6...k...=.P..m..{....i.k .;w........&.W.....\?G.
... .M............^.6q.. ....RN....X/.Mr_...Z...Ng.......Z............
...@.;.|Jl.C....>v.....\...b.H#.8..g......u}.*8..5.9w..`S..ao......
..K....w.!.p))...c|...3ZO......f..q.....-xd.......

GET /images/merchantlogos/88x31/2855_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "7acfcfa73dcdc61:0"

Last-Modified: Thu, 31 Aug 2006 20:40:11 GMT

Server: ECS (ewr/15E3)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 1364
GIF89aX.......59....d.2.............2....i.j...v......................
.uxK...........R...UX|...DG......t...fi.].............)[email protected]..
...q.....:>.g.....o.Z...MQ`...}.....]`............."&............!.
......,....X........pH,....r.l:...tJ.Z.....!B.]..f.\.NH.w.H.O..6...x#.
...\...).*.K:9...;4ayh...13....... .1=J7.6....w.h,...D".... 0*G.....--
....H$..'.D.%.$9...8.O!V...0.B.) %=...2#:QY".U..<7..P..,?,(..p?B...
.....$4......?T([email protected]*...e..P...........B..%R.P@d.............. 
.0`.AB..........7j...C.....t)[email protected]......^O.(A.G.. ...q.G.~&L...A@..
..5 .@@.. .`.!!i0..lp.qj.:.Nk|p..3......0.f.....L ......R.(aAl.%..5..D
^....0.X........!X..8.1.pc.....oxP.Y\..a(4`Xo......h....)w..`.....J...
.Ara..`J05H.....c..;([email protected]..^..@.._.....~.`..B....$.....40@l
.%.\[email protected].<. .\.....p@`._&.PX^k.........r.p....
....."..z........s-T``..T`..aP&..f..........x)B..r....!..}=0....lx..l.
 ...y [email protected].|[email protected]....?T.....
P.........D 5.d... .F.#...S.o...,....^l.`.....4....X-0..`A......|[email protected]
.Z..Y....*x`.^( `.z..6.....[`........Aa.......;[email protected]........%h.P..
...l.z,.|.|...*|...=Pb.....B..H]..4.es...L..28h.....c.8....V....*....o
..........]....0@T.=d...,...... B.q.l..4<....-.]..p[MA....Mt.l..4!.
qAJ...B.[..D..dj..V.p..]...=:.........6\.H...0....P.>|[email protected]@... ..
[email protected]. K...u... ...H......L.....)...;....
<<< skipped >>>

GET /images/sponsors/1900_secondary_2014-06-18_16-39-57.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "80dcf23a468bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:39:57 GMT

Server: ECS (ewr/15CC)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 2064
.PNG........IHDR...d...d.....G<ef....tEXtSoftware.Adobe ImageReadyq
.e<....PLTE...jjj.........................CE...JJJ......zzz......hh
h$$$>>><<<.>E555^^^...ZZZ.........FFF.........www
NNN...BBB...QQQ....68ppp@@@nnnXXXLLL.................................8
88......TTTHHH....',:::fff```...333...VVV.............................
.EEE.....................RRR]]].......................................
............DDD.......................................................
.....}}}............bbb.......................................sss.....
.......................................................uuu.~{.........
.ef.........................=>[email protected]....
.................._^.......}............................xxx.DC........
......................................................................
..........FF.HL......(((..............; ....IDATx...gX.I....<D".n#1
@@...r.PO..*.!....B .....R..T..E.........{.^.....&..p..y.yn~.fv.}.3o..
.`0.....`0.....M.[....&...1..G.)..E.B.:.[...n.mA.....LIh.k|.H.o.y.O..P
w.S.`E.rn..>..~Z.~.....P..t..3..../"p.3_|..*.....dr} P.v.......!.5.
..X".. ,..Zv..$....?.}n.J&...y.E......e>.~..B.._..h...8..0H..G..6..
..G.....  -j_m{.^...).#FS..).=.2.AT]....~m|..[....*[email protected].
....3......<C.7e.P...pG..d...".......n]...n.C..1..._J...Sa...H)?.I.
SH).......%V.....O....[U...Cg........O..`....U.^.........4...[..".....
..yU.bg)...J......Ozl......|....r...o...h.x.............I...=eP.U%N...
.Z....#L.CK.L./....L......>...]..^...r.$.v.H...a....Q..$.4.,.L.
<<< skipped >>>

GET /images/sponsors/39371_secondary_2014-06-18_16-40-36.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0ca3152468bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:40:36 GMT

Server: ECS (ewr/15BA)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 3363
.PNG........IHDR...d...d.....G<ef....tEXtSoftware.Adobe ImageReadyq
.e<....PLTEy.............7....*S Cf......iz.#;[..C.................
....)?fr......#R.........ds..........r..|.............................
(A\......AVm....*U...4Mu...:RrQc}........AJ`y[r..$L]s..9]...Uk........
 S.........Zl.Sd........*X..H...iy.;Ol...Mc...................2Da...cx
....3MlJ^}......\k..)M..H. E......F[{....Gq.*K....!M....&M.*O.......4S
r........l.....>Ql.2V.7Z.........3Id....2Z..:.....H...Wi.bq.Wh}....
.Q.........FZr...............u|.x.....IY.......Qcv.....L.&R...@Mh....#
I......K[u........A...:Od.6`....%Ohu...........*Zw.../PUk~............
.#F.&I........M@WtAWz.%W./U.$K..K.....................................
........................................................bav...Wb.S`yox
.Vj......O3Ef_p.8Hl. L..........................................Yev...
.....I..M.E^.#Q...H....IDATx...{X.W..y.Ad..!!XT..R.....B.R2#VZ.Pk3.=..
m.P.......}..b..%.......N2IH.`.......}..>..n.............~.G......{
./..s.=w... A.H.... .H.... .H.....5 ......~/.B.w......Z.... K...M]..&g
t;#/........<[email protected]{`S............y.8..wuv:.N...M...r..8.v.
F...... ....|.1r-.L.r...bw..V..m.l....?.......".h.t.0ET.J....c..z.^-.&
lt;...e.wVKO....v[. .H.."h.....m.T...z.m}|/.l.....C<K..a/$....R.E..
.}....v..~.<..7....(.....8Q...8P.T...P..6..I?<d...K....x....-...
..(..L.?..[...V......`..'M....'.......%.....V>.Jk.w .^n.(...=......
[email protected].....>7P.2.N<...b...L?1;.....(D....U` ._.pxl.$...
..'u.9...iz.0..X.PRQ.s.ng.j'.....^.!D?c`u..FVs./.Eq.. .V}.J.s7X.5$
<<< skipped >>>

GET /images/sponsors/24032_secondary_2014-06-18_16-38-46.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "01fa110468bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:38:46 GMT

Server: ECS (ewr/15B3)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

X-UA-Compatible: IE=edge

Content-Length: 5782
.PNG........IHDR...d...d.....p..T....pHYs.......... ......tIME........
.......tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:..
..tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.......
..tEXtWarning.........tEXtSource.........tEXtComment.........tEXtTitle
....'...aIDATx...yp.W..?.{n.F......-... ........I....b.,T.X...%PTm..fw
..Kp86......c....N...m..-[.u_#iF3..hf....3#.1..H.U._.....~......~.%...
K...AW......L.....b2Y@L&...d.1., &...d...L.....b2Y@L&...d.1., &...d...
L.....b2Y@L&...d.1., &...d...L.....b2Y@L&...d.1., &.........D.... f_..
32}.>.."D..D.."E.^)2%!.H...2..lG......>G.;../.....6....H)..f.. .
...F..2...v.......?...........F.f.e....2.....{...P&.!.$....XW...@*.L..
.$RK..Bdf.. .....:.v.B..|[email protected].:.)Pl..
.#..]U.......*Dq.....p.r.....\......4.Q......z.[.!........jR....IHq.p.
...yZ.<...4L..#.!.G2.B..a...u.../..0.0.....lo.R.n.%. ..Zp..y...U...
J.RFkV.i/.=.r,..H.i..N.=..b .... .lxk.P5.MYy)[..X..zg....<.G..{Q...
...R9...K.*..iT.....Hz...m........h...!...Pl*.~.ox.8..94!9~....8..f.h.
..._.._........(..'_..FPU\#.T..`..El.I..%..?..;..-...N...H..p.Q..E..&g
t;.{.$....Fb.....ih..I.._Dd....8.;..z.......0... uDW .i......}........
.N...t.K$.F.?.X...~......1../:Fim-.....r..w..s.Q...~...O^6.Q>.S.>
;...mS@.... .AR...v.ER.7r.v.....o.<[email protected]
...E. .....^g.=.1"..pt.4.BH.<...TCi...I]...l].}.........M.@]3...R .
.......?.^.....HZd.O!..(......%...v..y.h//.M..F!<[email protected][
..7.4..x.o.....E.Srz..z....D 8.....iD...e5P.......!.......:....r..
<<< skipped >>>

GET /images/sponsors/1537_secondary_2014-06-15_22-42-50.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0c16d6d1d89cf1:0"

Last-Modified: Mon, 16 Jun 2014 04:42:50 GMT

Server: ECS (ewr/159F)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 21634
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:918C9E7E0394E3
118E2899F2BD10F342" xmpMM:DocumentID="xmp.did:D56E0DE09F2211E3BA2D83E8
82B38B6D" xmpMM:InstanceID="xmp.iid:D56E0DDF9F2211E3BA2D83E882B38B6D" 
xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:6BB9611BF898E3119D2D9FD67814EBD9" stRef:
documentID="xmp.did:918C9E7E0394E3118E2899F2BD10F342"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.......................,..............................................
...........................................!.1.AQ".aq...2...BR#..br...
.3S$..Cc....4.......................!..1AQa..q"2........B...Rb.#r3C...
.........?.......2.>".P.~:..R....Y?....h..*.....A.$.P.O."M.`Pz...B.
....u5.....F..[.......?....=......\[email protected].&...JA.9..........7.0My...
f.6[{...E%)^.(.OUa. .2.......I..............u.B1T.(#d..m....a-.b.b
<<< skipped >>>

GET /images/merchantlogos/88x31/10150_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0ac19e842fcc1:0"

Last-Modified: Mon, 20 Jun 2011 19:59:52 GMT

Server: ECS (ewr/1598)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 517
GIF89aX..................@@@............   ...000...```pppPPP!.......,
....X........I..8....`(.di.h..l..p,.tm.8..y....`R. ...D.h...f..84... .
 4.....(,...c.MP.....eH......3..iA?....v..C...f.Cn..........P.@^..T.M.
..L.......q...[......bv^W...p}.^q.U.k..y...Qa.Z...p<..t...........n
.T...>..}....qLYI.@..... X..^.-..T`.......x..-..z.s....K?/...H..N.:
i..R`[email protected]....(...JiP.&`.([email protected]....^...OP..%)Y.f.
....,...1..Y....Xl...,...ef\...|U.....5.4...m.!..W......)...9........A
...I ..a.......c..M.....s....w..;....


GET /images/merchantlogos/88x31/112944_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "025c8fce091ce1:0"

Last-Modified: Mon, 05 Aug 2013 13:37:54 GMT

Server: ECS (ewr/1444)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 2654
GIF89aX...w..!.......,....X.....................)..'........ ..*.....'
.. ..*..0..9..,..0..9.1L........!..!..)..(..0.. ..0..9..,..1..8.!2. 9.
.A.&8.*A. J.0D.:[email protected]]..&..1..*..4..6..3..9.!1..=.#@.)D. J.1B.1K.0Q.0
Y.9K.9S.:X.?S.B[.B_.JV.I\.Ib.QZ.Rd.Ri.Xb.Zk.[p.ao.cs.in.ju.)J.)Z.2M.9R
.;Y.CQ.@^.HZ.Jb.Jk.RR.P^.Ti.Sp.ZZ.\f.Yo.^k.cu.ln.hs.h{.m..l..t..y..}..
.........BZ.JZ.Me.Uf.Sh.Zk.Xq.\x.au.az.ks.k{.k..n..tz.s..s..{..{..|...
...............................................Rs.Zs.Z{.t..s..{.......
......................................................................
...{..................................................................
......................................................................
......................................................................
......................................./^.lY..J._..H.....FE.(,r.".FD..
.X...P...)r.#.C<4...m.) .&. .fZ?..0.p`......hH.@.....$.....j.)ZJ.u.
.A....0..O......O.(.'[email protected]......&\ ......"8..aB.3..f.Z
mP.#.......3.."....A...$...!J?~... ..... ......Do.d..P,..`..I8...u....
.......6.O.'.....w....C9..x<.......xH....Da..@.!.|1.1.L@.*...N?.,..
..tP.u.<..w....D..@.?.U.....q.!6Y0................?.h..r.X.......S_
.....bW....%.??i..E.\`..`.b.5.\..,.M...x4rA"[email protected]..@X!.$1.7y
..@.. .. ..P.u.p....Q.. ......Xc..K!..E.t`.?.$.BD..b.4...A...8.CiaX...
.......A...........2.\.......*x.....d..D...J1.H...)..J..."[email protected].
)....|LT...4...Lt.M....... `.c.....'\:.8L.0..j<B.2.x.HY.y.ES,[email protected]
.J....%>....;..qg...P.._x.o.....!.`G.u..&.=d(.......f.:at?...(.
<<< skipped >>>

GET /images/merchantlogos/88x31/119375_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "05c58181228cf1:0"

Last-Modified: Wed, 12 Feb 2014 16:47:20 GMT

Server: ECS (ewr/1451)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 2429
GIF89aX...w..!.......,....X........k..t..t..n..w..t..x..n..n..k..t..u.
.x..|....!.c%#k!$s!!.%)I!)c% p')y#n.$u.#|.!..*$| $. '.))Z((d**.0..-B{ 
m.)...*]1)c- i. y0,.2,.12b11s35|0m..x..x.0..4..0..5..74l87.;6.=}.:..7.
.@..=8}@:.E@.@B_@@tGC{GB.E..MPmNl.J|.I..M..NK~OK.RR.SR.VZ.UX.UX.U..S..
V..ZW.ZZ.[].]..`..]..bZ.a^.dd.dc.ca.hk.io.h..kc.jn.om.vs.pr.tp.tt.w..s
..v..}~.~|....{..|..}...~.............................................
...................................................\..................
......................................................................
....................................nA...................[!.k$.`2.j2..
R........|[email protected]..]'.c$.d2.oF
..W..i..{..~...............................oB.zF.{T..l..~.............
...................................80.?...*\...Bu..:..0]B..3j....:u.5f
.9. D.(S:L...D...}..R.I.81.....>s....V...g..q.....j...S.-...X.v.hn^
;o..A5w..Y.....'.h1h.................c.........5...WO...............;F
.....-.TXo..g..! G1.)S..3Lw.Z<{..be..*.|........C.UAL..EBvv... ....
.On...#.].\.eW.NQ0.......Y...G..M].;n.<.r....%,.`..]...D'%H.M!Y&.6.
.....Uu....PG.%.........X.g.@[email protected].]..B.A..?...du...H.u
.([email protected].:....'.<Q.;[email protected]'...d....4P.E.1P
...(.N0...N6W4@.!....8.....-.r"...Z....BE.6..Q(K...".0...6p......!D.A.
..;.tA...pb. ...@$.........A. PH.3P.c...#O6........E.....*\..H.-......
[email protected].. [email protected]..........$.hy.j.d.....$.5.....7.
.KU..Q..........D.2m.J.K....7dc.....O!..Q.....@)..P..vT.M.Yp...<
<<< skipped >>>

GET /images/merchantlogos/88x31/119629_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "05a8861f162cf1:0"

Last-Modified: Mon, 28 Apr 2014 14:51:48 GMT

Server: ECS (ewr/15BA)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 1982
GIF89aX...w..!.......,....X.......On.Js.Uo!Qp.Pq.Tr.Wu"Yv)Xx!\y*]y0`w1
_y a|[email protected]}.S~.X|.N..X..R..[.
._..R..]..a..R..[..`..Z..b..Z..d..j..q..g..k..q..d..c..j..g..m..r..x..
u..y..m..y..r..|.....{.....u..s..y....................~...............
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................3..H......*\......#J.H1..J....d.Q%L.C.
\h...#6j.X.....03."r$..G.....2... ...3i.%I.$....)DL.h..tQ..IzR8r..a%*U
..:B.c.  ..=h(..BUj..4...G.2YZ.P._...6.4...?.1Y.a#......0.....|%1..AG.
.[...|... ..|.DS..I...0r(o.J`.. ......&=r...h....(...#Ay...B.....-V:q.
oAL/4...D......h.(iL.'G.8."..$.z..0A. r....Ix.Q.A..Q.R`.Z$A...!.#...`&
..2..'..X...W ...W.. ..A..l E%..x.#.....nd"I.E.X .yI...1.p.G Z.R%....a
...V%[email protected].......@.`..;H...?.!B......KHa........d....X ....p..
..p.$Yx..&v.....4`..St..&.....x........."x.....g...L,qH._\.....a..g.A.
.n.y.#[email protected]."..bX.....Q.$..@l.....!qL0.... ...l......D.9.0.$1L..
`.....Z.q....!F..e...od.......gL.g.$..1.....@..<a....a...|!....a...
ha...,...K.p....8.......@K... ...$.....}......wT..w7..9`.........P
<<< skipped >>>

GET /images/merchantlogos/88x31/18539_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0fa810634cf1:0"

Last-Modified: Thu, 27 Feb 2014 21:51:00 GMT

Server: ECS (ewr/15B1)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 1500
GIF89aX...w..!.......,....X...................   !!!"""###&&&'''((()))
***...///000111555666888999:::;;;<<<>>>???@@@AAABBBC
CCEEEFFFIIIJJJMMMOOOPPPQQQRRRSSSUUUVVVWWWXXXYYY[[[\\\]]]^^^___aaacccee
efffgggiiijjjkkklllmmmnnnooopppqqqrrrtttuuuvvvwwwxxxyyyzzz{{{}}}~~~...
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................H......*\......#J
.H.....3j...... C..I.....G.*.r%K..U.lIP.E0&Z."....4....a".&....P..f.$A
..9....P2L...t.....:[email protected].....@..@H.\i.....i...1..L
P.....TH.)L.......L...."....@.`.....O.D.R.I.....|.c..........f(.. @r9j
..2B...SCE".i.4...&.4.[...t .....0_..L......A...P..1......Y....{....!.
..\;...Aw.W.n.x!.e..FC.b...|. ..q...A&..._.lT...r<q .Rd.].&.....%..
......[...Ard`..$r..$)....F.p..a.........J.H.y.dbB..y...F.WC"......D."
..."..G.P..^..%._.!....v...........p.Pp.}..b's..... .A..d.`#\ix..@w...
....Y..i..C....H.....^;.1..i.....D2*.'l.]...A.%...BZ|.0@.{-Q..V.......
..,[email protected]`..%.<"...H..'....".p.W%[email protected].@.(...
...H(.t.T(...J..X..#.YrI%.\...4.l..8....<[email protected].....;..
<<< skipped >>>

GET /images/merchantlogos/88x31/38329_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0ace1a515c4cd1:0"

Last-Modified: Fri, 16 Nov 2012 16:15:52 GMT

Server: ECS (ewr/15A1)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 1898
GIF89aX...w..!.......,....X.......s..u..u..}.!..!.."..-..$.6E.ER......
.....#..'../..4........"..'..,.#:.(@.LZ..............).....5.$A.)9.(A.
:O.FY.Rc.Zh...........).)B.2L.w............1..3..8.*J.4P.@[.Ia.dt.s..}
.........1..9..<.!A.'F.,J.9Z.Jc.Uj..........4Q.6R.<X.A\.D_.Jc.q.
.............Jc.Sl.Zq._v.cy.i~.l..q..x..~.......................c{.k{.
k..v..{...............................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.........................................H......*\......#J.H.....3jl..
..8e.P.B...?.SJ|....O.b....Q.)<T.......R"-..H..N.8mb.G....~J.J.jOM.
8Y..u..OP(T........8...j.DY.h..iQ.,........,4h..J...H\f..B...C.@|..(..
:.g`.d's"..h(...g..K..^M.../...rs..)..Z4B.3M.<....z.....=e.1.4..>
;?v...."0.N.......V2....$s........'..W....H..CZ..o..P.<.er.V2.(.'S 
..&{.........e...)L....V,2D`........E*..1C..5q......!i..X.xx......D"..
...D......0.);."....`@.=...&*..D.A....Ypr..4\....$.."[email protected]
..s..yE%..i..1....M..."}$.H..h.UL..h....9...l.E.w... [email protected]
 r....jk*.L...9DP...d...S. .!4.q.|.....y.v.L.|If.Z..j*.] .....l&..J.#]
......0.'.<"SqC\"..ljX....rJ&B0.....Q..jh..".....M......;h$Slr.....
.!GX(..J...s. Bf"...F..(fH)..A.%.VZ....B..j......b..H..G....n....B
<<< skipped >>>

GET /images/merchantlogos/88x31/4699_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "8048b956938acb1:0"

Last-Modified: Mon, 22 Nov 2010 22:19:33 GMT

Server: ECS (ewr/159C)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 1441
GIF89aX...w..!.......,....X................   ;;;<<<===VVVWWW
XXXooopppqqq..........................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................H......*\......#J.H.....3j
...... [email protected][email protected].....
F......._.nM. lN.J...pT...f.~..5...%H..@ .U.'.z..7D....s..A/...(.&q..^
.a/\...B.._.:[email protected]. ......F.0}....l#...!.....&8A..... o.[.
D....R. .........."...d..0.2...'^w`.a.@....<[email protected].
.f.F...nqW.e...`.f.....1....9p../.f.Apyp..0^`.y...A.L.P.N..P.V.e..@"\.
.Yy..@......)[email protected]..... Plm.4..4Q .^^..A......D......y.h..T.....
!...E.....\O3%@B......W....(.5.\~.DB^-a..i....}"...s..p...^....%TVAr".
p..R...^.. [email protected]....@.".......m...t .#......{[email protected]>i..
@...^Dc..TP8.j.^.....P!..J.R.R.."D0L.'....7....G,......;....
<<< skipped >>>

GET /online-shopping-report/wp-content/uploads/2014/06/1MShopGold-google_346x3461-200x150.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "4cdf90c0698acf1:0"

Last-Modified: Tue, 17 Jun 2014 20:21:42 GMT

Server: ECS (ewr/15C7)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 10633
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?....N(.M=T. .S...
..L..j-O...a&>4.(.ScZ..[...b.....Pw.........6z........b..7.7c>..
..m_,ne......~U...0.0..B..pm?u..G.....M.....Q..H.G...d....../.. ...l..
....)G..1../........|.?.....u..x.......q8P1K].. ._..?...G. .#.[.~c.*..
........E...?.w.........X..k........-<u......S..d../......?.O..._.p
4....i....?...._..........T.?.{.......h........?.....40.8...^.......?.
.?......D...v........^...._.~k........A.(Q...........j6.....i......a..
.'$.....b..........~Y...~;.e8...W-...Svvw[_G.r..5...[u.Wq..h...2.j...Z
2.j....i#.2)8..u..:S"PsR*..s.*T.-Il|kVcJ...X...G<....N..j-N..t$r.s.
....r...~..........1Kc...Y.................Yw1.(<..y...gm....v..M..
.....p@?S.[.(...~!j..../5.F.8!......` .O:.ifX...ud.........Y...e.u>
H..NM..$.J..;t.t.K...].5.4p]Z.r..n).y..3.{b.k.|M.x|.y|Ar......i..I..v.
@...eT.9.....}.=.E./../ Z..5.....|...X...Y.....!A85...)I..o.Y..Y6}
<<< skipped >>>

GET /online-shopping-report/wp-content/uploads/2014/06/drop-earrings-200x150.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "570f63d7889cf1:0"

Last-Modified: Mon, 16 Jun 2014 15:32:54 GMT

Server: ECS (ewr/15C2)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 4200
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?........Sq.....R.
4...4...%)9.....RP(.V..:...KT.}..I....B.p8.M.4....."..R).ZF....s. ....
HF)(...A9....`..(.aE....38.p..4R.wRQHM0.u!...8.X...a.:(,.......#..O..Z
.N>....p{....U.f.m.....\I....O..?.... [email protected]..)]....N.(
?.V.....]...#..R.f.....%gbl.....<sZ.*......8s...O...%8.....N4..@).H
i('.j4&M/~:PE...\..(.B..........w.....rih.Dl9.U..".....q..cV..S......#
YB.B.##.. ..q.34.6..:.."7 ..=UI..s..MjI.lr8.9.[._........4.q..........
....[.....Mgf....I...zn.e...21....A...mgRI........s.,}..V.....|R...[.F
Qm.,.......n.'...k......5..e'....S..0....lf.E8.).....c.iV..h."...JJ^..
.....t.-.).!.pl.z...6..0).7..:[email protected](..iX6..h..z.H.QE <..Z;.R3`}(.
..l.k..O..I...)...b.c. r.P.{W.....K..h-fxf.KJ..#8....aR.cd..`..G'..y~'
.....x..:..`zm....9..}A.H..Q,?$j..`c......'N..$UX....u'..k<....-t..
.<C...]'P}n........V .....85....x.4....u.d...A'..}..W5.(M.!z.W.
<<< skipped >>>

GET /online-shopping-report/wp-content/uploads/2014/06/anatole-tank-200x150.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "8af6eadfb83cf1:0"

Last-Modified: Mon, 09 Jun 2014 15:58:38 GMT

Server: ECS (ewr/15C2)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 8884
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".................................................
.....................................@.".=W....IL..[..{..hY.M'.{./re0|
....;.......T.$..........lv...F...{.7.<.V..........UB..\..H......N.
..# .....K.q.Y.;.l]....._T.=R.E.g..i...]P1.."....].S.n..N........r]s.@
.....@C^!....z?$.........oG3...../ ...Ef.,..I).. .H.q.2%8...k..?.j....
>..{...c...3.............ll..~j.=}...;[email protected].
...@u....[..71..4.i..R..3.$dr.Bf.Q..].x.* ..A..,FS".n.6:...r..Rl....0.
.`E/d.g.o>....W<..D....fO.m..Ugt...D.3C.PZ.T.&...d(........5..5.
.71..n.dLW=..7.nS.....U....#.}...?....%.V7..p....9...2.i..?9.d.Sg._i..
.d..;..).~....s.............{..h.V....'..?j. ......b.k.%.../=......|.3
...%..{.......f<.p.J.t..f....@..... ..........................!....
 ."03#12%@............-.[.B..W.K..x'...{R.X..#?..[......M.X...8..3:.w3
..z.Yhi0....x.=..O....dg...J..>,....h....d...9.s.....T9{#\...D3..oI
...Z..d...$......vs..>\.M...2.,..gO*fC...0~.Z..J.....{.....?V.9.q..
s.....T).... .,M....`c.f~....K.....s.O.>.n........1.0.D..fs..iP.."}
6.I..k...".b~.3.wl-Q.).l.ZY.x.C&...\..u..W...1.7cq1>o.B.. 4=..o....
..n>.M .Kw...CH............Gd.DS.5..`......#.G..<..~.*....c.....
.H..2...._..."..P............~R..&v..x.w_.~!m..4s2pum.sb..lu..X..v...H
..~.....G.oD1*(....q1>2..9.N.......H.3}.n&i7.kl.._......r.8..g.
<<< skipped >>>

GET /images/hand-browseforthehottestdeals.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "8098197aaa29ce1:0"

Last-Modified: Mon, 25 Mar 2013 22:45:41 GMT

Server: ECS (ewr/15D6)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 2344
.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..\MV.H.nx.Gs...pN....'.....b6.q.a..a5K..X..q......q..N..W
*.'!C`............6.OOO*P.@.... .@...@..(P..@..._:.7....R......U......
...P.. .6..f...W.70....'.\..z.|n.0....*y...............N6.\...s..o..=.
a ....(..re......H.....kf)..9z.B..Vi_z......(.8O0.... .e.M..}.........
..z...>.....`7...../4.6R=h../`p.=....4.s).u....k=P..M....... A..uI.
.Q$.y].....;0..j.h;.xt..T5k..wl.............n.h...........1v.[[email protected]
dI.} ....A;%i.......FP.........c..\..w..us=..c.#.Z.Z..4F{.0.......W...
....y.g....3..>6............;.m......Xp.{ ....N.\..&......)....z..9
...."...g)@,.....Emq............|\...-...g...(d.82..k,[..Y"b.9.(..p/.D
...E..7.M...c...}...-....V.).%cE.......N`K.....q....AD.{.n ...=n..(a
..9.......A.5..)..x..(.`Mc.q..Tb.........^..x.......0...@.<k.&k.:..
.2#...]2... ?..2...r.c%...g!.K..w......p..C..l.y..Y..7....E.....K.3...
.w..#.f\.%......2....Y9....8....,.V...,...K.J...U.....u...3....W.r..P'
....d.....?..O0....g._1..1...a.....Y..N1Oi..T.v.Hf<.........\6`..I.
i t..s....2.......5t.jg...'*...W....s...-......f\%.w.Ae....y.#U.3.2...
...I.,.7eOSe.." ..o..u..z......._.....0.....j.(..a....xW..g>..#..G.
6k........HW.F......Q3..XS_D......e...}....p.m...M."g....l..D=........
.|...s...R....P.Z..=..9..0V...H...T.e...g.:<g.\...F.NS...c...3.....
5g.B../5.H9...T.p...V.Az.#.m..EN..y.1..y*J.K........%B.......b u....&.
..{.......A6..i3..l.cw .T@6'..i\].y..:....n...*%...jK.2..\....(....k.V
.i..>....n .. Ri..K0..|.5 KM...r....`ik..0..C.........#re.. ...
<<< skipped >>>

GET /images/claim-SG-reward.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "0ae2401984cf1:0"

Last-Modified: Mon, 09 Jun 2014 19:30:20 GMT

Server: ECS (ewr/15A8)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

X-UA-Compatible: IE=edge

Content-Length: 13901
.PNG........IHDR.......K.......y.....tEXtSoftware.Adobe ImageReadyq.e&
lt;..."iTXtXML:com.adobe.xmp.....<?xpacket begin="..." id="W5M0MpCe
hiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk=
"Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01        "> &
lt;rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#">
 <rdf:Description rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1
.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http:/
/ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photo
shop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:7E67CD43F00C11E3AAD28058
5825990E" xmpMM:DocumentID="xmp.did:7E67CD44F00C11E3AAD280585825990E"&
gt; <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7E67CD41F00C11E3AA
D280585825990E" stRef:documentID="xmp.did:7E67CD42F00C11E3AAD280585825
990E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta>
; <?xpacket end="r"?> .....2.IDATx..].......9wv.]\...UVP....-...
....1.r.h.......L4..#[email protected][..3;..7yS..lO_
.]_}..._.Y.....(.......eY{..G&.)q.....R.....-aZ.]..hi..6>.....m.l..
^-[..L....[ E..Kg-~.m{.r...HK/...qDE:..iM...tF..%....}..-....G.....a.G
....h;..6.RG......=Z6....X....?-g..-Z.....,;D..%.K.3i..%.q,...E0.g.`{*
.."m..l..M.2".J.9|>...}.....Z...:...Z...... ..\.....KLr3}...S...C{.
t...7...!S.....X..LF~.}....Q..h....$..s:DE.:...~k...__.t.b......W.Ir..
..*....@X.>.`......d.,.w....*|...%S"AK<..u..x....L.....9.....y. 
..b...`4...a.|...O&[......a"[email protected].%C.J.H.......Y.....;...e.?
<<< skipped >>>

GET /meter/VVV.shopathome.com/32.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: images.scanalert.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache

Expires: Thu, 19 Jun 2014 17:05:01 GMT

Content-Encoding: gzip

Content-Type: image/png; charset=UTF-8

Content-Length: 1736

Vary: Accept-Encoding

Date: Thu, 19 Jun 2014 16:57:46 GMT

Connection: keep-alive
.............N..PNG........IHDR...s..........)!b...xIDATx..[mH.U.~...M
.........r..... ......../.>..............\....F.i,......0&....P..w^
g\O.{.s...9....>...>.<.u....<....H....J..=.9...aeeEVWW.5~W
V....e.|.....E...y.=v,H.<..I...Y..Z..)...1..._zEfffL...C7..!.Lx...&
.......S._....;l....G.d .r.j,--.ko.i........'.r..aaa!X....s.........74
4l..".........o..G.:5:..uuuI}}}P......a..6Q...h.;._..cC?...L.%.T......
.HO.Q.;..t.^!..*3.H...}S..!S..SSSk..r......2.....am...q....(H....1.~..
..3..0(.0..C.c.K&&.ty?.../...=/.X..Sye....L......Lb..B........t.../...
|yF...e.A&..Pz..$y||<......."..d..\.K&.Dd.y_.....yi........~......W
..v...D8......p.. .`6s. ... Y..P................:.u..G...F....L..dl.L.
...I.=...X..L>.B.........o.~#..;..L.....v..........r{...H...S G{2..
...#......u..c..d..{...u!....:ioo7.........M9....%.A...r#.i.i.K`c..O..
..8..l....z..`...%\3O.... ...K'.Ya....v]......2...L...k^.w.. ...r...k.
.........F.:.%.?.\'...o.B.]..q.4~at....]W....:.....>R.N0..$..q.....
0....G..H.]O...!SN.q..kx..w.1.....0............5....i..y.qIpT....>.
b.a. ......'$.l..E.A.....G.....5..t..............rr.......F.....f.k#P.
.x...;[....b..MMMN#....l.fh.7..{X...6......M8..h..vA..<..\..I...Xd.
.4.. .L~...mtN..J......c.J.A......r..w..J.yx..........8.2....`..C`X..d
.q.....]....u|....K.e.M.. b.......X.O.(.O.....{....)Cx....l....L`n..!.
.....y[....qs.Ew..Kr....E(.....&.....5..\....d.cc?...z{.n..R$.!..)./._
F..i{&"..s........df2.........I.u..-...K.rx....#..2.:.k..:~.....5^....
q&..s......YT.m.........g.Qr..$.......&....^.7...."4..q..42..l#...
<<< skipped >>>

POST /RequestHandler.ashx HTTP/1.1

Accept: */*

Content-Type: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: tbws.shopathome.com

Content-Length: 704

Cache-Control: no-cache

MfcISAPICommand=update¶m=ð

akX4NOuo78lH_ltYGo6Y4Z3n_Veyr9azz2dZrx29jf9GQ-QWDh3Zy2XnLN1Tn85eR4L1gzFzrnrsl43tEcZA0JZqOYi44BetlYWGfx4nJKwMDwEDSvxJkPAm_dSkuDAoT0SJwZ_L13W7_h5FUQPshqxFw1PCtRwn9uWf8fN-fdS_uXpjieM3XkPdTfTvYnmWc5tvcY5WnFudiH71JAVSWot0kvQkdOiifvMlMvMnWKKsNwmukolsEPhezGZy4etTidBvgaS_YSDh79hNfK1edVyan4RKHU5K5Bfx70XETuFr8FYw-Qe_GchXQTMcIFzy5eD8h4uxw2Av3IvYaXSTVZoPzk0IL63izFwany0vpucPYVl5v5lS41a6uJAKQ8AqsnhQm19R4oFmDt7yDg5roz4vXlnekCdFOHJbQR85LGm5S7dUEQMCQIPncNjum8CdMycKUwg-V3H-wF_0rzPLnTSkOZnDFe-akR8KcnY86mTjQY49sNXsoBN3X_eJ_MjuhcPzLNrS1yOUS4535cgFSq30no8JuQHkDTp1h3EkFUJTHUleSdi0Qi3TDo0WRr8qRSf4ivfQ6SbJVdvafTIMK_Q9SHPpxXFFjhq0RDqgxUTM224vt0kj0xoGsZR43NaoupelKBAbQ94SKLyw944X20.
HTTP/1.1 200 OK

Connection: close

Date: Thu, 19 Jun 2014 16:57:37 GMT

Server: Microsoft-IIS/6.0

X-Powered-By: ASP.NET

X-AspNet-Version: 2.0.50727

Cache-Control: no-cache, no-store

Pragma: no-cache

Expires: -1

Content-Type: text/html

Content-Length: 460
......D].2......C!..0...<..=.)......Pk..6....pbJ..*[email protected].
2..^8.....s..^.5....).0V.N^.....Z'...L..........m..0..."J...h5.J.Xh...
)e.Gk..GJ. ...........~.j...V@&O..... ....y.L&..g.y..;.EY}AD.e..p.....
&.......x....UR$.U..{.x....8....O...Tn........^.{.. .(.Z.h.Y#......n..
.f8!.X.....X..qf.V......KP./..#[email protected]:..*..
.P. ./......#...[K.l..y..S.f.r.P.%.d.j....dJ.i.;[email protected]}..c3
x.Hs.'~...O<..{E......ob'..?.$..-..fjpg.1O...

GET /connect/xd_arbiter/DhmkJ2TR0QN.js?version=41#cb=fc1ada104106dc&domain=VVV.shopathome.com&origin=http://VVV.shopathome.com/f2db3a8e33bb934&relation=parent&error=unknown_user HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: static.ak.facebook.com

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

X-Content-Type-Options: nosniff

X-XSS-Protection: 0

Content-Encoding: gzip

X-FB-Debug: 6swEE4AaAf6h7tINfRqBk4Ito4z0KpJHXkzpHyWOWHZjPWQpZ97ymZcI3UTkjzzSqCt1FxYnM4E/lLlOECIzog==

Vary: Accept-Encoding

Content-Length: 9213

Cache-Control: public, max-age=31437876

Expires: Thu, 18 Jun 2015 13:42:29 GMT

Date: Thu, 19 Jun 2014 16:57:53 GMT

Connection: keep-alive
...........}.z.....<..N.T......TI.8v.g.]...^..W...D,....H...9......
Mzz&...z.:[.........../..........yQ.E./_1...tj...<?.9.Y.Xoy..I.L..G
3.].e....;J...E.e........<)Z..M-{..myil..p..<.2.j.............ad
..b.%.......,K..X.x.H?.....X.ACJ.~*.Yb......q.....e..G.rG..i..q=:.w.'.
[email protected]*.;.-.rn....)^..v...3qO8u.eg.9;'..eE..Gi.9...r........
.T....9PV...c...X..-...u6).,]X._X...e.....d...-.0oE<....Rl%fr...C..
.9..z.......8.]H...).l..X...D......C.../...#.;...._.tl.0*xF...........
..A.p.@kI[[email protected].<@Bo..n. ..x.".K..Q.<[email protected]. .a.
.X......Dl...n.N.Q.....-.E6.G.....C.....GM`SC.0ja....19R........x.....
E...t"`../.F.;..vz*.m<...4h....#.F,/^K`6...q..f..q.......<...Cb1
...)[email protected]!......4.cE...KA......9..p.5,.....vyN.*.k.&N..U.
[email protected]. u...^[email protected]?.j../.5.....jY\.VM..$..i[an%ia1.j.
.$7....J..K........5.".....1(... F.X.~.|.R.....b. IP..ZJ,....R.ra.'.;R
.A.@".B..!....F..$.. .!..EX..70$,B.Yw,.s..3....1...y...i..A..K.9;...)[
....d.....$].}C..M..Y..!../>.1..;..h.......\_S.a...._.....@..#.5W.b
8..........y^X#n.....N...G...Q...(...SO9....9.|N.hU:..........%..<*
.=j..,Z9'...f#&...N<V8.s...[^.l...-?...V..Xa{....k7..Y...Z....... .
.$.5........xZ9..o.A<..........?t.....=...a... :1.......sew..M.Fx..
.B.L..../...6..T... .x....y0..H{.r......Q.O...i.gv.9F..4)..8?P'..*>
.T.=.g......&.............M.*.....p}7.G<./.)M#..."N.&...Jh.........
..:.3qy..?v......'...`......e....&.....:...x..1...X....=..........X...
...p.l..ar..O......1._.......D.&x;..c...m...q.........T.. .....{.(
<<< skipped >>>

GET /connect/xd_arbiter/DhmkJ2TR0QN.js?version=41 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.ak.facebook.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html; charset=utf-8

X-Content-Type-Options: nosniff

X-XSS-Protection: 0

Content-Encoding: gzip

X-FB-Debug: 6swEE4AaAf6h7tINfRqBk4Ito4z0KpJHXkzpHyWOWHZjPWQpZ97ymZcI3UTkjzzSqCt1FxYnM4E/lLlOECIzog==

Vary: Accept-Encoding

Content-Length: 9213

Cache-Control: public, max-age=31437875

Expires: Thu, 18 Jun 2015 13:42:29 GMT

Date: Thu, 19 Jun 2014 16:57:54 GMT

Connection: keep-alive
...........}.z.....<..N.T......TI.8v.g.]...^..W...D,....H...9......
Mzz&...z.:[.........../..........yQ.E./_1...tj...<?.9.Y.Xoy..I.L..G
3.].e....;J...E.e........<)Z..M-{..myil..p..<.2.j.............ad
..b.%.......,K..X.x.H?.....X.ACJ.~*.Yb......q.....e..G.rG..i..q=:.w.'.
[email protected]*.;.-.rn....)^..v...3qO8u.eg.9;'..eE..Gi.9...r........
.T....9PV...c...X..-...u6).,]X._X...e.....d...-.0oE<....Rl%fr...C..
.9..z.......8.]H...).l..X...D......C.../...#.;...._.tl.0*xF...........
..A.p.@kI[[email protected].<@Bo..n. ..x.".K..Q.<[email protected]. .a.
.X......Dl...n.N.Q.....-.E6.G.....C.....GM`SC.0ja....19R........x.....
E...t"`../.F.;..vz*.m<...4h....#.F,/^K`6...q..f..q.......<...Cb1
...)[email protected]!......4.cE...KA......9..p.5,.....vyN.*.k.&N..U.
[email protected]. u...^[email protected]?.j../.5.....jY\.VM..$..i[an%ia1.j.
.$7....J..K........5.".....1(... F.X.~.|.R.....b. IP..ZJ,....R.ra.'.;R
.A.@".B..!....F..$.. .!..EX..70$,B.Yw,.s..3....1...y...i..A..K.9;...)[
....d.....$].}C..M..Y..!../>.1..;..h.......\_S.a...._.....@..#.5W.b
8..........y^X#n.....N...G...Q...(...SO9....9.|N.hU:..........%..<*
.=j..,Z9'...f#&...N<V8.s...[^.l...-?...V..Xa{....k7..Y...Z....... .
.$.5........xZ9..o.A<..........?t.....=...a... :1.......sew..M.Fx..
.B.L..../...6..T... .x....y0..H{.r......Q.O...i.gv.9F..4)..8?P'..*>
.T.=.g......&.............M.*.....p}7.G<./.)M#..."N.&...Jh.........
..:.3qy..?v......'...`......e....&.....:...x..1...X....=..........X...
...p.l..ar..O......1._.......D.&x;..c...m...q.........T.. .....{.(
<<< skipped >>>

GET /images/merchantlogos/88x31/383_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "80be27a26ee5ce1:0"

Last-Modified: Tue, 19 Nov 2013 21:30:57 GMT

Server: ECS (ewr/144D)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 1487
GIF89aX...w..!.......,....X...........................................
........!. ..  .)).)1.0,.0/.99.9B.?=.@@.......)[email protected].
PN.OP.ZZ.Zc.`]._`....Zc.cZ.cc.pn.pp.~}.~...~..........................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................5..H......*\.Pa...#J.H.....3j.. ... C.
.I....(S.......0Q..I..M.3o...2'[email protected])...Q.H2..)#....`,..!...]
k4..4$....P.p......T...@..!.....,..i].e..I..0b 6......O.fr..Y.uc.|....
.:[email protected]%....?.......!o....#`..R.$B....ue..J......3....\...#..&
lt;.p.!..7..[5Z.4L*......>..E@%C..4.W..:.u*V........}.QV.N....}D.T.
]`]U.U......~d_u.~..p.}D.].Q.@~;0..`%.."I30...)P.A.2.......!H....Z...c
b.ph.G..(T..uh..uM5R.R...Hg..\W..TdZG.).UD.F.e..(.U.......DY...t"."..a
.F....V.....%..."....i.(R.(..%IV..\.!H:hu.V...!Y....F`.Q.l..D...I.....
#.LhZ.H.U...q1!(......!P...H..........$.......U.8V.."Q;.....lZH|;.GHT.
*..}...&.@[.>..[IH.H.eH$Z.j.....:[email protected]....].g...
..... ..T....QC4.l.......;....
<<< skipped >>>

GET /images/hand-peasandcarrots.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "03e23633f27ce1:0"

Last-Modified: Fri, 22 Mar 2013 20:54:04 GMT

Server: ECS (ewr/15C2)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 3091
.PNG........IHDR...Q............D....tEXtSoftware.Adobe ImageReadyq.e&
lt;....IDATx..].u........F.r.#...".......0..#.?..}."@s6.k".6..F0k.[5|S
.nu.....s8c....~..........t.QG.u.........FGm..2.N...Z/..wsQs....y.7|.l
:...V...t.Y.5..=.|.N].J.?.;1.....O..q.E...^>_;...1.w....I=.)_>y.
.w..w..6g..h......n......[Mi....bO}.uV.l;u..^...5U.8.$....A..!...^t.C.
.....  :..i.9o ...K...$..6.]P.2..P.='...g`.o.g...."^. .W..k..$.wd....`
..`W|.5j8.B.%&.@4&#^:..= ....~Lm.T.=...~~:R`..cC...n...%.,...*..~..:J.
.HWt...yY..Q.......))d.!..:.......X0.U-..2....^;.5.....i"...-....9Q. :
...j.(.,'....PD..........YY..\Q{bl...q.0.w...LuO..-J..5..nH.I..B......
.k........P......G..\.A..l{Zw.p....S.3.....16.[k.l7...../ .|..e..,..kS
.y.a_3....z...m>;.... .i Z..u 4......#..B...]0.D..d.!...)G........*
.|.....`N......1..#Kt....4.2..d......&5Y.G...g.T*..kI.^{:.Q....K.5.I.[
.`..a..d..9...)...;O.A........dv.h...5.....m..' .%. ... ..I~..2..*.y..
o.{.WJ..e....C.?.p.e;..{[email protected].*..].==..
..{B..9w&.|\....cJ......-.q.. .q..;....rl...i..%d(%.a..z..,r..Q..\....
}.....8?.........K.>}......K....nz...d......h..}.'.=....7t....2^B`.
z.o...|.}w...-.w!...W.I...2..]86.?,kl;[email protected].... .X.. Zxf.....mM.....
.-J........"u)........l.*.^..."2.....1?...0v.Wd....)..DZ...w.`:U..{...
.....W..i/9..E{a^F.....'3......0s..g..h.......q.f..*9d.[%8<..iI..tY
.p....t...g2.P>;\.dJ.....Z..u...1..>k..n/,.Y[|..T......h...,....
.X.y..P...~..1......./..Q..:..aE.........E ..}......\..K..gx.p.8z.....
..KI.....Fb.H)....|.Q7w....N.5`../1;.CR...)%...l.O]..w3.7......B.R
<<< skipped >>>

GET /images/merchantlogos/88x31/113987_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "804b354a684ce1:0"

Last-Modified: Thu, 18 Jul 2013 22:29:39 GMT

Server: ECS (ewr/1444)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

X-UA-Compatible: IE=edge

Content-Length: 1636
GIF89aX...w..!.......,....X....................!!.)).11....!!.)).1).0/
.::.AA.JJ.RR.[[.aa.mm.BB.JJ.RR.ZZ.cc.kk.rr.{{..........ss.{s.{{.......
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................}..H......*\......#J.H.....u..."...=0.
.......R2p.aFH.0%[email protected]..(.!G...u.(..(N.3.*=(......@................
D|....I.71...4.../^..!.)..r..<1....r.....o..7..P..q..7T...#rc.:..8.
b.......!#...y..x.`....Id..W ..7......o..b..P..@............$>.....
[email protected].......`.{.$.p.............t...3...
[email protected].\Q.. ..h]..@&.0A{#...z>[email protected]. ..*T........9.........7
. BH9....>..U..t.C. ~...*[email protected] '^..i.CH....9ep
..U..ef1..A... .o.....*TU.........dgD1$.^.....@[email protected]...
......C..u...3.p..v.......C.)..@b>.`...^..F..0.....\..........r"lD.
....B...Y..)....~.p....0..Z...U..e....p.. .J....`... l..._....w...>
....-=.jZk.%...u... .t......V>.p..2t...4.u.......fy...k...G8T..
<<< skipped >>>

GET /images/sponsors/88104_secondary_2014-06-18_16-41-15.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "80b77069468bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:41:15 GMT

Server: ECS (ewr/15D9)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 5311
.PNG........IHDR...d...d.....p..T....pHYs.......... ......tIME........
d.7....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:..
..tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.......
..tEXtWarning.........tEXtSource.........tEXtComment.........tEXtTitle
....'....IDATx...[p......s.].......l....1....".@.....<f.6..M.}I^BU.
*[.$..}....L.V.`.. $..._..d]..ht..hzfz..}.Q....8.........9...9....eKB.
..i......X...K..a.b2,AL.%....1.. &...dX...K..a.b2,AL.%....1.. &...dX..
.K..a.b2,AL.%....1.. &...dX...K..a.b2,AL.%...\.$.I.E..l.......0??.....
.;v..'N...>/.......o3..U.....=z..o...x.T"..@cc.=3.....os....m.].. .
..J&.r...b...R.D:.f........t:.....c... >......L&._...E.f......a....
F...m......?......`..YU......E.u...m..h.` ..f.......v..,.x......J.p...
...YU.Y...a...3..p........H.tO..[q:........d.T*e...5SVKK.....B.....5..
n..3.>.>..]...%....#. ..p.,[.5....p"[email protected]~~...o....B..,.u]..
.>.P(.6..)H....t.R.d\..r...\.....s..f.B091a..H$..b..~..[.5...b.d.Y4
M3..........y.T*...|.b.s..NO..gX.nEQ.t...:.A...jvf.jq..r..Nss..7......
.|..._..w.R.!.J.{...)...i.t.. K.7.......f..p8.k.<.H ...p..t*[email protected]
c...UU.......... [email protected].^..G?b..}...E.........|wnv...F0.
.P(.i...133..#..../.U...r.`..u.U....h..l.4.D"A>.7.9..:;;.J.....{..r
..4cmQ.......>..Wu.gggy..w.EY.4...m.t6........l6.....N&...p ..?....
b..s/..x^}.U...1...,.J\8....qt]G..t4....c....R....r.`.....h...*[email protected]
.2ATU........s.:~...7.x.wO.......gYXX@UU&&&8q....3<<.'.OW....4..
....._..G.......k..........d.....3..N...I&...E.v;>.o.........%G
<<< skipped >>>

GET /images/sponsors/1537_secondary_2014-06-16_7-53-57.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0f24c6a6a89cf1:0"

Last-Modified: Mon, 16 Jun 2014 13:53:56 GMT

Server: ECS (ewr/15AE)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 24914
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:558FFA9DBFFAE2
11A5F0917565FF32FB" xmpMM:DocumentID="xmp.did:E15DA670EC2E11E39A73D189
57643B67" xmpMM:InstanceID="xmp.iid:E15DA66FEC2E11E39A73D18957643B67" 
xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:2963253948EBE311A2A4BE3192B461F9" stRef:
documentID="xmp.did:558FFA9DBFFAE211A5F0917565FF32FB"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.......................,..............................................
...........................................!1..AQa"..q.2...BR....br#3.
.....C...s$.S..4D5.F'7........................!1.AQ..aq..."2.......BRr
#3.b.$....5...4C.%c............?..3n.#.$ ...<a......a.`.w.........S
...I.....l.[n..5n......S....0......\...f....G.w),..9g...u..<#Z.....
.Wi=......5(....@.?_.....pqI.B.w.h...T....D....y.(s.....d./..!.|H.
<<< skipped >>>

GET /images/sponsors/1537_secondary_2014-06-15_22-45-40.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0b2c1d21d89cf1:0"

Last-Modified: Mon, 16 Jun 2014 04:45:40 GMT

Server: ECS (ewr/15CD)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 10965
......Exif..II*.................Ducky.......2.....ohXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c06
1 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="
hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.a
dobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6E0DC1C4E6CEE311B
4D8DCB6C5BF086E" xmpMM:DocumentID="xmp.did:9C5EC717CFC311E393459A131CE
E77C9" xmpMM:InstanceID="xmp.iid:9C5EC716CFC311E393459A131CEE77C9" xmp
:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedFrom
 stRef:instanceID="xmp.iid:1DFD2CBCBECFE311B4D8DCB6C5BF086E" stRef:doc
umentID="xmp.did:6E0DC1C4E6CEE311B4D8DCB6C5BF086E"/> </rdf:Descr
iption> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?&g
t;....Adobe.d.........................................................
..#"""#''''''''''..................................................!! 
!!''''''''''........,.."..............................................
........................................!1.AQ.aq.."2....Rr...Bb.#Ss4..
...3.C.t.c.T57..6.......................!.1A.Qaq..."2R....B...br.....#
3Sc4d......%5............?..S..S...y3J*AM...HT...x..p.....ZJZu.)i)i...
..g.y.T..'.....A..>......\......KE.T.4QE.QE.QE.QE.QE.QE.QE.QE...E..
.o.......?5Hj.vj>.(...F.JZJ(.....:i..y..T.Fi..4.*&.*3IO".jU;.@.
<<< skipped >>>

GET /images/merchantlogos/88x31/1900_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0cffb095a8cc1:0"

Last-Modified: Mon, 21 Nov 2011 21:36:56 GMT

Server: ECS (ewr/15AC)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 2958
GIF89aX...w..!.......,....X........./."#.11........#.B9.EA........... 
..... .!!..*.('.$4.14.GE..............)...."'./0.0>[email protected].
ZZ.fb.h\..... ..(........!..(..... ..(.".. ..!.. &.((.(1.22.0;.8;.9@.@
>.KO..u.................$..*..3........!.. ....."..0..8.!.. ". (. /
.!9.(".(/.22..>[email protected]`.[K.[Z.\c.]i.eb.lm.m|.{{........!....
. ..)..4.."..*........"..)..:.".. ). 3.'*.(0.13.08.98.?C.HL.NY.WX.ZZ.Z
b.`l.gd.vq.z......z.....!..).....$..)..!..*..)..2.)?.4<.DP.MR.HV.Nl
.ZT.^b.\l.kk.jr.t|.xp..{....................!..)..$.!5.Qa.[].\e.jm.ks.
sq.}|...................&1.ak.ie.jq.rx.{...}..........................
.............................ll.kk.n..s~.yz...........................
...............................u......................................
............................................g..H....P^<..d...Sf.x".
[email protected]....>..`y."K.r..i...@'.
a"..D...J....D....}.-jT$.'.6lP..)...hPq..E.'.,.t...Z..\(y..C.....|)Qd.
.5..e.dF.Z.V....C.Z..d..e.%L.PE...K.J...$.......%T.xr.%/ X...S6k.[....
L:0`.U...J.M..`... ...5....j..%.gS.....V.p......V..Ys..........HA%RU..
.^A1p....|........1 ... ....h..A-.L .OFHp.....F.z.....uW.`..... h ..O.
.FXN\q._P,...U.....|2L!.....]... "l.A.1..B.b..M:. ...[..A".h..,.....?.
...N$1.#.}.....#K.P<...O.V.R....U/0..U....:..1.7.\.B:..RK9.\..).l..
<.....&......dq......&]..N7.X..y4Lq......!........S..($..38..?.$.Dd
4D ....C../D`...n..........r.......GX...Z...({t.N658...G..I>!......
....\"....@.;[email protected].# .....$3.. *!.. ....C....7.s.$..P
<<< skipped >>>

GET /images/merchantlogos/88x31/119457_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0a67e35bc2ccf1:0"

Last-Modified: Tue, 18 Feb 2014 15:15:08 GMT

Server: ECS (ewr/15C6)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 1307
GIF89aX...w..!.......,....X.......!!!FFFbbbjjjpppuuuvvvwwwxxx{{{|||}}}
~~~...................................................................
............................`..............[........r........b..b..]..
c.....Y..^..^..m..............u.......................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...................................H......*\......#J.H.....3j...... C.
.y.P%........A.$?.9Y....-.....eL.Ph...F'..<y....N.M..i..#.R.;..]:..
.0.:M.3$....`~J[.m..Z..}...@. T..r.E..pVV"B...CJ.........2`0A....%....
.Qc$v.J...J.-S.T...@Z.. T..h.........O..x...-D....B...#..%Ep....5...(T
.C.'......bY..."#.xn.\G.4.$5.c.....:.....v......4}...D QB......|<b.
K....... ..cx!..$..][.....D....^[email protected]...!.d.].-}........D(.H
..(.\..t2#..`....8R..;>p.......d."$.N @. 'LpH..|.D...R.'S..I"m....4
.r.azd`h.g...K.]`...8"F.'.B.r.f....v.....*....j....*P@.;....
<<< skipped >>>

GET /images/merchantlogos/88x31/6053_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "09cda74172acc1:0"

Last-Modified: Mon, 13 Jun 2011 22:15:52 GMT

Server: ECS (ewr/15B6)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 1515
GIF89aX...w..!.......,....X................... ..%..!..)../..4..:..@..
E..B..K..S..R..Z..a..g..c..l..r..w..|.................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
...................................H......*\......#J.H.....3j...... C.
.9P....'LX..@..$16`."AD..:..."....)..p3g...N....@......)....K.:......8
;..P.BA.?....U....2.@.....%&.]@..K..N.8qa....S.@ 0l..%2...W.....B .b..
..;.. c.... ..]v5..'F.x.@...._.t..@..&d..!`.N.0.....8...I.......$.t...
....]......o..5PH.bA...b...Q4....G...:..0.5....P.. .........(.......`.
....F..T..-D..f.IH_. ...j...Bf.f."N.h...', ..2.... ....A6..K..gS...6b.
....M....i.,..u.0....=.#. \....\.@V.......`.z"d@C..........@[email protected]".
..8...H .N .P..2x @.b..B...`....H.......D..B.........d.l,(`(.....h5a(.
[email protected].$pB........`[email protected][email protected]. 
.....gK.........,h......B.......X.B..*....).UZ.!..J.y...............W@
.*.%..*k...L.<.."[email protected]'...L7..A...;....
<<< skipped >>>

GET /images/merchantlogos/88x31/5726_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "8082f72a27d4ce1:0"

Last-Modified: Mon, 28 Oct 2013 21:46:33 GMT

Server: ECS (ewr/15DD)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 2507
GIF89aX...w..!.......,....X................................%%.........
. #.%(.:4........!.!'.-/.LP...."*.$/!(,")0 67).$( 3)0;*:;&FB-."1!2..43
.928;07B4=H4HL8.);.29999<A99B9AJ9RUA.0H#<A@FAHRCSRCU[IrjF0AILTLP
UIQ\R.7V#@PP\QZaTkq].;]5O]NdZRZ]Zh[`fYiog'H`Ygackcinbrxiktklykx|kw.l..
k..i=ZrJesRkptzty~w}.s}.p..xy}|..|..y...2W.Wu......................Cg.
Kt.s.................9a.=h.Sw.a..............S....................Jv.^
.....=m.U..............I{.`.....J{.N..............T..............N..a.
.h..s..............F..Q..[..............D..I..Q..T..X..^..`..e..c..y..
.........>..C..E..I..K..Q..X.._..p..........................7{.5..:
..=..E..J..P..N..Y..Z..d..{.................;..;..A..D..H..K..Q..[..Z.
.f..a..t..x................................6..;..A..D..I..K..R..S..Z..
Z..a.......................................[....d..)\...1[..Y... .l..&
.(......a;v...w.S.\.RaB.......V...<.....1l...B...-m.L..G/[-Z.P....X
..X.......\.f]....1[...C...;Z......C..0.xb;..F.Y.......Y...<X...d..
.C.O....8..a.....Rx....H..S26....Z....\K.;d.H,[email protected]%.C&....l..v.V..
[email protected].:P\@.k..s....,..zJ.........1x...#.H.H!..1G.
(..C .d._j.iT.N..'.H..r.......m.B.!..b. kl.D.....'.......g.P.mC.2S..@.
:Tq..t..G.u....k0...,,`....c.O..r.5...M-..r...$..).Xs..?..U-.|....d...
UT.E.l.Q..W(...E|[email protected]}.bM1..rK1...Nd....<.T..)r^u.-...........[
.i..W\QD.T.0...HA_A[f..2...#6....<.(..2....1<[email protected]$Q..x.Q..
ET.D.8<....t0.<.$%.6..2iN.xR.).(gK%.L[M.,.r.6"HPD"......,..,.S..
%..`..j8...?M../..B.-....*.t..(....8....;....,.h .... ..k.....0.. 
<<< skipped >>>

GET /images/merchantlogos/88x31/527_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "809ab37b5d43cd1:0"

Last-Modified: Tue, 05 Jun 2012 20:55:05 GMT

Server: ECS (ewr/15E6)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 2009
GIF89aX...w..!.......,....X...........................................
......................................................   !!!"""%%%&&&(
(()))***   ...000111444555666777<<<===>>>???AAABBBCC
CEEEGGGIIIJJJKKKLLLMMMPPPQQQTTTUUUVVVWWWXXXYYYZZZ\\\]]]^^^___```aaabbb
cccdddeeefffggghhhiiikkklllmmmnnnooopppuuuvvvwww|||}}}................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................................................H......*\......#J
.H.....3j...... C..I.$....... ......L``......8 .A......9@(...`.....S.:
_.H:p.N...NM.....W........."......*W.0.:u..)L.......'j....$.N.....#HM.
..d.H....$.|*.........0<[email protected][email protected]. .,Z.l...Rf... .
.......2......Zz...{ ...q......W .;......g.....A.H......mGV...,...E...
..8....@.... ...8|5......R...."?....). .S.....^)..O.."..@%%....PK..`e.
.>..F....@.....~W.r.a..b..@!...).D@[email protected]
y..!*(.W....C.6HP.Mn...... ..]....L,..-.d..).p..@'.B.L. p...,..->..
..M........R.XA'.......9-...............1.,m....S......`..{L....F....(
.SK...G#....Jq&.I".p0....J.."<...0..B-=.u.L..p....".rar....4..&P..a
KXu...q.g.*.(Q.*N.d.P.H.&!.`..xC...r .0.,>[email protected]?)hb..p0...P
<<< skipped >>>

GET /images/merchantlogos/88x31/23436_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "806b8aa53b3dce1:0"

Last-Modified: Fri, 19 Apr 2013 20:22:43 GMT

Server: ECS (ewr/15B3)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 1811
GIF89aX...w..!.......,....X................................{..v..q..n.
.h..e..^}.a..Xu.Ur.Sn.J`.Ld.H\.>N.EV"CR'AN,5;1DM9.2:@E;4<@INBKQD
,,N-,N0/S- S21S==STWX**XGGX[_\(%]1/^$!^LK`TTa[[c`ad%!gikl%!olmp&"pnotr
szxx|'"....(".("....)"....*"....*".... #.,#....,#.....#........#.....#
..../$....0$.0$..........1$.2%.3&.6).7 .8,.>2.E9.G;.J?.MB.QF.WL.XM.
]R.dZ.j`.pg.vm..v.....~...............................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................H......*\......#J.H.....3j
...... 7....MH.EL.0....6<T...qd..'.E.ArK..8^..q"I..S..Z....;x.!<
....C.....%K....>.....Ay..R.$..-N...BR..-D..E2.../=K.".h...i.."I%K.
.z....x...~..>#.....vP..`...;...r#J...a......*.I.Q..gn*......6..ub.
... ...0tH.....Pd(z.B...U...q..'......$g.a<..P.....?....3g..*j(....
m...g.vHA..`.t.....FQ...L t..a)..`[.VHO~...I8.A NMQ..Y..q.".....k..GOl
.....(....$..hT.....:..A...Hr..!..b.W.....b.$...IY.Q...rQ....p...,P..P
.0..G..ac}...{[..Fe.e.c.]...{....I..tGWY.(P..........I5....Mf..A{.....
f.....6.%..-......h.........@.....{G....V..#[email protected]=.Q.Z...FA
*RA.AHHPl...qD.G.1........v5n".~..".....':.G"f.........k...Y.......a..
.....G.pC.z.......E.d..Y.$...e....{=........!.pq....V.#W.d.u....[.
<<< skipped >>>

GET /images/merchantlogos/88x31/58203_sm.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0857cd88224cd1:0"

Last-Modified: Fri, 27 Apr 2012 14:34:26 GMT

Server: ECS (ewr/15CB)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web03

X-UA-Compatible: IE=edge

Content-Length: 1627
GIF89aX...w..!.......,....X........-,..-./-./..0/.1/.10.21.22.32.43.76
.87.98.76.87.98.:9.;:.<;.=<.CB.DC.>=.@?.DC.FE.HG.IH.LK.CB.GG.
IH.JI.KK.MM.QP.RQ.UT.SR.TS.VU.WV.XW.YX.YY.[Z.\[.]\.^].`^.\[.\\.^]._^.b
b.dc.ge.fe.ff.gg.hh.ih.ii.ji.kj.kk.hg.lk.ll.nm.oo.po.qq.rr.ss.ut.vu.yx
....qp.xx.{{.}|..~....................~...............................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................H......*\......#J.H.....3j
...... C...k..A#56Sd.P7.k....2...2...9.f..7s.|.s.Dv...$....t.......8w.
..k.4.N.F.6.....Z.....k...A2..W....6.T.W...&9T.8.%.:.........,H.L..@..
.\.5,*s`0..B..S-Rh...H.y ..(.z...7^4'.z.$P.Y<R.B...B....(.4..g.w.v.
Dp.[.H3.0..`...,...P`|&.w.../........#..BO..g2g.........@........@O.@A
I.....6.....ZX...3...}[email protected]..,...
..x  ..2..."....'....-....L....<.... .12......L(...6z. B.!......PLT
.u..Q=.....`E.L.h)P([email protected]//.0....w.r...'e.:..)..TC4|..A2.1*S......
L(.BFl.d`.%......l*......P.:...=.p..2...L.B.f.?...#.Y.CO.VV,A].`.X..S.
.3...7..$............Mbq.4...l.L.[.,t.d..^..eg..s..^t.*...j/.(."..2=0.
...L....C......8c.0.....q<..P..l.........v80S.(....J..DC..". .i
<<< skipped >>>

GET /online-shopping-report/wp-content/uploads/2014/06/shopgold_400x400-200x150.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "1249e0af578acf1:0"

Last-Modified: Tue, 17 Jun 2014 18:12:23 GMT

Server: ECS (ewr/15BF)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 8285
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".................................................
...........}........!1A..Qa."q.2....#B...R..$3br........%&'()*456789:C
DEFGHIJSTUVWXYZcdefghijstuvwxyz.......................................
......................................................................
.................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*
56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz................................
....................................................?..o.......h<..
.=.h.~D......m^I.G......$(......(..W.>..../..........H.zzR...W.F[..
...srO@h.(...........Z..g.~}.h...p......K7.=?........b.........*.....c
I..^....b....`F..EQ...J*......gw....A8........~......;.....U... .}....
.Z._.I.3I..O..D.F09n........*j.A..........<.a[..........c.~s.z..>
;w.=....%..............9s......rxQ.Q.........8.(.(....x_..h?>.x....
..Ns....O./>...v...z..('o.9'....|.....0'.........O,z.J...O,z.J..77$
.... .1.7$..........:(.$(......).......I.. ...R....#[email protected]
[email protected]......~w.........oZ0\.c......K7.=?.....T~.._........w...).w./.?.Mz
...n..-...O...o.....n..#..RW'..#.9.32....uq...M6._..y..]......)|Si/...
.>......{.............pT.........{.<..xv.Aaaok.............'o..W
w^E.Q;.....Pp.ld....z.o".~...3..S.....J..M..i.tv......?.x..p9&.*.5...O
Y}......5..u.. .................\..4C..}.......)...o.Y...~...I...K
<<< skipped >>>

GET /online-shopping-report/wp-content/uploads/2014/06/fireworks-1395846-m-200x150.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0d7ef18c85cf1:0"

Last-Modified: Wed, 11 Jun 2014 15:51:00 GMT

Server: ECS (ewr/15B2)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 8081
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".................................................
...............................................q.6.......{...V..'N.11.
e1.V........- Do.#z`....D..U.M.......].<......=.^..7..........d....
.k..gdL.a.5W..F....T..e...V...T...g....._.._KM.>....m....t.....v..V
..u...?....I..;..zj..#U.|WOS/..0..k....-S...m(,'Q.-...c....4j.R.`.x...
...N.....)..N.... t<..u..........N.>7K..w5....c......<.2.e.&.
:~...>]=....zV.o.g.(...........:|.......S.B.n|..............}..e..c
|.%..,... ..a.9z.....)............................. !#0."12@`.........
.........}0.... ....).V..<1.......Q..s..3..dD..B...%...jC.K.F......
..>.".........x.."./..T. ..".a.[ZR..x........Z.u...~..r..\.....&.f.
TUc...S........0lr..f0..td.lT....d.....rVC....Q.V..O..g...e.... .1...I
.>.D...n. AJ.'.Dy.I.D..;.`.zx,.....l.0(.V...5..3...xxL..,..Y..?.d..
.......Pa..;_`X.....a{[.*.`..I....1/....j..A.. ....W!...3\1.5G..A.....
...C.Y..F..i..p..T..[.7.b.S&.A..f.t...* y.:..I....=.xj..M%K...l*...V.4
.....M.{.....;M.t.wk.%.5.....,..L....0....y.9.Z0.*c.C.gQ;[..._&5....OV
..J...T...Rni...=NL.._RPf.......3..u....Z....;B...Y..._.5..0.O....d;[F
....X.[...._:[email protected].......?Lx.Wy$.gf.|/N.....`.........q.D.wy.."..6
....]...&.6..:.9..........y..5....i..{....]......]..2....K`2.:..h.v...
....&E........^)..p....fg`.|,......../g}]s...3P.T....d.._...(.....
<<< skipped >>>

GET /online-shopping-report/wp-content/uploads/2014/06/Polar-Heart-Rate-monitor-200x150.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "e086f7e4b685cf1:0"

Last-Modified: Wed, 11 Jun 2014 20:51:18 GMT

Server: ECS (ewr/15BE)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 6591
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
...................."..........................................K......
...................!..1...AQ"a..#23q....BR...$%br.......5DSct.........
...........................$.....................!..1...Qa............
....?...J...R.....iA. ZPi.P......g...>v......(..d.|...4~rB....m...F
K.n;. .)I$'s...?._..V.k..hK .~.....`H..s..}....=k..~..G...a...kK..[-.)
...aJN..y'.T.n..........6............zj.l.Z.m.R.[..A.._.Bp...e.V...8..
.u...%. R...z.r..}.....b..:o.P.^.H...SL.R........8....^#..K...>...A
.]k.....73P_/........Au.u.O>MWMqK....^....r.........Y..._p....*-.mG
.....=.F..j&..TN.$n2:.....Xq.I...Zk..G#..rJv.......6.. .N.k.o.........
....().}@.Y...p 9.o<.....Q.BH..L..[..N..d.............. Z.v...l3.R.
.5.. ...G.B...1 .......6...k.#d......x..J.Ij[..~v.....W...pf.n.6:....C
....I.~...J...R.....iA.)J.)J.)J.)Q.(.R....3RjIB$..%#...~...5.J.......%
.fj ..F....$..K..[@.'.W..3.....g;R_....!..'.a..(N|..w.>.].o.x....:.
.....r..Fk....j.~......... .rI!-....oY]...........u...:'.p>....8A.$
gj.8ql..2.a*.Kt.....% }...q..6.p._....)d.D....*1.mx..:C-.....FN...>
.B..k.........f.~'^.#P..Ox.......\ )d..BO.k..Zg....B.T..Nq...2.|....Q.
.r......6....R.v..w.g..p.(<.QmQB......J....bJW...o].*E.b..L.g...O1X
T......q.}.c....i.../.......b.....>._.o9...>.&..u..4...L\[}.....
....y......._. t.m........%....R...`.|(;4.(..(..(..(..(..mZ.H...kM
<<< skipped >>>

GET /online-shopping-report/wp-content/uploads/2014/06/wedding-dress-ann-taylor-200x150.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "79d4693ea80cf1:0"

Last-Modified: Wed, 04 Jun 2014 15:32:50 GMT

Server: ECS (ewr/15E6)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 4804
......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), qu
ality = 90....C.......................................................
.............C........................................................
....................".........................................;.......
..................!1...AQa."q..#2..B.$r..34CRb........................
...........*........................!1A.."#Qaq.2Dr..............?...LE
E..........d..b.u\,...i..3.$Tq..1..{)......X...lh....l>.......|.<
;.g...w...........xqC.o|..8........@$..*........Xz.i...7..KQ'p....~.\.
w.Z7'..4=j.}J.E..GSGh|...n{c....80;.a.?8..'..S..Q...A.6.K..FL..S.RP...
..L.^.....v.;.O..._O..".]).O.T9..p.?.P..'.04~......3ww*..q.4..j.T....W
..\...t....X.].)*........#..z...Y./.h=m.j}gM.|3..#..7'#.l.e..b........
z8...S.O...bw.\.r0O..lN..:J.-.4...Q...Ukj.-f.K8{\.F.ip.y.W5...M7.e...Z
-%.L.;.CI."[email protected],>.).N...4|..,.%.D...
_;9P..g..#0Si.....e....Q}..$.&..Qp.Q.xF..b*...#ab..p.A.....F..%...Q.H.
.....f. .....5. .>.Z./P(:q`.*....f.SS0...vHh>[.I.....n:.Qj.;...X
.h.cu..|d..Ws...[..V....ru...Yj....5....V\ .[IF....V...gr...{..q.k.!q.
....=.7......6i..L.a#.......q.........k.k. j.....Y=}t.{.....h.X...O..0
.O ....I...|@X.<.#.....o..^...J....4V~..?.r.)....... }Tf...<....
.i.7.......%/K......EKQUS.t...cK....r..;.>.Z|.v.../.u5=4......di...
u.......L...R2....#...3...9..6.r.....1..Q.z...(......M......ocN.2....$
.}9..H..]N...x...K......S.\.V.r..v.%..N......WK.5.F.9..=.88...G..w....
.UR..o.....S.B..qD..1.`5.l.....ki.{.#7}r..:O~...;d..8.ibl4.41..`4.
<<< skipped >>>

GET /images/email/black-seal-96-50-belcarogroupinc-3102.gif HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "80f0fdbade8cf1:0"

Last-Modified: Fri, 03 Jan 2014 23:51:33 GMT

Server: ECS (ewr/159E)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 2058
GIF89a`.2............................!..XMP DataXMP<?xpacket begin=
"..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:
ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57
:01        "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-r
df-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="hXXp://
ns.adobe.com/xap/1.0/" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" x
mlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:Creato
rTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:F94036
FA74D111E3BEA8CF791A45B470" xmpMM:DocumentID="xmp.did:F94036FB74D111E3
BEA8CF791A45B470"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:
F94036F874D111E3BEA8CF791A45B470" stRef:documentID="xmp.did:F94036F974
D111E3BEA8CF791A45B470"/> </rdf:Description> </rdf:RDF>
 </x:xmpmeta> <?xpacket end="r"?>.........................
......................................................................
...................................~}|{zyxwvutsrqponmlkjihgfedcba`_^]\
[ZYXWVUTSRQPONMLKJIHGFEDCBA@?>=<;:9876543210/.-, *)('&%$#"! ....
.............................!.......,....`.2....x...0.I.......`(.dH..
`[email protected],.Ci..F([email protected].*@ ..?....".P. ......M..RYZ.x."G.....f.9n.J.
...y} ]3~.l.D= s0..b.D...t6q.... .@....?..[>.X0L./...s..XxeD*....S.
-*..P........_....P.?........2q..:Du....._._Y..... _.M...Mq......4.).A
.>t.68j....x.j..Gl.<^.^p.........}a.. .&.v...2....,.\.PCFT......
..bCVe.........j..............Wud.:.kV.Z.z.h....^.u.........i{..N.
<<< skipped >>>

GET /images/header_deals-today-gone-tomorrow.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: i.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0c4816b3566cf1:0"

Last-Modified: Fri, 02 May 2014 18:36:24 GMT

Server: ECS (ewr/15D0)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web01

X-UA-Compatible: IE=edge

Content-Length: 4828
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" 
xmpMM:InstanceID="xmp.iid:AE09EE86D22811E3BD6DCE69BE1C7289" xmpMM:Docu
mentID="xmp.did:AE09EE87D22811E3BD6DCE69BE1C7289"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:AE09EE84D22811E3BD6DCE69BE1C7289" stRe
f:documentID="xmp.did:AE09EE85D22811E3BD6DCE69BE1C7289"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................#.T............................................
..........................................!..1A...S.Q.aq"...2rRb#....B
...5.3csT........................A!1....."2.Qaq....#.BRr34............
...?..K&K..S..#H.J7..n...5..O.D..'..Rg.Z#...-......T..U........Yt.lK-.
f.....%:.B.T......Zv6..f..2....".Uo..#.%.JIZ.JE..&.ue...I.....ac..,.[.
:$&....6HHQ...l>U.cf.c.o.*..M. $.}.0.J.eI..6e"...j...O..~..-<u8.
24.C...4I.B....F..].Py...(<>.....k.).....i?.15.....).(W\....
<<< skipped >>>

GET /?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Pragma: no-cache

Content-Type: text/html; charset=utf-8

Content-Encoding: gzip

Expires: -1

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

Set-Cookie: SAHSessionID=6c6ab666-73af-442a-8122-b0db834e9f63; domain=shopathome.com; path=/

X-AspNet-Version: 4.0.30319

Set-Cookie: SAHSessionID=6c6ab666-73af-442a-8122-b0db834e9f63; domain=shopathome.com; path=/

Set-Cookie: SAH=SRC=REBATE&REFER=960116914; domain=.shopathome.com; expires=Fri, 20-Jun-2014 16:57:44 GMT; path=/

Set-Cookie: CookieCheck=Y; domain=.shopathome.com; path=/

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web03

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Thu, 19 Jun 2014 16:57:43 GMT

Content-Length: 17896
.............V.9./.....{P<31..}..!&..C....<3.,..-....=}.<....
./........Jv..>.m.1...2.....T*.~U:..~..^..:.<..x.........\......
.g..JWWW..Z.r..J...]c....V..D.>UY.....5*U..V....".5.3[..8b%...?\5..
.....O.G......NN..r.\.~.....kO.....k..m.t.Kr.X#.lZ.s. .I.!.....`.."...
.or:......1d...DE.G..D.R.e^'.{}..#%.n.....^..mO...Q-.c&dM.Ht..-.!.....
l..K.....-..-|b.&..8..b;.....&.jjDc.p.m..a.1..6"jX..L....P.%V?...;.-..
@..q..b..e.*.>.:...<.ZA.*..R.h9fQ...~...G..U6..d.......;...qzBF.
.. 2.]{.........nj.U..d...../...o7.k.SQ7....o...P{nU~P*E.]A t....r.q,g
#.EGE.Q4.Q...s..L..gcx.hO....f..P.....qo.....Ze..x.5]...C.px..........
..........n_.u............o...6.v.:...O...L......V.....kPsm...n.l.k.j.
...|[email protected]..$$z_y...M....uX.....K^.,..o.w.,.7.......
,...........m....o77k..|..).n.KVQ>*...AQ......e.a.. ....j....BXr.F&
gt;ERA.......u:.bP.xC.e.x....%A..f.fE...o.f.z....l}Y.y.Y.......W?.E...
...>.q>{a;..V.../yC..<.K.<....../..KK..~ ..;..,.`=..G.._kf
... .".&.c..!.o.9n..)|..R...LF....hGnY..m.U.0f.J4...|.v....R.^...\'.C4
.xr|4.|i.........E..<K...:../....[.-.....Wt]c.r.B.7"..#x,-S../.F...
.>...YT....2t..kv...0..m........e....... .~A..L3S......ps....o9.n..
<.,[email protected].._...........('|.&.d..4........YX.J.c..n.-.......
..5K..q.....m_..}..J...TH.<..yz...,.r..Kt.r .7\....).7....n.. X.>
;...~....a.X...f...~y...A...d.......UxQ.V.S.3.S@...*.Y&...........`..P
.Y^..q_w\.7..K...I].....K2g...}.....n.....O...<.jb3..wr.`.C..)~...!
PFA~..1.Q ;[email protected]...{.D..f6#`.b|.bRs<5.....3f.i..#..x.
<<< skipped >>>

GET /WebResource.axd?d=utXq0EopSmH_wSGx3BdZvDyYLpS5Ff55sDuYcl5aUvI_mXIJL5BpykW6xvZro8cCJWqYDkZtKLBu4ajxaGC76D-cQPk1&t=635195457660000000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.shopathome.com

Connection: Keep-Alive

Cookie: SAHSessionID=6c6ab666-73af-442a-8122-b0db834e9f63; SAH=SRC=REBATE&REFER=960116914; CookieCheck=Y

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript

Content-Encoding: gzip

Expires: Fri, 19 Jun 2015 15:54:11 GMT

Last-Modified: Sat, 09 Nov 2013 05:16:06 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web03

X-Powered-By: ASP.NET

X-UA-Compatible: IE=edge

Date: Thu, 19 Jun 2014 16:57:44 GMT

Content-Length: 4391
............io...{.......,.....*.B..]..mXJ6...hrdqC.*9.-...;'97.8i?4=,
..5..7o.....&y....N.b9..Kx.F_.Wx......4,...z...._/......I.b8...E.^u...
.P.]....i..............x...O....I..8yCO.6P........ky.T...BD.....\M..U.
E.z...."[email protected]....?i.8..=~M...$.. .=.. .5(.)$B..c..=.%L.".A.f..yp....
.H.....7.z{\[email protected]..&6..S....^.=...`.d .;........u.Z.
.R.......w......b.h...>7."....ZxiX....;......?...&.......;..E.TT.J.
.peh.(^.#h,....8...G.......C..k hN.}...>.....`.R......3..<.o....
T..f/.]d.c.;.a.W6 ..3.c>........e.......S.]..F.yve..........* .....
...'...I..n9..@.'..8L.;D..x...QQ...#P.r.E."..u.A1.3..'.~.f`\68I..M.rH.
4...Ox.(..._.`.E......q.C$.l.......M...xt~~4....x.{...'Y...$p.H.uM.jt=
z.HL..q[*1N.'.O...G.g....... Y......V.].]<...>....L......]......
...]>.?........Q..E..I)..TG$.?]...".......|.{..tz.w......6..@......
x.."[email protected]....).J..8&.................FM.>LM....8
0......<O..KO.4=M.....$..R0Is....[..#......G.z.3....,o.4n=......$%M
....r..9.zyV .M.QU.-..........U....U....."...z.w...(....yAC.M...n..'.#
R3.V!\........?.z.X......{...c..F.x54..... .w%,....c/._.fY...._.?*...E
...F.*66..............d.CM.c.E0..Y.....%[email protected].
..."<..)........L}......Rrd........)*2..?\.............y...H....C.X
 B.5.....r....."[email protected].(.>..Z9...)!..?..w,s<P.(.o
...`[R.F9B....P..Q)..#...$&.....P.../`#...Q^ .c....m........i{..nR.C..
.....2O....X0..$..M..z...S0....Y.a.FlM#DHk....."b..Q[..V..............
x..q...^.&(..T."..Q...q.....oa..^....5..T.R.q..B..Q......BM.6...".
<<< skipped >>>

GET /js/91114986.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.optimizely.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: max-age=60

Content-Type: text/javascript

Date: Thu, 19 Jun 2014 16:57:45 GMT

Etag: "5ccbba2ab3407f4bcd5b77b4aa501fb8"

Last-Modified: Thu, 19 Jun 2014 13:40:46 GMT

Server: ECS (lga/1387)

Vary: Accept-Encoding

x-amz-id-2: oc8OuBl0HWSC 896wmYdE9jzfhovl6psBdl7mGBKPXvkQBOXVQj7V xN98zkUxL9

x-amz-request-id: FA863F44E0FE7B90

X-Cache: HIT

Content-Length: 78352
....]..S....k{...0.}~........_.K.'...i...........A.1E..hY.....6..$A..(
Y..66E......~...H.D.dt>.w8......So8...(.<|...|.g....<....8z..
,...... ^....Q..].......0.......#J...[vt......gI2..99>~..........o.
.h.'g.y.?.H....Y.&Q4..3.......yxz.M....W...G..9.BsC.1..... .O.....?...
.........|...v.3...3B....\......0.R)....(x.C........a.........q.?.G...
{.RF9....N.....p...Q..P..G.O....n.....>....8...@R)#.....au..7o.2#9.
Z..'[email protected]....?.E...OF.B...$......]..PBI...{.5.>SV.. .?.$.,NF.
.....G.I.*.$.?.'.g...n...Z..8.g....\....8=.Ix1.....RLXJ..|.)..p...t>
;.uN..?O......P.hi....B.<..........Rl....=..p..o.Rg7..J.Y..{....LhJ
i........h.'.x.tnT2b........3\...K ..F....m...!.....?.p...GL5...C4....
.f:u.%......1.eT`mRj4....Z....x4......DzG....2Ec\.p8.....&.....?......
..a..&[.......]......#.eV..............!DJ.~...8. ...g.F......k4.-...a
}[email protected]@.EJ.*..!...R(......p
.......V.A......._a.^1&.x.].X.{..UT>..O......-.l....-.li.&.....`...
....(... .e'........w4...<..............-.....My.?... `s....../..8.
....S...l\.2B.`^..u.p`.a..$8....8..9...&........ ....l.v.%|...$Z@...!.
.......8.9........~.z]....)...]z.(....D^r.z?...5.3.!}.................
r....k..@..'x..o..(..s6..mp"...E,,.......\....jo..n.^..........{.~....
._.....a8{.l.hI.<..x......w*..v....$............W5..;......\M8.R...
.Qs..&.d.....U5..j.W..?.RI....E...;.....9......A.6....l*j=.j....:.....
...Zw.3Uk..OI.3...m.J....)...'l..wL..x...zN....(Z..q[..sZ.. ..Z.ZVg}.Q
.zw...{Ku-Z.E...5.u A..u..R^..9.....l..N'GW....(4F.......8.....9.^
<<< skipped >>>

GET /1/eabd37c669?a=442317&ap=2&fe=6750&dc=6329&tt=3B8AAD7D039242EF&v=411.b2946c1&to=YlVRZxFXX0VWVkMPDVsfcmAzGVVTUVRCChYbUUBDGw==&f=[]&jsonp=NREUM.setToken HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: beacon-1.newrelic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Set-Cookie: JSESSIONID=616240eccb9191c6;Path=/

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Content-Type: text/javascript;charset=ISO-8859-1

Content-Length: 21
NREUM.setToken(null)...

GET /en_US/all.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: connect.facebook.net

Connection: Keep-Alive

HTTP/1.1 200 OK

ETag: "fc5e9a096500f05f7cfd6fd3e600720f"

Content-Type: application/x-javascript; charset=utf-8

Timing-Allow-Origin: *

Content-Encoding: gzip

Content-MD5: OuTkpPl0lLKwdSQRT/lgCw==

X-FB-Debug: b8sZOgTJoHgiQ0awJtQ1sUuCwTO7cUkqmZrhLh3OMvPWEfPuU0UK5fqQwIWolMr5xdd3AdL Jg24UTh8Qr2Hdw==

Content-Length: 53829

Cache-Control: public, max-age=1200

Expires: Thu, 19 Jun 2014 17:17:51 GMT

Date: Thu, 19 Jun 2014 16:57:51 GMT

Connection: keep-alive

Vary: Accept-Encoding
............k{.H.7...O.=3.jd..:B.|.q.v..[U=.3..%@.q.F`......_Df*%.....
.......cddddddD..O..j....<.=.......&.$...3..I.tyx.....O.p....O.....
?.......t9.z.y.}...q<,}.t......N8I.ni1.......^M...Q9^...,..JG..j...
i.......p.j<....tr...7.>}{./...c>[.VW..._U........b.@.%.-...2
...pt^.K....qg1.'s.T.).U|.=....*..y..0....`.)....(.f.M..Rd..Lr...Zo...
.."........t.|.GK....[-._.E...|...]...b6)...Y..A..s...Yx..f..ju.)V. 2.
........tz......Qu....I0.:i.....~...b.r..4........0........j?H>_M..
.i8./...*`;...AEv..eP.\..,F...?..J....n6.ge.#.Qr*a.)Q..I</..pR....$
.:n.....m.....j7.&^....p.....7..g.sj.%G~.1z.5F...J..y._.7Gg...$...y}..
..Y...........)..L.A&]..2.gQ....K..P....."..h...v........q;.N.I.<..
^.<.......t.,...m`..A..I.@....{=...7_N.....;:.qW....z..<LI.[...N
0.9.T....-.........H..#[email protected]?J\,.ny.....f.`Id5.....<..........R
.Lh....`....E.P.;.PR..N.B../[email protected]..).NAn."...a.R......MJ...98#...F
..(..U...?j.Tj......<...:...x4"...18..=..^C2....V....O...P......rn.
...sx....>.....A...........?..O}..=.c..<.E....ab.......sC.:.../.
...v.......6....y.l....F......E..*..!iD/[email protected]....`.{
X...}. ......X..Q.x......(...v...HB...A)....1^.....:.`V..<..`.c.$..
i....a.l..b...i....\.yw7J..`.) zs.1.ju.R....:.N..S>q..au.....I.`.4J
.R.........}s%...LQ.q:S2Q.Q......~,...k.P...Xh.B...F.YH8....<..4...
..>.y...,[email protected].!..._..|Z...,%....[.%.|.>...
./........q4).Gp].x5..Ts.Y...e5..K...A...'..1.......7q......4H.4r].R4;
....X........ </O...m..X...Bp8.&.......<.&....QD.......x....
<<< skipped >>>

GET /event?a=91114986&d=21303474&y=false&s172491114=direct&s172437468=false&s172419741=ie&s172406886=none&n=http://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID=%7b55575A94-3A40-4D8A-B305-A200D98B105B%7d&ae=no&source=91045&subsource=50193&setupguid=%7b618968ac-6931-4f12-8585-7b1e78e04011%7d&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=&u=oeu1403179387100r0.6311023321519293&t=1403179387178&f=1006681359,1140372338,868243247,1137681340,955580750,1126901197,917044067,1137800424,1004574052,1342541934,786269042,702098547,1244112341 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 91114986.log.optimizely.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/gif

Date: Thu, 19 Jun 2014 16:57:46 GMT

P3P: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"

Server: nginx/1.2.7

Set-Cookie: fixed_external_91114986_end_user_id=; Domain=.optimizely.com; expires=Thu, 01 Jan 1970 00:00:00 GMT; Max-Age=-1

Set-Cookie: end_user_id=oeu1403179387100r0.6311023321519293; Domain=.91114986.log.optimizely.com; expires=Sun, 16 Jun 2024 16:57:46 GMT

Content-Length: 35

Connection: keep-alive
GIF89a.............,...........D..;HTTP/1.1 200 OK..Content-Type: imag
e/gif..Date: Thu, 19 Jun 2014 16:57:46 GMT..P3P: CP="IDC DSP COR CURa 
ADMa OUR IND PHY ONL COM STA"..Server: nginx/1.2.7..Set-Cookie: fixed_
external_91114986_end_user_id=; Domain=.optimizely.com; expires=Thu, 0
1 Jan 1970 00:00:00 GMT; Max-Age=-1..Set-Cookie: end_user_id=oeu140317
9387100r0.6311023321519293; Domain=.91114986.log.optimizely.com; expir
es=Sun, 16 Jun 2024 16:57:46 GMT..Content-Length: 35..Connection: keep
-alive..GIF89a.............,...........D..;..

GET /images/search-input.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:45 GMT

Etag: "0329242d48cf1:0"

Last-Modified: Fri, 03 Jan 2014 22:36:36 GMT

Server: ECS (ewr/145A)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web02

X-UA-Compatible: IE=edge

Content-Length: 1181
.PNG........IHDR..."...!.......yl...dIDATX..WklSe..i;X7.]..p\.c.4.....
..E1..!!...!1..#._H.a....C0.u`.-..@@..C77...2......mY.QXy.}.t.N{.J9...
.|......<.{,. s,q.....`. [.CL.d....r.f._L.#...<#.)(.8.......2A. 
_0Q..(!..6A.`....s.;..O}....JX..B............f2Rc.VYb1B,"vFa..v.....G.
B.....a..{..~..w..Y......I<[email protected]=.ww.
k..%.Ma.4.D..(..X.......q..Wu...vy.............[?...Q.....f.h..K. ?...
....;g..D....xR...*.6|^.WK.....yA..E.A..z.6...b.-....5.......6..r.....
..Y%.....c.n4..-.....*......l6#............S...C.....#"....>......4
6..Etr....a..h>.........IP.4(G<..f.: .\:w"z.........o..D\..\Ec..
.....o.......;[A..".*....}.j..."_..Eg...6..TW..T.F.)...yo.0..n...|AfB5
....^*&.d.d.........:.8#"(.9.j......Z...Lu.,Z.zI.........#".i...~....c
r...D..$@.,..........E......9.d..o.....c2...^*_.`:....../t{..........Q
{.S...@#... .....w`"...@:."1..v..$k..0......Q.,..yYw..?.Y.' Q...ivp..j
.E...<..yH.........MhVJu....t.=A2N.....U..2(.R_..*......h.G3.....d.
..t......(.&.]......D.....v4.s.J7...3:......e.s..KhV...P.Y".....}.._z6
F(..K...I_I.Y!..P.f.t....j.,.~"...T..4.N.9I#....A_.......!..:b........
9..KR.(d.........a..I.1....1..&.......s.EI.)..-.d"..A.eSy.u.y........y
....IEND.B`.....
<<< skipped >>>

GET /images/pattern_stripes.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "0366f92aef9cd1:0"

Last-Modified: Wed, 23 Jan 2013 21:14:04 GMT

Server: ECS (ewr/1447)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 158
.PNG........IHDR..............PX.....tEXtSoftware.Adobe ImageReadyq.e&
lt;[email protected]...=....%..G....Lx...&<rX.......P.1...X..............
. ...| .........IEND.B`.HTTP/1.1 200 OK..Accept-Ranges: bytes..Cache-C
ontrol: public,max-age=604800..Content-Type: image/png..Date: Thu, 19 
Jun 2014 16:57:46 GMT..Etag: "0366f92aef9cd1:0"..Last-Modified: Wed, 2
3 Jan 2013 21:14:04 GMT..Server: ECS (ewr/1447)..X-Cache: HIT..X-Power
ed-By: ASP.NET..X-Server: Web06..X-UA-Compatible: IE=edge..Content-Len
gth: 158...PNG........IHDR..............PX.....tEXtSoftware.Adobe Imag
eReadyq.e<[email protected]...=....%..G....Lx...&<rX.......P.1...X....
........... ...| .........IEND.B`.....


GET /images/dotted-bottom.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "8037d89646ece1:0"

Last-Modified: Thu, 20 Jun 2013 22:22:03 GMT

Server: ECS (ewr/1459)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 1366
......Exif..II*.................Ducky.......<.....ohXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRe
f="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://n
s.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:F1C18D4CE5D9E2
118A3FAB9DE5FC7BF4" xmpMM:DocumentID="xmp.did:D5216A11D9F711E2B84CC325
1F6F1432" xmpMM:InstanceID="xmp.iid:D5216A10D9F711E2B84CC3251F6F1432" 
xmp:CreatorTool="Adobe Photoshop CS5.1 Windows"> <xmpMM:DerivedF
rom stRef:instanceID="xmp.iid:F1C18D4CE5D9E2118A3FAB9DE5FC7BF4" stRef:
documentID="xmp.did:F1C18D4CE5D9E2118A3FAB9DE5FC7BF4"/> </rdf:De
scription> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"
?>....Adobe.d......................................................
......................................................................
.....................5.<.............\.............................
.................................1q..."2Q.............................
...?....2..Lq.e..=.$.N.V...O[.x[.g.`EJ.e.T..j.m..p..a.u.c..-.q...*.U.F
..J....D...n...WF...E~....,.....[....q.c......'..^.`..................
............................
<<< skipped >>>

GET /pixel?id=2285230&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: B=769pvhp9q65kb&b=3&s=lj

Connection: Keep-Alive

Host: ads.yahoo.com

HTTP/1.1 200 OK

Date: Thu, 19 Jun 2014 16:57:47 GMT

Server: YTS/1.20.13

X-RightMedia-Hostname: raptor2457.rm.bf1.yahoo.com

P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Set-Cookie: bh="b!!!!#!%b=(!!!!#>oo-h"; path=/; expires=Sat, 18-Jun-2016 16:57:47 GMT

Set-Cookie: uid=uid=d709e7e6-f7d2-11e3-9d64-10604ba611f0&_hmacv=1&_salt=1583417071&_keyid=k1&_hmac=c035c39d9b160db9ec4da1c4fabb19707d0a7269; path=/; expires=Sat, 19-Jul-2014 16:57:47 GMT

Set-Cookie: RMBX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT

Set-Cookie: RMBX=769pvhp9q65kb&b=3&s=lj&t=169; path=/; expires=Sun, 19-Jun-2016 16:57:47 GMT; domain=.yahoo.com

Cache-Control: no-cache, no-store, must-revalidate, max-age=0

Vary: *

Last-Modified: Thu, 19 Jun 2014 16:57:47 GMT

Expires: Thu, 19 Jun 2014 16:57:47 GMT

Pragma: no-cache

Content-Type: image/gif

Age: 0

Transfer-Encoding: chunked

Connection: keep-alive
2b..GIF89a.............!.......,...........D..;..0..

GET /dc.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 19 Jun 2014 12:05:42 GMT

Expires: Fri, 20 Jun 2014 00:05:42 GMT

Last-Modified: Thu, 29 May 2014 22:33:33 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 15784

Age: 17525

Cache-Control: public, max-age=43200

Alternate-Protocol: 80:quic
...........}[email protected].,.ih.....$.o.gF.-')....nvc
yF..h4....8.Yo....[>Z.<...D.......p..$c!........&x....w-...E<
....{...yv.$."9..i.Y...g..{$..(Y.~..e.N........K..x.d2....Bi.'....3..&
gt;.......9....?...v.Aq.G.....-..!.M...H........g...Bp8.A..L7.<..}y
..u........V.a....f;l.8....-.sp..zI.awP'.t1.=$...A.0..)...A........a..
.d..l0<....... {...&.....~.p.GX.]].......7....|..r9...=H3.S].......
.Ysl.m.J.............np'G.<.*.....G/..A.....e..P..8U.$H]C...i...T*.
..G9...O......Aaf.8...... .c.[1.o..h.V....j}....$....VV..k.t\G..W...4/
U&A.'.g....*!.1X.yI..b..5.3....#....,.O...g........<......:n.....}.
Y.[)jL....v....}.4.'..^.|..lc{.._..I4.v=...f....V}...|......].JG..\.[9
...hp....w.Y^1..>........!.0.U..}x.;^......F..I.............>..R
...(.).k..t.......>...[X5.zi&.9j..\.\.D.<.g....^Y)...L.*D......F
.zp g.[..K.d.D..*.Y..!/.N.s...o`..A.......q.!....~.[.1...C".J...H..R.^
..M.(..| ..D.{.....(c.s..iF.........c)G....-]..3<bZ......%P......Y.
q.h.L....0J.fr.....W.....YC....{.?.b.......$....t.<......Zi.t..m m.
w`......y...2i..e..dQBC..J....-..[.4H..|........j.........Z.....4.X...
.......p..l.0.....nz......~d../.#..&.:......i........*...s6.JxL.RT7...
..'......._j.cr/...EBjJ..k.:7...............y^...'i.I.sH..<.L....J.
........Y.]@..b|.......i.EpO. ..Q.v.......&...l.jSm.....QH..m.=..si|.P
 .zVS........V.v..j..f>.`\!.`..`c73..2....y.......p...l..._..=.....
..k....<.'..'.bX....s..C..n..wZ..*[email protected].^..fM...
.>...2_.......iv..EJ.UU..&n...~O...MIM...;_W.-..&..l..N..;j.I..
<<< skipped >>>

GET /__utm.gif?utmwv=5.5.2dc&utms=1&utmn=606285241&utmhn=VVV.shopathome.com&utmcs=utf-8&utmsr=1024x768&utmvp=1004x591&utmsc=32-bit&utmul=en-us&utmje=1&utmfl=11.6 r602&utmdt=Coupons & Promo Codes + Cash Back Up to 35% | ShopAtHome.com&utmhid=926967008&utmr=-&utmp=/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&ae=no&source=91045&subsource=50193&setupguid=%7B618968ac-6931-4f12-8585-7b1e78e04011%7D&setupcid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=&sahusertype=nonauth&utmht=1403179391772&utmac=UA-2915199-1&utmcc=__utma=212097611.739183431.1403179390.1403179390.1403179390.1;+__utmz=212097611.1403179390.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none);&utmu=qBCAAAw~ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: stats.g.doubleclick.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Wed, 19 Apr 2000 11:43:00 GMT

Last-Modified: Wed, 21 Jan 2004 19:51:30 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Fri, 13 Jun 2014 00:05:42 GMT

Server: Golfe2

Content-Length: 35

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Age: 579128

Alternate-Protocol: 80:quic
GIF89a.............,...........D..;..

GET /toolbarpostinstall.aspx?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: discounts.shopathome.com

Connection: Keep-Alive

HTTP/1.1 301 Moved Permanently

Cache-Control: private

Transfer-Encoding: chunked

Location: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Server: Microsoft-IIS/7.5

X-AspNet-Version: 4.0.30319

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

X-Server: Web09

X-Powered-By: ASP.NET

Date: Thu, 19 Jun 2014 16:57:43 GMT
0..

GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Thu, 19 Jun 2014 16:57:36 GMT

Etag: "038a33e4e8acf1:0"

Last-Modified: Tue, 17 Jun 2014 17:04:48 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (lga/1328)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 1008
.|..A...k}......@1......$L..X:u.F5..m..h...s.z`...o.`........3......#.
.;.Y....GGc(N..j...6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.....


GET /agent/toolbarprefs.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Thu, 19 Jun 2014 16:57:37 GMT

Etag: "038a33e4e8acf1:0"

Last-Modified: Tue, 17 Jun 2014 17:04:48 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (lga/1328)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 1008
.|..A...k}......@1......$L..X:u.F5..m..h...s.z`...o.`........3......#.
.;.Y....GGc(N..j...6.h6b........0)._..al...eZ.e...S.....W....7.1.....i
.......Y.t..|._..o4......E......Z........Z#..R._.?..].~..m1V.....F=...
Q....!..r..\j........h..\..7...L.P...!8f."......S'.}V..b...&...p.5OW.h
.q. @J.T'......t....iN.:......].R{.d..Puw..D...o....._.P....0..z..!...
...I....3....kb.N....rC....V.GiM.$.....G....Sx.:......."..."...>A..
.?4..w.fq=.`...%..k......p`3:./n.....C..0Wx.K.ZX........K..%...... ...
.......9k..OI..*A....m....G:..[Z..m........Z.?.. }.'....[....I........
a..r...... ..|. ..a5..1..?..-#...D...........G. rt.&....}gA...o..!....
.Kl..:.qe....%y\?.9]&.by....t-.i...d..W.:e2!8.....u....&O...m..[.WCRB.
.Z..K.......cZF....... ....P....D..|5F6.....].G7.8^s.qi..z...s.Q...E?]
.......QA........Wf<...P.|.`f_...>S..u...]U...{`[.>..a...t...
......41..S....eDJ.~.`...H.C.....!H..G.......hRc$..}....].....[Y..T..s
q.*..K{.~...&..N.].Y......._...']..V.5.>. & ...>T.......vJ...U..
z.{.Y,D..?X.....N...3..l..W>.<.3.N.-.....xqDh.....


GET /agent/bce_.sah HTTP/1.1

Accept: application/octet-stream

User-Agent: SelectRebatesDownloader

Host: xml.sahcdn.com

Cache-Control: no-cache

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=86400

Content-Type: application/octet-stream

Date: Thu, 19 Jun 2014 16:57:37 GMT

Etag: "027c04b4e8acf1:0"

Last-Modified: Tue, 17 Jun 2014 17:05:10 GMT

P3P: CP="NON DSP COR CURa ADMa OUR NOR PUR"

Server: ECAcc (lga/1344)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 458120
...v.a.5uq,:..=w2..b....M..T>.!....o..,vW.&...W?C'..w. .C........!.
...G.'........P....p(bPA.;.x..l. .}3#..5.............s.....J.h;.at.|..
...h...M.5.....J.?. dP....f....f.(Hj...#.,U.:.......O..L. .US...aX?...
..~r.u.k.x...CK.....4..0Q...._4.".H..q/Qu..."._#.%.e...0|i..(......|..
 -=e.P..>.... ..y.)..G=.....A%...=....I?.,[email protected]; ..W...pe{...
...~....................W.n....p.#3...:.lP."......dnYB...&0X.E>x...
.....P..T.tNg8...o...~.....7......|.......Lu....C.|..lZ.......4[I.*...
..YK.........9G.$.....x..<.)*.bx...`;...L../.<....l`$.]]..%...Zm
]S...).P.}..F.;...<.S...K.3tc.^Zo9`...1.D .9|.u.Y.........z..F.|.%%
..l..(...Y...|M9..\..I.o^.(...(....I./..2.........h1.z... ..y.....h.._
..iZ.&%....a..."P`O$.; s......HCK....I...../.GxY.B.v....s.<}kh.....
.Y.....k....s..9 ......U/..k.H...FZz.K....Tw...`.....Y=..VA...........
....u.R&4..f./(...A.x:}.y...o...>...S..L..F}.)zGj$..Y....J.|....C'.
@..c......>.06....$....m5.n ...o..)>h.2.ZR:B3h....MZ...8.RD..m/i
!-0.2...%o..Si...lvK.!.y.Jb...Hr.k..GX.#.^......).0pm...s.][email protected].....
..G4.....'..C..Lzg!........%...@M.&.K............Ln.N...[.....'....-..
NsO....j;[email protected].\...&2...e.....vYb].x...0..I[.D*m..tLvO3.]....|.C.....
..NM3...i......[..Yw...........Pgi#.. ....<.nI%.dB9..Lk..Y........P
E}...?fdT..s.l..7.........b.._...8L...N3L....HX.X..;...X..Y...(i....f.
...5fd.9(Y...._W.xi.}..'.X.......i%v...Bi........u...p*d..\.X..].{4a..
...q..9.Z...w.u.P..s....B~AQ. T.m.X.y0...36}y....|.....g...Y.,.A...s..
a.Wr.Oa.l......w.^.*....d0..(.y....A ..h".P\p..j(.......h]0.e..1.O
<<< skipped >>>

GET /js/html5shiv.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Date: Thu, 19 Jun 2014 16:57:44 GMT

Etag: "2b4de541448bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:25:49 GMT

Server: ECS (ewr/15A5)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

X-UA-Compatible: IE=edge

Content-Length: 2812
............ks.6.{~..........~.I.....1..S.. ...S..@.}.....A.......<
c.....}....C....^}E...!./._O?#.yB.T^PE...i.E........<.l. ?.|....W..
W<c.b99H.....*.\T.K^..rBr..W..cr. =x..^i.6.<.r.p.!....U2.4.5.Vv}
Ce.pF,.i.W.W.i.............^.Z.y.<2.............6...;..5..Y..Q...F.
 M%.....g..t....~-.X.....%.....e.......JQ.[."/. .-..n.3|..#..m.M&r..|.
,8 s.DS|...7..M.eS|.._7.)...M..Q6u.g.jZ5JKQ-...d..s......y..F.f]v.~.4.
.\.L.L.. s).....u-$.!g...5..6.#Az.....y...."ba.. `0........C].. .u.Z.P
DH...S.v..i.....H-.....IK.5..9Y.{"...........Q.....PXN55h.<...9...V
x.....J\V...A~..?8..=......-.._.......4......%4....t...I.{.......=M.3.
@i.......B...... .W.E...d...R@..\P=|.9U<...XLKk....QbI'.Atl....I...
iV.2...IMKV-.....g..ve.O...%.!.Z*Fj....0..........h.hX.....n .,w...=..
.FO.}.....(Z.._..|..MM|.....u...!.$p..{.....;lo_.):.v4vO[0...#..0.z..'
=.]e..-...c\[email protected]`)&".M0.Y&.../.h*....`.!.%..sp....G......|.
....dCn.z......4.n...r.%.. `.^#i..|xPkP....sd}k..Y\D..........Q.....U.
.......Gu2....'0....d......t.i.B..y2~s..=...K..r......Ss.o.r....b`...=
9......d.{.)...iI.~.Qf...\.%c......I.........._S..f...FQ)...i..{.0[..A
#6.L...6RaH.@\[email protected]...^B.k....9..$crLbD[.5...c./.b.q...
...*[email protected]...{..../$..C....<..~.U-..ai
..'..yo....D8$..h.j...f/5.7:_vYe...:.C`Os ..3.....p.k.Wq1iI.]...L.~..M
[email protected]..^<4Z..Z.....E.A..........)......w..7.[.=F....].E..w2...
x.oc.&>Y.....f....K2....)...P....h....p.%.....Q1b.....M..6M.X.&.0.-
\..\.xJ...1.k.<[email protected]./...C..].a,.a.]A...&..iV.j.V,..}/v..
<<< skipped >>>

GET /js/tipped/excanvas/excanvas.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Date: Thu, 19 Jun 2014 16:57:45 GMT

Etag: "26ff3a42448bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:25:50 GMT

Server: ECS (ewr/15E2)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 4297
...........:.s.......l].....m......o...y.....O..`...`@....~.3.........
T..t.......a<......h^iG..[.C.E......a<....8`i.Bm.....9.Nr......7
V.q.jG.D3p..Q..".:[j.ZkiVi......f1..... -N. [.IL..i....u$..D..42..0...
.z3u.F .....*w...jeQ.....8.............,..3MXYj.{\..l..5..K.........hT
0.U...*.*N#....Z..!.0.."..UOb...ou.....~r.]\.......A"._\....k...._O../
.../_../.././.\B.W...F.....Dc /X....w.l.(K.r.]1.ca.......,.`ki........
).H.Y..K<.....L./..V.../..0....VVP0Z...a....>.R7..UgYZ.u..2[..R2
.....Ag..N.j>..XU..;...).;.7...n...A5.54&b^.%YQ.y..n.........7.7_^.
j-.<[email protected]{f0...L.......w....O.&..(.C..h.....q.......C...h...
........5N........S`(./.e.7.V-.......[..[!..L.`Y. ...j~g..rn<....g.
bV.-.'v..$....[kl....q.v..9..Q...B.....IZ...y.o.7..;~V...D.......h... 
.t..2...J$WU.0q.pu..&.....D....~..j....?.8.tP[V(..h..p.*...O..^4...$.i
r..s.....QW.,..U.....}.?...._..Zq.@\p)...9...N..s......w.C.n..l...8.Y.
a...Q..N.2K...p4`.X....$...{`.=..V.R.......l.....t..tK0...[..;......g.
.t....lE..=.)..`1u'd3.L.f..o....m".g......F.u..P.\...L...yz......Dc.U.
/[email protected].$3O%. .L....'I..A.t~.Qsw#....]..e......cv.M..;...Fp.....
i....F....%.f..Ss.....K...37S.O(*..(B......r.h..Uh4.6-..w..M..]*d...r.
..A5..0[.&....vZ.....x..}..JV..be.........]u.....O....(-U:..F...I.....
.N....0.h..F.BP..1...2...:.7..8..Go.)..8.hz..n.}6.f.i......}...[.L.dJn
'.....*.-.<.....]rQ....V..P..L...T...V...Z.3\..Jc@... ...K.`..p&t.o
>..*.8..d.Y.~...5,vA.a.W.._Y.m.... .......B!/`...rS.TM....$.-".%Jrd
...)1..p.....9.X..V..|.3...n..r8kw....^.V......3.}.x..H.M.......-f
<<< skipped >>>

GET /js/lazyload-min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Date: Thu, 19 Jun 2014 16:57:46 GMT

Etag: "80548041448bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:25:49 GMT

Server: ECS (ewr/15CC)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 1156
...........V.n.6...[...([email protected](-I%......%.Nv.....p..
.C.......%.W.*..T....>.z .c...2..ZJ...K..,..FY>I>7...-.....=.
...])n7BX..S.....A.En..j)b.?.$.V....E2.gnJ. ..c..e.J.8.H5....VL....'..
.j.....k.gj....\4V...u..s.......w.@WRI.....>..w`.pm..yY..b.4.4..Q..
_.u..3..9....l...,..E.!m.B....i4.G.1......M..Z...0(.....:~..7..Pi..s.$
......'..\..r..J....j..g....f.....D.....K.....F.,...I,....U]../..]....
..c.&gl..cR.....n^.`-s>.../w...V|...}.o...zR..;.|@..w,#..t.z<...
...`mH..Hs}{.q.yG..Q..2.zB&.<M....Ox.\....=.X{.....tW..4...x.......
S..DY..[[email protected]@d..;.DiD..(A. I..6.oa....o.G..
...@S...............~......g........|.;.7 .....9..0.....].....G....d~h
.OAc.x.._....'..,#U...?..2....4b.p..j.%.F...1......e7..EnO...MZ...t,#.
.M.....BQ.. .<*...........\.J.D.]]..yn.....>..(..x..s. ...X.....
......R........]..1.... .H..f..;...w .g..u..N.Y...[..e..q.. @z.U..pO.R
B.z...?.I>..............H.(#.E.....n,..4..pT........./..$N...w....L
1..<..""-.....h.Y.k....=..l)...:..b../.R....7.B....M&......Q56.J...
..I.g..h...4.u..;]<I./....}.b....`.E..7K....%....#....3.......xN.B.
'.d......h. _C......,]..B.b.._y.......O9......_w....F....A]e....o...}.
......
<<< skipped >>>

GET /js/CombinedJS_BA7D55C3C593FF689E4B47E14B9D6658.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Date: Thu, 19 Jun 2014 16:57:47 GMT

Etag: "695186bbc78bcf1:0"

Last-Modified: Thu, 19 Jun 2014 14:06:57 GMT

Server: ECS (ewr/15CF)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web09

X-UA-Compatible: IE=edge

Content-Length: 104431
.............r.H.(....B...f.....nP..,.m}..c....Z.....-..."Y#2b_c..{...
[email protected].{fg".-............_........G.....n.....o.....\v..#I.w.
..q.;...oA..y...|.k..8......vb....,./&.G..Rn~......5|...~.O.x..|h....4
I.....F..R.*.U.......~..._,.w.]...."...Y....E9.Ej...bcw...H..l.\wC.%`D
Xd..i.f......`..C1..qV..%,....m.t..9O..4..K...I2..g.M......<<...
k....a......ka).Y..2.`.Y...QQ......b..4.......Q.J.x.D.56.N.<.......
Y.....c....__.S~.#.......lsS...{.9.e.........V...........W...#.n0.R Y.
......h...U,...d..j...n......n.C....`........=Z..M.....T&C.......C.w.U
...0...&.;1.5...o.../.;Y..[V..;...ir|.......Y./.....m..y...?......7\w{
w...b..iw.....3..|..6?...?...c.s...gr9....7........^..6l...u..Y..MX...
..ohJ....Oh..q............(1....K.... .......1.,._F..Aw..q.....)......
$)..._.....q.......q.^........Z(E.......=.v?..y>..4..........f.q.wF
....k .n>.V.7.O...c...`v.....g...a;F.........7.f...k....X......7.I6
......Mv...}...<..{;.l..........T.v.0KL..s.......a.kV.9.m...{..b~..
.afr?...k..M.Hb.x..\ ...o......;..g..........xW.,.J;tP...(..!l.b.....~
..;.nv.....Z...v.........T..!.R.&L......[..#4}[email protected] 
{..[.ZKw.0J2.i.YfKST$.4_.*.KL.?S..........W9t|.S[.T..........`fe......
....Sm.l.q..........E...j...8.N.v.e~........H...6.&.#%..[.^%...%{.U...
cd....6{e.E.......@.{U.`lq ..!..p..I'..p}C....f.|.....j.....".!g.Rs[I|
.o.......C..L...Fd...,..B.......1U.}..H.}.vt..O.Q.............5.......
...|..%.d.d. y5>...7..hB.....>..90h.5..@?...4..E....R.0S)..>.
..u........h.!/......'.....j..~...m..S..I....C.........0..&..qU#..
<<< skipped >>>

GET /js/controls/couponads.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Date: Thu, 19 Jun 2014 16:57:48 GMT

Etag: "80548041448bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:25:49 GMT

Server: ECS (ewr/144E)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web08

X-UA-Compatible: IE=edge

Content-Length: 343
.............J.@.._eYJI...xS.b#..R...&;..&;qw.*.O.... 8./...z%?.6.f.|s
....A$.B,...L....D...d..(.;.Q^.H. "cC.("...j......D;Q.#p4.....!w...rU.
...?....y.dP.3...V.%dXU6..:d.T......@O%.vNU...........,........V.....q
.[c...m{...o.H.50..vm>Z.C8t...............j....0.....3..d...k.H..5.
.?E............2.p...._B......~.0xi..O.1.rxs../.......X....-@.}...nt>....


GET /js/jquery.contentcarousel-min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Date: Thu, 19 Jun 2014 16:57:51 GMT

Etag: "5de5e741448bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:25:49 GMT

Server: ECS (ewr/1588)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

X-UA-Compatible: IE=edge

Content-Length: 1408
...........XK..6.. ..H......b-7H..rH...r(z.J..D.].~,....>$Q.#N...X.
.....o.#....4.%.".M*..zG.e...T.i#....X.]me.Z1...VQ.f....L...f9v..Y.i!.
$.....g.XN...a.-f.UZ.,'{.w...7I..).....4.....p../s.r..3QjVjU.....l9-4F
Cw...Db.6[.9..z....B..k.f.])..6.(....i..,.Q.g..........!Z.. .......J*R
.B1.....J...l..\.......$..77..B......|.a.}....g\..bR..fB2.<3.^..1x6
@FH=...... .PZ.%0....i..WhD.`.(..`..).^.UE...._ ..p.M.x9...d...q<}.
....N.....o.D.<>z..S....D.O.!.lkL...0L*..^.(..t..  .1p...r[.M.[3
....'u'A.........?(..x...^.......M..M).3D.....%..._#o.u(.....O.-..b...
...,[email protected].(.qJ....B...i.....zb2Q.Y.IoH.u..F...}V....|G....../
....:.DX|Bi....N.k....u...$5..b...2B...!:E....h1....m.6.6..2YheA....H.
.~.......as....MWQU.7.b.......=^..U..z.....5..... j.7....!....../$}..:
.....k..;.W..........Vi..I...j.5..VLf.......,...^..SbW..k............*
Z2....{^r.........I..s.\/......l..../.q.N.S....k.f..(j(h.[....,3}Y%..=
.K...Ax...&o5...U.H.hhT3...I.4.p7.:2....K..WI.w.\.[.5.E;..r...Y.....7.
.J23..g..`...R.uq.S...UP.'.#0.J..?.ku..h.nO.AFw...Z.9`.{F..M.y..u..9.%
:qO.......M.R....A...... [email protected]...)g.....-.....L.y.1=....(.W.Xk.
. ~.......N\b....ef:...TB.X....6.n...u../....[...j'..z.wc{.*}.....?.5.
.....sQ............._..'v|o...y6`..#x4....a..L...x.G..q....v.`...(g.N-
>..n..BY............xV.#C..............t.u.f.x.%...2}..I.-..b..B..,
-....zi.&..6.FK..IJ)...Y......I...L$...]o..~)[email protected]...`j......J.D9
.........8U.;)I....n..Z.......
<<< skipped >>>

GET /js/jquery.easing.1.3-min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: j2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: application/x-javascript

Date: Thu, 19 Jun 2014 16:57:51 GMT

Etag: "feafee41448bcf1:0"

Last-Modified: Wed, 18 Jun 2014 22:25:49 GMT

Server: ECS (ewr/15BA)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web06

X-UA-Compatible: IE=edge

Content-Length: 827
...........WMS.<.. .9I../0P.Mg`8..)L....lZS.qm.....w%.Dr";-........
>..J...N..N.UY.....z.....<o./...<...m.7I.x5.E....u..l..z.s..u
.^mn.6...)S^....F[9@..@...^..y..Y..4......Mg.Dz..$..r..a.G$An......X\.
....B.....J..:..qz4E.....M ....,3...UY#...4.T......kX.q$.J.8..3sL.;P.^
....}....p.q.;.._A3....*.U.S.........[W.4..\.. 8.3E..Q........NH(.sji,
..G...X.........6.b.....DUEY.".........Q.......5.Bie^..x.<...([s...
.B.^..'N..#n..M.hS..%G>..@[email protected]]?t$.8..2..a...h.y.........L..Q..g.
..<...\x~x....z.3.lq...K...J.W.MA..sN.2Z....B....k....6}..M.Dm..V..
".V....G...;.2..QD.JH.W...-....... gr.......?0...B..l@...;!.kf.L.I...z
K...=......_G.....J.zEi..;#\.`yo.v.2F...c."*].Vv...".........s$.l..-..
.....R.6.....L.#.z.)...D.][email protected]{...l..'..|7p. 3.e.....P...:...[Q`. 
......../.x... p......a...0.g-...V.5./E......5.0 h..#.W}.@."..c-z.....
4.........

GET /spp.pl?a=1000742424085&.yp=7164&js=no HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sp.analytics.yahoo.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Thu, 19 Jun 2014 16:57:47 GMT

P3P: policyref="hXXp://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"

Set-Cookie: B=769pvhp9q65kb&b=3&s=lj; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.yahoo.com

TS: 0 379 spdc3_bf1

Location: hXXp://ads.yahoo.com/pixel?id=2285230&t=2

Pragma: no-cache

Expires: Thu, 19 Jun 2014 16:57:48 GMT

Cache-Control: no-cache, private, must-revalidate

Accept-Ranges: bytes

Tracking-Status: site tracked

Content-Length: 43

Content-Type: image/gif

Age: 0

Connection: keep-alive

Server: ATS
GIF89a.............!.......,...........D..;..

GET /styles/CombinedAll_00874B01C6DC1916FB344FEA317D89E1.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Encoding: gzip

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: text/css

Date: Thu, 19 Jun 2014 16:57:44 GMT

Etag: "28b9743ec78bcf1:0"

Last-Modified: Thu, 19 Jun 2014 14:03:27 GMT

Server: ECS (ewr/15DA)

Vary: Accept-Encoding

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web07

X-UA-Compatible: IE=edge

Content-Length: 44387
............{....'.U8...u....$.U....v?f...t...3.O>.*Z$.f....~..c?.~
.... .LVU.}.....L ............Y........7.........~[-.......h..%..fCN.%
Y.-...fW...A.8....Z.a..k2...X...by[............fOv.;R.....9l.k.9.7..aK
*......=..v.*...US}<.i....XP..O.vY.W..........J|.h6.)...Z..~'......
.A.l.w7wdy{.......~......5..:>...b...Q.-W..C...kR/.A.Y...jG.fPl....
..QM>- 2....w..i....v_}..O.(z~.|".......{u.>I...../..9..... ..H.
..,..f./6.......;*o....-.A1v..Y..Yi ......Aq.7`.y//..ru...]C..y1|.[...
wd...IQ..Hvu.).m.iG-.-.`t..mg......t:.SpCFrd.qF.7eQ}d.dS.d..b..^.v...~
..nI.{......%..../....}.....vdK......gQR.E'6.G5(./rXN...........8.jE..
,..=.....jv...|..T.]K.l.%...Sq}.JR9I2Mc...I.T.....>/.b.Dl.&.%%,....
....N<..!.E..h..i.j.....F.a...>..M.4.}.................l......].
..SC4.%.4...q....,.Nw.G..`....x^...`.f..V.q{(..S...9.........$.}..r...
jA..i...wEM.....a;..=.mv._.....?.1....Nc.._.H..(..V.4~...mw.Fp.#].....
...c..<]I&...S.g'f.gu.*?..P.iV1REHt.....Y.j.{..6uW;(S..-...z....N..
.......O.............z..4^.V.?....z....4~.VU.;$.z....u...[{.nt. .%%.;Z
....D..,....K .gR~\.M.Ab../.....b....VT.h..c.)....#..y.....5...n..._.0
..o6.....'..ee......k....../.4...._..oQ.2I...J.V.......&...-Bxm...i..(
..e.P.e.V...fl.7t.c......C..m..........~Y.........V.~..#;rtD.gJ..]5e..
....g......R.`r`.Z.F)...#...8...;J..t..1.}.%..0.............2s..aG....
........Tn.Z.....J..foeb.........5..V.b.|.!kz@@..id..A.2.'.}..NN...N.y
B..7./..8..X...Rr.&T....h.F..hM...-[.`...@.&/.......Rm....\.y1..z).%..
.#j?.WBgm..p...o}..T.z.k...._.....ff|..Rt....U37C1.2. ....P..L.^..
<<< skipped >>>

GET /images/background_sah_2014.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/jpeg

Date: Thu, 19 Jun 2014 16:57:45 GMT

Etag: "802d51f43e66cf1:0"

Last-Modified: Fri, 02 May 2014 19:44:39 GMT

Server: ECS (ewr/1451)

X-Cache: HIT

X-Powered-By: ASP.NET

X-Server: Web05

X-UA-Compatible: IE=edge

Content-Length: 1198
......Exif..II*.................Ducky.......<..... hXXp://ns.adobe.
com/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?&g
t; <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-
c061 64.140949, 2010/12/07-10:57:01        "> <rdf:RDF xmlns:rdf
="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description
 rdf:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="ht
tp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.
0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" 
xmpMM:InstanceID="xmp.iid:3295104FD23211E3AE07B2FBA6D740AA" xmpMM:Docu
mentID="xmp.did:32951050D23211E3AE07B2FBA6D740AA"> <xmpMM:Derive
dFrom stRef:instanceID="xmp.iid:3295104DD23211E3AE07B2FBA6D740AA" stRe
f:documentID="xmp.did:3295104ED23211E3AE07B2FBA6D740AA"/> </rdf:
Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="
r"?>....Adobe.d....................................................
......................................................................
.......................................d..............................
..................................Q.....U.......................R.....
[email protected]...'r..W.U...H.w..t>....
<<< skipped >>>

GET /images/global-sprite.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.shopathome.com/?page=&A=SuccessPI&owner=dlnopop&ErrorInfo=&ErrorLevel=1&GUID={55575A94-3A40-4D8A-B305-A200D98B105B}&ae=no&source=91045&subsource=50193&setupguid={618968ac-6931-4f12-8585-7b1e78e04011}&setupcid=34052608&cid=34052608&refer=960116914&disabler=-1&tbstatus=1&tbcode=1&tbtext=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c2.sahcdn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: public,max-age=604800

Content-Type: image/png

Date: Thu, 19 Jun 2014 16:57:45 GMT

Etag: "076273fe80cf1:0"