not-a-virus.AdWare.Win32.OutBrowse.g_84bd722fea

by malwarelabrobot on August 22nd, 2014 in Malware Descriptions.

not-a-virus:AdWare.Win32.OutBrowse.g (Kaspersky), mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Adware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 84bd722fea6da21d35d2b9c5aad0561a
SHA1: eef93a8b6bb4660fa835c4b6306a4c30d2b669ff
SHA256: c965ab55d777fad99d0a00f8af2b4f286194211513910aa20c183f469a973067
SSDeep: 12288:K5UnYdbT2wW c1fFbftgCin2JI6J8bc1YT/AAUHnOiNh:K5UnY03lgd2J0bqAU
Size: 567000 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit


Summary:

Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Payload

No specific payload has been found.

Process activity

The not-a-virus creates the following process(es):

wmic.exe:1680
ping.exe:408
FreeCoinsApp.exe:2028
RegisterInstallStart.exe:1984
wyUpdate4.exe:2432
wyUpdate4.exe:2076
wyUpdate4.exe:2616
%original file name%.exe:580
find.exe:1252

The not-a-virus injects its code into the following process(es):

rdms.exe:484
SystemMonitor.exe:1988
FCUpdater.exe:1484
FCMonitor.exe:2024
FCUI.exe:1596

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process rdms.exe:484 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (2785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (9863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (6189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914086145550\FreeCoinsApp.exe (5370360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe (5680176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (1086 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (5774 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91408614555 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (0 bytes)

The process wmic.exe:1680 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (238 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (0 bytes)

The process FreeCoinsApp.exe:2028 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\gpi.bat (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\send_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\global.properties.xml (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\close_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_horizontal_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\popup_multi.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\noInternet.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_content_footer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\body_ad_purple.png (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FreeCoins\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll (5568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\search_box.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\jquery.custom-scrollbar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\loading_img.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\query_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\openThankYou.bat (340 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\notifications_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\share_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\ok_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe.config (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert_1.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.min.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tray_icon_on.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\aPop.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\BG_settings.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RunAppMonitor.bat (102 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\background_body.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (4232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe (7168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallAddiotionals.bat (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_vertical_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\redeemed_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_OFF_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email-30X1.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_bg.png (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg2.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\storageManager.js (2193 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\runApp.bat (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe (1965 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_blue.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.dll (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_center_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\alert_skin_4.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_background.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\Thumbs.db (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll (14768 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\index_skin_4.html (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\BG_alert.png (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\Stumbleupon32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\main_v4.css (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\facebook_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_gray.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_empty.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallNet35xp.bat (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\settings_body.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\redeem_now.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery-1.9.1.min.js (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\lifeCycleManager.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\setting_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\settings_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\BG_popUP.png (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionManager.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Desktop\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionPopupUI.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\pcc.bat (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.cookie.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\coupons_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\googlePlus32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\search_noresults.png (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\borderItem.jpg (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\errorHandling.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\twitter32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\mail_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Thumbs.db (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\body.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\save_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\browsers.css (1428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_ON_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\json2.js (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\time_left_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_face.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\minimize_app.png (2997 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\close_app.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\SetupNET35.exe (49498 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\gmail32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\locked_popup_face2.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\transparent.gif (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\counter_all.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_logo.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\utils.js (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\image_2.jpg (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\email32X32.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_history_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\ourScrollBar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\yahoo32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\close_btn_fBack.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\production.properties.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\alertManager.js (2286 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\uiManager.js (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\home_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\header_image.png (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\alerts.xml (1302 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\facebook32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_gray.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\DAutils.dll (3136 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\promotionPopup_skin_4.html (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_body.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\close_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe.config (546 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_close.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.js (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_pointer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\commManager.js (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon.png (6 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (0 bytes)

The process wyUpdate4.exe:2432 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (497 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2504 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (0 bytes)

The process wyUpdate4.exe:2076 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (723 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2213 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (0 bytes)

The process wyUpdate4.exe:2616 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (294 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2685 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (0 bytes)

The process %original file name%.exe:580 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\nsisunz.dll (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (4583 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (0 bytes)

The process FCUI.exe:1596 makes changes in the file system.
The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Application Data\FreeCoins\fcud.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Application Data\FreeCoins (0 bytes)

Registry activity

The process rdms.exe:484 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 A1 58 46 71 74 44 60 A7 C0 91 57 FA 37 F2 2E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The not-a-virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wmic.exe:1680 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 4B F7 64 58 1C D8 97 44 64 2C A0 C0 0B 74 8E"

The process ping.exe:408 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA DA 71 5B B8 A8 FC 45 0D B0 F7 BE B2 0F B9 8B"

The process FreeCoinsApp.exe:2028 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"DisplayName" = "Free Coins Desktop App 1.26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"URLInfoAbout" = "http://www.freecoins.co"
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe"
"Publisher" = "Free Coins."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"FCUI.exe" = "7000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\FreeCoins]
"RegistrationStatus" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"DisplayVersion" = "1.26"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 14 00 13 4D 1C E6 39 A6 7E 2B 0E 5E 1C 1F F8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\FreeCoins]
"InstallPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins"

[HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION]
"FCUI.exe" = "7000"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"

"FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"

The process RegisterInstallStart.exe:1984 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 5B 66 FF FD 8C AC D1 BF 07 09 86 7F 77 C6 CF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\FreeCoins]
"GoogleAnalyticsJsoned" = "{""cm"":""(organic)""

The process SystemMonitor.exe:1988 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 67 2E E3 07 FA B9 CF BE 90 B0 66 1B D7 D1 2E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process wyUpdate4.exe:2432 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 E4 64 E4 E3 B5 EC 00 57 49 E1 CF 9C 1A DB A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process wyUpdate4.exe:2076 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 74 B7 FD 7F F7 77 C5 B4 39 9F 62 44 9D B1 9E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process wyUpdate4.exe:2616 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 44 60 6A CC 6B 7C C2 AE BF 8B 24 48 05 B1 B5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process FCUpdater.exe:1484 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 B5 25 6D 7F B1 78 C2 33 36 02 39 57 D5 33 53"

[HKCU\Software\FreeCoins]
"FreeCoinsIEExt" = "1"
"FreeCoinsFFExt" = "1"
"FreeCoinsInstall" = "2014-8-21-12-50"

The process FCMonitor.exe:2024 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 1A 55 A2 78 14 E7 4D 24 DE E1 65 7E E5 86 38"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:580 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 06 97 70 90 FE 7C 60 FF 2D 22 A7 D0 B2 3D 8A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process FCUI.exe:1596 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePrefix" = ":2014082120140822:"
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "FCUI.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1407762306"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 17 40 EF 34 79 D8 4C C2 CC 99 26 C3 6F C5 31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheOptions" = "11"

[HKCU\Software\FreeCoins]
"FreeCoinsUUID" = "6d2d1975-0e9c-4d2b-b9ec-faf7bf8f0dbc"
"ver" = "1.26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014082120140822\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"

The not-a-virus deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The process find.exe:1252 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 78 51 53 89 09 42 98 F1 0E 5C 87 19 44 75 98"

Dropped PE files

MD5 File path
97156d3730ca295bceb65005e43e1556 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\DAutils.dll
462b4784eda015ee2222a685f54708fe c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\FCUI.exe
f2d9d327dd1c6f7242d279087d1b9a0c c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll
96bc18f8dee95af3771763dee0e15986 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll
410be2d16ea77628b919414213734785 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe
aafb99a979d4cbe4c0505408bd826f87 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe
9d40de3d6ebfcc6d8501c6629fa2b259 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\SetupNET35.exe
37c753d5ab2dba14e7b7e1dc56b87c27 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\wyUpdate.exe
0776370846dfe1d108cbd098db162f35 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\wyUpdate4.exe
91ec4108ee17d0a6800f49d6755138df c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\914086145550\FreeCoinsApp.exe
2a5ef58458b77e20115182851d0e4bf9 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso2.tmp\Convert.dll
5f13dbc378792f23e598079fc1e4422b c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso2.tmp\nsisunz.dll
b950b7d00028a589f3a6b9889de51782 c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\rdms.exe
91ec4108ee17d0a6800f49d6755138df c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

Company Name:
Product Name: Setup.exe
Product Version: 1.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 23628 24064 4.46394 856b32eb77dfd6fb67f21d6543272da5
.rdata 28672 4764 5120 3.4982 dc77f8a1e6985a4361c55642680ddb4f
.data 36864 154712 1024 3.3278 7922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata 192512 36864 0 0 d41d8cd98f00b204e9800998ecf8427e
.rsrc 229376 3120 3584 2.72195 ecb2f57811e1216779bf9790e5ace50c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 48
55f698dfa9f4d0becb76c70b86a35e89
37a35826b44a6f7dc08f2efa7dc5edcb
98074817f9a780ea48cfd72a1247d983
6cb1e085f1893765d316b2ac3d0a7cb7
35d0d82e99ab227a8036a61f77ee390e
243184caa5aecebf185a6b99d9c3e08e
de5df25bad894c285472140860b2dd84
74112916e3582d7bab8e654f188506b8
6b3c2dd4ebcede91f226d82c1c6089c6
eaba4aaf1128a9ca05a39f34231c52bc
000054aeade704f5ca8b1a0493550b71
41140783f703a6df7462369dbe3f852d
bc786b8de7507076f13911c5809f8659
611a21c471eac31ccb70dc393a7c66fb
a1829913b550e46c3544a0605e40f862
d988f8070ab8f0bfd3e40845d3300874
c0106ff9927efd05d3e74d3cd79f6797
c0b58298dee466313a5e17b969d070ee
824ba00bf5cc85f85979a5b617716eb4
0c303f04c92ab2c13e92e90a1f21794e
2c4293931465af9d6cd990a3e8bf60d8
1c54228ca5c48ccb1d09875d39541b5e
7554f68b2e1e2fbff6083e995b0787ea
d4232c4e272ef986fe85195221a9ba1f
20283c332f55101dceb6b874952fb88a

URLs

URL IP
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4
hxxp://freecoins.vo.llnwd.net/d/FreeCoinsApp.exe
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O
hxxp://www.freecoins.co/CA_Servlet/trackingServlet?getGAparams=1
hxxp://www.freecoins.co/CA_Servlet/trackingServlet
hxxp://www.google.com/collect
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png
hxxp://www.gamehub.ws/index.php?&productname=Free Coins
hxxp://www.gamehub.ws/css/index.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.9.1/jquery.min.js
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://www.gamehub.ws/js/jquery.cookie.js
hxxp://partnerad.l.doubleclick.net/gpt/pubads_impl_47.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-0/html/container.html
hxxp://www.gamehub.ws/js/core-min.js
hxxp://www.gamehub.ws/js/sha256-min.js
hxxp://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/css/index.css
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/free_coins_logo.png
hxxp://ib.anycast.adnxs.com/tt?id=3092585
hxxp://ib.anycast.adnxs.com/tt?id=3092599
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/bg_body.jpg
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/desttop_bg.png
hxxp://ib.anycast.adnxs.com/tt?id=3095266
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3092585
hxxp://flex.msn.com.nsatc.net/mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3092599
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3095266
hxxp://flex.msn.com.nsatc.net/mstag/mstag.1003102000.js
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266
hxxp://flex.msn.com.nsatc.net/mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600
hxxp://a1961.g.akamai.net/ANX_async_usersync.js
hxxp://a1961.g.akamai.net/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg
hxxp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
hxxp://a1961.g.akamai.net/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg
hxxp://ib.anycast.adnxs.com/a_usersync?cbfn=ANX_async_load
hxxp://partnerad.l.doubleclick.net/pagead/conversion.js
hxxp://r.msn.com.nsatc.net/?type=1&domainId=2745850&dedup=1&actionid=207232
hxxp://partnerad.l.doubleclick.net/pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
hxxp://ib.anycast.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://www.google.com/analytics.js
hxxp://a.ssl.fastly.net/serve/52dfe62b6897d9bfcf00011e.js
hxxp://pagead46.l.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://www.google.com/collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601
hxxp://ib.anycast.adnxs.com/seg?t=2&add=1418586
hxxp://c.live.com.nsatc.net/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd
hxxp://ib.anycast.adnxs.com/seg?t=2&add=1459541
hxxp://ib.anycast.adnxs.com/px?t=2&id=157720&other=aXlHoNTekoQSgLGK
hxxp://www.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://prod-pixel-collector-1097235636.us-east-1.elb.amazonaws.com/seg/?add=1418586,1459541
hxxp://prod-pixel-collector-1097235636.us-east-1.elb.amazonaws.com/px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094
hxxp://freecoins.vo.llnwd.net/updates/a/desktopapp.wys
hxxp://ib.anycast.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load
hxxp://ds-any-world.ngd.ysm.yahoodns.net/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
hxxp://ib.anycast.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")
hxxp://partnerad.l.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ==
hxxp://www.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y
hxxp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
hxxp://ib.anycast.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy
hxxp://ib.anycast.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
hxxp://ib.anycast.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load
hxxp://ib.anycast.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://ib.anycast.adnxs.com/mapuid?member=181&user=
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://ib.anycast.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load
hxxp://a1961.g.akamai.net/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif
hxxp://darcher3.darcherllc1.netdna-cdn.com/cdn/bv.js?bv=0.008
hxxp://freecoins.vo.llnwd.net/updates/m/fcmonitor.wys
hxxp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] 208.71.121.1
hxxp://t.mookie1.com/rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] 208.71.121.1
hxxp://any.edge.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus
hxxp://ib.anycast.adnxs.com/mapuid?member=364&user=2040815613008858
hxxp://ib.anycast.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load
hxxp://freecoins.vo.llnwd.net/updates/u/fcupdater.wys
hxxp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 95.131.122.226
hxxp://na.gmtdmp.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805
hxxp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30
hxxp://pixel.rubiconproject.net.akadns.net/tap.php?v=4894||
hxxp://ib.anycast.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?id=537072399&val=3385203591170409805
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
hxxp://pug33000.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805
hxxp://a1945.g.akamai.net/j/roundtrip.js
hxxp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] 208.71.121.1
hxxp://ib.anycast.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw=
hxxp://a1945.g.akamai.net/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js
hxxp://eqv-ad-lb4.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805
hxxp://ac-na.quantserve.com.akadns.net/dpixel?source=appnexus&eid=5&id=3385203591170409805
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/w/out
hxxp://partnerad.l.doubleclick.net/pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876
hxxp://ib.anycast.adnxs.com/seg?add=1392486&t=2
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/x/out
hxxp://pagead46.l.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/f/out
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/l/out
hxxp://www.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/g/out?google_nid=adroll4
hxxp://www.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y
hxxp://partnerad.l.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926
hxxp://star.c10r.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI
hxxp://r.turn.com.akadns.net/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 69.194.244.11
hxxp://ib.anycast.adnxs.com/mapuid?member=1471&user=2040815613008858
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/g/in?google_ula=1535926,0
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b
hxxp://ib.anycast.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct
hxxp://ib.anycast.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load
hxxp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t
hxxp://e6791.b.akamaiedge.net/event/img?mm_bnc
hxxp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hxxp://ib.adnxs.com/seg?add=673614 74.119.118.94
hxxp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hxxp://ib.adnxs.com/seg?add=673614
hxxp://a1945.g.akamai.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc
hxxp://a1945.g.akamai.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc
hxxp://ib.anycast.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load
hxxp://e6791.b.akamaiedge.net/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc
hxxp://e6791.b.akamaiedge.net/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc
hxxp://ib.anycast.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load
hxxp://partnerad.l.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805
hxxp://ib.anycast.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
hxxp://p-aws-oregon-tag-01-1110002569.us-west-2.elb.amazonaws.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684
hxxp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in 199.38.164.155
hxxp://ib.anycast.adnxs.com/setuid?entity=11&code=NC-00000010467304128
hxxp://x.skimresources.com/?provider=captify&uid=3385203591170409805 54.85.113.130
hxxp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE] 208.71.121.1
hxxp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805
hxxp://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=2040815613008858
hxxp://ib.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load
hxxp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
hxxp://cdn.adnxs.com/ANX_async_usersync.js
hxxp://pixel.mathtag.com/event/img?mm_bnc
hxxp://www.googleadservices.com/pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
hxxp://ib.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load
hxxp://ib.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css 198.232.124.224
hxxp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus
hxxp://cdn.wemempoclano.net/updates/u/fcupdater.wys
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png 198.232.124.224
hxxp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805
hxxp://a.adroll.com/j/roundtrip.js
hxxp://ib.adnxs.com/bounce?/tt?id=3092585
hxxp://ib.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load
hxxp://static.revenyou.com/offers/images/Theme8/button.png 198.232.124.224
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct
hxxp://adx.adnxs.com/mapuid?member=181&user=
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599
hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://cdn.adnxs.com/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585
hxxp://d.adroll.com/cm/g/out?google_nid=adroll4
hxxp://ib.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load
hxxp://www.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y
hxxp://ib.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load
hxxp://flex.msn.com/mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js
hxxp://d.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw=
hxxp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy
hxxp://ib.adnxs.com/seg?t=2&add=1459541
hxxp://data.getserverinfo.com/Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0 54.83.205.127
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png 198.232.124.224
hxxp://ib.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load
hxxp://ib.adnxs.com/tt?id=3095266
hxxp://ib.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load
hxxp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc
hxxp://www.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI
hxxp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128
hxxp://d.adroll.com/cm/f/out
hxxp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=3385203591170409805 64.94.107.19
hxxp://ib.adnxs.com/a_usersync?cbfn=ANX_async_load
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
hxxp://pixel.prfct.co/seg/?add=1418586,1459541
hxxp://data.getserverinfo.com/Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O 54.83.205.127
hxxp://www.google-analytics.com/collect
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ== 173.194.43.109
hxxp://partner.googleadservices.com/gpt/pubads_impl_47.js
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg 198.232.124.224
hxxp://data.getserverinfo.com/Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 54.83.205.127
hxxp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd
hxxp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 54.200.162.182
hxxp://www.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y
hxxp://ib.adnxs.com/tt?id=3092599
hxxp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc
hxxp://ib.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg 198.232.124.224
hxxp://www.googleadservices.com/pagead/conversion.js
hxxp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png 74.125.201.95
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css 74.125.201.95
hxxp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2 54.83.205.127
hxxp://ib.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load
hxxp://cdn.freecoins.co/updates/a/desktopapp.wys
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js 74.125.201.95
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js 74.125.201.95
hxxp://cdn.wemempoclano.net/updates/m/fcmonitor.wys
hxxp://ib.adnxs.com/mapuid?member=364&user=2040815613008858
hxxp://ib.adnxs.com/mapuid?member=1471&user=2040815613008858
hxxp://ib.adnxs.com/tt?id=3092585
hxxp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 69.194.244.11
hxxp://ib.adnxs.com/px?t=2&id=157720&other=aXlHoNTekoQSgLGK
hxxp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882
hxxp://ib.adnxs.com/seg?add=1392486&t=2
hxxp://d.adroll.com/cm/w/out
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png 74.125.201.95
hxxp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 208.71.121.14
hxxp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js
hxxp://d.adroll.com/cm/l/out
hxxp://flex.msn.com/mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg 198.232.124.224
hxxp://d.adroll.com/cm/x/out
hxxp://ib.adnxs.com/bounce?/tt?id=3092599
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js 74.125.201.95
hxxp://cdn.freecoins.co/d/FreeCoinsApp.exe
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 173.194.43.109
hxxp://cdn.adnxs.com/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif
hxxp://dcdn.darchermedia.com/cdn/bv.js?bv=0.008
hxxp://www.google-analytics.com/collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601
hxxp://d.adroll.com/cm/g/in?google_ula=1535926,0
hxxp://tpc.googlesyndication.com/safeframe/1-0-0/html/container.html 173.194.43.106
hxxp://tag.perfectaudience.com/serve/52dfe62b6897d9bfcf00011e.js 23.235.44.130
hxxp://www.googleadservices.com/pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876
hxxp://www.google-analytics.com/analytics.js
hxxp://flex.msn.com/mstag/mstag.1003102000.js
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc
hxxp://www.googletagservices.com/tag/js/gpt.js
hxxp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926 173.194.43.109
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg 198.232.124.224
hxxp://pixel.prfct.co/px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
hxxp://ib.adnxs.com/seg?t=2&add=1418586
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png 198.232.124.224
hxxp://cdn.adnxs.com/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg
hxxp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805
hxxp://pixel.rubiconproject.com/tap.php?v=4894||
hxxp://2745850.r.msn.com/?type=1&domainId=2745850&dedup=1&actionid=207232


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN VMProtect Packed Binary Inbound via HTTP - Likely Hostile
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/css; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 09:06:21 GMT
Expires: Thu, 21 Aug 2014 10:06:21 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 6091
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 2621
Alternate-Protocol: 80:quic
[email protected]..~...e.#K.$.#A..=.!%J|iz...
;@Z.:...y..}..........X.H~{G...O~......-.M^[email protected]........
....!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.W
O8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h
.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ....
....... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}..
.t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>.....
.|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8
a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}[email protected]^...S2.gn.h......;V.
yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or
..%X...78.I.>[email protected].<.W 
EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M..
. ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k
:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<
;._.. J.YK.:9.H}3....U.B..$..W..f$l]^[email protected].,(."
......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V
.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l
..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v.
.~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4..
.1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!
pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t..
.M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 08:52:26 GMT
Expires: Thu, 21 Aug 2014 09:52:26 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 51558
X-XSS-Protection: 1; mode=block
Age: 3457
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Alternate-Protocol: 80:quic
............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...A
P...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3.
.................E1.-.uz..........ZXI..rZm....../[email protected].....
.yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....
&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,...
...j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.
O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,[email protected]...
..l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xv
rR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9.
.S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvI
o^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._
...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../....
_.........4..s........x..z|...^|.../.._..?.z..............?.......?=..
....N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z
...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y.
...c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3.....
...Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.
n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T..
...D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\[email protected]......
\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.
....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!V
o........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 09:46:20 GMT
Expires: Thu, 21 Aug 2014 10:46:20 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 3457
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 223
Alternate-Protocol: 80:quic
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B.
...6...._.d.c.......*...V......|U.......w-...p..>Z..........`......
......`............`............`............`............`...........
.`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.
x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1
..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."..
.-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C....
.y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ
..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH
...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._&l
t;....p.p....`............`..b.......:............:.............Xj)...
w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7...
..;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:
.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O..
...m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....
3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD.
.M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;
....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n
.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x....
.].?/..9r......h...]^}M....<....;..........p.p....`........}.....n.
.~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M...
...j..4.%..x......!ij....bXcT..^[$=V.4<m^.=~..Yo.E..s..>....
<<< skipped >>>


GET /ANX_async_usersync.js HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4


HTTP/1.1 200 OK
Server: Apache
ETag: "e3de0e76c13e81e3b0683dac240498eb:1377552334"
Last-Modified: Mon, 26 Aug 2013 21:25:34 GMT
Accept-Ranges: bytes
Content-Type: application/x-javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 509
Connection: keep-alive
...........TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s..
.|\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H....
..-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...
W:4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X
.\...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w.
........X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&..
.M6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,
./.,H).|..0g.z...k../g...HTTP/1.1 200 OK..Server: Apache..ETag: "e3de0
e76c13e81e3b0683dac240498eb:1377552334"..Last-Modified: Mon, 26 Aug 20
13 21:25:34 GMT..Accept-Ranges: bytes..Content-Type: application/x-jav
ascript..Vary: Accept-Encoding..Content-Encoding: gzip..Date: Thu, 21 
Aug 2014 09:51:04 GMT..Content-Length: 509..Connection: keep-alive....
.........TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s...|
\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H......
-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...W:
4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X.\
...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w...
......X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&...M
6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,./
.,H).|..0g.z...k../g.......
<<< skipped >>>

GET /p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz0Fhu?d$ L8ih
HTTP/1.1 200 OK
Server: Apache
ETag: "1a825d5acd849546ad35aa925bf5f9f7:1408446966"
Last-Modified: Tue, 19 Aug 2014 11:16:06 GMT
Accept-Ranges: bytes
Content-Length: 5470
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:09 GMT
Connection: keep-alive
GIF89a..X......$..67b...k.....&.....Mb....6..r...Z..t.I........r..6..#
|.'..............^...P.......a......{.K..............%.....a..........
.p..r...h.H..%.........f.1..q......FFF..M...}.nc..n.3V..]...........3]
...#e...........---u.....s.....Il,m.H...2[....M}....Dq.cjT...r..i. y..
o..w..q..z..o..p..y..x..s..n..v..u..r..v..t..r..q..p..x..w..x..p.....t
..z..n..t..&&&.....#s..s..u..u..hjk..q..s........$..%..$.....%..$..q..
%..............%.....$T....%......k..{..w.*..&..!.....%...j.....o....U
.....!..*|.....WWWAI1FS)...l....u.................$w....#......p....r.
..|.............%........|..F......z..|||p..o..LX3.....(..9...........
.Ix.........%......n.[.. p.\..k~.@\xF......Tz......Lh...........w.....
...q.I~.]..ox.J.....`{.<......j.2..............o..l.....M..........
.pt.\.....M...!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzr
eSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adob
e XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00        "> <rd
f:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <
rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/
mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmln
s:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did
:a07e3509-56d3-9e47-9312-c420c55db420" xmpMM:DocumentID="xmp.did:64256
D6B215211E4932BC583D61BF021" xmpMM:InstanceID="xmp.iid:64256D6A215211E
4932BC583D61BF021" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"
> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fd28247f-299f
<<< skipped >>>


GET /gpt/pubads_impl_47.js HTTP/1.1
Accept: */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partner.googleadservices.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Wed, 13 Aug 2014 09:40:03 GMT
Date: Tue, 19 Aug 2014 04:32:03 GMT
Expires: Wed, 19 Aug 2015 04:32:03 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33599
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 191938
Alternate-Protocol: 80:quic
......n.....y..H.8.._.....B..sL"Y..8N...L....i].9D.....?U..ZB$...wgcZ}
..U.u..b.....vn/.l{..... c3_.p.v......e:...;..W.s.(.b./.....~3..d.{...
.."......|B...=.ds>.1..l.o........y....i;........,...f}.~....^=....
E.h..l..L....=.Uk.o.l....\Z..8.g...T.......k-&Q..&qd....t4..M...i<.
..f'Pq<.....T'....r..Fw...{...fq2J]..o..u.=RKo..Q.o.....x..}..`....
..X^... ...m)..*...bQ.N.4.\.&*....M..bYU...1#......U.bq.H....Y..T.....
S..s..Y..%...Q.-fqw1..Vm.n.<.........1..'O.4...~..........5...ttc.z
....Y.v.d.A...%a.w.3.......,..t ..u99.b..OG.8....y.U.v..s...._*.x.\.I.
.$s9..E....p4..z.k...Y.......y5......k.lJ.P.v..._.......2.....D.......
..;.'.K.uQ\..3m..i..?.%`u..t.. ..<.t..8KC.?...>I......M..mL_....
..;..........Fg0......._...p6...K.....U..........5x.c.....q<g'O....
..q..\.iE>......1}/uU}m.xg..T.A..x.S.;.....1.0..q...........!K..4.l
..u.../.6X$.nG........Wt.R.......i...........3....x..&......JB.z..<
.q.K|....*f.g....<$.z.}.'.Q..71.m...o./.y:.t...r..V........5ot..._.
......C-.r.V......g.t...k.-u.....,(}.6.;3............`.r`"....qf.....{
...p-..s..U...e^`.^U.;..r.K..m.V.}g.. ...{[email protected].=.
...>..K.....~...5.b....A.....O.;.}..j!.'.e..a........{D.. ..0.[.6.T
 g..e......YsaR...B.[]5T.g1...Q._....-....9.....h<..6........6..@..
....hn7.....%....V...".xc7a...[...9....SWOf...*8.....U..!..$.......k..
.....`.....Q.@?.?..B.......jbo.d.G..g.k.n..uj...i.A.6.........Bj..[...
v-oK...:...D\/.{..paT,....,_......<..9.aa..|.........Y...sq....{...
..[0.g.6....:?o..:.(.`0.`....'..Qp..9....n<...e0D....u...).~V..
<<< skipped >>>


GET /offers/images/Theme8/topLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/nextCase.jpg HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:59 GMT..Co
ntent-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>

GET /offers/images/Theme8/button.png HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: image/png
Content-Length: 458
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT
ETag: "1b5642f092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:59 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi.......
.../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f.
..p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C......
.$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....
-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^
.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...



GET /rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:09 GMT
Server: Apache/2.2.3 (Red Hat)
Set-Cookie: id=2040815613008858; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com
Set-Cookie: mdata=1|2040815613008858|1408614669; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com
Set-Cookie: OAX=igh79FP1wQ0ABVfH; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Location: /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]
Connection: close
Content-Type: text/plain; charset=UTF-8



GET /js/sha256-min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:02 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT
ETag: "406d0-5aa-4fc68d5e5db4d"
Accept-Ranges: bytes
Content-Length: 1450
Connection: close
Content-Type: text/javascript
/*.CryptoJS v3.1.2.code.google.com/p/crypto-js.(c) 2009-2013 by Jeff M
ott. All rights reserved..code.google.com/p/crypto-js/wiki/License.*/.
(function(k){for(var g=CryptoJS,h=g.lib,v=h.WordArray,j=h.Hasher,h=g.a
lgo,s=[],t=[],u=function(q){return 4294967296*(q-(q|0))|0},l=2,b=0;64&
gt;b;){var d;a:{d=l;for(var w=k.sqrt(d),r=2;r<=w;r  )if(!(d%r)){d=!
1;break a}d=!0}d&&(8>b&&(s[b]=u(k.pow(l,0.5))),t[b]=u(k.pow(l,1/3))
,b  );l  }var n=[],h=h.SHA256=j.extend({_doReset:function(){this._hash
=new v.init(s.slice(0))},_doProcessBlock:function(q,h){for(var a=this.
_hash.words,c=a[0],d=a[1],b=a[2],k=a[3],f=a[4],g=a[5],j=a[6],l=a[7],e=
0;64>e;e  ){if(16>e)n[e]=.q[h e]|0;else{var m=n[e-15],p=n[e-2];n
[e]=((m<<25|m>>>7)^(m<<14|m>>>18)^m>&
gt;>3) n[e-7] ((p<<15|p>>>17)^(p<<13|p>>
>19)^p>>>10) n[e-16]}m=l ((f<<26|f>>>6)^(f&
lt;<21|f>>>11)^(f<<7|f>>>25)) (f&g^~f&j) t[
e] n[e];p=((c<<30|c>>>2)^(c<<19|c>>>13)^
(c<<10|c>>>22)) (c&d^c&b^d&b);l=j;j=g;g=f;f=k m|0;k=b;b
=d;d=c;c=m p|0}a[0]=a[0] c|0;a[1]=a[1] d|0;a[2]=a[2] b|0;a[3]=a[3] k|0
;a[4]=a[4] f|0;a[5]=a[5] g|0;a[6]=a[6] j|0;a[7]=a[7] l|0},_doFinalize:
function(){var d=this._data,b=d.words,a=8*this._nDataBytes,c=8*d.sigBy
tes;.b[c>>>5]|=128<<24-c2;b[(c 64>>>9<<
;4) 14]=k.floor(a/4294967296);b[(c 64>>>9<<4) 15]=a;d.s
igBytes=4*b.length;this._process();return this._hash},clone:functi
<<< skipped >>>


GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: dis.eu.criteo.com


HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/gif
Expires: -1
Server: Microsoft-IIS/7.5
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 43
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Cont
rol: no-cache..Pragma: no-cache..Content-Type: image/gif..Expires: -1.
.Server: Microsoft-IIS/7.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS 
NAV STA"..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 43..GIF
89a.............!.......,...........D..;..



GET /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:09 GMT
Server: Apache/2.2.3 (Red Hat)
Location: //ib.adnxs.com/mapuid?member=364&user=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8



GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Date: Thu, 21 Aug 2014 09:06:13 GMT
Expires: Thu, 21 Aug 2014 10:06:13 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 29947
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 2629
Alternate-Protocol: 80:quic
...............F....>..R..1.d...j0!^[email protected]........
....@0.....$..}9[.......O....f.O.......6......6...W.?..!.t............
C...r....'.}.Y..J5.....?g.|...n.Ec...j.....Q.m..Y..w...m..?}...l.....3
.o.>mp..t.g..w.tq;.v...o.-..l...q.lg:z..w..W....zM.....d.9[d.IOU...
.T#^....;..1..,..o.o.m.......g...}.m5.._u........*ES~.....5.....m.....
.v..%_..w......Z..w.6Y.E.....l......gw.C....l...a..X.:F...o&...a...z.D
#...Zq.{...x..V.wk.K..O^..(i.......f.SR/io...c..=.,.^x..*...~..4...:.{
=n(J.z(..t(.q..i.p...Y.N.tD..J.=........vXn.K..e.-xH..i..F.1..f.....e.
o?..\ew....>~...c2........z..............Gj.zB.;:....2..M.sF.s../..
*8..o....x.;....>& n.... [email protected]/.h...?U.....=T.
EE.N.i..DMU.e.E....j..Q6...B-.J....>M....:.MZ-.4.Z..._..i.%..m..]..
........o.........~.......3...HN..t.................E/[....-..vq..y...
.-....j......0.xO..U4W..&Jx.ktt.<..u.6oNK..x..h....p.Oh.......P...6
...R.C..\.n..m..?..W....6..G.....hn..h.o......!.ep6...T..N..$.......5.
)P...3.V......_.O...5..gl.5........c......6.m...^..b...c.y.r..$.....L.
.p...o.................(,uB..T.2_28....d..us.f1.L..=..&..bV..m<..=.
.......3D..\.Y..r3....A_.Y.G.%.....7|.$t.Z.k..C..\.8?.h...q....naF.i-.
......B..`6t.._..h12n....v..".pq..C.h.......x...N.L...p..............f
`[email protected].]  h........v..(i....|mv....7.......t......j..j...c.K
2...;.4.$;Ve...-o4.~.;..h.M...(*N....m0T.G]5.......K`#.&..Z.V...3.....
.m2.Z.hJ;..F...`Q.QM.?.,..E........@......=.b.........._.Fi.h6........
l....2.}$...>.=.N.M)....$eP..]..p%M....|.e......&jJ...x.u...:..
<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 08:59:41 GMT
Expires: Thu, 21 Aug 2014 09:59:41 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 88
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 3022
Alternate-Protocol: 80:quic
.PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w.
..........IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Last-Modif
ied: Fri, 12 Oct 2012 18:27:19 GMT..Date: Thu, 21 Aug 2014 08:59:41 GM
T..Expires: Thu, 21 Aug 2014 09:59:41 GMT..Access-Control-Allow-Origin
: *..Timing-Allow-Origin: *..X-Content-Type-Options: nosniff..Server: 
sffe..Content-Length: 88..X-XSS-Protection: 1; mode=block..Cache-Contr
ol: public, must-revalidate, proxy-revalidate, max-age=3600..Age: 3022
..Alternate-Protocol: 80:quic...PNG........IHDR.......d.....G,Z`....ID
AT..c.....&.....G0..ed.......w...........IEND.B`...



GET /cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:12 GMT
Server: Apache/2.2.3 (Red Hat)
Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8



GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671


HTTP/1.1 200 OK
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Type: image/gif
Content-Length: 43
Cache-Control: private, max-age=0, no-cache
Connection: close
GIF89a.............!.......,...........D..;..



GET /p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4


HTTP/1.1 200 OK
Server: Apache
ETag: "9531dfcab239be5053dbfa4ef4277fce:1408543221"
Last-Modified: Wed, 20 Aug 2014 14:00:13 GMT
Accept-Ranges: bytes
Content-Length: 21629
Content-Type: image/jpeg
Date: Thu, 21 Aug 2014 09:51:04 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................Z...........
......................................................................
............."#3.!2CSc..1BRs..Abr...$Qaq..4...........DTt56...d%..Uu7.
.............................!1..".AQ2.a..q...B#...Rr34...$...........
.?..N.z...:.\..!....5.)......t..[.g.bJ../~Z......84.......7..Z.uZ.b..T
...P{"......u9j.e..|*T..]....~'.s....eo..[V...V..c.........}]U.'v..9.]
s...5.Y=.1V[...[*3.....3JW.W..p.........%..l.i..U.....lK..g./.....4...
:..j...&.f.M.Q....U.z.................h..(..8.^F.R=<M.{LS.h....M...
*...t<[[email protected]=..I.~......h=.kE|.-n.9&.9!...
q2.......\......y.r...h.P.<3.... .WV..f..!.IM~.vI.....fu.m.}.c...P.
dV..,F.....ZQ.A..B...W..qx..,........g)...|.k.&G.4.4G.;...e....K..O{?.
......B.....V..!......d...q.q.....V.p`..2.....v`..$.k".Z.E^t.=..]..[v.
p.$...%......Zm>MJ.....$I.$.dj.r'....p....o9.6..&..\..HBR.(.e.Oy..{
...5.)...j[.MR.[..LIk....yF...d.....c9..K_...I....d..1............B...
Q....;.....W..0.......S.....~.~.|..............t..P~i......W.....l...K
4.....1..~&.W...8..ZQ?_.\..1r.h;w......$.rQ.d...M.b[..0..:gi..-IJ..G..
...^....s}...p....$...yp....b:.d.v..kk3. ........Q..{P.k.2.......5X:.?
..6o....T....F.....$...j..~....{............7......s...D...h0d.4!,.vw.
.@$...o'.b..Jb....*.pT._..d.%..T...9.qr^'w&.{...X.~.....-.MF.b|LO.....
m.....h.M.$...r.......G....V\..(........ ..hy[.B.u...4}T...?.M..u]
<<< skipped >>>

GET /p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4


HTTP/1.1 200 OK
Server: Apache
ETag: "6ffe88efc10e4300c223a6efe5e670a3:1408542730"
Last-Modified: Wed, 20 Aug 2014 13:52:07 GMT
Accept-Ranges: bytes
Content-Length: 49331
Content-Type: image/jpeg
Date: Thu, 21 Aug 2014 09:51:05 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................
......................................................................
..........................................................X...........
......................................................................
.............!1AQ".a2.qR#3...B4..b$.r........CSs..6....c..7.Tt%U......
.................!1Q...Aaq...".......2BRb...r...#..3C.4.Sc$...........
.?...........b..bAtI.'[E..q%S.M.....P-#ED...QV..]42.A,..(.&T$.....R]..
O..z.d.....b8.{j.B.J.he>..k../..;[email protected]'Q[1
..dr,EPC%#5D...U.k.R.),yR.7.R*(......PbQ.t2Z[R.0.UU..S...b.j...iru^..&
A...K...6k.....U"..........2.p..Q.*......_..x....L.L/y. [..P.TW.._.5.,
.......1..<.'\.......-[[h .....v.wU..._.t*....};..b.....*.E3p......
P..)...._./...D..f.^.........5........_.. [|.).. X...{.Y^".F..EQ:.n...
e....J.....([email protected]....:...s<.W.9cyXu....}...`G.....
Qe.S....O-x.Z.....q....5..9.....9K0...6B.O.R_Jk.4F!... 7.Y|'..oEI...\k
~..H.....D.|...j.w.2..LfQ .q......@RW>.5mQ~ ..42...Q..5....^. ..O&g
t;.6......R..:..k...M.5.77..OHE.1N...*[email protected]...
..aO.Z.rb.FM.P...........xL]k..5j.qMTI..........SB.(..'..%............
4."iHTN,..b#..d.........../.#..&.f.......R..[f....Z@^.A.....U5$ ....O.
C..H..{.U.....^..F,...J.n.......C&.....Z'..Z%.5UZ..]d.T"6).M...."..L.b
4.D....'O..o.j.......9Z....-......dE.$..t%..D....#.K9Y..le...;...w..I.
v.N....V......)..J...b.mI........2.zg..jL.Xp.8.!.. .U.......i.c .(b...
.....;""...5W$.G...!.W......U._.Xj%*..aR3...Qi.....q_.5.?my...b...
<<< skipped >>>


GET /is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: ak1.abmr.net


HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: hXXp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: 01AI=2-2-25FB066375997C08AA677974C936756369EEB775B3215452B8D97A7A0953AB1B-A1FE72069F55C12A131FFA81D61F21398DF6187ADBE704B79CE071A6719EB0D4; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net
P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"
HTTP/1.1 302 Moved Temporarily..Content-Length: 0..Location: hXXp://pi
xel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9d
iWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc..Expires: Thu, 21
 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..
Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: kee
p-alive..Set-Cookie: 01AI=2-2-25FB066375997C08AA677974C936756369EEB775
B3215452B8D97A7A0953AB1B-A1FE72069F55C12A131FFA81D61F21398DF6187ADBE70
4B79CE071A6719EB0D4; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; do
main=.abmr.net..P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", C
P="NON DSP COR CURa ADMa DEVa OUR SAMa IND"..



GET /event/img?mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=


HTTP/1.1 302 Moved Temporarily
Server: AkamaiGHost
Content-Length: 0
Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
HTTP/1.1 302 Moved Temporarily..Server: AkamaiGHost..Content-Length: 0
..Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-
N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555
A9E9909C20&D=mathtag.com&01AD=1&mm_bnc..Expires: Thu, 21 Aug 2014 09:5
1:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cac
he..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-C
ookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domai
n=.mathtag.com..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV U
NI"......


GET /event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=; HRL8=CT-1
Connection: Keep-Alive
Host: pixel.mathtag.com


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar  4 2014 19:08:19 ewr-pixel-x12 pid 0x1109 4361
Expires: Thu, 21 Aug 2014 09:51:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:16 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Ty
pe: image/gif..Content-Length: 43..Server: mt2/2.10.2.rc1 26c5168 CORE
-1658-uuid-random-patch Mar  4 2014 19:08:19 ewr-pixel-x12 pid 0x1109 
4361..Expires: Thu, 21 Aug 2014 09:51:16 GMT..Cache-Control: max-age=0
, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:1
6 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-USR; expires=Thu, 1
8-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com..Set-Cookie: mt_m
isc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 G
MT..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"..GIF89a.
............!.......,...........D..;..



GET /cm/x/out HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b


HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXp://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI')
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/
Content-Length: 112
Connection: keep-alive
Go to hXXp://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid('ZTR
iYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI')....


GET /cm/f/out HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b


HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/
Content-Length: 112
Connection: keep-alive
Go to hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=Z
TRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI....


GET /cm/g/out?google_nid=adroll4 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b


HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:14 GMT
Location: hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/
Content-Length: 117
Connection: keep-alive
Go to hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&goog
le_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926HTTP/1.1 302 Moved Temp
orarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Thu
, 21 Aug 2014 09:51:14 GMT..Location: hXXp://cm.g.doubleclick.net/pixe
l?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ul
a=1535926..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma:
 no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffd
ec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max
-Age=157680000; Path=/..Content-Length: 117..Connection: keep-alive..G
o to hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&googl
e_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926..



GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eu-gmtdmp.gd1.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Connection: close
GIF89a.............!.......,...........D..;..



GET /pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: googleads.g.doubleclick.net


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 21 Aug 2014 09:51:06 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://VVV.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 76
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Aug-2014 10:06:06 GMT; path=/; domain=.doubleclick.net
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?...HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doublecli
ck.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND
 UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Date: Thu, 21 Aug 2
014 09:51:06 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00
 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://VVV.g
oogle.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614
622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&g
uid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_
nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLanding
Page/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct
=2&convclickts=0&random=4279697415..Content-Type: text/html; charset=U
TF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server:
 cafe..Content-Length: 76..X-XSS-Protection: 1; mode=block..Alternate-
Protocol: 80:quic..Set-Cookie: test_cookie=CheckForPermission; expires
=Thu, 21-Aug-2014 10:06:06 GMT; path=/; domain=.doubleclick.net.......
.......(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?..
.....
<<< skipped >>>

GET /pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3
Connection: Keep-Alive
Host: googleads.g.doubleclick.net


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 21 Aug 2014 09:51:13 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://VVV.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879
Content-Type: image/gif
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="C
URa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV O
TC NOI DSP COR"..Date: Thu, 21 Aug 2014 09:51:13 GMT..Pragma: no-cache
..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, mus
t-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/933633792
/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=10
98627879..Content-Type: image/gif..X-Content-Type-Options: nosniff..Se
rver: cafe..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alter
nate-Protocol: 80:quic..GIF89a.............!.......,...........D.;..



GET /px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.prfct.co
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Cache-control: no-cache="set-cookie"
Content-Type: image/gif
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Server: Jetty(9.0.5.v20130815)
Set-Cookie: pa_uid=pa_YE6NcKMeCbRFLEScY;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT
Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC0C8EF11D2BF2EEF1E82F34F041864DF0CDFDC718E7050E1FA11D9BB039B95618;PATH=/
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Cache-control: no-cache="set-cookie"
..Content-Type: image/gif..Expires: Thu, 01 Jan 1970 00:00:00 GMT..P3P
: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM ST
A PRE"..Server: Jetty(9.0.5.v20130815)..Set-Cookie: pa_uid=pa_YE6NcKMe
CbRFLEScY;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GM
T..Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986
C47DE59261A4C141DD42C6C8DC0C8EF11D2BF2EEF1E82F34F041864DF0CDFDC718E705
0E1FA11D9BB039B95618;PATH=/..Content-Length: 43..Connection: keep-aliv
e..GIF89a.............!.......,...........D..;..



GET /pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ== HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: test_cookie=CheckForPermission


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://adx.adnxs.com/mapuid?member=181&user=
Date: Thu, 21 Aug 2014 09:51:06 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 245
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
Set-Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://adx.adnxs.com/mapuid?member=181&user=">he
re</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: po
licyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="
CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV 
OTC NOI DSP COR"..Location: hXXp://adx.adnxs.com/mapuid?member=181&use
r=..Date: Thu, 21 Aug 2014 09:51:06 GMT..Pragma: no-cache..Expires: Fr
i, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate.
.Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)
..Content-Length: 245..X-XSS-Protection: 1; mode=block..Alternate-Prot
ocol: 80:quic..Set-Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs
=002213fd4822e18203ab0698c3; expires=Sat, 20-Aug-2016 09:51:06 GMT; pa
th=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; expires=Mon, 
21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net..<HTML>
;<HEAD><meta http-equiv="content-type" content="text/html;cha
rset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><B
ODY>.<H1>302 Moved</H1>.The document has moved.<A HR
EF="hXXp://adx.adnxs.com/mapuid?member=181&user=">here</A>
;...</BODY></HTML>......
<<< skipped >>>

GET /pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0
Date: Thu, 21 Aug 2014 09:51:14 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 245
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0">he
re</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: po
licyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="
CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV 
OTC NOI DSP COR"..Location: hXXp://d.adroll.com/cm/g/in?google_ula=153
5926,0..Date: Thu, 21 Aug 2014 09:51:14 GMT..Pragma: no-cache..Expires
: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalid
ate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unkn
own)..Content-Length: 245..X-XSS-Protection: 1; mode=block..Alternate-
Protocol: 80:quic..<HTML><HEAD><meta http-equiv="conten
t-type" content="text/html;charset=utf-8">.<TITLE>302 Moved&l
t;/TITLE></HEAD><BODY>.<H1>302 Moved</H1>.T
he document has moved.<A HREF="hXXp://d.adroll.com/cm/g/in?google_u
la=1535926,0">here</A>...</BODY></HTML>...
...
<<< skipped >>>

GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
Date: Thu, 21 Aug 2014 09:51:16 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 317
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=338520359
1170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">
here</A>...</BODY></HTML>......



GET /e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: e.nexac.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-type: image/gif
Date: Thu, 21 Aug 2014 09:51:18 GMT
Expires: Wed Sep 15 09:14:42 MDT 2010
P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"
Pragma: no-cache
Server: lighttpd/1.4.28
Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/
Set-Cookie: na_an=1408614678; expires=Sat, 20-Sep-2014 09:51:18 GMT; path=/; domain=.nexac.com
X-Powered-By: Jigawatts
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-ty
pe: image/gif..Date: Thu, 21 Aug 2014 09:51:18 GMT..Expires: Wed Sep 1
5 09:14:42 MDT 2010..P3P: policyref="hXXp://VVV.nextaction.net/P3P/Pol
icyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo 
HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"..Pra
gma: no-cache..Server: lighttpd/1.4.28..Set-Cookie: na_tc=Y; expires=S
un, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/..Set-Cookie: n
a_an=1408614678; expires=Sat, 20-Sep-2014 09:51:18 GMT; path=/; domain
=.nexac.com..X-Powered-By: Jigawatts..Content-Length: 43..Connection: 
keep-alive..GIF89a.............!.......,...........D..;..



GET /e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.jumptap.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 43
Content-Type: image/gif
Cache-Control: no-cache, max-age=2592000
Server: Jetty(7.6.7.v20120910)
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu,
 21 Aug 2014 09:51:15 GMT..Content-Length: 43..Content-Type: image/gif
..Cache-Control: no-cache, max-age=2592000..Server: Jetty(7.6.7.v20120
910)..GIF89a.............!.......,...........D..;....



GET /seg?t=2&add=1459541 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ==
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 0
....


GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QPn=Mde3%$o2(/ZA!*jSH=QL./dmNSPB?j>ni'Gpih®X/<FeyMOoPD 6#xcHg!%FI5#=<I'; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 150
ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86af
cfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":8, "tagtype
":"img"});....


GET /pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
Connection: Keep-Alive
Host: ib.adnxs.com


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:06 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359117040
9805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51
:06 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.Erk#WD
gEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!
7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnx
s.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Th
u, 21 Aug 2014 09:51:06 GMT..GIF89a.............!.......,[email protected].
.;....
<<< skipped >>>

GET /ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:5
1:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-C
ookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:
51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; chars
et=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 0..nt>....


GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 150
ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86af
cfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":7, "tagtype
":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private.
.Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policy
ref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSA
o PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection:
 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov
-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; p
ath=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpO
nly..Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>
;W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP; path=/; e
xpires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Con
tent-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 20
14 09:51:07 GMT..Content-Length: 150..ANX_async_load({"url":"hXXp://ad
s.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwi
d=10000602235&sigv=1", "c":7, "tagtype":"img"});....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz0Fhu?d$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR`v/roZT; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:08 GMT
Content-Length: 774
document.write('<a href="hXXp://nym1.ib.adnxs.com/click?_Knx0k1igD9
kkpGzsKd9P0Jg5dAi29E_ZJKRs7CnfT_8qfHSTWKAP3e7G38xU_k-TcUWCLuo-i4MwfVTA
AAAALO7LwCtBwAAKQQAAAIAAADJyxoBP9AGAAAAAQBVU0QAVVNEAKAAWALLCQAA5McAAgU
AAQIAAJQANiseKQAAAAA./cnd=!uwbgQQjlye4BEMmX6wgYv6AbIAA./referrer=htt
p://ib.adnxs.com/bounce?/tt?id=3095266/clickenc=http%3
A//lp.sharelive.net/?sysid=406&appid=744" target="_blank
"><img width="160" height="600" style="border-style: none" src="
hXXp://cdn.adnxs.com/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gi
f"/></a>');document.write('<scr' 'ipt type="text/javascrip
t" src="hXXp://dcdn.darchermedia.com/cdn/bv.js?bv=0.008"></scr' 
'ipt>');document.write('<scr'   'ipt src="hXXp://cdn.adnxs.com/A
NX_async_usersync.js"></scr' 'ipt>');....
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Prov
ider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif
?meta=appNexus", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Contr
ol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 No
v 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p
3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV
 DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409
805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com;
 HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:
09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/QE:2jUDg
EREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CG
Zv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-No
v-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Content-Type: applic
ation/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:09 GMT..
Content-Length: 182..ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api
/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/33
85203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});
....
<<< skipped >>>

GET /mapuid?member=364&user=2040815613008858 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylp<cH:Ti*W@)8Xu/^meB)H; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.plat
formID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"})
;....


GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*gjZ>6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HfCkq>=3.)s; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 142
ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus
/tokens?token=3385203591170409805&expires=30", "c":5, "tagtype":"img"}
);HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma:
 no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="htt
p://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo O
URo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-
Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09
:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; e
xpires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set
-Cookie: anj=dTM7k!M40*gjZ>6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2
q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:Hf
Ckq>=3.)s; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.a
dnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-
8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 142..ANX_async
_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?t
oken=3385203591170409805&expires=30", "c":5, "tagtype":"img"});
....
<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AhK:95e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0.`WmNHTMM@!(*IBm$MIX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.plat
formID=AN&src.visitorID=3385203591170409805", "c":7, "tagtype":"img"})
;....


GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.plat
formID=AN&src.visitorID=3385203591170409805", "c":6, "tagtype":"img"})
;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: 
no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http
://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OU
Ro SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-C
ookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:
51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; ex
pires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-
Cookie: anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`Nbn
U2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:
HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=; path=/; expires=Wed, 19-Nov-2014 09:5
1:11 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javas
cript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Len
gth: 141..ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/syn
c?src.platformID=AN&src.visitorID=3385203591170409805", "c":6, "tagtyp
e":"img"});....
<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val
=3385203591170409805", "c":5, "tagtype":"img"});....


GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val
=3385203591170409805", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache
-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat,
 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/po
licy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS C
OM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591
170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnx
s.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 
09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.wh
.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F
9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1
.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.
adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf
-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 118..ANX_asyn
c_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203
591170409805", "c":4, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//i
b.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":4, "tagtype":
"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..P
ragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyre
f="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo 
PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0
..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2
014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pat
h=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r
/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<I
RD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; 
expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Co
ntent-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2
014 09:51:12 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://t
.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1
471&user=[MOOKIE]", "c":4, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/2#@C1/1J9n2]x2DauGmU9q'w<Ow]Gn%pe?[f?`nfj(6L2]z3I/.zc<SY#G`7IKRz6:TukE=8hT_kM#aIYzx]s(02WVE%zD?; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 113
ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385
203591170409805", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359117040
9805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51
:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/IE:X*YD
gEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>
;8M!*edD$/2#@C1/1J9n2]x2DauGmU9q'w<Ow]Gn%pe?[f?`nfj(6L2]z3I/.zc<
SY#G`7IKRz6:TukE=8hT_kM#aIYzx]s(02WVE%zD?; path=/; expires=Wed, 19-Nov
-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: applica
tion/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..C
ontent-Length: 113..ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1
&pub=345&userid=3385203591170409805", "c":3, "tagtype":"img"});
....
<<< skipped >>>

GET /pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir= HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@
Connection: Keep-Alive
Host: ib.adnxs.com


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=^<5.XQOF; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:13 GMT
GIF89a.............!.......,[email protected]..;....


GET /mapuid?member=1471&user=2040815613008858 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs L*<V`r_^@[email protected]_:7DV=oPD 6#xbWe]NRFG?.vZeASQ:3:3nq9VwXZS; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/
partners/7142/users/3385203591170409805;noCookies=t", "c":3, "tagtype"
:"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..
Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyr
ef="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo
 PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 
0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-
2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pa
th=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOn
ly..Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVe
s)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<
@@jXHm5G]KPX[*AxDPwhNbmMs L*<V`r_^@[email protected]_:7DV=oPD 6#xbWe]NRFG
?.vZeASQ:3:3nq9VwXZS; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; d
omain=.adnxs.com; HttpOnly..Content-Type: application/javascript; char
set=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 149..A
NX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/p
artners/7142/users/3385203591170409805;noCookies=t", "c":3, "tagtype":
"img"});....
<<< skipped >>>

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 169
ANX_async_load({"url":"hXXp://dis.criteo.com/dis/usersync.aspx?r=7&p=1
9&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=67361
4", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store,
 no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:
00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="
NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; 
expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Se
t-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domai
n=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0
/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqC
Vc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#
Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx; path=/; expires=Wed, 19
-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Content-Type: app
lication/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GM
T..Content-Length: 169..ANX_async_load({"url":"hXXp://dis.criteo.com/d
is/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib
.adnxs.com/seg?add=673614", "c":1, "tagtype":"img"});....
<<< skipped >>>

GET /pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir= HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:15 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*[email protected]_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/
partners/7142/users/3385203591170409805;noCookies=t", "c":1, "tagtype"
:"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..
Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyr
ef="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo
 PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 
0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-
2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pa
th=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOn
ly..Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jb
bVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[
fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@
.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed
, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type:
 application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:1
5 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumpta
p.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;no
Cookies=t", "c":1, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*[email protected]_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=ap
pnexus&google_cm&google_sc&uid=3385203591170409805", "c":0, "tagtype":
"img"});....


GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqc
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=ap
pnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":
"img"});....


GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=ap
pnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":
"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..P
ragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyre
f="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo 
PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0
..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2
014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pat
h=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnl
y..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:5
1:16 GMT..Content-Length: 0..HTTP/1.1 200 OK..Cache-Control: no-store,
 no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:
00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="
NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; 
expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Se
t-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domai
n=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: 
Thu, 21 Aug 2014 09:51:16 GMT..Content-Length: 0......
<<< skipped >>>

GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:17 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359117040
9805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51
:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]EVt4ZD
gEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>
;8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^ap
q_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi
1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com;
 HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 
Aug 2014 09:51:17 GMT..GIF89a.............!.......,[email protected]..;nt>....
<<< skipped >>>

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*[email protected]^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx]s(01RWW*itG; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Content-Length: 102
ANX_async_load({"url":"hXXp://m.xp1.ru4.com/activity?_o=62795&_t=cm_ap
n_in", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-sto
re, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:
00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", C
P="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA P
RE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=
/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly.
.Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; do
main=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*fR537e6AqeU#-2*b 
Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:
@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@
Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx]s(01R
WW*itG; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.c
om; HttpOnly..Content-Type: application/javascript; charset=utf-8..Dat
e: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length: 102..ANX_async_load(
{"url":"hXXp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in", "c":1, "
tagtype":"img"});....
<<< skipped >>>

GET /setuid?entity=11&code=NC-00000010467304128 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F
Connection: Keep-Alive
Host: ib.adnxs.com


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*[email protected]_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:18 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359117040
9805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51
:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/AfR537e
6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1P
l1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<
;?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*[email protected]_:7=5soPD 
6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$; path=/; expires=Wed, 19-Nov-2014
 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Conten
t-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:18 GMT..GIF89a........
.....!.......,[email protected]..;....
<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*[email protected]_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:19 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:5
1:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Conte
nt-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:19 GMT
..Content-Length: 0..



GET /if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: nym1.ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3Macd9s3po!/_3RiNx:M; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 510
<SCRIPT SRC="hXXp://an.z5x.net/ttj?id=3319347&size=160x600&position
=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=
3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9
v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQ
CgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtS
eU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://i
b.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=" TYPE="tex
t/javascript"></SCRIPT>HTTP/1.1 200 OK..Cache-Control: no-sto
re, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:
00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", C
P="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA P
RE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=
/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly.
.Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; do
main=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX
%m3ux[3Macd9s3po!/_3RiNx:M; path=/; expires=Wed, 19-Nov-2014 09:51:05 
GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf
-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 510..<SCRI
PT SRC="hXXp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&c
b=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&
pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dK
M_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAA
<<< skipped >>>

GET /if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEB
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 148
<SCRIPT SRC="hXXp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&refer
rer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266" TYPE="text/javascript"&
gt;</SCRIPT>..HTTP/1.1 200 OK..Cache-Control: no-store, no-cache
, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P
3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP C
OR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-P
rotection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=W
ed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie:
 sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.
com; HttpOnly..Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD
$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<; path=/
; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..
Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:0
7 GMT..Content-Length: 148..<SCRIPT SRC="hXXp://ib.adnxs.com/ttj?id
=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095
266" TYPE="text/javascript"></SCRIPT>....
<<< skipped >>>


GET /is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: ak1.abmr.net


HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: hXXp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: 01AI=2-2-11D5DE5315B982453FFC1B127DDFA708AF68DE22869D001BA11FDB1D92AB1550-BFF35046EB015A925D86111169A014CFA2220E9515310C261C7561C6453CBCB6; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net
P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"
HTTP/1.1 302 Moved Temporarily..Content-Length: 0..Location: hXXp://pi
xel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdej
lBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc..Expires: Thu, 21
 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..
Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: kee
p-alive..Set-Cookie: 01AI=2-2-11D5DE5315B982453FFC1B127DDFA708AF68DE22
869D001BA11FDB1D92AB1550-BFF35046EB015A925D86111169A014CFA2220E9515310
C261C7561C6453CBCB6; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; do
main=.abmr.net..P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", C
P="NON DSP COR CURa ADMa DEVa OUR SAMa IND"..



GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dps.bing.com
Connection: Keep-Alive
Cookie: MUID=2F6B223C4C616DD806C724A148616EB1


HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 42
Content-Type: image/gif
Expires: 2:51:04 AM
Server: Microsoft-IIS/8.5
TrackingId: b6d56b86-8f34-47bc-aafa-3741ae4c49d7
X-Powered-By: ASP.NET
X-MSEdge-Ref: Ref A: 9EADC1D16D464D5C84E8BF9245A33047 Ref B: 83051D85D07344195EA85793513249CE Ref C: Thu Aug 21 02:51:09 2014 PST
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Contr
ol: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 2:
51:04 AM..Server: Microsoft-IIS/8.5..TrackingId: b6d56b86-8f34-47bc-aa
fa-3741ae4c49d7..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: 9EADC1D16
D464D5C84E8BF9245A33047 Ref B: 83051D85D07344195EA85793513249CE Ref C:
 Thu Aug 21 02:51:09 2014 PST..Date: Thu, 21 Aug 2014 09:51:09 GMT..GI
F89a.............!.......,...........L.;..



GET /updates/u/fcupdater.wys HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)
Host: cdn.wemempoclano.net
Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Age: 183471
Date: Thu, 21 Aug 2014 09:51:10 GMT
Last-Modified: Wed, 23 Oct 2013 14:27:47 GMT
Content-Length: 294
Connection: keep-alive
PK........w.WC....z.........$.0.. .........X.:.....G.:.....G.:........
vq.3bdg```.bC=.v. [email protected]; m...%%.V...)yziE.....y.z.....).
%.....i..v.^bN.^I..P.^ye)....p.lz..p.8..GlA......PK..-.......w.WC....z
.........$.......  ......0.. .........X.:.....G.:.....G.:.....PK......
....S.........HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..Accept-Range
s: bytes..Age: 183471..Date: Thu, 21 Aug 2014 09:51:10 GMT..Last-Modif
ied: Wed, 23 Oct 2013 14:27:47 GMT..Content-Length: 294..Connection: k
eep-alive..PK........w.WC....z.........$.0.. .........X.:.....G.:.....
G.:........vq.3bdg```.bC=.v. [email protected]; m...%%.V...)yziE....
.y.z.....).%.....i..v.^bN.^I..P.^ye)....p.lz..p.8..GlA......PK..-.....
..w.WC....z.........$.......  ......0.. .........X.:.....G.:.....G.:..
...PK..........S...........



GET /ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com.ua


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:07 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: adclick_server
Content-Length: 76
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?...HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:07 GMT..Pragma: no
-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cach
e, no-store, must-revalidate..Content-Type: text/html; charset=UTF-8..
X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: adcli
ck_server..Content-Length: 76..X-XSS-Protection: 1; mode=block..Altern
ate-Protocol: 80:quic..............(....I.O.T(...I.UJJL.N/./.K.M.../.*
)J. .H,J. Q......R`....h.?.......


GET /ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com.ua


HTTP/1.1 200 OK
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Typ
e: image/gif..Date: Thu, 21 Aug 2014 09:51:14 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_
server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate
-Protocol: 80:quic..GIF89a.............!.......,...........D.;..



GET /mapuid?member=181&user= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
Connection: Keep-Alive
Host: adx.adnxs.com


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:07 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359117040
9805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51
:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=33852035911704
09805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.co
m; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 2
1 Aug 2014 09:51:07 GMT..GIF89a.............!.......,[email protected]..;..



GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 08 Feb 2013 15:35:10 GMT
Date: Fri, 08 Aug 2014 06:25:37 GMT
Expires: Sat, 08 Aug 2015 06:25:37 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 32819
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 1135523
Alternate-Protocol: 80:quic
............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.
~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f
.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.
T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4
[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l
.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........
../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..
w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V...
.....V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^
.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g
..Q...S_..Y.....G)..T.".......<......&...*..Z.t%[email protected].
h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;..
...3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE.
.,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q..
..v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_......
..j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)
....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*......
..H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v.
...n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f.......
...&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3...
...i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..
`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&
<<< skipped >>>


POST /collect HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: VVV.google-analytics.com
Content-Length: 210
Expect: 100-continue
Connection: Keep-Alive

t=event&ec=Installation_Process&ea=install_start&el=user start to install the app&ev=0&v=1&tid=UA-45411392-1&cid=6d7f6e0c-b90b-4b58-b851-2e2d1d13a422&cm=(organic)&cn=(undefined)&ci=0&cc=(unknown ad)&cs=(direct)
HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:50:57 GMT
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Mon, 07 Aug 1995 23:30:00 GMT..Cache-Control: private, no-cac
he, no-cache=Set-Cookie, proxy-revalidate..Access-Control-Allow-Origin
: *..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Opti
ons: nosniff..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:50:57
 GMT..Server: Golfe2..Content-Length: 35..Alternate-Protocol: 80:quic.
.GIF89a.............,...........D..;..



GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
Cookie: i=6333127b-59e4-4c75-9681-e9f9bbb7943b|1408614672


HTTP/1.1 200 OK
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Type: image/gif
Content-Length: 43
Cache-Control: private, max-age=0, no-cache
Connection: close
GIF89a.............!.......,...........D..;..



GET /tap.php?v=4894|| HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805
Connection: Keep-Alive
Host: pixel.rubiconproject.com


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com
Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com
Content-Length: 49
Keep-Alive: timeout=30, max=9733
Connection: Keep-Alive
Content-Type: image/gif
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Thu, 21 Aug 2014 09:51:11 GMT..Server: Apache..X-Powered-By: PHP/5.3
.3..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set
-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; 
domain=.rubiconproject.com..Set-Cookie: rpx=4894=40633,0,1,,
; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubicon
project.com..Content-Length: 49..Keep-Alive: timeout=30, max=9733..Con
nection: Keep-Alive..Content-Type: image/gif..GIF89a..................
.!.......,...........T..;..



GET /cm/w/out HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b


HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXps://analytics.twitter.com/i/adsct?p_user_id=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI&p_id=823423
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/
Content-Length: 109
Connection: keep-alive
Go to hXXps://analytics.twitter.com/i/adsct?p_user_id=ZTRiYWM1ZmFjMzEw
YTRmZmRlYzkxMDY1NjdkNDMxOGI&p_id=823423....


GET /cm/l/out HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b


HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/
Content-Length: 85
Connection: keep-alive
Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffd
ec9106567d4318bHTTP/1.1 302 Moved Temporarily..Cache-Control: no-store
, no-cache, must-revalidate..Date: Thu, 21 Aug 2014 09:51:13 GMT..Loca
tion: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffd
ec9106567d4318b..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..P
ragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac31
0a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GM
T; Max-Age=157680000; Path=/..Content-Length: 85..Connection: keep-ali
ve..Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a
4ffdec9106567d4318b....


GET /cm/g/in?google_ula=1535926,0 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b
Connection: Keep-Alive
Host: d.adroll.com


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b-g_1408614674; Version=1; Expires=Tue, 20-Aug-2019 09:51:14 GMT; Max-Age=157680000; Path=/
X-Result: g.-1.-1.1535926.0.-1
Content-Length: 35
Connection: keep-alive
GIF87a.............,............Q.;HTTP/1.1 200 OK..Cache-Control: no-
store, no-cache, must-revalidate..Content-Type: image/gif..Date: Thu, 
21 Aug 2014 09:51:14 GMT..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NA
V STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4
bac5fac310a4ffdec9106567d4318b-g_1408614674; Version=1; Expires=Tue, 2
0-Aug-2019 09:51:14 GMT; Max-Age=157680000; Path=/..X-Result: g.-1.-1.
1535926.0.-1..Content-Length: 35..Connection: keep-alive..GIF87a......
.......,............Q.;..



GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9827
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu,
 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR
 STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id
=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51
:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Doma
in=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-
Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 
30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43.
.Keep-Alive: timeout=1, max=9827..Connection: Keep-Alive..GIF89a......
.......!.......,...........D..;....



GET /offers/images/Theme8/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:04 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:04 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:04 GMT..Co
ntent-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>


GET /FreeCoinsLandingPage/themes/thankyou/images/free_coins_logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"5837-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: image/png
Content-Length: 5837
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
.PNG........IHDR..."...".....:G......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>


GET /cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:12 GMT
Server: Apache/2.2.3 (Red Hat)
Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:12 GMT..Server: Apach
e/2.2.3 (Red Hat)..Location: //ib.adnxs.com/mapuid?member=1471&user=20
40815613008858..Connection: close..Content-Type: text/plain; charset=U
TF-8..



GET /tag/js/gpt.js HTTP/1.1
Accept: */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googletagservices.com
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 7333933708124470652
Date: Thu, 21 Aug 2014 08:52:51 GMT
Expires: Thu, 21 Aug 2014 09:52:51 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 14500
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 3489
Alternate-Protocol: 80:quic
...........}iw.8.....GooF.....3cE.I..M.4M..~r(J^.5..4m../..........=g.
[email protected].~:.%...9...G.2.........}.r..A`..Oo..._c..o[..
"......?.....fI.f......8.......a....T.<...".......l..wi<....M&P.
.....>.f.....pU..-.F.....5[N.(...I.I4.....k9...h...v..,&#....B.Q...
'G.8.Y0........,..7.........bg.;......2...[.h.D5.:[..G)H........I,....
.;..B......WnP........O.S.E..y...*N...........I.f9....T.....U.......&g
t;.....rC.[|2O.qt....V.n....k...1..1.......F..j.}.b7p...b..l.......lrY
<........\.F..9.0._...x..4#..u9.....Os....N.9.U.wO.h. ..o.w.".r..G.
T6......4l.jU...ft....{....5........^.....4.g......KGWQ..C...>k..g.
.."d..(...k .Tb.C.V<....o.5...3.Yt].fJ..A..K..c.A.[.;.;..g....b1.7.
.....4...%.,N...9K3QP.%'.....mk..f..w.6_..l=...`p[...Qt......o.w{.o..O
..s.]9..v.y..^....u'.:.,),m.1e)....h...f....N...V....\..3.....\.4...B.
n..K.-~...`..z......&..).l.*........]..}7..D....\..q.......C.E.#]..|,.
...O.....;..4J....n..[.Q..O..z...<...,.../.._....W..h.^...3X..q.s.*
....t.%...f.OU...7E.Q.h?..m..A.i...A.%....Lr.4..sJ...%o.g.r.......N ~p
.u...r..u\.ea8l....$J....6~.?W...%.......U..H.m..v.e=..W.i.. ........Q
.F.(...l..|hA..-...i...@vvr?AE.IX... ....z....Z.A..=...f..8#9..S.....v
..0i...|.*...5n.....i.$..&o..o....&Y?... .....A...i.h..n.U..&...9.|.XP
.a....._=...[...=..>...h..>..1}@..>.TJ....%}.....c......\....
N....>..?...qH....}.........._..)&......P?..@}L........_R).......9.
@rn.7b...........}0.'...wh..A.....*?. ......a<H..b.A..5...}M...OX..
..~x{.z...G;!..U;B?P.......o...#".M..:.. .#.s.X_......: ..... ..t.
<<< skipped >>>


GET /r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: r.turn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/
Content-Type: image/gif
Content-Length: 43
Date: Thu, 21 Aug 2014 09:51:13 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Ap
ache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa
 PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=0, no-ca
che, no-store, private, must-revalidate, s-maxage=0..Pragma: no-cache.
.Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 1
7-Feb-2015 09:51:14 GMT; Path=/..Content-Type: image/gif..Content-Leng
th: 43..Date: Thu, 21 Aug 2014 09:51:13 GMT..GIF89a.............!.....
..,...........D..;....


GET /r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: r.turn.com
Connection: Keep-Alive
Cookie: uid=7369045053275563920


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/
Content-Type: image/gif
Content-Length: 43
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Ap
ache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa
 PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=0, no-ca
che, no-store, private, must-revalidate, s-maxage=0..Pragma: no-cache.
.Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 1
7-Feb-2015 09:51:14 GMT; Path=/..Content-Type: image/gif..Content-Leng
th: 43..Date: Thu, 21 Aug 2014 09:51:14 GMT..GIF89a.............!.....
..,...........D..;..



GET /cm?in=1&pub=345&userid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.rfihub.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Server: nginx/1.5.3
Date: Thu, 21 Aug 2014 09:51:13 GMT
Content-Length: 0
Connection: keep-alive
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com
Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com
Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=
HTTP/1.1 302 Found..Server: nginx/1.5.3..Date: Thu, 21 Aug 2014 09:51:
13 GMT..Content-Length: 0..Connection: keep-alive..P3P: CP="NOI CURa A
DMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: e=ai;Path=/;Do
main=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Expires: Thu, 
01 Jan 1970 00:00:00 GMT..Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1
MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;P
ath=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Set-Co
okie: hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5h
e4GIwAAAA==;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:1
3 GMT..Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQ
xsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=;Path=/;Domain=.rfihub.com;Expire
s=Mon, 06-Feb-2017 09:51:13 GMT..Set-Cookie: euds=H4sIAAAAAAAAABMSNja2
MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com..Set-Co
okie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCw
pTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com..Location: hXXp://ib.adnxs
.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');
&redir=......
<<< skipped >>>


GET /js/core-min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:01 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT
ETag: "406cf-ce2-4fc68d5e5db4d"
Accept-Ranges: bytes
Content-Length: 3298
Connection: close
Content-Type: text/javascript
/*.CryptoJS v3.1.2.code.google.com/p/crypto-js.(c) 2009-2013 by Jeff M
ott. All rights reserved..code.google.com/p/crypto-js/wiki/License.*/.
var CryptoJS=CryptoJS||function(h,r){var k={},l=k.lib={},n=function(){
},f=l.Base={extend:function(a){n.prototype=this;var b=new n;a&&b.mixIn
(a);b.hasOwnProperty("init")||(b.init=function(){b.$super.init.apply(t
his,arguments)});b.init.prototype=b;b.$super=this;return b},create:fun
ction(){var a=this.extend();a.init.apply(a,arguments);return a},init:f
unction(){},mixIn:function(a){for(var b in a)a.hasOwnProperty(b)&&(thi
s[b]=a[b]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},c
lone:function(){return this.init.prototype.extend(this)}},.j=l.WordArr
ay=f.extend({init:function(a,b){a=this.words=a||[];this.sigBytes=b!=r?
b:4*a.length},toString:function(a){return(a||s).stringify(this)},conca
t:function(a){var b=this.words,d=a.words,c=this.sigBytes;a=a.sigBytes;
this.clamp();if(c%4)for(var e=0;e<a;e  )b[c e>>>2]|=(d[e&g
t;>>2]>>>24-8*(e%4)&255)<<24-8*((c e)%4);else if(
65535<d.length)for(e=0;e<a;e =4)b[c e>>>2]=d[e>>&
gt;2];else b.push.apply(b,d);this.sigBytes =a;return this},clamp:funct
ion(){var a=this.words,b=this.sigBytes;a[b>>>2]&=4294967295&l
t;<.32-8*(b%4);a.length=h.ceil(b/4)},clone:function(){var a=f.clone
.call(this);a.words=this.words.slice(0);return a},random:function(a){f
or(var b=[],d=0;d<a;d =4)b.push(4294967296*h.random()|0);return new
 j.init(b,a)}}),m=k.enc={},s=m.Hex={stringify:function(a){var b=a.
<<< skipped >>>


GET /pagead/conversion.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googleadservices.com
Connection: Keep-Alive


HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 10951747834593842486
Date: Wed, 20 Aug 2014 21:52:56 GMT
Expires: Thu, 21 Aug 2014 21:52:56 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 3638
X-XSS-Protection: 1; mode=block
Age: 43089
Cache-Control: public, max-age=86400
Alternate-Protocol: 80:quic
...........Z.s....=..h:.:\[email protected]..
...J./...y..I.(........N.D....g......y.n..F"..pR..C..x....$...lgq..h,.
e.../.....Br..c.<..z.E....i..u....px..\R.a.A....h=.M\5[....TGrm6$\.
m...Z...p.N[-..]...pI..&..w.cTPt!...}r..E...x....d...~o.e..{.....7....
.*.R'O."HD#....c.........Q.....(.....g;v6.......\|ke}.b...9[.../aE...o
^.k......~gQS.\..?....Jwi..d/.Z.......f3.vt.l..D..".V4...~....y.7..).t
.<...[h.kt_...y.k.*.......lb.|.Ox..h.i..K...D.g...........X.Y#.n.FH
6..=7.,1`...K8.KX''..~..W..z..&.]..f.....0....w..E......?.~.."~.....k-
..."[S.....C>..d[..^H../..;.j.&..9W1....X.8.1z...p....>......W.}
m..{j..T....v.k.......n.........Z-........w...6.P.|G....C|...P.qh....6
..C.ob...n..t..... ...w.].9..J:.".....T.L...!c.7l6.Y...8....uu..x"'J.0
i9'..n;4.0,.Cg4B#._..#8.<....)....{......r ...M.......y......N.....
5J3q....hq........P...~../e..LjeA.p..E....^...x....QK0o..u^...^n..:S-.
....r.....". ..J!tT:$g.F..W.d.....l....m..b......:.Z.[.........T.\u<
;hL[.*g"........}.:g......\.N./.Q.n.s..pX.....'o...s.....m......]j....
3..#.(..b.Da..c...;.|.<.!.Zk....q.....%...Z....;.8...PC........EP' 
..X..~..z...:...r2U.X.y<.)..8....~..q"x.Lk&.S1O..e.F.1..^..,..u.O.y
]..d.7..Z..1.X.;.F.H....w.I..pZ..O$[..../..H\.j.. . .l.W\....t ../....
..D.).Aok.U..di'Y....G...e.#....l%...)......i H.".,.b.f.......R..K...(
........*2. O?_..F,..w...;.....{.}V.gU.X.....-~_..k....:...^h....B..bE
oW;.......7....o.U..!..jvu.B.;.Me9.3...Z...[...LX.~...7.Vf...E.....Y.1
....kQ.\.,.(.Z.._......jn&G....6.:...[j....RF..IH.b7.<......@..
<<< skipped >>>

GET /pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googleadservices.com
Connection: Keep-Alive


HTTP/1.1 302 Found
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Date: Thu, 21 Aug 2014 09:51:05 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 76
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....
h.?.......


GET /pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googleadservices.com
Connection: Keep-Alive


HTTP/1.1 302 Found
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Date: Thu, 21 Aug 2014 09:51:13 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882
Content-Type: image/gif
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: pol
icyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV P
SA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Thu, 21 Aug 2014 09:51:13 G
MT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Co
ntrol: no-cache, must-revalidate..Location: hXXp://googleads.g.doublec
lick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6
YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_
cookie_present=false&convclickts=0&random=500434882..Content-Type: ima
ge/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Length:
 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..GIF
89a.............!.......,...........D.;..



GET /c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.bing.com
Connection: Keep-Alive


HTTP/1.1 302 Redirect
Cache-Control: private, no-cache, proxy-revalidate, no-store
Pragma: no-cache
Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Thu, 21-Aug-2014 13:51:06 GMT; path=/;
Set-Cookie: MUID=2F6B223C4C616DD806C724A148616EB1; domain=.bing.com; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/;
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 0
HTTP/1.1 302 Redirect..Cache-Control: private, no-cache, proxy-revalid
ate, no-store..Pragma: no-cache..Location: hXXp://ib.adnxs.com/pxj?bid
der=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1
|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")..Server: 
Microsoft-IIS/8.0..X-Powered-By: ASP.NET..P3P: CP="BUS CUR CONo FIN IV
Do ONL OUR PHY SAMo TELo"..Set-Cookie: ANONCHK=1; domain=c.bing.com; e
xpires=Thu, 21-Aug-2014 13:51:06 GMT; path=/;..Set-Cookie: MUID=2F6B22
3C4C616DD806C724A148616EB1; domain=.bing.com; expires=Sat, 20-Aug-2016
 09:51:06 GMT; path=/;..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-L
ength: 0..



GET /Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:50:06 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 9773
Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"83$.Fmkcsez_oajgRvjdo
"8.((* 0. .RcbC`r 7.!("P`_F^w3.!6" '.M^nllsJak`.5.W
loSqbc.9^\ci_q]tmm.&.Q^pdLaqn.'.NoicqcrD<.300&!=lu\qnHd
c_q.:.'.DlU^csBopDfnm_if!61*.=s^SOF!6" '.@qcRLK."8..
'.Algl]nbGai^ 7.!("Ma^`kSOF!6"folk3-,^hneao&oac*[ols
 oj\\i ]ni/-j^a^pp)Cun_ha^Hdc_qOcp`]i8mc`dnib8*1-$sih`=0.._bqqcc917  1
.jb[cl=4.(..alomprwd\8 4/ rus`dl8,0#^e^=.!`]60.&!Nar`.5&/).@`d
goajg_i>`pa 5., 7/3,-5241.% >hsevgmmn^qO_fGewn.5. ).O]ympl.3 .&a
mp;!Afd`[obtb.9)1*.HmhklnhknP\l`.8*  .Dgn[m^n^hbuR_o].3 .&!Olc`h&l
t;_rblHjsr\dg.8-&!Ripom\eMc`dnCmhe\gbIcma"8..x%y.JnotCs].3 .&
amp;!Lrc@p`.8.. .CmhhjgcknSupc.23% JimetguYobmkNxleq.2.) .1!("P`_
F^w.4!., M]bDcv03.: .$.KcmiqpN_h].3 Scqpu_g.(.Q^pdLaqn.&.Dl]tob_n]
.% Mln`uaoA?.8/3 .AjrYtlMc`dn"8 $.BqT[hpFmmAilr^fk.:/'.@qcRLK
.: .$.>vbOQH2 5..% @ilial_Ddgc.4!., J^a^pRLK.: cloi8,)cerc^l)mfb
9;`lpq(lmZah(bkm-*ga_com.@yl\ed\Mc`dnSam]`g=l`earg_5-00#pned;-1!]gpnh`
=/4(./$i_``p;1  ,$`itjtpta_603,%oyq]ao61/ cbb; .c[;/. .R_o].3 .&!=
dbdldhl^fC]t_.2.*06,8)12/.3.*.;mpitdjplcpLdcKctk.3 .&!Lawjmo.8*  .
Eda]^mgs_!6-/'.KkmjiseolMYo^ 7'0("Bdk^kcm[m_yP\l`.8*  .Sj
`]k:dq_qEnqoYge 7* .VgmlpZjL`earAjehZlaFhje 5..v*x.Oksr@p`.8.. .Pp`=s^
 7.!("AjekhlbhsPyn`.51*.Gnjirdr\mglhSupcn.5./*-,-7 '.M^eH_x.:
 .$.KcdEdu62.2..*.LdlopoF\fc.4!Ripom\e.*.XkuRpZ`.?`]dhep\ljk.(.EkcsnZ\
lc.&!Lrm_m^mGA.9.8*.9gp_vmNbfcm.5)*.CrSago>jkGkms]lj.2,% Br
<<< skipped >>>

GET /Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0 HTTP/1.1


User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:50:54 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK......


GET /Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O HTTP/1.1


User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:00 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html
; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:00 GMT..Server: Microsof
t-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Po
wered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....



GET /ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com


HTTP/1.1 302 Found
Location: hXXp://VVV.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y
Cache-Control: private, max-age=43200
Date: Thu, 21 Aug 2014 09:51:06 GMT
Expires: Thu, 21 Aug 2014 09:51:06 GMT
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 706
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/976381674/?rand
om=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&v
alue=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=
ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&
;u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=ht
tp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=C
AIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts
=0&random=4279697415&ipr=y">here</A>...</BODY>&
lt;/HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google.com.ua/a
ds/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=
1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=
846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_n
mime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thanky
ou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclic
kts=0&random=4279697415&ipr=y..Cache-Control: private, max-age=43200..
Date: Thu, 21 Aug 2014 09:51:06 GMT..Expires: Thu, 21 Aug 2014 09:51:0
6 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options:
 nosniff..Server: adclick_server..Content-Length: 706..X-XSS-Protectio
n: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEA
<<< skipped >>>

GET /ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com


HTTP/1.1 302 Found
Location: hXXp://VVV.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y
Cache-Control: private, max-age=43200
Date: Thu, 21 Aug 2014 09:51:14 GMT
Expires: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 346
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/933633792/?labe
l=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&ran
dom=1098627879&ipr=y">here</A>...</BODY></HTML&g
t;..HTTP/1.1 302 Found..Location: hXXp://VVV.google.com.ua/ads/user-li
sts/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=fa
lse&random=1098627879&ipr=y..Cache-Control: private, max-age=43200..Da
te: Thu, 21 Aug 2014 09:51:14 GMT..Expires: Thu, 21 Aug 2014 09:51:14 
GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: n
osniff..Server: adclick_server..Content-Length: 346..X-XSS-Protection:
 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD>&
lt;meta http-equiv="content-type" content="text/html;charset=utf-8">
;.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1
>302 Moved</H1>.The document has moved.<A HREF="hXXp://www
.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&
;script=0&ct_cookie_present=false&random=1098627879&ipr=y"
>here</A>...</BODY></HTML>....
<<< skipped >>>


GET /cdn/bv.js?bv=0.008 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dcdn.darchermedia.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Type: application/x-javascript
Content-Length: 10245
Connection: keep-alive
Last-Modified: Tue, 19 Aug 2014 04:17:46 GMT
Vary: Accept-Encoding
ETag: "53f2cfea-2805"
Server: NetDNA-cache/2.2
X-Cache: HIT
Accept-Ranges: bytes
/*********************************************************************
****.* .* DARCHER LLC INTELLECTUAL PROPERTY.* __________________.* .* 
 [2014] DARCHER LLC <[email protected]>.*  All Rights Res
erved..* .* NOTICE:  All information contained herein is, and remains.
* the property of DARCHER LLC dba DARCHER MEDIA and its suppliers,.* i
f any.  The intellectual and technical concepts contained.* herein are
 proprietary to DARCHER LLC dba DARCHER MEDIA.* and its suppliers and 
covered by U.S. and Foreign Patents,.* patents in process, and are pro
tected by trade secret or copyright law..* Dissemination of this infor
mation or reproduction of this material.* is strictly forbidden unless
 prior written permission is obtained.* from DARCHER LLC <support@d
archermedia.com>..*/..var _0xb840=["\x72\x61\x6E\x64\x6F\x6D","\x66
\x6C\x6F\x6F\x72","\x63\x75\x72\x72\x65\x6E\x74\x53\x63\x72\x69\x70\x7
4","\x55\x5A\x78\x63\x52\x54\x78\x51\x25\x78\x40\x57\x6D\x4D\x25\x44\x
76\x39\x48\x55\x54\x45\x3F\x23\x5A\x2A\x52\x36\x6B\x23\x38\x41\x40\x6E
\x65\x43\x6B\x62\x44\x5A\x4E\x47\x76\x7A\x56\x5A\x23\x46\x64\x67\x5A\x
26\x4E\x65\x36\x36\x21\x56\x78\x72\x35\x64\x75\x7A\x54\x4E\x32\x5A\x77
\x21\x25\x4B\x64\x43\x51\x68\x62\x73\x4B\x53\x32\x25\x57\x5F\x6D\x32\x
7A\x4A\x73\x24\x50\x75\x52\x67\x40\x47\x34\x26\x68\x55\x57\x43\x4A\x65
\x77\x2D\x79\x55\x23\x35\x74\x21\x46\x52\x76\x25\x42\x62\x5E\x62\x4C\x
2B\x46\x70\x41\x56\x58\x37","\x70\x75\x73\x68","\x73\x6C\x69\x63\x65",
"\x72\x6F\x75\x6E\x64","\x73\x70\x6C\x69\x63\x65","\x44\x2A\x48\x3
<<< skipped >>>


GET /pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:12 GMT
Location: hXXp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/
X-Conversion-Currency: 
X-Conversion-Value: 0
Content-Length: 0
Connection: keep-alive
HTTP/1.1 302 Moved Temporarily..Cache-Control: no-store, no-cache, mus
t-revalidate..Date: Thu, 21 Aug 2014 09:51:12 GMT..Location: hXXp://a.
adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD
3MBH75C5T6UGS6V.js..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fa
c310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12
 GMT; Max-Age=157680000; Path=/..X-Conversion-Currency: ..X-Conversion
-Value: 0..Content-Length: 0..Connection: keep-alive......



GET /d/FreeCoinsApp.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.freecoins.co
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Content-Type: application/octet-stream
Age: 46300
Date: Thu, 21 Aug 2014 09:50:02 GMT
Last-Modified: Tue, 12 Aug 2014 10:47:11 GMT
Content-Length: 19969368
Connection: keep-alive
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..i
u..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i..................
......PE..L......K.................^...........0.......p....@.........
................. ......zM1......................................t....
.......v............0.................................................
.............p...............................text...L\.......^........
.......... ..`.rdata.......p.......b..............@[email protected]\......
.....v..............@....ndata...................................rsrc.
...v.......x...z..............@..@....................................
......................................................................
......................................................................
......................................................................
......................................................................
............................................U....\.}..t .}.F.E.u..H...
[email protected]@..e...E..E.P.u...Pr@
..}[email protected]... M.......M....3.....FQ.....NU..M.....
.....VT..U.....FP..E...............E.P.M...Hp@[email protected]
....E..9}[email protected].}[email protected]..
[email protected]@.W...E..E.h ...Pj.h`[email protected]...\r@._^3.
[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G...
..t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>


GET /FreeCoinsLandingPage/themes/thankyou/images/desttop_bg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"20943-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: image/png
Content-Length: 20943
Date: Thu, 21 Aug 2014 09:51:03 GMT
Connection: close
.PNG........IHDR...V.........5 ......pHYs................OiCCPPhotosho
p ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE.........
..Q,......!.........{.k........>...........H3Q5...B..........@..$p.
...d!s.#...~<< ".....x.....M..0.....B.\[email protected]..@F....
&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH..
...........0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I.
 [email protected]..._-...."[email protected]~..,/...;.
.m..%..h^[email protected].~<<E.........J.B[a.W}.g._.W.l.~<..
....$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..&
gt;.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?..
..D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/[email protected]..=p..
a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2...
.G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.
."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.X
H,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,  .......3...!.[.
[email protected].(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.
....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&
..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._.
.. .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).).
.4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.
n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC][email protected]....
..<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>


GET /mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flex.msn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: public
Content-Type: application/x-javascript; charset=utf-8
Content-Encoding: gzip
Expires: Thu, 21 Aug 2014 10:06:03 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
Content-Length: 488
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;..8..]....../.6....i.
Wyu.....*........}l^..N...zyx..i....M>.U.."_....=-s....l..17...j.||
...............g...../... .....f...n..g.............>n..g......}|oo
/......t....}.og......{...<...x....z.........O........Vy..y../.%.z.
...d...;....~....UY.[........~..I...D~^..._~2....?..........g......>
;z.L.b.....>n.w.....3..........OR.*...]..|.#..?..t............}D...
u..............



GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:49:15 GMT
Expires: Thu, 21 Aug 2014 11:49:15 GMT
Last-Modified: Thu, 31 Jul 2014 23:23:53 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11119
Cache-Control: public, max-age=7200
Age: 110
Alternate-Protocol: 80:quic
...........}{W.....|......a...N..Eo..[K.!..%.RB.:..B......d;...<..5
C........'........\....Q2T#.||..|t>...a&N...P..E,.I.}..'.i&....N[..
....".n.$....2<M..(...N.B..<OP`..~."/M....O..<-3.....S.ne.8..
s..SO\.:I...?e..G)r.(.&2K^..s...}M...,K..4C...{f.h$.NG...B............
z"[email protected]:[email protected]#9.........:....D^
..`N..A..!..F..>.Y.a....4.G..... .$.S.^D...5...{...m..][email protected]>
;.5e...2.b1......{..z..{..z..L...p...HRG....F.'>b.c...>0...#....
.......2I..I..h{.2.&....-.t[.i..b..<.8";q7..g&w/*U<..>U.QY...
R..s.m.Z-....V..3.O.#.T...n.........8hQS.........z....W..w.....?8|....
.O..|.&c.............t.M/......k..........^.......m=hY..;.....5.....89
o|...%-.R....a*{..E.m....,............l........w~w.lt...y........_.h..
..... ..VW.....h.\.*l....d..i. .....z.I*.....R7.-;..Z..;... Y..n...jO.
....... ...u..D..#h..%[email protected]... .K.......R>.c.r.h._.........
kO.]-m.Yy..E3.c.....'........._&.....%tp...72.Z...)..O.d.... .*T*:h"/.
.:..ju....=5..f.....7....l&......ir>.H.;..j.oP.:....Y......4h...*..
......U...D .....B..d...P.L ivY...1S.....o..L.]...}....N.....q7....?K@
....~V...?..g...;.....S..y..........7[*.B..:..q.s.m-.....2....W]...X:.
eT...$i..-...w...<^=^].w&t..::\o....R.f}c..X....H..>...j".....A.
...i........]/..*F}).MmD...ju8..*H.....B ...<.6..#.*.......>..-.
."..%....n% ....6.n.-z8..D.:......Buz....uAB B....$y.0W.....P~....s...
.U.%....]b.&u....O4x.....W..ykT...`.k.}7M{..m.7.V...2M. ....7f.:.....6
[o.....'c,.=..<.b.....U..8..0.Z.D'b/.#5..)..\w....GO~.a<..O.
<<< skipped >>>

GET /collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Wed, 20 Aug 2014 22:04:40 GMT
Server: Golfe2
Content-Length: 35
Age: 42386
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..
Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *
..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options
: nosniff..Content-Type: image/gif..Date: Wed, 20 Aug 2014 22:04:40 GM
T..Server: Golfe2..Content-Length: 35..Age: 42386..Cache-Control: priv
ate, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Protoc
ol: 80:quic..GIF89a.............,...........D..;..



GET /?provider=captify&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: x.skimresources.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Location: hXXp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server: TornadoServer/2.4.1
Set-Cookie: skimGUID=1d2182171d38f63bead29a52dfc1bed2; Domain=.skimresources.com; expires=Fri, 21 Aug 2015 09:51:18 GMT; Path=/
Content-Length: 0
Connection: keep-alive
HTTP/1.1 302 Found..Content-Type: text/html; charset=UTF-8..Date: Thu,
 21 Aug 2014 09:51:18 GMT..Location: hXXp://d2tjil5tz17cbz.cloudfront.
net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=338520359117040980
5..P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR I
ND CNT"..Server: TornadoServer/2.4.1..Set-Cookie: skimGUID=1d2182171d3
8f63bead29a52dfc1bed2; Domain=.skimresources.com; expires=Fri, 21 Aug 
2015 09:51:18 GMT; Path=/..Content-Length: 0..Connection: keep-alive..



GET /dpixel?source=appnexus&eid=5&id=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cms.quantserve.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Connection: close
Content-Type: image/gif
Set-Cookie: mc=53f5c111-6e765-7acdf-772b7; expires=Sat, 20-Feb-2016 09:51:13 GMT; path=/; domain=.quantserve.com
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 35
Date: Thu, 21 Aug 2014 09:51:13 GMT
Server: QS
GIF89a.......,.................D..;..



GET /CA_Servlet/trackingServlet?getGAparams=1 HTTP/1.1
Host: VVV.freecoins.co
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 127
Vary: Accept-Encoding
Date: Thu, 21 Aug 2014 09:50:56 GMT
Connection: close
{"cm":"(organic)","cn":"(undefined)","ci":"0","cid":"6d7f6e0c-b90b-4b5
8-b851-2e2d1d13a422","cc":"(unknown ad)","cs":"(direct)"}..



GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
Date: Thu, 21 Aug 2014 09:51:17 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 317
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=338520359
1170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">
here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: 
policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP
="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NA
V OTC NOI DSP COR"..Location: hXXp://ib.adnxs.com/setuid?entity=101&ui
d=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1..
Date: Thu, 21 Aug 2014 09:51:17 GMT..Pragma: no-cache..Expires: Fri, 0
1 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Con
tent-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Co
ntent-Length: 317..X-XSS-Protection: 1; mode=block..Alternate-Protocol
: 80:quic..<HTML><HEAD><meta http-equiv="content-type" 
content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE
></HEAD><BODY>.<H1>302 Moved</H1>.The docum
ent has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&ui
d=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_
cver=1">here</A>...</BODY></HTML>....
<<< skipped >>>


GET /tt?id=3092585 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 0
....


GET /bounce?/tt?id=3092585 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=2303909238682748008; sess=1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 1027
<script>!function(){function n(n){try{if(!window.location.ancest
orOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;
o>r;r  )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){
}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(n
ull,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}
),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({r
eferrer:n.document.referrer||null,location:n.location.href||null,isTop
:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n
===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1
,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&
(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancest
orOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURICompo
nent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<
script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1p
lb_xYRHd5q5vN4403Wk.' c '&id=3092585"></scr' 'ipt>')}();</
script>....
<<< skipped >>>

GET /bounce?/tt?id=3092599 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=2303909238682748008; sess=1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 1027
<script>!function(){function n(n){try{if(!window.location.ancest
orOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;
o>r;r  )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){
}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(n
ull,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}
),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({r
eferrer:n.document.referrer||null,location:n.location.href||null,isTop
:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n
===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1
,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&
(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancest
orOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURICompo
nent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<
script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKE
B7xq-EnYVMkT0tBsxwk.' c '&id=3092599"></scr' 'ipt>')}();</
script>....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 634
document.write('<a href="hXXp://nym1.ib.adnxs.com/click?AAAAAAAAAAA
AAAAAAAAAANv5fmq8dKM_AAAAAAAAAAAAAAAAAAAAAAqC-xhAJjkFTcUWCLuo-i4IwfVTA
AAAAGkwLwAQCgAA_AkAAAIAAAASsBsBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAbbYAAgU
AAQIAAJAAKRa4zwAAAAA./cnd=!owaGPQiV8KsCEJLg7ggY1sYbIAE./referrer=htt
p://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3092585/clickenc=
http://VVV.gamesgirl.net/" target="_blank"><img width="1
60" height="600" style="border-style: none" src="hXXp://cdn.adnxs.com/
p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg"/></a>');d
ocument.write('<scr'   'ipt src="hXXp://cdn.adnxs.com/ANX_async_use
rsync.js"></scr' 'ipt>');....
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 124
ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=39136398759
4223&m=3385203591170409805", "c":9, "tagtype":"img"});HTTP/1.1 200 OK.
.Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires
: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/
w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo
 BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385
203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain
=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug
-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k
!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j; 
path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; Http
Only..Content-Type: application/javascript; charset=utf-8..Date: Thu, 
21 Aug 2014 09:51:05 GMT..Content-Length: 124..ANX_async_load({"url":"
hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=3385203591170409
805", "c":9, "tagtype":"img"});....
<<< skipped >>>

GET /ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j
Connection: Keep
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 1441
!function(){function n(n){try{if(!window.location.ancestorOrigins)retu
rn;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r  )n.c
all(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}func
tion r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch
(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==
window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.docu
ment.referrer||null,location:n.location.href||null,isTop:n===window.to
p})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top}
)}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,
l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].refe
rrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l
==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c=
"&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="ht
tp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbB
auki0.' c '&id=3319347&size=160x600&position=above&cb=1408614664&refer
rer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://ny
m1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTCh
JfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAA
AAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi3
3ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%
2Ftt%3Fid%3D3095266/clickenc="></scr' 'ipt>')}();.
...
<<< skipped >>>

GET /seg?t=2&add=1418586 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz0<OctCí^mhpB=L_>W9]mU [J)*c!_(i.)MAEX/<FexB#Isr.-O.Z8q!85^_5znu^; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 0
....


GET /px?t=2&id=157720&other=aXlHoNTekoQSgLGK HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3uz016QPn=Mde3%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*iA5wf; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:06 GMT
GIF89a.............!.......,[email protected]..;....


GET /ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Al
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3uz016QPn=Mde3%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*iA5wf; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 1257
document.write('<iframe frameborder="0" width="160" height="600" ma
rginheight="0" marginwidth="0" target="_blank" scrolling="no" src="htt
p://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqh
j9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4
BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick
=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlez
bcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0
GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd%3
D%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.ad
nxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cn
d=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAi
AEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAA
AAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('
a', 342179, 1408614666);uf('c', 4499349, 140861466
6);uf('r', 17724857, 1408614666);&vpid=13&apid=41891
1&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&m
edia_subtypes=1&ct=0&rsrc=3&dlo=1"></iframe>');document.write
('<scr'   'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js">
</scr' 'ipt>');....
<<< skipped >>>

GET /ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
Connection: Keep-Alive
Host: ib.adnxs.com


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:5
1:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-C
ookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:
51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; chars
et=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 0..nt>....


GET /ttj?id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$h
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 1075
!function(){function n(n){try{if(!window.location.ancestorOrigins)retu
rn;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r  )n.c
all(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}func
tion r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch
(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==
window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.docu
ment.referrer||null,location:n.location.href||null,isTop:n===window.to
p})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top}
)}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,
l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].refe
rrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l
==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c=
"&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="ht
tp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO
3WvOc.' c '&id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/boun
ce?/tt?id=3095266"></scr' 'ipt>')}();....
<<< skipped >>>

GET /ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:08 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: n
o-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http:
//cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OUR
o SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Co
okie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:5
1:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; exp
ires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-C
ookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:
51:08 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; chars
et=utf-8..Date: Thu, 21 Aug 2014 09:51:08 GMT..Content-Length: 0..nt>....


GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:08 GMT
Content-Length: 145
ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=/
/ib.adnxs.com/mapuid?member=364&user=[MOOKIE]", "c":6, "tagtype":"im
g"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Prag
ma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="
hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSD
o OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..S
et-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014
 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/
; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..
Set-Cookie: anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]m
U [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk; path=/
; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..
Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug
 2014 09:51:08 GMT..Content-Length: 145..ANX_async_load({"url":"http:/
/t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=3
64&user=[MOOKIE]", "c":6, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Prov
ider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif
?meta=appNexus", "c":9, "tagtype":"img"});....


GET /a_usersync?cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Prov
ider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif
?meta=appNexus", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Contr
ol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 No
v 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p
3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV
 DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409
805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com;
 HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:
09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/QE:2jUDg
EREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CG
Zv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-No
v-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Content-Type: applic
ation/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:09 GMT..
Content-Length: 182..ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api
/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/33
85203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});
....
<<< skipped >>>

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylp<cH:Ti*W@)8Xu/^meB)H; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.plat
formID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"})
;....


GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>[email protected]$ %6KvV(d5)[J!.]^>qQusg


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?s
rc.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":
"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..P
ragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyre
f="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo 
PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0
..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2
014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pat
h=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowl
W?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!
XrSO0NS3Cl[(jdu; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain
=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=u
tf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 148..ANX_as
ync_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.pla
tformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"}
);....
<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AhK:95e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0.`WmNHTMM@!(*IBm$MIX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.plat
formID=AN&src.visitorID=3385203591170409805", "c":7, "tagtype":"img"})
;....


GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 142
ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus
/tokens?token=3385203591170409805&expires=30", "c":7, "tagtype":"img"}
);HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma:
 no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="htt
p://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo O
URo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-
Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09
:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; e
xpires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set
-Cookie: anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2
q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HF
P='pmP_-oqjR%g![[XZ9*DtX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GM
T; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; 
charset=utf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 14
2..ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appne
xus/tokens?token=3385203591170409805&expires=30", "c":7, "tagtype":"im
g"});....
<<< skipped >>>

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`Nbn
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val
=3385203591170409805", "c":6, "tagtype":"img"});....


GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 177
ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=b
z0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591
170409805", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: n
o-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 200
8 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xm
l", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM 
STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; 
path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; Http
Only..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GM
T; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40LgN>u2e6Aq
eU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1P
l1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1
X'g^`!.xyiah?c4; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain
=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=u
tf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 177..ANX_as
ync_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR
5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409
805", "c":6, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//i
b.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":5, "tagtype":
"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..P
ragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyre
f="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo 
PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0
..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2
014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pat
h=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnl
y..Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r
/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<I
RD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; 
expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Co
ntent-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2
014 09:51:12 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://t
.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1
471&user=[MOOKIE]", "c":5, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 128
ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexu
s&eid=5&id=3385203591170409805", "c":5, "tagtype":"img"});HTTP/1.1 200
 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Exp
ires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.
com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo 
OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=
3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; do
main=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22
-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=d
TM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2sia
XS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9c
jsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@; path=/; expires
=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-T
ype: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:
51:12 GMT..Content-Length: 128..ANX_async_load({"url":"hXXp://cms.quan
tserve.com/dpixel?source=appnexus&eid=5&id=3385203591170409805", "c":5
, "tagtype":"img"});....
<<< skipped >>>

GET /seg?add=1392486&t=2 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:13 GMT
Content-Length: 0
....


GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3m
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz016QQy(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:/!*yXt!'0/Vw>L qib%9]C[bf*G1OZfO@W/.Fsu90[UA)iD`18sX#ENkQ9Lm0eZfVcQh)/HzKS-*yXvYFlq$69q>U; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:13 GMT
Content-Length: 123
ANX_async_load({"url":"hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_
exuid=3385203591170409805", "c":4, "tagtype":"img"});....


GET /pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI') HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,[email protected]..;....


GET /mapuid?member=1471&user=2040815613008858 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=^<5.XQOF


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 117
ANX_async_load({"url":"hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=
3385203591170409805", "c":2, "tagtype":"img"});....


GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 123
ANX_async_load({"url":"hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_
exuid=3385203591170409805", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..
Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires:
 Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w
3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo 
BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=33852
03591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=
.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-
2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!
M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$k
lZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-
^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm; p
ath=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpO
nly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 2
1 Aug 2014 09:51:14 GMT..Content-Length: 123..ANX_async_load({"url":"h
ttp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=338520359117040980
5", "c":4, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 113
ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385
203591170409805", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359117040
9805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51
:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.E:X*YD
gEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>
;8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6
gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iP
N3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.co
m; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date
: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 113..ANX_async_load({
"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805"
, "c":2, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*[email protected]_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/
partners/7142/users/3385203591170409805;noCookies=t", "c":0, "tagtype"
:"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..
Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyr
ef="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo
 PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 
0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-
2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; pa
th=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOn
ly..Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jb
bVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[
fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@
.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed
, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type:
 application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:1
5 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumpta
p.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;no
Cookies=t", "c":0, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*[email protected]_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 0
....


GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*[email protected]_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=ap
pnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":
"img"});....


GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:16 GMT
GIF89a.............!.......,[email protected]..;HTTP/1.1 200 OK..Cache-Cont
rol: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 N
ov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/
p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NA
V DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359117040
9805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com
; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51
:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]EVt4ZD
gEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>
;8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^ap
q_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs
$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com;
 HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 
Aug 2014 09:51:16 GMT..GIF89a.............!.......,[email protected]..;nt>....
<<< skipped >>>

GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:17 GMT
GIF89a.............!.......,[email protected]..;....


GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*[email protected]^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:17 GMT
Content-Length: 122
ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203
591170409805&na_pid=2684", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..C
ache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: 
Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3
c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo B
US COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520
3591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.
adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2
014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M
40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS 
R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@
p23tqfPo_7uY#gk9?y8WXj=?Af*[email protected]^r?mgEm0>4ej$FOX-kZtV[
S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09
:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/jav
ascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:17 GMT..Content-L
ength: 122..ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_
exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});>....
<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3m
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*[email protected]^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:17 GMT
Content-Length: 122
ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203
591170409805&na_pid=2684", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..C
ache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: 
Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3
c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo B
US COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520
3591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.
adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2
014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M
40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS 
R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@
p23tqfPo_7uY#gk9?y8WXj=?Af*[email protected]^r?mgEm0>4ej$FOX-kZtV[
S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09
:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/jav
ascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:17 GMT..Content-L
ength: 122..ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_
exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});>....
<<< skipped >>>

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Content-Length: 119
ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=captify&ui
d=3385203591170409805", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cach
e-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat
, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/p
olicy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS 
COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338520359
1170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adn
xs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014
 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/A
dX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((Ve
PyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi
).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8
hT_UrFg]Yzx^Mi*)xp96 wWY]F/F; path=/; expires=Wed, 19-Nov-2014 09:51:1
8 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascri
pt; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length
: 119..ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=cap
tify&uid=3385203591170409805", "c":1, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*[email protected]_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*[email protected]_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Content-Length: 195
ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=h
ttp://mookie.bncnt.com/mookie/map?anuid=338520359117040980
5&mookieid=[MOOKIE]", "c":0, "tagtype":"img"});HTTP/1.1 200 OK
..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expire
s: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com
/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTR
o BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=338
5203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domai
n=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Au
g-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7
k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVI
uK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1
xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*[email protected]
gT_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j; path=/; ex
pires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Cont
ent-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 201
4 09:51:18 GMT..Content-Length: 195..ANX_async_load({"url":"hXXp://t.m
ookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mo
okie/map?anuid=3385203591170409805&mookieid=[MOOKIE]", "c"
:0, "tagtype":"img"});....
<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.weqTx5e6AqeU#-2*b Bp<=3k?p6^<>.XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@YN:RVC:)6tq=yF$=1!4h>fP*0yGCGp`b$AE]^e)W:?L*D8Ozi6hvWG]R^b4kcqNmIp?SYzx^Mi*)xp96*k6^`'82; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:19 GMT
Content-Length: 135
ANX_async_load({"url":"hXXp://rt.legolas-media.com/lgapnx?ci=12&ti=440
11&pbi=10817&apid=3385203591170409805", "c":0, "tagtype":"img"});HTTP/
1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cac
he..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn
.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAM
o UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie:
 uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 
GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=
Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie
: anj=dTM7k!M4.weqTx5e6AqeU#-2*b Bp<=3k?p6^<>.XM'F1]0r/OmU [J
) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#Pyx
HQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@YN:RVC:)6tq=
yF$=1!4h>fP*0yGCGp`b$AE]^e)W:?L*D8Ozi6hvWG]R^b4kcqNmIp?SYzx^Mi*)xp9
6*k6^`'82; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnx
s.com; HttpOnly..Content-..
<<< skipped >>>


GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: image2.pubmatic.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:12 GMT
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Set-Cookie: KRTBCOOKIE_57=476-uid:3385203591170409805; domain=pubmatic.com; expires=Sun, 20-Aug-2017 09:51:12 GMT; path=/
Set-Cookie: PUBRETARGET=78_1503222672; domain=pubmatic.com; expires=Sun, 20-Aug-2017 09:51:12 GMT; path=/
Content-Length: 42
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Connection: close
Content-Type: image/gif; charset=utf-8
GIF89a.............!.......,...........D.;..



GET /offers/images/Theme8/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bodyImg.png HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: image/png
Content-Length: 1914
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT
ETag: "36dd864c691ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:58 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM
..z&..............u0...`..:....p..Q<...0PLTE.......................
.........................{.......IDATx......:..`..p..J.4.ty.:......)v.
.\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..].
.8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.
\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._.
.d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..&
gt;).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../
..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o
..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F
]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W
7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8..
......KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y.
.)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z
%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y.
..... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S..
...W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>[email protected])e
M.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J..
.,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.
*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.
J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....
X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*
<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/button_over.png HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: image/png
Content-Length: 921
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT
ETag: "f072da2a092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:59 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e&
lt;...;IDATx..Z;o.1..Y.D...W."$=D..*[email protected].
...........;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.s
h..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[[email protected].
...y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?
7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.
......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K.....
...YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\
D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........
Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N.......
.*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..t
svP!.U0.q.......9z.e [email protected]............. .>=...{WVim...
.f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o
[email protected].^......IEND.B`.HTTP/1.1 200 OK..Date: Thu, 21 Aug 
2014 09:50:59 GMT..Content-Type: image/png..Content-Length: 921..Conne
ction: keep-alive..Cache-Control: max-age=604800..Last-Modified: Mon, 
05 Aug 2013 17:21:05 GMT..ETag: "f072da2a092ce1:0"..X-Powered-By: ASP.
NET..Server: NetDNA-cache/2.2..Expires: Thu, 28 Aug 2014 09:50:59 GMT.
.X-Cache: HIT..Accept-Ranges: bytes...PNG........IHDR...Y............m
....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D
..*[email protected]............;..N.h..=.|..x6..f..pf
...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8
<<< skipped >>>


GET /mookie/map?anuid=3385203591170409805&mookieid=2040815613008858 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: mookie.bncnt.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-type: text/plain
Connection: close
Content-Length: 0
Date: Thu, 21 Aug 2014 09:50:59 GMT



GET /oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tap.rubiconproject.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Date: Thu, 21 Aug 2014 09:51:10 GMT
Server: TRP Apache-Coyote/1.1
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||
Content-Length: 0
Cache-control: private
Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: au=HZ3WT02I-CD7Q-10.208.162.44; Domain=.rubiconproject.com; Expires=Fri, 19-Aug-2022 09:51:10 GMT; Path=/
Set-Cookie: dq=1|1|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Keep-Alive: timeout=5, max=19
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8
HTTP/1.1 302 Moved Temporarily..Date: Thu, 21 Aug 2014 09:51:10 GMT..S
erver: TRP Apache-Coyote/1.1..p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS
 IND UNI COM NAV INT"..Location: hXXp://pixel.rubiconproject.com/tap.p
hp?v=4894||..Content-Length: 0..Cache-control: private..Set-Cookie
: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51
:10 GMT; Path=/..Set-Cookie: au=HZ3WT02I-CD7Q-10.208.162.44; Domain=.r
ubiconproject.com; Expires=Fri, 19-Aug-2022 09:51:10 GMT; Path=/..Set-
Cookie: dq=1|1|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set
-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Exp
ires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: SERVERID=; Exp
ires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..Keep-Alive: timeout=5, max
=19..Connection: Keep-Alive..Content-Type: text/plain; charset=UTF-8..
....
<<< skipped >>>

GET /oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tap.rubiconproject.com
Connection: Keep-Alive
Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805; dq=1|1|0|0


HTTP/1.1 302 Moved Temporarily
Date: Thu, 21 Aug 2014 09:51:10 GMT
Server: TRP Apache-Coyote/1.1
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||
Content-Length: 0
Cache-control: private
Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: dq=2|2|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Keep-Alive: timeout=5, max=122
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8
HTTP/1.1 302 Moved Temporarily..Date: Thu, 21 Aug 2014 09:51:10 GMT..S
erver: TRP Apache-Coyote/1.1..p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS
 IND UNI COM NAV INT"..Location: hXXp://pixel.rubiconproject.com/tap.p
hp?v=4894||..Content-Length: 0..Cache-control: private..Set-Cookie
: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51
:10 GMT; Path=/..Set-Cookie: dq=2|2|0|0; Expires=Fri, 21-Aug-2015 09:5
1:10 GMT; Path=/..Set-Cookie: put_1986=3385203591170409805; Domain=.ru
biconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-C
ookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..Keep-
Alive: timeout=5, max=122..Connection: Keep-Alive..Content-Type: text/
plain; charset=UTF-8..



GET /tt?id=3092599 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2473127181019865522; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 0
....


GET /tt?id=3095266 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma
: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="ht
tp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo 
OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set
-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domai
n=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Au
g-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=33
85203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; doma
in=.adnxs.com; HttpOnly..Location: hXXp://ib.adnxs.com/bounce?/tt?
id=3095266..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Au
g 2014 09:51:03 GMT..Content-Length: 0......


GET /bounce?/tt?id=3095266 HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 1027
<script>!function(){function n(n){try{if(!window.location.ancest
orOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;
o>r;r  )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){
}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(n
ull,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}
),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({r
eferrer:n.document.referrer||null,location:n.location.href||null,isTop
:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n
===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1
,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&
(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancest
orOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURICompo
nent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<
script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKE
B7xq-EnYVMkT0tBsxwk.' c '&id=3095266"></scr' 'ipt>')}();</
script>....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 633
document.write('<a href="hXXp://nym1.ib.adnxs.com/click?AAAAAAAAAAA
AAAAAAAAAACuHFtnO96M_AAAAAAAAAAAAAAAAAAAAAPXvdpDQx4slTcUWCLuo-i4IwfVTA
AAAAHcwLwAQCgAA_AkAAAIAAACpshsBVuMGAAAAAQBVU0QAVVNEANgCWgCdGAAAl7MAAgU
AAQIAAJAAmRmutAAAAAA./cnd=!vwaZPgiV8KsCEKnl7ggY1sYbIAE./referrer=htt
p://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3092599/clickenc=
http://VVV.gamesgirl.net/" target="_blank"><img width="7
28" height="90" style="border-style: none" src="hXXp://cdn.adnxs.com/p
/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg"/></a>');do
cument.write('<scr'   'ipt src="hXXp://cdn.adnxs.com/ANX_async_user
sync.js"></scr' 'ipt>');....
<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 909
document.write('<iframe frameborder="0" width="160" height="600" ma
rginheight="0" marginwidth="0" target="_blank" scrolling="no" src="htt
p://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcn
j-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQ
BVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!G
ymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAE
BmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQ
OABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a'%2
C 353928, 1408614664);uf('c', 4665015, 1408614664)%3
Buf('r', 18094836, 1408614664);&vpid=1249&apid=280253&re
ferrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266
&media_subtypes=1&ct=0&rsrc=2&dlo=1"></iframe>');document.wri
te('<scr'   'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"&g
t;</scr' 'ipt>');....
<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=338520359117040
9805&Red3=MSAN_pd", "c":9, "tagtype":"iframe"});HTTP/1.1 200 OK..Cache
-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat,
 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/po
licy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS C
OM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591
170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnx
s.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 
09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40DE
:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxM
W>; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.co
m; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date
: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 118..ANX_async_load({
"url":"hXXp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_p
d", "c":9, "tagtype":"iframe"});....
<<< skipped >>>


GET /seg/?add=1418586,1459541 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.prfct.co
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Cache-control: no-cache="set-cookie"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: hXXps://pixel.prfct.co/seg/?check_cookie=1&add=1418586,1459541
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Server: Jetty(9.0.5.v20130815)
Set-Cookie: pa_uid=pa_trixrKxFXQKpexCzd;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT
Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC189DEFF632539AF65322743D460B9CC168CCFFDB1AAE0D5AA3403F0C049FBEDD;PATH=/
Content-Length: 0
Connection: keep-alive



GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Set-Cookie: i=7b5065f4-a2df-4edf-16a9-17679ca07782|1408614671; Version=1; Expires=Fri, 21-Aug-2015 09:51:11 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
P3P: CP="CUR ADM OUR NOR STA NID"
Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 0
Connection: close



GET /?type=1&domainId=2745850&dedup=1&actionid=207232 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 2745850.r.msn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Microsoft-IIS/8.0
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
Date: Thu, 21 Aug 2014 09:51:05 GMT
Connection: close



GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ads.yahoo.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:07 GMT
P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Set-Cookie: B=aud5rvp9vbg8b&b=3&s=os; expires=Sun, 21-Aug-2016 09:51:07 GMT; path=/; domain=.yahoo.com
Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:07 GMT
Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
Cache-Control: private
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Age: 0
Connection: keep-alive
Server: ATS
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:07 GMT..P3P: policyre
f="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI 
PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY 
ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: 
B=aud5rvp9vbg8b&b=3&s=os; expires=Sun, 21-Aug-2016 09:51:07 GMT; path=
/; domain=.yahoo.com..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; p
ath=/; expires=Sat, 20-Aug-2016 09:51:07 GMT..Location: hXXp://ib.adnx
s.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP..Cache-Control: private..Co
ntent-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Conn
ection: keep-alive..Server: ATS..



GET /e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: e.nexac.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-type: image/gif
Date: Thu, 21 Aug 2014 09:51:17 GMT
Expires: Wed Sep 15 09:14:42 MDT 2010
P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"
Pragma: no-cache
Server: lighttpd/1.4.28
Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/
Set-Cookie: na_an=1408614677; expires=Sat, 20-Sep-2014 09:51:17 GMT; path=/; domain=.nexac.com
X-Powered-By: Jigawatts
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-ty
pe: image/gif..Date: Thu, 21 Aug 2014 09:51:17 GMT..Expires: Wed Sep 1
5 09:14:42 MDT 2010..P3P: policyref="hXXp://VVV.nextaction.net/P3P/Pol
icyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo 
HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"..Pra
gma: no-cache..Server: lighttpd/1.4.28..Set-Cookie: na_tc=Y; expires=S
un, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/..Set-Cookie: n
a_an=1408614677; expires=Sat, 20-Sep-2014 09:51:17 GMT; path=/; domain
=.nexac.com..X-Powered-By: Jigawatts..Content-Length: 43..Connection: 
keep-alive..GIF89a.............!.......,...........D..;..



GET /377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: idsync.rlcdn.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Date: Thu, 21 Aug 2014 09:51:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1
P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
Set-Cookie: ck1=ck1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:14 GMT
Content-Length: 0
Connection: keep-alive
....


GET /377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1 HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: idsync.rlcdn.com
Connection: Keep-Alive
Cookie: ck1=ck1


HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Content-Type: image/gif; charset=ISO-8859-1
Date: Thu, 21 Aug 2014 09:51:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
Set-Cookie: rlas3="TA03JilRL6ZfZHiTJV4DPXmXZtGqnF1a473g/aAAnwY=";Version=1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT;Max-Age=15551997
Set-Cookie: rtn1=cb8adb15e36b089ef86b12932f97ce18;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT
Set-Cookie: dids604882570=50313e24fe8f030a80f7a1716f6f091ce6f8375504619c4571885ea1fac72a5acb949ecef93fde87da2430bee7bf9c07;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:13 GMT
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Cont
rol: no-cache, no-store..Content-Type: image/gif; charset=ISO-8859-1..
Date: Thu, 21 Aug 2014 09:51:14 GMT..Expires: Thu, 01 Jan 1970 00:00:0
0 GMT..P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE
"..Set-Cookie: rlas3="TA03JilRL6ZfZHiTJV4DPXmXZtGqnF1a473g/aAAnwY=";Ve
rsion=1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT;Max-Ag
e=15551997..Set-Cookie: rtn1=cb8adb15e36b089ef86b12932f97ce18;Domain=.
rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT..Set-Cookie: dids60488
2570=50313e24fe8f030a80f7a1716f6f091ce6f8375504619c4571885ea1fac72a5ac
b949ecef93fde87da2430bee7bf9c07;Domain=.rlcdn.com;Expires=Tue, 17-Feb-
2015 09:51:13 GMT..Content-Length: 43..Connection: keep-alive..GIF89a.
............!.......,...........L..;..



GET /mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flex.msn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: public
Content-Type: application/javascript; charset=utf-8
Content-Encoding: gzip
Expires: Fri, 22 Aug 2014 09:51:04 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Date: Thu, 21 Aug 2014 09:51:04 GMT
Connection: close
Content-Length: 366
.............`.I.%&/m.{.J.J..t...`[email protected]#).*..eVe]f.@......{
....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....
Z.u{.:o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>
.{w......;.z.h..i...{......_8..Y.<.}.M>:...S..[....C.>!X.....
...T..^...so..e...o..@(..t..~....>.>."....l.....@i....((..{_....
.........y...I.M...w._rg..aB0...~...y.....



GET /ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: an.z5x.net
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Location: hXXp://ib.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma
: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="ht
tp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo 
OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Loc
ation: hXXp://ib.adnxs.com/ttj?id=3319347&size=160x600&position=above&
cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266
&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8d
KM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwM
AAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAA
AA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs
.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=..Content-Type: te
xt/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-L
ength: 0..
<<< skipped >>>


GET /installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: data.getserverinfo.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 1527
Connection: keep-alive
..<html>..    <head>..        <title>Thank you for i
nstalling Free Coins</title>..        <script type="text/java
script">  </script>..        <script type='text/javascript
'>..            var googletag = googletag || {};..            googl
etag.cmd = googletag.cmd || [];..            (function () {..         
       var gads = document.createElement('script');..                g
ads.async = true;..                gads.type = 'text/javascript';..   
             var useSSL = 'https:' == document.location.protocol;..   
             gads.src = (useSSL ? 'https:' : 'http:')  ..             
               '//VVV.googletagservices.com/tag/js/gpt.js';..         
       var node = document.getElementsByTagName('script')[0];..       
         node.parentNode.insertBefore(gads, node);..            })();.
.        </script>..        <script type='text/javascript'>
;..            googletag.cmd.push(function () {..                googl
etag.defineSlot('/5612216/TYP', [1200, 1400], 'div-gpt-ad-136793693367
1-0').addService(googletag.pubads());..                googletag.pubad
s().enableSingleRequest();..                googletag.enableServices()
;..            });..        </script>..    </head>..    &l
t;body>..        <div style="position:relative;left:0px;top:0px;
color:white; height: 1px; visibility: hidden;"></div>..      
  <iframe src="hXXp://VVV.gamehub.ws/index.php?&productname=Fre
e Coins" width=100% height=100%  frameborder=0 scrolling=no margin
<<< skipped >>>


GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Set-Cookie: i=6333127b-59e4-4c75-9681-e9f9bbb7943b|1408614672; Version=1; Expires=Fri, 21-Aug-2015 09:51:12 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
P3P: CP="CUR ADM OUR NOR STA NID"
Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 0
Connection: close



GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Set-Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671; Version=1; Expires=Fri, 21-Aug-2015 09:51:11 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
P3P: CP="CUR ADM OUR NOR STA NID"
Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 0
Connection: close



GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9591
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu,
 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR
 STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id
=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51
:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Doma
in=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-
Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 
30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43.
.Keep-Alive: timeout=1, max=9591..Connection: Keep-Alive..GIF89a......
.......!.......,...........D..;....


GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9705
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu,
 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR
 STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id
=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51
:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Doma
in=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-
Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 
30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43.
.Keep-Alive: timeout=1, max=9705..Connection: Keep-Alive..GIF89a......
.......!.......,...........D..;....


GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9326
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu,
 21 Aug 2014 09:51:11 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR
 STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id
=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51
:11 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Doma
in=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Cache-
Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 
30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43.
.Keep-Alive: timeout=1, max=9326..Connection: Keep-Alive..GIF89a......
.......!.......,...........D..;..



GET /css/index.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:00 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:41 GMT
ETag: "406bb-42fa-4fc68d5de596e"
Accept-Ranges: bytes
Content-Length: 17146
Connection: close
Content-Type: text/css
body, table, td, tr, div, p, h1, h2, h3, h4, h5, h6, form, fieldset, l
egend, input, textarea, select, th, tbody { margin: 0; padding: 0; }..
img { border: none; }..sup { vertical-align: text-top; }..sub { vertic
al-align: text-bottom; }..input, textarea, select { font-size: inherit
; font-weight: inherit; font-family: inherit; }..body, table, td, tr, 
div, h1, h2, h3, h4, h5, h6, form, input, textarea, select, th, tbody 
{ font-family: arial; font-size: 12px; }..*,*:before,*:after { -webkit
-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: bord
er-box; }../* Start Land CSS */...clear{ clear: both; }..body{ directi
on: ltr; margin: auto; background: rgb(3,167,235); border-bottom: 1px 
solid #000; background: url(data:image/svg xml;base64,PD94bWwgdmVyc2lv
bj0iMS4wIiA/Pgo8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgd2
lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEgMSIgcHJlc2VydmVB
c3BlY3RSYXRpbz0ibm9uZSI CiAgPGxpbmVhckdyYWRpZW50IGlkPSJncmFkLXVjZ2ctZ2
VuZXJhdGVkIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSIgeDE9IjAlIiB5MT0i
MCUiIHgyPSIwJSIgeTI9IjEwMCUiPgogICAgPHN0b3Agb2Zmc2V0PSIwJSIgc3RvcC1jb2
xvcj0iIzAzYTdlYiIgc3RvcC1vcGFjaXR5PSIxIi8 CiAgICA8c3RvcCBvZmZzZXQ9IjEw
MCUiIHN0b3AtY29sb3I9IiMwZDQyYTQiIHN0b3Atb3BhY2l0eT0iMSIvPgogIDwvbGluZW
FyR3JhZGllbnQ CiAgPHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9IjEiIGhlaWdodD0iMSIg
ZmlsbD0idXJsKCNncmFkLXVjZ2ctZ2VuZXJhdGVkKSIgLz4KPC9zdmc );....backgrou
nd: -moz-linear-gradient(top, rgba(3,167,235,1) 0%, rgba(13,66,164,1) 
100%); ....background: -webkit-gradient(linear, left top, left bot
<<< skipped >>>


GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dis.criteo.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Location: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614
Server: Microsoft-IIS/7.5
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 254
<html><head><title>Object moved</title></he
ad><body>..<h2>Object moved to <a href="hXXp://dis.e
u.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203
591170409805&url=hXXp://ib.adnxs.com/seg?add=673614">here</a
>.</h2>..</body></html>..HTTP/1.1 302 Found..Loca
tion: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3
385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614..Server: Mic
rosoft-IIS/7.5..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 2
54..<html><head><title>Object moved</title><
;/head><body>..<h2>Object moved to <a href="hXXp://d
is.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=338
5203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614">here&l
t;/a>.</h2>..</body></html>....



GET /j/roundtrip.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.adroll.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: LE2eIYesxo5swo4NMC7tAainUT30r5JogXU/RXKTrtijeh7 q5UGyMLm4MgpUWWd
x-amz-request-id: 71820825864519DA
Last-Modified: Fri, 15 Aug 2014 17:15:55 GMT
ETag: "d9890eadfd6a83b5319937ea62acdcaf"
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4679
Cache-Control: must-revalidate, max-age=75
Date: Thu, 21 Aug 2014 09:51:12 GMT
Connection: keep-alive
...........;k..6... (z"...G..W.i.77.q%vv.I]mid..B.G.R!.y.H.}.. ....]..
\#..4...&2.'.....7..[.).L'.H.gI.?.i.=L.........W.;...............Rn'9.
.w..1P...<...0.$rgN.P...$q.0.v,u.s..H.".x....... w.ON.{H..pY.).....
F.9s....q.Z.s..C..........6.&.>...f.e/.3.....H.,.....XZN6..J.>..
.tM6....L\e.....^....x...0...k....y./M.;.......... ]...e.Q....|B~..}.Q
e..3.X5h.jR$1e.....6w... .[..=a.p..}..`./..,[...Q.....O.W.!..i(A..i...
4..........N..Oc7.v..5...h.u9..I{;...n.!..d.(..''..........Y...y......
[x..4.v1.JI...."^[...=.A...,...r,....<....\l)...k.}. .F..nRD....VZf
P..t..i{...se .j.....X.F...j..hX-..h........^f...&..]....%...k.Z......
j....t..G.......d5.] n.o7Sx......v...^.h/..x.Y.u.!..,.f.../..{-^.&7...
[ ......_...K............k..O'..Q8...r..i......{..j..r..eb.9..,..'.P..
}.....'E....mV..>.K#g.7...[#.sF.,.2.q......IJ..9)[email protected]&
gt;....iz../..=..........$g....#k..G....G...#x.n.ZX.u"...FV..v.#.d ..O
..G.cOx.....A..<W..,.Y.....*-.W.K.AJq....z>...2k.!.=....M.m..-.^
..N~....(.8..k.*.....$.....y..74T.R.,...E...a......;......mX.I......w-
..Ac2IX.)..9.Q.5=.!..z..(...y...s}H....`....rHYA..Y.]y..U.8...B~...R.I
z..Yn......X] .S.`..)......!.E....=../W?.."[email protected].
....0 3.*...S..^.WG.Z..9.........?5....G.u....c......_f6.;e9.%H.t..Z.B
.CR0..4..D.s.....)[email protected][email protected].|.........K....m....l.!c.\......
...H....Fsx...c.?............Z. x...H$...Pc8...F....s_'.E.i/.. 2Z.oyb&
lt;..(.....c.[P..h..C....x\.c..=...&E..(.."x...)..Hh...R.. ...in..%.i.
-J.......P*....x^.7t.*f../.....Q..h..r..y..6..so.....m  ..,m..g...
<<< skipped >>>

GET /pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js HTTP/1.1


Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: a.adroll.com


HTTP/1.1 200 OK
x-amz-id-2: MLC7mfQun88l9jNDL5MfqEb5Nsj0EkrQ91NOKYy0QHi7HHtKVAdEIqu6RZL8jH2P
x-amz-request-id: F19D990794E64995
Last-Modified: Wed, 13 Aug 2014 22:36:29 GMT
ETag: "80fa4efff8cbff1a1fac780705fbfe52"
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 931
Cache-Control: must-revalidate, max-age=300
Date: Thu, 21 Aug 2014 09:51:13 GMT
Connection: keep-alive
...........V.n.8.}.Wp.....d[.[.0...m.I.E...4.hr,..I..|A.....oI....&..q
x...pHN4...B ....#B.....`.dD.(.Y[.O.2...Y5.ec..u..0.j.e..Ajd@.._A.Y..r
.*3..T(..*.U.bo.....@-o.$P>.....0V.B..,SI'.".....*3;..*[.* h..1..-.
.x.@~...c78.......x"../e.\nV`Z...K..d..FK..`..L.......1...#.*)......[&
lt;..yv............`.....=......:n...>.?.{B....$8.>:...1...F..nn
.........{K....${...P./$.Q.p....d\....`)....H...*8....g..Y..B.u=-.....
...$.T.JF..Za..<.{..m.......M^.../R[&.p0.7.......Fe..a..........YI.
...0a..'.DW..I.B...M..a.[=ly.W..\w......CY...j..I.L........@...>...
i:...i...{..1..rwH3@.....|...?....^?......_..>!..8.V.3#.[K.Q..;.b..
...U.Y....K.KBy..<.a.b.....L%..t.......7.?O........0X:/PL^...{...u.
).lM......}.pk3...N.le..VCN...G......9.BB....6..<.`....]!..K......M
............Q..>{.............Q......2..11.{..X.F.t.O..GC.7.......o
.7....ag..`.E8.4j...W(........nf.$..1..1-.P|<..G =...v]....%vQ.X..T
.....6...0......Nh.4*.Ed..o....a....[...........uy....HTTP/1.1 200 OK.
.x-amz-id-2: MLC7mfQun88l9jNDL5MfqEb5Nsj0EkrQ91NOKYy0QHi7HHtKVAdEIqu6R
ZL8jH2P..x-amz-request-id: F19D990794E64995..Last-Modified: Wed, 13 Au
g 2014 22:36:29 GMT..ETag: "80fa4efff8cbff1a1fac780705fbfe52"..Accept-
Ranges: bytes..Content-Type: text/javascript..Server: AmazonS3..Vary: 
Accept-Encoding..Content-Encoding: gzip..Content-Length: 931..Cache-Co
ntrol: must-revalidate, max-age=300..Date: Thu, 21 Aug 2014 09:51:13 G
MT..Connection: keep-alive.............V.n.8.}.Wp.....d[.[.0...m.I.E..
.4.hr,..I..|A.....oI....&..qx...pHN4...B ....#B.....`.dD.(.Y[.O.2.
<<< skipped >>>


GET /updates/a/desktopapp.wys HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)
Host: cdn.freecoins.co
Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Age: 109207
Date: Thu, 21 Aug 2014 09:51:06 GMT
Last-Modified: Tue, 12 Aug 2014 10:43:54 GMT
Content-Length: 723
Connection: keep-alive
PK...........E98..'...P.....$.0.. ........... .f...D...e...D...e......
vq.3b.````.bC=#3v. .$`.g.gh.g........(..Vb.l....8....J_?9%O/.(559?3.X/
9_.. %[email protected].$_.d.^ye)..*...YSw]....q$.:h.8\ %..(...a.!n{].!.
...)..^D...2.....Y.....H6.4....f#rl6B.Y..Y...J.RrR...r*.t.....3...S...
:...E.9.Tp.............z.......Mp..?A.a....8.6..c.)n...m.. ..j3..`...L
[email protected]}...l............n..6 ..8...N...........lVW.S..f.rl..m...$...
........-q.<[email protected]..)Y..../3..6..Wh.......Y
Fxk..IH.........)...p.........-8.mD.....{o?........orj.#<..^.3....;
....1y.6...%.H..:.-.....]Fx..H..j..,..8m6#.......b......q.3P,...PK..-.
.........E98..'...P.....$.......  ......0.. ........... .f...D...e...D
...e...PK..........S...j.....HTTP/1.1 200 OK..Server: Apache-Coyote/1.
1..Accept-Ranges: bytes..Age: 109207..Date: Thu, 21 Aug 2014 09:51:06 
GMT..Last-Modified: Tue, 12 Aug 2014 10:43:54 GMT..Content-Length: 723
..Connection: keep-alive..PK...........E98..'...P.....$.0.. ..........
. .f...D...e...D...e......vq.3b.````.bC=#3v. .$`.g.gh.g........(..Vb.l
....8....J_?9%O/.(559?3.X/9_.. %[email protected].$_.d.^ye)..*...YSw]...
.q$.:h.8\ %..(...a.!n{].!....)..^D...2.....Y.....H6.4....f#rl6B.Y..Y..
.J.RrR...r*.t.....3...S...:...E.9.Tp.............z.......Mp..?A.a....8
.6..c.)n...m.. ..j3..`[email protected]}...l............n..6 ..8...N......
.....lVW.S..f.rl..m...$...........-q.<[email protected]
N..)Y..../3..6..Wh.......YFxk..IH.........)...p.........-8.mD.....{o?.
.......orj.#<..^.3....;....1y.6...%.H..:.-.....]Fx..H..j..,..8m
<<< skipped >>>


GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dps.bing.com
Connection: Keep-Alive
Cookie: MUID=2F6B223C4C616DD806C724A148616EB1


HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 42
Content-Type: image/gif
Expires: 2:51:04 AM
Server: Microsoft-IIS/8.5
TrackingId: efa22998-1ff1-4065-8c49-c55ba1a96922
X-Powered-By: ASP.NET
X-MSEdge-Ref: Ref A: 90AD790EE4E44F15A43A7507ED7480F4 Ref B: 898EFCFC7D9FFA32F0BE9D52BED1B55C Ref C: Thu Aug 21 02:51:09 2014 PST
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,...........L.;....


GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dps.bing.com
Connection: Keep-Alive
Cookie: MUID=2F6B223C4C616DD806C724A148616EB1


HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 42
Content-Type: image/gif
Expires: 2:51:05 AM
Server: Microsoft-IIS/8.5
TrackingId: cebbe73e-cfd0-43c2-b2bc-9ba5dbcddac3
X-Powered-By: ASP.NET
X-MSEdge-Ref: Ref A: EC694F809EF44FE884B64B93555A741A Ref B: EEEFAC4E2D0E8E5851CC732C27CC94EC Ref C: Thu Aug 21 02:51:10 2014 PST
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Contr
ol: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 2:
51:05 AM..Server: Microsoft-IIS/8.5..TrackingId: cebbe73e-cfd0-43c2-b2
bc-9ba5dbcddac3..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: EC694F809
EF44FE884B64B93555A741A Ref B: EEEFAC4E2D0E8E5851CC732C27CC94EC Ref C:
 Thu Aug 21 02:51:10 2014 PST..Date: Thu, 21 Aug 2014 09:51:09 GMT..GI
F89a.............!.......,...........L.;..



GET /mstag/mstag.1003102000.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flex.msn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Thu, 14 Aug 2014 21:12:05 GMT
Accept-Ranges: bytes
ETag: "804023664b8cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
Date: Thu, 21 Aug 2014 09:51:03 GMT
Connection: close
Content-Length: 1956
...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$
v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.
3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....
Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..
{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...
]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...R
c........A..A.Q/>M....ee..............Z^. ..|[email protected],..2..%.c
........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.
........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W.
.V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z
...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G..
...N.i.n<[email protected]..!.(..F...L..J.......3..x.....U.w
>.S..`..4.4}S.h.....1._.k[[email protected].>.e.eKa...Q..m.....\6.~.
.(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.
......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.
....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w
 .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;[email protected] ..6...`.....m.
....H=U..P.....H_ O[[email protected]/.Q........p.C..GG..>..>..Q;3\.7...
.yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6
.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2
u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u....
.......JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`
<<< skipped >>>


GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ads.yahoo.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:06 GMT
P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Set-Cookie: B=34pghj19vbg8a&b=3&s=6r; expires=Sun, 21-Aug-2016 09:51:06 GMT; path=/; domain=.yahoo.com
Set-Cookie: RMBX=34pghj19vbg8a&b=3&s=6r&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:06 GMT
Location: hXXp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy
Cache-Control: private
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Age: 0
Connection: keep-alive
Server: ATS
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:06 GMT..P3P: policyre
f="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI 
PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY 
ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: 
B=34pghj19vbg8a&b=3&s=6r; expires=Sun, 21-Aug-2016 09:51:06 GMT; path=
/; domain=.yahoo.com..Set-Cookie: RMBX=34pghj19vbg8a&b=3&s=6r&t=232; p
ath=/; expires=Sat, 20-Aug-2016 09:51:06 GMT..Location: hXXp://ib.adnx
s.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy..Cache-Control: private..Co
ntent-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Conn
ection: keep-alive..Server: ATS......


GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1


Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ads.yahoo.com
Connection: Keep-Alive
Cookie: B=aud5rvp9vbg8b&b=3&s=os; RMBX=aud5rvp9vbg8b&b=3&s=os&t=232


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:08 GMT
P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:08 GMT
Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com
Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
Cache-Control: private
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Age: 0
Connection: keep-alive
Server: ATS
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:08 GMT..P3P: policyre
f="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI 
PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY 
ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: 
RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09
:51:08 GMT..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; exp
ires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com..Location: http:
//ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP..Cache-Control: pr
ivate..Content-Length: 0..Content-Type: text/plain; charset=utf-8..Age
: 0..Connection: keep-alive..Server: ATS..



GET /tap.php?v=4894|| HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.rubiconproject.com
Connection: Keep-Alive
Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com
Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com
Content-Length: 49
Keep-Alive: timeout=30, max=8880
Connection: Keep-Alive
Content-Type: image/gif
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Thu, 21 Aug 2014 09:51:11 GMT..Server: Apache..X-Powered-By: PHP/5.3
.3..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set
-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; 
domain=.rubiconproject.com..Set-Cookie: rpx=4894=40633,0,1,,
; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubicon
project.com..Content-Length: 49..Keep-Alive: timeout=30, max=8880..Con
nection: Keep-Alive..Content-Type: image/gif..GIF89a..................
.!.......,...........T..;..



GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:02 GMT
Content-Type: text/css
Content-Length: 20706
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT
ETag: "ca38195cd123cd1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:02 GMT
X-Cache: HIT
Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.tx
t (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Ve
rsion 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquer
y.com/UI/Theming/API. */../* Layout helpers.--------------------------
--------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-acce
ssible { position: absolute !important; clip: rect(1px 1px 1px 1px); c
lip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0
; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font
-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helpe
r-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:
after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfi
x { width: 100%; height: 100%; top: 0; left: 0; position: absolute; op
acity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.-----------
-----------------------*/..ui-state-disabled { cursor: default !import
ant; }.../* Icons.----------------------------------*/../* states and 
images */..ui-icon { display: block; text-indent: -99999px; overflow: 
hidden; background-repeat: no-repeat; }.../* Misc visuals.------------
----------------------*/../* Overlays */..ui-widget-overlay { position
: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQu
ery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://
jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 li
censes.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/
<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:03 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>......
<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1


Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive


HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:04 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://ww
w.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://
VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content
-Type" content="text/html; charset=iso-8859-1"/>..<title>404 
- File or directory not found.</title>..<style type="text/css
">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Aria
l, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px
 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:
1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;
color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 
2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..backgr
ound-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...c
ontent-container{background:#FFF;width:96%;margin-top:8px;padding:10px
;position:relative;}..-->..</style>..</head>..<body&
gt;..<div id="header"><h1>Server Error</h1></div&
gt;..<div id="content">.. <div class="content-container">&
lt;fieldset>..  <h2>404 - File or directory not found.</h2
>..  <h3>The resource you are looking for might have been rem
oved, had its name changed, or is temporarily unavailable.</h3>.
. </fieldset></div>..</div>..</body>..</htm
l>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:04 GMT..Co
ntent-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>


GET /serve/52dfe62b6897d9bfcf00011e.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tag.perfectaudience.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: max-age=1800
Content-Type: text/javascript
Status: 200 OK
X-Frame-Options: sameorigin
X-Xss-Protection: 1; mode=block
Content-Length: 4436
Accept-Ranges: bytes
Date: Thu, 21 Aug 2014 09:51:05 GMT
Via: 1.1 varnish
Age: 0
Connection: keep-alive
X-Served-By: cache-dfw1835-DFW
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1408614665.946026802,VS0,VE48
Vary: Accept-Encoding
window._pa = window._pa || {};._pa.segments = [{"name":"All visitors",
"id":1418586,"regex":".*"},{"name":"Users that downloaded the app","id
":1459541,"regex":"/FreeCoinsLandingPage/thankyou\\.jsp/?([?#].*)*$"}]
;._pa.conversions = [{"name":"Successful Installation","id":"157720","
regex":"/FreeCoinsLandingPage/thankyou\\.jsp/?([?#].*)*$"},{"name":"Su
ccessful install","id":"169355","regex":"/installer/thankyou\\?/?([?#]
.*)*$"},{"name":"JCCasino Download","id":"180231","regex":"/software\\
-download//?([?#].*)*$"},{"name":"Bingo Register","id":"180782","regex
":"/registration\\.aspx/?([?#].*)*$"}];._pa.conversionEvents = [];._pa
.segmentEvents = [];._pa.rtbId = '7094';._pa.siteId = '52dfe62b6897d9b
fcf00011e';.!function(){function e(e,t,p){a(e,t,p),n(e,t)}function a(e
,a,n){if(null==n||isNaN(n))var t=_pa.pixelHost "seg?t=2&add=" e;else v
ar t=_pa.pixelHost "seg?t=2&add=" e ":" n;_pa.createImageTag("segments
",e,t,a)}function n(e,a){var n=_pa.paRtbHost "seg/?add=" e;_pa.product
Id&&(n =":" encodeURIComponent(_pa.productId)),r?_pa.createImageTag("p
aRtbSegments",e,n,a):i.push({id:e,name:a})}function t(){if(r=!0,0!==i.
length){for(var e=[],a=[],n=0;n<i.length;n  ){var t=i[n],p=t.id,o=t
.name;_pa.productId&&(p =":" encodeURIComponent(_pa.productId)),e.push
(p),a.push(o)}var p=e.join(","),o=a.join(","),d=_pa.paRtbHost "seg/?ad
d=" p;_pa.createImageTag("paRtbSegments",p,d,o)}}function p(e,a,n,t){n
=n||_pa.orderId,t=t||_pa.revenue;var p="";n&&""!==n&&(n=n.toString().r
eplace(/@.*/,"@"),p ="&order_id=" encodeURIComponent(n)),t&&""!==t
<<< skipped >>>


GET /rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:19 GMT
Server: Apache/2.2.3 (Red Hat)
Location: hXXp://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8



GET /event/img?mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=


HTTP/1.1 302 Moved Temporarily
Server: AkamaiGHost
Content-Length: 0
Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
HTTP/1.1 302 Moved Temporarily..Server: AkamaiGHost..Content-Length: 0
..Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-
cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA8
40B092808F&D=mathtag.com&01AD=1&mm_bnc..Expires: Thu, 21 Aug 2014 09:5
1:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cac
he..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-C
ookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domai
n=.mathtag.com..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV U
NI"......


GET /event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=; HRL8=CT-1
Connection: Keep-Alive
Host: pixel.mathtag.com


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar  4 2014 19:08:19 ewr-pixel-x20 pid 0x7f47 32583
Expires: Thu, 21 Aug 2014 09:51:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:16 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Ty
pe: image/gif..Content-Length: 43..Server: mt2/2.10.2.rc1 26c5168 CORE
-1658-uuid-random-patch Mar  4 2014 19:08:19 ewr-pixel-x20 pid 0x7f47 
32583..Expires: Thu, 21 Aug 2014 09:51:16 GMT..Cache-Control: max-age=
0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:
16 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-USR; expires=Thu, 
18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com..Set-Cookie: mt_
misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 
GMT..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"..GIF89a
.............!.......,...........D..;..



GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671


HTTP/1.1 200 OK
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Type: image/gif
Content-Length: 43
Cache-Control: private, max-age=0, no-cache
Connection: close
GIF89a.............!.......,...........D..;..



GET /FreeCoinsLandingPage/themes/thankyou/css/index.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"1666-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
a..............200...TQo.0.~...pR_....$Y.[..i.....#..x162N........4...
.........G..._.....?...k......*U...CR..A....?zP{PN..h.Z.6C.{. ].?g.6.x
 X.$.rY.pi........,....B. TD.\&...&.rY.... ^...*M.N@*......~d......^`.
.....#...T...6.ez.. i.....k(..f..../J..........s)?...T;.%......L.}Gc&l
t;.5&2..H.w...t..r...Bq...c/..(..h....M..~.^....&...."....[n..mKS..[.|
.."\n2,..L.....L`.....kA..-.).n...Z...YH...F.N.f...l.'H.-\.~.......x..
z....>.sL.....B.D.,7...6..._..g...<.?.]..].@].............y.....
.A.....(@.;-....W.`.8-\|......8..4L...5..1 ..%...&...8e..` ..^...M`..)
ojA.}r..Be.....V..).xz.2........._o."..P-}Xhj"_..u.:.....q...W..4:..8&
lt;....}...VK.....i.'...>.dq...t..g.!.~.Z.}..U.`.v<......O......
0..



GET /js/jquery.cookie.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:01 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT
ETag: "406ce-c17-4fc68d5e5db4d"
Accept-Ranges: bytes
Content-Length: 3095
Connection: close
Content-Type: text/javascript
/*!. * jQuery Cookie Plugin v1.4.0. * hXXps://github.com/carhartl/jque
ry-cookie. *. * Copyright 2013 Klaus Hartl. * Released under the MIT l
icense. */.(function (factory) {..if (typeof define === 'function' && 
define.amd) {...// AMD. Register as anonymous module....define(['jquer
y'], factory);..} else {...// Browser globals....factory(jQuery);..}.}
(function ($) {...var pluses = /\ /g;...function encode(s) {...return 
config.raw ? s : encodeURIComponent(s);..}...function decode(s) {...re
turn config.raw ? s : decodeURIComponent(s);..}...function stringifyCo
okieValue(value) {...return encode(config.json ? JSON.stringify(value)
 : String(value));..}...function parseCookieValue(s) {...if (s.indexOf
('"') === 0) {....// This is a quoted cookie as according to RFC2068, 
unescape.......s = s.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g
, '\\');...}....try {....// Replace server-side written pluses with sp
aces.....// If we can't decode the cookie, ignore it, it's unusable...
..s = decodeURIComponent(s.replace(pluses, ' '));...} catch(e) {....re
turn;...}....try {....// If we can't parse the cookie, ignore it, it's
 unusable.....return config.json ? JSON.parse(s) : s;...} catch(e) {}.
.}...function read(s, converter) {...var value = config.raw ? s : pars
eCookieValue(s);...return $.isFunction(converter) ? converter(value) :
 value;..}...var config = $.cookie = function (key, value, options) {.
...// Write...if (value !== undefined && !$.isFunction(value)) {....op
tions = $.extend({}, config.defaults, options);.....if (typeof opt
<<< skipped >>>


GET /FreeCoinsLandingPage/themes/thankyou/images/bg_body.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"53305-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: image/jpeg
Content-Length: 53305
Date: Thu, 21 Aug 2014 09:51:03 GMT
Connection: close
......Exif..MM.*.............................b...........j.(..........
.1.........r.2...........i....................'.......'.Adobe Photosho
p CS5 Windows.2013:12:30 18:50:38.....................................
...............................................&.(....................
.....................H.......H..........Adobe_CM......Adobe.d.........
......................................................................
..................................................................d...
."................?...................................................
.......................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5
....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw..........
..............5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.
T..dEU6te......u..F...............Vfv........'7GWgw.................?.
M...c.....xR..m<..J..(EH......... I..Ai.....i.....I....l04v...B.{%.
....hE ....#.p;...`X;h|.....aA._".LJ..e..r...i......'..2..}D4..4..U5..
).5..>.lc..2>$...,4.`@.g.....`Hj......~.B..î..?..,%.P.-.y.0.Mr
w.........VCC@h. J....\?F~J..........~!...Ii........<4W.f.Gc.@.....
[email protected]...$.......{.]..i..Y.X..:..Jh ..n%..CG....E
LaW....i.......(.....=l......R..x...Z....P.".x(.......Z.=......0.4<
...2.Kv..?w....i......5...X`.b.]e....-....Y.\....S!.of...B...v.rS.f..V
....6.c.@.*.....k#S.CD..........5.....Gez.{..........!..Gb...4.. c..L.
.S$.E{t.....h.........#D....=....Dx..n..D}......]{...G.%..5.XC.......U
V.7L.'.U.cN..{f........V.....j.EMce.K....L....S.V. [email protected]...
<<< skipped >>>


GET /s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: d2tjil5tz17cbz.cloudfront.net


HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Date: Thu, 21 Aug 2014 09:51:20 GMT
x-amz-meta-cb-modifiedtime: Tue, 08 May 2012 12:38:45 GMT
Last-Modified: Mon, 19 May 2014 15:26:46 GMT
ETag: "45cf913e5d9d3c9b2058033056d3dd23"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Miss from cloudfront
Via: 1.1 c739a168fcf19d0acf0a618f6eb437d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zCVEUT1QNdT6fVUAD0zbTCj1BVADOEzWXOWxhaiviyigb7_TPllnhA==
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Ty
pe: image/gif..Content-Length: 43..Connection: keep-alive..Date: Thu, 
21 Aug 2014 09:51:20 GMT..x-amz-meta-cb-modifiedtime: Tue, 08 May 2012
 12:38:45 GMT..Last-Modified: Mon, 19 May 2014 15:26:46 GMT..ETag: "45
cf913e5d9d3c9b2058033056d3dd23"..Accept-Ranges: bytes..Server: AmazonS
3..X-Cache: Miss from cloudfront..Via: 1.1 c739a168fcf19d0acf0a618f6eb
437d2.cloudfront.net (CloudFront)..X-Amz-Cf-Id: zCVEUT1QNdT6fVUAD0zbTC
j1BVADOEzWXOWxhaiviyigb7_TPllnhA==..GIF89a.............!.......,......
.....D..;..



GET /fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.facebook.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 02:51:14 PDT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Pragma: public
X-XSS-Protection: 0
Cache-Control: public, max-age=0
Expires: Thu, 21 Aug 2014 02:51:14 PDT
X-UA-Compatible: IE=edge,chrome=1
Content-Encoding: gzip
X-FB-Debug:  /LOc 4/dXoyzwMthIKyvsprUDn5uwbU7Nit WyS6T/N3zP8D avDYdWKrSv 0IpwMh3i4wjllQhTobQncItvA==
Transfer-Encoding: chunked
Connection: keep-alive
2f............r.t..Ldd`dh`....,. Z.D.d...\...........a....v.h. .....0.
.HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 02:51:14 PDT..X-Content-Type-
Options: nosniff..Content-Type: image/gif..Pragma: public..X-XSS-Prote
ction: 0..Cache-Control: public, max-age=0..Expires: Thu, 21 Aug 2014 
02:51:14 PDT..X-UA-Compatible: IE=edge,chrome=1..Content-Encoding: gzi
p..X-FB-Debug:  /LOc 4/dXoyzwMthIKyvsprUDn5uwbU7Nit WyS6T/N3zP8D avDYd
WKrSv 0IpwMh3i4wjllQhTobQncItvA==..Transfer-Encoding: chunked..Connect
ion: keep-alive..2f............r.t..Ldd`dh`....,. Z.D.d...\...........
a....v.h. .....0..



GET /cm?in=1&pub=345&userid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.rfihub.com
Connection: Keep-Alive
Cookie: e=ai; rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA; hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==; eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=; euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=; ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA


HTTP/1.1 302 Found
Server: nginx/1.5.3
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 0
Connection: keep-alive
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8x8nBMt7V19DSND/YuDwSyHB2dguLTzPwcDWwBVqvNsiMAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNwXiWYwofEsAtukdrDQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com
Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com
Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=
HTTP/1.1 302 Found..Server: nginx/1.5.3..Date: Thu, 21 Aug 2014 09:51:
15 GMT..Content-Length: 0..Connection: keep-alive..P3P: CP="NOI CURa A
DMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: e=ai;Path=/;Do
main=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Expires: Thu, 
01 Jan 1970 00:00:00 GMT..Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1
MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;P
ath=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Set-Co
okie: hl=H4sIAAAAAAAAANNSTHR0Mi8x8nBMt7V19DSND/YuDwSyHB2dguLTzPwcDWwBV
qvNsiMAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:1
5 GMT..Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQ
xsDAzNDEzNwXiWYwofEsAtukdrDQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mo
n, 06-Feb-2017 09:51:15 GMT..Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUy
MDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com..Set-Cookie
: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjY
CALo/pXElAAAA;Path=/;Domain=.rfihub.com..Location: hXXp://ib.adnxs.com
/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&red
ir=..
<<< skipped >>>


GET /safeframe/1-0-0/html/container.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tpc.googlesyndication.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Last-Modified: Tue, 14 Jan 2014 13:13:27 GMT
Date: Tue, 12 Aug 2014 18:51:55 GMT
Expires: Wed, 12 Aug 2015 18:51:55 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1287
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 745146
Alternate-Protocol: 80:quic
......n....VyS.8...Oa<.G".....4.#C.Q.B.= Iw.[q\.;......>.N..;;.3
MyO...]Vs...}{w}d..8..j....9.<...*R.....8.|,.v.(.¶.R....As..O.e..
h.J.0..p..*J.B...4|P.(.4..Z6`...BMeb.....m..y.m..BU.!....a.].....E!W.l
m..4.. ..j$.8....0...n.2..!I`Lh.l.....:@b.<S.I .WCb^M..&.So......w.
u....szd........DaR.... .718.P...t;.......?.&....4..*.0.a.$.X.!.......
A.O...[..5X.]..h..(0.9.y[.Q...4.B....v..I...*....a......M=MD:4.ZO.6.&l
t;.g.@/...G.z.....^.FI..=.4...7 ..N.R.h.a....arQ..L.!.N.:.-.P....B.D..
.=...n.a....e".`J....'\f.8N."s]j.(.%!9..@..`.<..<..v.`... g...Y.
...6.......C....h.......b.s_..G.......-....2..v6.#EL...je;....p.......
d."...]U.e..b.s.R.[O.j.E...../.X..p.".......b.^/..R..w.....|.........V
....@.=...,........l"..n._..,.......8............"...u....U. .._y.[.i.
.../T...C..GQ,...yYx.7...h...mL.;.#.zla.-..lw:n;.O..I9......ZC..q5..j&
uN.rY...fO......7..;Y..e.......I...{.U..Y..}L..G...1..^....~..P..Sp~..
...H/...f..w...).T.8...~s.X..w.X....*..Q5...l.$I.Q......8z...p....b.$.
....D.4...p...og.A.$..uj.t.t.....u..ej...e.]....Sa.G.....A.;_.s.)A.5..
i&....*.].9....."..(..C...n\.....M..j..V..h....3..e..z...n...]_..d.\;.
kW..&"..D...h...T7I..R].u.....).t....e.........C.;.......=...]A!{o...l
"..........H..*.o{..E..w..PD.......po.L#L5v....i.gUM....8.....5f..3^..
.U.l....-............... ......S.S.......Si.......
<<< skipped >>>


POST /CA_Servlet/trackingServlet HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: VVV.freecoins.co
Content-Length: 10
Expect: 100-continue
Connection: Keep-Alive


HTTP/1.1 100 Continue
....




statType=3

HTTP/1.1 200 OK


Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 0
Date: Thu, 21 Aug 2014 09:50:56 GMT
Connection: close



GET /index.php?&productname=Free Coins HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:00 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.13
Set-Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
4169..<!DOCTYPE html>..<html xmlns="hXXp://VVV.w3.org/1999/xh
tml" xml:lang="en" lang="en">..    <head>..        <title&
gt;GameHub</title>..        <meta http-equiv="Content-Type" c
ontent="text/html; charset=utf-8"/>..        <meta name="descrip
tion" content="" />..        <meta name="keywords" content="" /&
gt;..        <meta http-equiv="Cache-Control" content="no-cache, no
-store, must-revalidate">..            <meta http-equiv="Pragma"
 content="no-cache">..                <meta http-equiv="Expires"
 content="0">..                    <link type="text/css" rel="St
yleSheet" href="css/index.css" />..                    <script s
rc="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"><
;/script>..                    <script src="js/jquery.cookie.js"
></script>..                    <script src="js/core-min.j
s"></script>..                    <script src="js/sha256-m
in.js"></script>..                    <script>window.FB
_APP_ID = "1430933670481682";</script>..                    <
script src="js/facebookConnect.js"></script>..               
     <script src="js/gamesHub.js"></script>..             
       <!-- TEST ENV -->..                    <!--<script 
src="//test.maudau.com/AdsBar/api?appid=5464&get=images&adSizeType=1"&
gt;</script>..                    <script>window.casino=Ma
uDauOBJ</script>..                    <script src="//test
<<< skipped >>>


GET /updates/m/fcmonitor.wys HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)
Host: cdn.wemempoclano.net
Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Age: 50159
Date: Thu, 21 Aug 2014 09:51:09 GMT
Last-Modified: Tue, 12 Aug 2014 13:00:40 GMT
Content-Length: 497
Connection: keep-alive
PK........v`.E.X..E...{.....$.0.. ...........zR.......N.......N.......
vq.3b.````.bC=C3v. .$`.g.gh.g.........a. 1`[email protected]`......W....[.....
....Z._Z..X.Z.........Y._....W....E.....9...y..).......r:.p..... .....
.8...p..02.......R.....1.).?.y.mD..R..2.....y..'X.".'x........kqz.....
Q. F...y.. .^.....1%^1..W.q{... *.W.....%^1..WLp{e.Lf.WtC.>...)%^1.
.WLq{.-.. ..T.qz.... 1'.*...9.....)y.?.:..#..PK..-.......v`.E.X..E...{
.....$.......  ......0.. ...........zR.......N.......N....PK..........
S...........



GET /FreeCoinsLandingPage/thankyou.jsp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1; Path=/FreeCoinsLandingPage
Content-Type: text/html
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
a..............200...Y.s.H..|. &...9#...y....S6vlr...E..H.-4Z=0l...u..
......SU........cH.}......C...i....2.9n.P.a.U5...E})....B.R.&H. Q....P
........W.2j.C9.y..foH.g.CD$O..O....q.k......#..UB=.}]...RF,......#>
;n(g.....{S.).*g.%d.PC-k..R?`a#.......s..5........7%E![....E.f...,z&!.
[email protected]."BZ..&... -6@...?.r~.-.g9..U.Yami.ui.Oy
d...u.#.......(...{.9..p3.VI.R.&5Bv..Q...p...'$.....H."[email protected]
L>[email protected].=X.......e.\....;....|................M.....
..%."..D......l.?|.R....!FZ.~..Jz.xtr...xzs...5...200......n..........
n..b.;...{r?^.~..}....m.$gW..^j.......ku.o[[email protected].$.`.Bf..V.Y.bSV\.
....\.L..N.......%.E.1.A..Q2...?6.Jb>.I...A.G..9&..L(}G.B.\{.......
.:.cf:......Px..yu.....c u....P..V.....s.../....TL...\.G.....g"\.^%..1
.....\.Dx..y.@X...@L X.{.Z...Is...=U.....$.}...l..#d.....%...O&.......
...*..9}.i..U....=.w...b.....e..,.0.W!..!.Kw.[w.&x......C....t..0'Xf.;
.t..D.4^U..[$....$... z..z....A~B.d..]%V....esd.......|..$.....!..r.. 
..`.Z.\ 5h...m....j...f....i....(p%.$....i.b.1.`y.0..CZfy:84..AiP(0Z&l
t;..bz.)@......200...O1O...B].LCn....i23..D).....].0-..BO..".M..t....q
.TT^s)-\1.r.......^...U...$.m.>.Tm$.~...>.Tl$.....:t........q...
.".:p..F....y......:.&T........ \(....N........!l........v.qY.".`A`ENR
{.....;f~..[.\~%"...}......^..|.....'.......>7!R*...I.||X..._z.*. .
.....0.!2...7..n.rK~{.8t.......og_..?l.k9(}..^.%`L.........E..^.v_....
-....z............b........?....O.....By..v...jZ.t......).....v;.2.8JD
.!..3./5....u...isLj...4..t...576....#H.7]9..n..G....~ ...5.bjb..k
<<< skipped >>>


GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: sync.mathtag.com
Connection: Keep-Alive


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar  4 2014 19:08:19 ewr-pixel-x3 pid 0x417b 16763
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; domain=.mathtag.com; path=/; expires=Fri, 21-Aug-2015 09:51:14 GMT
Location: hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct
Expires: Thu, 21 Aug 2014 09:51:13 GMT
....


GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: sync.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar  4 2014 19:08:19 ewr-pixel-x4 pid 0x4a46 19014
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Location: hXXp://pixel.mathtag.com/event/img?mm_bnc
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Expires: Thu, 21 Aug 2014 09:51:13 GMT
....


GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805 HTTP/1.1


Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: sync.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=


HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar  4 2014 19:08:19 ewr-pixel-x6 pid 0x42be 17086
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Location: hXXp://pixel.mathtag.com/event/img?mm_bnc
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Expires: Thu, 21 Aug 2014 09:51:13 GMT
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Type:
 image/gif..Content-Length: 0..Connection: keep-alive..Keep-Alive: tim
eout=360..Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch M
ar  4 2014 19:08:19 ewr-pixel-x6 pid 0x42be 17086..Cache-Control: no-c
ache..P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM IN
T OTC PUR STA"..Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com;
 path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT..Location: hXXp://pixel
.mathtag.com/event/img?mm_bnc..Set-Cookie: mt_misc=; domain=.mathtag.c
om; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT..Expires: Thu, 21 Au
g 2014 09:51:13 GMT..



GET //offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:50:01 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 7542
Connection: keep-alive
.<html>.    <head>.      .       <style type="text/css"
>.            .ui-progressbar-value { background-image: url(images/
pbar-ani.gif); }.        </style>.       .        <link type=
"text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery
-ui-1.8.19.custom.css" rel="stylesheet" />.        <link href="h
ttp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-u
i.css" rel="stylesheet" type="text/css" />.        <script  type
="text/javascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1
.5/jquery.min.js"></script>.        <script  type="text/ja
vascript"  src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jque
ry-ui.min.js"></script>..       <title>2 - NonProduct (
Free Coins)</title><script type='text/javascript'></scr
ipt><style type='text/css'>body      {          width:100%; h
eight:100%; margin:0px; padding:0px; font-size:font-family:helvetica; 
font-size:12px;}   .divLeadpName      {         border-bottom-style:gr
oove;border-bottom-width: thin; padding-left:61px; padding-top:9px; fo
nt-size:font-family:helvetica; font-style:italic; font-size:25px;     
            font-weight:bold; color:black; position:absolute;   width:
 100%; background-color: #fff; ba}   #divTop         {display: none}  
#divMiddle      {background-color: #efecec; height: 100%;} #middle    
{background-color: #fff;} .divOnNext      {          position:absolute
; width:89px; height:26px; cursor:pointer;  bottom:  8px; margin-l
<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1


Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 6258
Connection: keep-alive
<html>.    <head>.      <title>4 - NonProduct (Free 
Coins)</title><script type='text/javascript'></script&g
t;<style type='text/css'>body      {          width:100%; height
:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-
size:12px;}   .divLeadpName      {         border-bottom-style:groove;
border-bottom-width: thin; padding-left:61px; padding-top:9px; font-si
ze:font-family:helvetica; font-style:italic; font-size:25px;          
       font-weight:bold; color:black; position:absolute;   width: 100%
; background-color: #fff; ba}   #divTop         {display: none}  #divM
iddle      {background-color: #efecec; height: 100%;} #middle    {back
ground-color: #fff;} .divOnNext      {          position:absolute; wid
th:89px; height:26px; cursor:pointer;  bottom:  8px; margin-left:1px; 
right: 1%;                           background:url("hXXp://static.rev
enyou.com/offers/images/Theme8/button.png");}   .divAccept      {     
     text-align:center; font-family:Arial halvetica; width:89px; posit
ion:absolute; font-size:12px; bottom: 7px; margin-left:1px; right: 2%;
}     .divDecline      {         text-align:center;height:26px; bottom
: 8px; cursor:pointer; font-family:Arial helvetica; font-size:12px; po
sition:absolute; left:1%; padding-top: 4px;}     .divAgreementLeadP{  
        position:absolute; bottom:46px; left:3px;font-size:10px;      
}     #divAgreementLeadPWelcome {bottom:46px;position:absolute;left:18
7px;font-size:10px;}     a:visited      {           color:Blue;   
<<< skipped >>>


GET /activity?_o=62795&_t=cm_apn_in HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: m.xp1.ru4.com
Connection: Keep-Alive


HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Thu, 21 Aug 2014 09:51:18 GMT
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"
Pragma: no-cache
Set-cookie: X1ID=NC-00000010467304128; domain=.ru4.com; path=/; expires=Thu, 21-Feb-2016 05:51:18 GMT
Set-cookie: TMP_X1ID=NC-00000010467304128; domain=.ru4.com; path=/
Location: hXXp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128
Content-length: 0
HTTP/1.1 302 Moved Temporarily..Server: Sun-Java-System-Web-Server/7.0
..Date: Thu, 21 Aug 2014 09:51:18 GMT..P3p: policyref="/w3c/p3p.xml", 
CP="NON DSP COR PSAa OUR STP UNI"..Pragma: no-cache..Set-cookie: X1ID=
NC-00000010467304128; domain=.ru4.com; path=/; expires=Thu, 21-Feb-201
6 05:51:18 GMT..Set-cookie: TMP_X1ID=NC-00000010467304128; domain=.ru4
.com; path=/..Location: hXXp://ib.adnxs.com/setuid?entity=11&code=NC-0
0000010467304128..Content-length: 0..



GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3


HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
Date: Thu, 21 Aug 2014 09:51:16 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 317
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="te
xt/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HE
AD><BODY>.<H1>302 Moved</H1>.The document has mov
ed.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=338520359
1170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">
here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: 
policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP
="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NA
V OTC NOI DSP COR"..Location: hXXp://ib.adnxs.com/setuid?entity=101&ui
d=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1..
Date: Thu, 21 Aug 2014 09:51:16 GMT..Pragma: no-cache..Expires: Fri, 0
1 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Con
tent-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Co
ntent-Length: 317..X-XSS-Protection: 1; mode=block..Alternate-Protocol
: 80:quic..<HTML><HEAD><meta http-equiv="content-type" 
content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE
></HEAD><BODY>.<H1>302 Moved</H1>.The docum
ent has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&ui
d=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_
cver=1">here</A>...</BODY></HTML>....
<<< skipped >>>


GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH


HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9649
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu,
 21 Aug 2014 09:51:11 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR
 STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id
=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51
:11 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Doma
in=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Cache-
Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 
30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43.
.Keep-Alive: timeout=1, max=9649..Connection: Keep-Alive..GIF89a......
.......!.......,...........D..;..







The not-a-virus connects to the servers at the folowing location(s):







%original file name%.exe_580:




.text
`.rdata
@.data
.ndata
.rsrc
uDSSh
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
KERNEL32.dll
ExitWindowsEx
USER32.dll
GDI32.dll
SHFileOperationA
ShellExecuteA
SHELL32.dll
RegEnumKeyA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
ADVAPI32.dll
COMCTL32.dll
ole32.dll
VERSION.dll
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
... %d%%
~nsu.tmp
%u.%u%s%s
RegDeleteKeyExA
%s=%s
*?|<>/":
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe /PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe
1.2.2
Extract: %f
%u byte%c
(%u byte%c)
%d.%d%d Ë%c
inflate 1.2.2 Copyright 1995-2004 Mark Adler
GetProcessHeap
nsisunz.dll
operator
GetProcessWindowStation
portuguese-brazilian
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.zip
onsBv3.dat
rdms.zip
NSTRU~1.DAT
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp
c:\%original file name%.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
%original file name%.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp
/PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"><assemblyIdentity version="1.0.0.0" processorArchitecture="X86" name="Nullsoft.NSIS.exehead" type="win32"/><description>Nullsoft Install System v2.46</description><trustInfo xmlns="urn:schemas-microsoft-com:asm.v3"><security><requestedPrivileges><requestedExecutionLevel level="requireAdministrator" uiAccess="false"/></requestedPrivileges></security></trustInfo><compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"><application><supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/><supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/></application></compatibility></assembly>
WUSER32.DLL
Setup.exe

rdms.exe_484:




.text
`.rdata
@.data
.rsrc
@.reloc
SSh,bJ
.CGy,
SShT&J
<9%u3
FTPj
YPSSSh
,4,56,789
xSSSh
FTPjKS
FtPj;S
C.PjRV
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
%d/%d/%d %d:%d:%d
X:X:X:X:X:X
large file support is disabled
unknown operation
SQL logic error or missing database
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_log
sqlite_source_id
sqlite_version
sqlite_attach
sqlite_detach
sqlite_stat1
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_table
GetProcessHeap
RowKey
3.7.16.2
SQLite format 3
CREATE TABLE sqlite_master(
sql text
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
922337203685477580
SQLITE_
?API call with %s database connection pointer
OsError 0x%x (%u)
os_win.c:%d: (%d) %s(%s) - %s
delayed %dms for lock/sharing conflict
%s\etilqs_
%s\%s
cannot limit WAL size: %s
2nd reference to page %d
invalid page number %d
%s(%d)
keyinfo(%d
%r %s BY term out of range - should be between 1 and %d
Expression tree is too large (maximum depth %d)
too many SQL variables
variable number must be between ?1 and ?%d
too many columns in %s
%s OR name=%Q
type='trigger' AND (%s)
table %s may not be altered
sqlite_
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
duplicate column name: %s
too many columns on %s
DELETE FROM %Q.%s WHERE %s=%Q
sqlite_stat%d
unknown column "%s" in foreign key definition
number of columns in foreign key does not match the number of columns in the referenced table
foreign key on %s should reference only one column of table %T
a JOIN clause is required before %s
cannot modify %s because it is a view
table %s may not be modified
Cforeign key mismatch - "%w" referencing "%w"
error during initialization: %s
no entry point [%s] in shared library [%s]
unable to open shared library [%s]
sqlite3_extension_init
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
USE TEMP B-TREE FOR %s
COMPOUND SUBQUERIES %d AND %d %s(%s)
%s:%d
no such index: %s
SCAN TABLE %s %s%s(~%d rows)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
sqlite_master
sqlite_temp_master
vtable constructor did not declare schema: %s
vtable constructor failed: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
%s (~%lld rows)
%s VIRTUAL TABLE INDEX %d:%s
%s (rowid<?)
%s (rowid>?)
%s (rowid>? AND rowid<?)
%s (rowid=?)
%s USING INTEGER PRIMARY KEY
%s USING %s%sINDEX%s%s%s
%s AS %s
%s TABLE %s
%s SUBQUERY %d
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
foreign key constraint failed
unable to use function %s in the requested context
zeroblob(%d)
CREATE TABLE %Q.%s(%s)
%s %T cannot reference objects in database %s
default value of column [%s] is not constant
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
no such collation sequence: %s
%s - %s
malformed database schema (%s)
cannot join using column %s - column not present in both tables
cannot have both ON and USING clauses in the same join
a NATURAL join may not have an ON or USING clause
%s.%s
%s-shm
bind on a busy prepared statement: [%s]
%s: %s
%s: %s.%s
%s: %s.%s.%s
misuse of aliased aggregate %s
not authorized to use function: %s
too many terms in %s BY clause
EXECUTE %s%s SUBQUERY %d
%.*s"%w"%s
%s%.*s"%w"
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
Cannot add a PRIMARY KEY column
invalid name: "%s"
automatic extension loading failed: %s
d-d-d d:d:d
d:d:d
d-d-d
M@d
SELECTs to the left and right of %s do not have the same number of result columns
LIMIT clause should come after %s not before
ORDER BY clause should come after %s not before
BmTindexed columns are not unique
Recovered %d frames from WAL file %s
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Failed to read ptrmap key=%d
failed to get page %d
%d of %d pages missing from overflow list starting at %d
freelist leaf count too big on page %d
Fragmentation of %d bytes reported as %d on page %d
Multiple uses for byte %d of page %d
Corruption detected in cell %d on page %d
On page %d at right child:
On tree page %d cell %d:
btreeInitPage() returns error code %d
unable to get the page. error code=%d
Page %d:
Outstanding page count goes from %d to %d during this analysis
Pointer map page %d is referenced
Page %d is never used
sqlite3_get_table() called with two or more incompatible queries
no such vfs: %s
%s mode not allowed: %s
no such %s mode: %s
MJ delete: %s
-mjX9X
MJ collide: %s
%s-mjXXXXXX9XXz
database %s is locked
cannot detach database %s
no such database: %s
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
unknown database: %s
unknown database %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
PRIMARY KEY must be unique
constraint %s failed
%s.%s may not be NULL
database schema is locked: %s
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
PRAGMA vacuum_db.synchronous=OFF
cannot VACUUM - SQL statements in progress
misuse of aggregate: %s()
constraint failed at %d in [%s]
abort at %d in [%s]: %s
database table is locked: %s
cannot change %s wal mode from within a transaction
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot commit transaction - SQL statements in progress
cannot release savepoint - SQL statements in progress
no such savepoint: %s
cannot open savepoint - SQL statements in progress
statement aborts at %d: [%s] %s
cannot use index: %s
at most %d tables in a join
cannot open value of type %s
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unsupported file format
no such trigger: %S
unable to open database: %s
database %s is already in use
too many attached databases - max %d
sqlite_sequence
there is already an index named %s
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
no such index: %S
unable to identify the object to be reindexed
no such table: %s
%s.%s.%s
too many references to "%s": max 65535
sqlite_subquery_%p_
cannot create INSTEAD OF trigger on table: %S
cannot create %s trigger on view: %S
cannot open %s column for writing
no such column: "%s"
indexed
foreign key
cannot open view: %s
cannot open virtual table: %s
sqlite_altertab_%s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
CREATE%s INDEX %.*s
table %s has no column named %s
sqlite_autoindex_%s_%d
index %s already exists
there is already a table named %s
virtual tables may not be indexed
views may not be indexed
table %s may not be indexed
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
table "%s" has more than one primary key
CREATE TABLE %Q.sqlite_sequence(name,seq)
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE %s %.*s
view %s is circularly defined
table %S has no column named %s
%d values for %d columns
table %S has %d columns but %d values were supplied
*** in database %s ***
unsupported encoding: %s
foreign_key_check
foreign_key_list
no such column: %s
there is already another table or index with this name: %s
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
view %s may not be altered
-- TRIGGER %s
use DROP VIEW to delete view %s
use DROP TABLE to delete table %s
table %s may not be dropped
sqlite_stat
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the INDEXED BY clause is not allowed on UPDATE or DELETE statements within triggers
Error %d has occurred.
Error %u in WinHttpReadData.
Error %u in WinHttpQueryDataAvailable.
F%D,3
Visual C   CRT: Not enough memory to complete call to strerror.
portuguese-brazilian
Broken pipe
Inappropriate I/O control operation
Operation not permitted
operator
GetProcessWindowStation
WinHttpCloseHandle
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpOpen
WINHTTP.dll
PSAPI.DLL
KERNEL32.dll
EnumChildWindows
CreateDialogIndirectParamW
USER32.dll
GDI32.dll
RegOpenKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
ADVAPI32.dll
ShellExecuteW
SHELL32.dll
ole32.dll
OLEAUT32.dll
URLDownloadToFileW
urlmon.dll
IPHLPAPI.DLL
GetCPInfo
.?AV?$CAtlExeModuleT@VCSmartInstallerModule@@@ATL@@
.?AVCWebPage@@
zcÁ
{A0386B19-B7E7-4BE7-B567-ABF77CBB6E60} = s `ATLExeServer'
`ATLExeServer.EXE'
val AppID = s {A0386B19-B7E7-4BE7-B567-ABF77CBB6E60}
ForceRemove {FA20B59B-21AA-44FC-8A68-450979B7CC90} = s 'CBrowserExternals Class'
val ServerExecutable = s '%MODULE_RAW%'
TypeLib = s '{03771AEF-400D-4A13-B712-25878EC4A3F5}'
ForceRemove {622D38AD-B4A9-4170-8192-5B865C6A5DCE} = s 'CBrowserExternalImp Class'
ForceRemove {6D4506CE-F855-4657-AA38-DB6B1F733982} = s 'CBrowserExternal Class'
stdole2.tlbWWW
~cmdWd
OpenUrlW
urlWd
method OpenUrl
Created by MIDL version 7.00.0555 at Wed Jul 09 20:02:58 2014
llo%srt
<BUTTON onclick='window.external.OnClick(theBody, "red");'>Red</BUTTON>
<BUTTON onclick='window.external.OnClick(theBody, "green");'>Green</BUTTON>
<BUTTON onclick='window.external.OnClick(theBody, "blue");'>Blue</BUTTON>
<requestedExecutionLevel level="requireAdministrator" uiAccess="false"></requestedExecutionLevel>
5~6!7$8*8
6m6
7'8 8/83878;8?8
9&989`9~9
4 4D4[4
: :':,:::
=6=[=~= >
296@6,737
5 5$5(54585
4 4$4(4,40444
5 5$5(5,5054585<5@5
3 3$3(3,3034383
Advapi32.dll
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
THANKYOU_URL
EXE_CMDLINE
EXE_URL
SERVER_URL
execmdline
exeurl
\Microsoft\Windows\Cookies
cookies.sqlite
sqlite
\Mozilla\Firefox\Profiles
Found cookie in Chrome!
SELECT value,last_access_utc FROM cookies WHERE host_key LIKE '%
\..\Local Settings\Application Data\Google\Chrome\User Data\Default\
\..\Local\Google\Chrome\User Data\Default\
Chrome_WidgetWin_1
Exception opening/reading chrome cookies
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
OLEACC.DLL
SELECT url FROM moz_places WHERE url LIKE '%
places.sqlite
\PreExe_ID_
\default.html
Safari.exe
Opera.exe
firefox
chrome
http\shell\open\command
Opera.HTML
IE.AssocFile.HTM
FirefoxHTML
ChromeHTML
Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice
Software\Mozilla\Mozilla FireFox
SOFTWARE\Mozilla\Mozilla FireFox
SOFTWARE\Google\Update\Clients\{8A69D345-D564-463c-AFF1-A69D9E530F96}
virtualoffercmd
\PostCheck.exe
opera
&chromev=
CHROMEVERSION
@@exeurl
AntivirusesRegKeys
RegKey64
RegKey32
PostExe
PreExe
ReportName
RegKey
ExeURL2
ExeURL
OfferURL
I{A33DE4AA-9646-4E33-9E44-E472C6312E2F}
OLEAUT32.DLL
Mscoree.dll
888816666554443
6666554443
!6666554443
virtualoffercmd:
/REPORTURL=
_2nd.exe
mscoree.dll
- Attempt to initialize the CRT more than once.
- CRT not initialized
- floating point support not loaded
KKERNEL32.DLL
WUSER32.DLL
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe
{8856F961-340A-11D0-A96B-00C04FD705A2}

iexplore.exe_1236:




%?9-*09,*19}*09
.text
`.data
.rsrc
msvcrt.dll
KERNEL32.dll
NTDLL.DLL
USER32.dll
SHLWAPI.dll
SHDOCVW.dll
Software\Microsoft\Windows\CurrentVersion\Explorer\BrowseNewProcess
IE-X-X
rsabase.dll
System\CurrentControlSet\Control\Windows
dw15 -x -s %u
watson.microsoft.com
IEWatsonURL
%s -h %u
iedw.exe
Iexplore.XPExceptionFilter
jscript.DLL
mshtml.dll
mlang.dll
urlmon.dll
wininet.dll
shdocvw.DLL
browseui.DLL
comctl32.DLL
IEXPLORE.EXE
iexplore.pdb
ADVAPI32.dll
MsgWaitForMultipleObjects
IExplorer.EXE
IIIIIB(II<.Fg
7?_____ZZSSH%
)z.UUUUUUUU
,....Qym
````2```
{.QLQIIIKGKGKGKGKGKG
;33;33;0
8888880
8887080
browseui.dll
shdocvw.dll
6.00.2900.5512 (xpsp.080413-2105)
Windows
Operating System
6.00.2900.5512






Remove it with Ad-Aware




    

  1. Click (here) to download and install Ad-Aware Free Antivirus.
    2. 

  2. Update the definition files.
    3. 

  3. Run a full scan of your computer.
    4. 





Manual removal*




    

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):
    

    wmic.exe:1680
    ping.exe:408
    FreeCoinsApp.exe:2028
    RegisterInstallStart.exe:1984
    wyUpdate4.exe:2432
    wyUpdate4.exe:2076
    wyUpdate4.exe:2616
    %original file name%.exe:580
    find.exe:1252
    

    2. 

  2. Delete the original not-a-virus file.
    3. 

  3. Delete or disinfect the following files created/modified by the not-a-virus:
    

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (2785 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\button[1].png (458 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (9863 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bodyImg[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_over[1].png (921 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (6189 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\914086145550\FreeCoinsApp.exe (5370360 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe (5680176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (1086 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (5774 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (238 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\gpi.bat (143 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\send_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\global.properties.xml (1638 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-1.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\close_btn.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\DAutils.dll (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_horizontal_middle_slice.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\arrow.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\popup_multi.png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\noInternet.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\coins_icon.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_content_footer.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\body_ad_purple.png (6 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\FreeCoins\FreeCoins.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll (5568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\search_box.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\jquery.custom-scrollbar.css (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\loading_img.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\query_link.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-2.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\openThankYou.bat (340 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\notifications_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\share_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\ok_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe.config (263 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert_1.png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\arrow.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.min.js (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\down.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tray_icon_on.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\aPop.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\BG_settings.png (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RunAppMonitor.bat (102 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\background_body.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (4232 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe (7168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallAddiotionals.bat (575 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_vertical_middle_slice.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\redeemed_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_OFF_settings_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email-30X1.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-1.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_bg.png (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\client.wyc (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg2.png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_top.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\storageManager.js (2193 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\runApp.bat (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_48.ico (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\production.properties.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\installPath.txt (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\lock.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe (1965 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\alerts.xml (651 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_blue.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\coins_btn.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.dll (7384 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_center_slice.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\alert_skin_4.html (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_background.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.xml (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_bg.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\Thumbs.db (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll (14768 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\index_skin_4.html (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\BG_alert.png (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\Stumbleupon32X32.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\up.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\main_v4.css (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\facebook_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_32.ico (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate4.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_gray.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_empty.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallNet35xp.bat (446 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\client.wyc (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\settings_body.png (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\redeem_now.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery-1.9.1.min.js (6312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\time_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\lifeCycleManager.js (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\verifyUninstall.bat (464 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\setting_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\settings_link.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\BG_popUP.png (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\time_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_bottom.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\production.properties.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\DAutils.dll (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionManager.js (63 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_64x64.ico (48 bytes)
    %Documents and Settings%\%current user%\Desktop\FreeCoins.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_bottom.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionPopupUI.js (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-2.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\pcc.bat (82 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon_click.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.cookie.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\coupons_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\verifyUninstall.bat (464 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\googlePlus32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\search_noresults.png (63 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\borderItem.jpg (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\errorHandling.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\twitter32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\mail_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Thumbs.db (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\body.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\top.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\save_btn.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\lock.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\browsers.css (1428 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_ON_settings_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_48.ico (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\json2.js (51 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\time_left_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_16.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_face.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\minimize_app.png (2997 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\close_app.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_32.ico (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\SetupNET35.exe (49498 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\gmail32X32.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\locked_popup_face2.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\transparent.gif (126 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_icon.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\counter_all.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_logo.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\utils.js (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\image_2.jpg (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\email32X32.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_history_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon_click.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\locked_popup_bg.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\ourScrollBar.css (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\invite_friends_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_icon.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn_click.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\global.properties.xml (819 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\yahoo32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.xml (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\close_btn_fBack.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_16.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\production.properties.xml (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\client.wyc (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\alertManager.js (2286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\uiManager.js (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\home_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_64x64.ico (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_top.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\installPath.txt (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\header_image.png (6312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\invite_friends_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\alerts.xml (1302 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\facebook32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\alerts.xml (651 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\down.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_gray.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\global.properties.xml (819 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\DAutils.dll (3136 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\promotionPopup_skin_4.html (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\down.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate4.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\up.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_body.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\close_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate4.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe.config (546 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_close.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.js (75 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_pointer.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\commManager.js (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (497 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (723 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (294 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\nsisunz.dll (211 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (57028 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (4583 bytes)
    

    4. 

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):
    

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"

    

    5. 

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
    6. 

  6. Reboot the computer.
    7. 



*Manual removal may cause unexpected system behaviour and should be performed at your own risk.












 
 




 
No votes yet












				


							


			

				
					  
							

		

		


					
							

	

	
	        


	

        
      
 

      
      

      
    
 

    
  
 

		


		

		
			

			

				

					Lavasoft is the maker of Ad-Aware,
					the world's most popular anti-malware 
					software with over 450 million 
					downloads.
				

				

					© 2026 Lavasoft. All rights reserved.

					Terms Of Use |   Privacy Policy
					


								

			


		

		


	

	
	

	

		x
		
Our best antivirus yet!

		
Fresh new look. Faster scanning. Better protection.

		

			
Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

			
For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

			
			Download adaware antivirus 12
		

		No thanks, continue to lavasoft.com
	

	

		

			close x
			
Discover the new adaware antivirus 12

			
Our best antivirus yet

			Download Now