not-a-virus:AdWare.Win32.OutBrowse.g (Kaspersky), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Adware
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 84bd722fea6da21d35d2b9c5aad0561a
SHA1: eef93a8b6bb4660fa835c4b6306a4c30d2b669ff
SHA256: c965ab55d777fad99d0a00f8af2b4f286194211513910aa20c183f469a973067
SSDeep: 12288:K5UnYdbT2wW c1fFbftgCin2JI6J8bc1YT/AAUHnOiNh:K5UnY03lgd2J0bqAU
Size: 567000 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The not-a-virus creates the following process(es):
wmic.exe:1680
ping.exe:408
FreeCoinsApp.exe:2028
RegisterInstallStart.exe:1984
wyUpdate4.exe:2432
wyUpdate4.exe:2076
wyUpdate4.exe:2616
%original file name%.exe:580
find.exe:1252
The not-a-virus injects its code into the following process(es):
rdms.exe:484
SystemMonitor.exe:1988
FCUpdater.exe:1484
FCMonitor.exe:2024
FCUI.exe:1596
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process rdms.exe:484 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (2785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (9863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (6189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914086145550\FreeCoinsApp.exe (5370360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe (5680176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (1086 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (5774 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\91408614555 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (0 bytes)
The process wmic.exe:1680 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (238 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (0 bytes)
The process FreeCoinsApp.exe:2028 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\gpi.bat (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\send_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\global.properties.xml (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\close_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_horizontal_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\popup_multi.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\noInternet.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_content_footer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\body_ad_purple.png (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FreeCoins\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll (5568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\search_box.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\jquery.custom-scrollbar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\loading_img.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\query_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\openThankYou.bat (340 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\notifications_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\share_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\ok_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe.config (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert_1.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.min.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tray_icon_on.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\aPop.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\BG_settings.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RunAppMonitor.bat (102 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\background_body.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (4232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe (7168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallAddiotionals.bat (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_vertical_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\redeemed_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_OFF_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email-30X1.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_bg.png (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg2.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\storageManager.js (2193 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\runApp.bat (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe (1965 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_blue.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.dll (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_center_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\alert_skin_4.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_background.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\Thumbs.db (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll (14768 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\index_skin_4.html (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\BG_alert.png (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\Stumbleupon32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\main_v4.css (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\facebook_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_gray.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_empty.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallNet35xp.bat (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\settings_body.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\redeem_now.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery-1.9.1.min.js (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\lifeCycleManager.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\setting_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\settings_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\BG_popUP.png (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionManager.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Desktop\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionPopupUI.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\pcc.bat (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.cookie.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\coupons_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\googlePlus32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\search_noresults.png (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\borderItem.jpg (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\errorHandling.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\twitter32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\mail_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Thumbs.db (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\body.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\save_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\browsers.css (1428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_ON_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\json2.js (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\time_left_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_face.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\minimize_app.png (2997 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\close_app.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\SetupNET35.exe (49498 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\gmail32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\locked_popup_face2.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\transparent.gif (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\counter_all.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_logo.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\utils.js (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\image_2.jpg (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\email32X32.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_history_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\ourScrollBar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\yahoo32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\close_btn_fBack.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\production.properties.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\alertManager.js (2286 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\uiManager.js (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\home_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\header_image.png (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\alerts.xml (1302 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\facebook32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_gray.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\DAutils.dll (3136 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\promotionPopup_skin_4.html (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_body.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\close_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe.config (546 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_close.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.js (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_pointer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\commManager.js (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon.png (6 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (0 bytes)
The process wyUpdate4.exe:2432 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (497 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\w2504 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (0 bytes)
The process wyUpdate4.exe:2076 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (723 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\w2213 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (0 bytes)
The process wyUpdate4.exe:2616 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (294 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\w2685 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (0 bytes)
The process %original file name%.exe:580 makes changes in the file system.
The not-a-virus creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\nsisunz.dll (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (4583 bytes)
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (0 bytes)
The process FCUI.exe:1596 makes changes in the file system.
The not-a-virus deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Application Data\FreeCoins\fcud.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Application Data\FreeCoins (0 bytes)
Registry activity
The process rdms.exe:484 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"
[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"
[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 A1 58 46 71 74 44 60 A7 C0 91 57 FA 37 F2 2E"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"
The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The not-a-virus deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process wmic.exe:1680 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 4B F7 64 58 1C D8 97 44 64 2C A0 C0 0B 74 8E"
The process ping.exe:408 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA DA 71 5B B8 A8 FC 45 0D B0 F7 BE B2 0F B9 8B"
The process FreeCoinsApp.exe:2028 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"DisplayName" = "Free Coins Desktop App 1.26"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"URLInfoAbout" = "http://www.freecoins.co"
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe"
"Publisher" = "Free Coins."
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"FCUI.exe" = "7000"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKCU\Software\FreeCoins]
"RegistrationStatus" = "1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"DisplayVersion" = "1.26"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 14 00 13 4D 1C E6 39 A6 7E 2B 0E 5E 1C 1F F8"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\FreeCoins]
"InstallPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins"
[HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION]
"FCUI.exe" = "7000"
To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"
"FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"
The process RegisterInstallStart.exe:1984 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 5B 66 FF FD 8C AC D1 BF 07 09 86 7F 77 C6 CF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\FreeCoins]
"GoogleAnalyticsJsoned" = "{""cm"":""(organic)""
The process SystemMonitor.exe:1988 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 67 2E E3 07 FA B9 CF BE 90 B0 66 1B D7 D1 2E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process wyUpdate4.exe:2432 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 E4 64 E4 E3 B5 EC 00 57 49 E1 CF 9C 1A DB A3"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
The process wyUpdate4.exe:2076 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 74 B7 FD 7F F7 77 C5 B4 39 9F 62 44 9D B1 9E"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
The process wyUpdate4.exe:2616 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 44 60 6A CC 6B 7C C2 AE BF 8B 24 48 05 B1 B5"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
The process FCUpdater.exe:1484 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 B5 25 6D 7F B1 78 C2 33 36 02 39 57 D5 33 53"
[HKCU\Software\FreeCoins]
"FreeCoinsIEExt" = "1"
"FreeCoinsFFExt" = "1"
"FreeCoinsInstall" = "2014-8-21-12-50"
The process FCMonitor.exe:2024 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 1A 55 A2 78 14 E7 4D 24 DE E1 65 7E E5 86 38"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
The process %original file name%.exe:580 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 06 97 70 90 FE 7C 60 FF 2D 22 A7 D0 B2 3D 8A"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process FCUI.exe:1596 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePrefix" = ":2014082120140822:"
"CacheRepair" = "0"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "FCUI.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheLimit" = "8192"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1407762306"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 17 40 EF 34 79 D8 4C C2 CC 99 26 C3 6F C5 31"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheOptions" = "11"
[HKCU\Software\FreeCoins]
"FreeCoinsUUID" = "6d2d1975-0e9c-4d2b-b9ec-faf7bf8f0dbc"
"ver" = "1.26"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014082120140822\"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"
The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"
The not-a-virus deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]
The process find.exe:1252 makes changes in the system registry.
The not-a-virus creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 78 51 53 89 09 42 98 F1 0E 5C 87 19 44 75 98"
Dropped PE files
MD5 | File path |
---|---|
97156d3730ca295bceb65005e43e1556 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\DAutils.dll |
462b4784eda015ee2222a685f54708fe | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\FCUI.exe |
f2d9d327dd1c6f7242d279087d1b9a0c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll |
96bc18f8dee95af3771763dee0e15986 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll |
410be2d16ea77628b919414213734785 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe |
aafb99a979d4cbe4c0505408bd826f87 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe |
9d40de3d6ebfcc6d8501c6629fa2b259 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\SetupNET35.exe |
37c753d5ab2dba14e7b7e1dc56b87c27 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\wyUpdate.exe |
0776370846dfe1d108cbd098db162f35 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\wyUpdate4.exe |
91ec4108ee17d0a6800f49d6755138df | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\914086145550\FreeCoinsApp.exe |
2a5ef58458b77e20115182851d0e4bf9 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso2.tmp\Convert.dll |
5f13dbc378792f23e598079fc1e4422b | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso2.tmp\nsisunz.dll |
b950b7d00028a589f3a6b9889de51782 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\rdms.exe |
91ec4108ee17d0a6800f49d6755138df | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe |
HOSTS file anomalies
No changes have been detected.
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
wmic.exe:1680
ping.exe:408
FreeCoinsApp.exe:2028
RegisterInstallStart.exe:1984
wyUpdate4.exe:2432
wyUpdate4.exe:2076
wyUpdate4.exe:2616
%original file name%.exe:580
find.exe:1252 - Delete the original not-a-virus file.
- Delete or disinfect the following files created/modified by the not-a-virus:
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (2785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (9863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (6189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914086145550\FreeCoinsApp.exe (5370360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe (5680176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (1086 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (5774 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (238 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\gpi.bat (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\send_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\global.properties.xml (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\close_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_horizontal_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\popup_multi.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\noInternet.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_content_footer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\body_ad_purple.png (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FreeCoins\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll (5568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\search_box.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\jquery.custom-scrollbar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\loading_img.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\query_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\openThankYou.bat (340 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\notifications_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\share_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\ok_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe.config (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert_1.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.min.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tray_icon_on.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\aPop.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\BG_settings.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RunAppMonitor.bat (102 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\background_body.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (4232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe (7168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallAddiotionals.bat (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_vertical_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\redeemed_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_OFF_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email-30X1.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_bg.png (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg2.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\storageManager.js (2193 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\runApp.bat (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe (1965 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_blue.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.dll (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_center_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\alert_skin_4.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_background.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\Thumbs.db (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll (14768 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\index_skin_4.html (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\BG_alert.png (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\Stumbleupon32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\main_v4.css (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\facebook_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_gray.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_empty.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallNet35xp.bat (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\settings_body.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\redeem_now.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery-1.9.1.min.js (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\lifeCycleManager.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\setting_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\settings_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\BG_popUP.png (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionManager.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Desktop\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionPopupUI.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\pcc.bat (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.cookie.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\coupons_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\googlePlus32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\search_noresults.png (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\borderItem.jpg (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\errorHandling.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\twitter32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\mail_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Thumbs.db (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\body.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\save_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\browsers.css (1428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_ON_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\json2.js (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\time_left_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_face.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\minimize_app.png (2997 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\close_app.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\SetupNET35.exe (49498 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\gmail32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\locked_popup_face2.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\transparent.gif (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\counter_all.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_logo.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\utils.js (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\image_2.jpg (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\email32X32.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_history_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\ourScrollBar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\yahoo32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\close_btn_fBack.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\production.properties.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\alertManager.js (2286 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\uiManager.js (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\home_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\header_image.png (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\alerts.xml (1302 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\facebook32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_gray.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\DAutils.dll (3136 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\promotionPopup_skin_4.html (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_body.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\close_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe.config (546 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_close.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.js (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_pointer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\commManager.js (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (497 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (294 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\nsisunz.dll (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (4583 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe" - Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
Company Name:
Product Name: Setup.exe
Product Version: 1.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral
Company Name: Product Name: Setup.exeProduct Version: 1.0 Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: Language Neutral
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 36864 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 229376 | 3120 | 3584 | 2.72195 | ecb2f57811e1216779bf9790e5ace50c |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 48
55f698dfa9f4d0becb76c70b86a35e89
37a35826b44a6f7dc08f2efa7dc5edcb
98074817f9a780ea48cfd72a1247d983
6cb1e085f1893765d316b2ac3d0a7cb7
35d0d82e99ab227a8036a61f77ee390e
243184caa5aecebf185a6b99d9c3e08e
de5df25bad894c285472140860b2dd84
74112916e3582d7bab8e654f188506b8
6b3c2dd4ebcede91f226d82c1c6089c6
eaba4aaf1128a9ca05a39f34231c52bc
000054aeade704f5ca8b1a0493550b71
41140783f703a6df7462369dbe3f852d
bc786b8de7507076f13911c5809f8659
611a21c471eac31ccb70dc393a7c66fb
a1829913b550e46c3544a0605e40f862
d988f8070ab8f0bfd3e40845d3300874
c0106ff9927efd05d3e74d3cd79f6797
c0b58298dee466313a5e17b969d070ee
824ba00bf5cc85f85979a5b617716eb4
0c303f04c92ab2c13e92e90a1f21794e
2c4293931465af9d6cd990a3e8bf60d8
1c54228ca5c48ccb1d09875d39541b5e
7554f68b2e1e2fbff6083e995b0787ea
d4232c4e272ef986fe85195221a9ba1f
20283c332f55101dceb6b874952fb88a
Network Activity
URLs
URL | IP |
---|---|
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 | |
hxxp://freecoins.vo.llnwd.net/d/FreeCoinsApp.exe | |
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css | |
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png | |
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg | |
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0 | |
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O | |
hxxp://www.freecoins.co/CA_Servlet/trackingServlet?getGAparams=1 | |
hxxp://www.freecoins.co/CA_Servlet/trackingServlet | |
hxxp://www.google.com/collect | |
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& | |
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2 | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png | |
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png | |
hxxp://www.gamehub.ws/index.php?&productname=Free Coins | |
hxxp://www.gamehub.ws/css/index.css | |
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.9.1/jquery.min.js | |
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js | |
hxxp://www.gamehub.ws/js/jquery.cookie.js | |
hxxp://partnerad.l.doubleclick.net/gpt/pubads_impl_47.js | |
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-0/html/container.html | |
hxxp://www.gamehub.ws/js/core-min.js | |
hxxp://www.gamehub.ws/js/sha256-min.js | |
hxxp://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp | |
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/css/index.css | |
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/free_coins_logo.png | |
hxxp://ib.anycast.adnxs.com/tt?id=3092585 | |
hxxp://ib.anycast.adnxs.com/tt?id=3092599 | |
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/bg_body.jpg | |
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/desttop_bg.png | |
hxxp://ib.anycast.adnxs.com/tt?id=3095266 | |
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3092585 | |
hxxp://flex.msn.com.nsatc.net/mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js | |
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3092599 | |
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3095266 | |
hxxp://flex.msn.com.nsatc.net/mstag/mstag.1003102000.js | |
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585 | |
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599 | |
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266 | |
hxxp://flex.msn.com.nsatc.net/mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600 | |
hxxp://a1961.g.akamai.net/ANX_async_usersync.js | |
hxxp://a1961.g.akamai.net/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg | |
hxxp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1 | |
hxxp://a1961.g.akamai.net/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg | |
hxxp://ib.anycast.adnxs.com/a_usersync?cbfn=ANX_async_load | |
hxxp://partnerad.l.doubleclick.net/pagead/conversion.js | |
hxxp://r.msn.com.nsatc.net/?type=1&domainId=2745850&dedup=1&actionid=207232 | |
hxxp://partnerad.l.doubleclick.net/pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp | |
hxxp://ib.anycast.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= | |
hxxp://www.google.com/analytics.js | |
hxxp://a.ssl.fastly.net/serve/52dfe62b6897d9bfcf00011e.js | |
hxxp://pagead46.l.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 | |
hxxp://www.google.com/collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601 | |
hxxp://ib.anycast.adnxs.com/seg?t=2&add=1418586 | |
hxxp://c.live.com.nsatc.net/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd | |
hxxp://ib.anycast.adnxs.com/seg?t=2&add=1459541 | |
hxxp://ib.anycast.adnxs.com/px?t=2&id=157720&other=aXlHoNTekoQSgLGK | |
hxxp://www.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415 | |
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= | |
hxxp://prod-pixel-collector-1097235636.us-east-1.elb.amazonaws.com/seg/?add=1418586,1459541 | |
hxxp://prod-pixel-collector-1097235636.us-east-1.elb.amazonaws.com/px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094 | |
hxxp://freecoins.vo.llnwd.net/updates/a/desktopapp.wys | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load | |
hxxp://ds-any-world.ngd.ysm.yahoodns.net/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 | |
hxxp://ib.anycast.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") | |
hxxp://partnerad.l.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ== | |
hxxp://www.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y | |
hxxp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1 | |
hxxp://ib.anycast.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy | |
hxxp://ib.anycast.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load | |
hxxp://ib.anycast.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266 | |
hxxp://ib.anycast.adnxs.com/mapuid?member=181&user= | |
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266 | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load | |
hxxp://a1961.g.akamai.net/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif | |
hxxp://darcher3.darcherllc1.netdna-cdn.com/cdn/bv.js?bv=0.008 | |
hxxp://freecoins.vo.llnwd.net/updates/m/fcmonitor.wys | |
hxxp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] | 208.71.121.1 |
hxxp://t.mookie1.com/rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] | 208.71.121.1 |
hxxp://any.edge.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus | |
hxxp://ib.anycast.adnxs.com/mapuid?member=364&user=2040815613008858 | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load | |
hxxp://freecoins.vo.llnwd.net/updates/u/fcupdater.wys | |
hxxp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 | 95.131.122.226 |
hxxp://na.gmtdmp.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 | |
hxxp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30 | |
hxxp://pixel.rubiconproject.net.akadns.net/tap.php?v=4894|| | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load | |
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?id=537072399&val=3385203591170409805 | |
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 | |
hxxp://pug33000.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805 | |
hxxp://a1945.g.akamai.net/j/roundtrip.js | |
hxxp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] | 208.71.121.1 |
hxxp://ib.anycast.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load | |
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw= | |
hxxp://a1945.g.akamai.net/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js | |
hxxp://eqv-ad-lb4.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805 | |
hxxp://ac-na.quantserve.com.akadns.net/dpixel?source=appnexus&eid=5&id=3385203591170409805 | |
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/w/out | |
hxxp://partnerad.l.doubleclick.net/pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876 | |
hxxp://ib.anycast.adnxs.com/seg?add=1392486&t=2 | |
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/x/out | |
hxxp://pagead46.l.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882 | |
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/f/out | |
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/l/out | |
hxxp://www.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879 | |
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/g/out?google_nid=adroll4 | |
hxxp://www.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y | |
hxxp://partnerad.l.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926 | |
hxxp://star.c10r.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI | |
hxxp://r.turn.com.akadns.net/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 | 69.194.244.11 |
hxxp://ib.anycast.adnxs.com/mapuid?member=1471&user=2040815613008858 | |
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/g/in?google_ula=1535926,0 | |
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load | |
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805 | |
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1 | |
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load | |
hxxp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t | |
hxxp://e6791.b.akamaiedge.net/event/img?mm_bnc | |
hxxp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hxxp://ib.adnxs.com/seg?add=673614 | 74.119.118.94 |
hxxp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hxxp://ib.adnxs.com/seg?add=673614 | |
hxxp://a1945.g.akamai.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc | |
hxxp://a1945.g.akamai.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load | |
hxxp://e6791.b.akamaiedge.net/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc | |
hxxp://e6791.b.akamaiedge.net/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc | |
hxxp://ib.anycast.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load | |
hxxp://partnerad.l.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 | |
hxxp://ib.anycast.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 | |
hxxp://p-aws-oregon-tag-01-1110002569.us-west-2.elb.amazonaws.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 | |
hxxp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in | 199.38.164.155 |
hxxp://ib.anycast.adnxs.com/setuid?entity=11&code=NC-00000010467304128 | |
hxxp://x.skimresources.com/?provider=captify&uid=3385203591170409805 | 54.85.113.130 |
hxxp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE] | 208.71.121.1 |
hxxp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805 | |
hxxp://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=2040815613008858 | |
hxxp://ib.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load | |
hxxp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 | |
hxxp://cdn.adnxs.com/ANX_async_usersync.js | |
hxxp://pixel.mathtag.com/event/img?mm_bnc | |
hxxp://www.googleadservices.com/pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp | |
hxxp://ib.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load | |
hxxp://ib.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load | |
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css | 198.232.124.224 |
hxxp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus | |
hxxp://cdn.wemempoclano.net/updates/u/fcupdater.wys | |
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& | |
hxxp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP | |
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png | 198.232.124.224 |
hxxp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805 | |
hxxp://a.adroll.com/j/roundtrip.js | |
hxxp://ib.adnxs.com/bounce?/tt?id=3092585 | |
hxxp://ib.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load | |
hxxp://static.revenyou.com/offers/images/Theme8/button.png | 198.232.124.224 |
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct | |
hxxp://adx.adnxs.com/mapuid?member=181&user= | |
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599 | |
hxxp://ib.adnxs.com/bounce?/tt?id=3095266 | |
hxxp://cdn.adnxs.com/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg | |
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585 | |
hxxp://d.adroll.com/cm/g/out?google_nid=adroll4 | |
hxxp://ib.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load | |
hxxp://www.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y | |
hxxp://ib.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load | |
hxxp://flex.msn.com/mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js | |
hxxp://d.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw= | |
hxxp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy | |
hxxp://ib.adnxs.com/seg?t=2&add=1459541 | |
hxxp://data.getserverinfo.com/Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0 | 54.83.205.127 |
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png | 198.232.124.224 |
hxxp://ib.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load | |
hxxp://ib.adnxs.com/tt?id=3095266 | |
hxxp://ib.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load | |
hxxp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= | |
hxxp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc | |
hxxp://www.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI | |
hxxp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128 | |
hxxp://d.adroll.com/cm/f/out | |
hxxp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=3385203591170409805 | 64.94.107.19 |
hxxp://ib.adnxs.com/a_usersync?cbfn=ANX_async_load | |
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= | |
hxxp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 | |
hxxp://pixel.prfct.co/seg/?add=1418586,1459541 | |
hxxp://data.getserverinfo.com/Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O | 54.83.205.127 |
hxxp://www.google-analytics.com/collect | |
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805 | |
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ== | 173.194.43.109 |
hxxp://partner.googleadservices.com/gpt/pubads_impl_47.js | |
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg | 198.232.124.224 |
hxxp://data.getserverinfo.com/Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 | 54.83.205.127 |
hxxp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd | |
hxxp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805 | |
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 | |
hxxp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 | 54.200.162.182 |
hxxp://www.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y | |
hxxp://ib.adnxs.com/tt?id=3092599 | |
hxxp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc | |
hxxp://ib.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load | |
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg | 198.232.124.224 |
hxxp://www.googleadservices.com/pagead/conversion.js | |
hxxp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266 | |
hxxp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc | |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png | 74.125.201.95 |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css | 74.125.201.95 |
hxxp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2 | 54.83.205.127 |
hxxp://ib.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load | |
hxxp://cdn.freecoins.co/updates/a/desktopapp.wys | |
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js | 74.125.201.95 |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js | 74.125.201.95 |
hxxp://cdn.wemempoclano.net/updates/m/fcmonitor.wys | |
hxxp://ib.adnxs.com/mapuid?member=364&user=2040815613008858 | |
hxxp://ib.adnxs.com/mapuid?member=1471&user=2040815613008858 | |
hxxp://ib.adnxs.com/tt?id=3092585 | |
hxxp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 | 69.194.244.11 |
hxxp://ib.adnxs.com/px?t=2&id=157720&other=aXlHoNTekoQSgLGK | |
hxxp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") | |
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882 | |
hxxp://ib.adnxs.com/seg?add=1392486&t=2 | |
hxxp://d.adroll.com/cm/w/out | |
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266 | |
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png | 74.125.201.95 |
hxxp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 | 208.71.121.14 |
hxxp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js | |
hxxp://d.adroll.com/cm/l/out | |
hxxp://flex.msn.com/mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600 | |
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg | 198.232.124.224 |
hxxp://d.adroll.com/cm/x/out | |
hxxp://ib.adnxs.com/bounce?/tt?id=3092599 | |
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js | 74.125.201.95 |
hxxp://cdn.freecoins.co/d/FreeCoinsApp.exe | |
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 | 173.194.43.109 |
hxxp://cdn.adnxs.com/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif | |
hxxp://dcdn.darchermedia.com/cdn/bv.js?bv=0.008 | |
hxxp://www.google-analytics.com/collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601 | |
hxxp://d.adroll.com/cm/g/in?google_ula=1535926,0 | |
hxxp://tpc.googlesyndication.com/safeframe/1-0-0/html/container.html | 173.194.43.106 |
hxxp://tag.perfectaudience.com/serve/52dfe62b6897d9bfcf00011e.js | 23.235.44.130 |
hxxp://www.googleadservices.com/pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876 | |
hxxp://www.google-analytics.com/analytics.js | |
hxxp://flex.msn.com/mstag/mstag.1003102000.js | |
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1 | |
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266 | |
hxxp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc | |
hxxp://www.googletagservices.com/tag/js/gpt.js | |
hxxp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926 | 173.194.43.109 |
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b | |
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg | 198.232.124.224 |
hxxp://pixel.prfct.co/px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094 | |
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& | |
hxxp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 | |
hxxp://ib.adnxs.com/seg?t=2&add=1418586 | |
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png | 198.232.124.224 |
hxxp://cdn.adnxs.com/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg | |
hxxp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805 | |
hxxp://pixel.rubiconproject.com/tap.php?v=4894|| | |
hxxp://2745850.r.msn.com/?type=1&domainId=2745850&dedup=1&actionid=207232 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/css; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 09:06:21 GMT
Expires: Thu, 21 Aug 2014 10:06:21 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 6091
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 2621
Alternate-Protocol: 80:quic
...........=k.....3...E...yl.=.=.....7@..6..~...e.#K.$.#A..=.!%J|iz...;@Z.:...y..}..........X.H~{G...O~......-.M^M....@o..c.....Og.s............!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.WO8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ........... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}...t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>......|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}g@G..m^...S2.gn.h......;V.yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or..%X...78.I.>..Y.99@.........U......4....5.......2.......UY.<.W EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M... ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<._.. J.YK.:9.H}3....U.B..$..W..f$l]^m....@..c..........0.h...l.q.,(."......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v..~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4...1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t...M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 08:52:26 GMT
Expires: Thu, 21 Aug 2014 09:52:26 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 51558
X-XSS-Protection: 1; mode=block
Age: 3457
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Alternate-Protocol: 80:quic
............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...AP...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3..................E1.-.uz..........ZXI..rZm....../X...4.......@..Z......yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,......j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,....J.@.b.....l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xvrR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9..S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvIo^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../...._.........4..s........x..z|...^|.../.._..?.z..............?.......?=......N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y....c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3........Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T.....D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\..m...@.0......\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!Vo........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 09:46:20 GMT
Expires: Thu, 21 Aug 2014 10:46:20 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 3457
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 223
Alternate-Protocol: 80:quic
.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B....6...._.d.c.......*...V......|U.......w-...p..>Z..........`............`............`............`............`............`............`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."...-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C.....y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._<....p.p....`............`..b.......:............:.............Xj)...w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7.....;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O.....m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD..M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x.....].?/..9r......h...]^}M....<....;..........p.p....`........}.....n..~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M......j..4.%..x......!ij....bXcT..^[$=V.4<m^.=~..Yo.E..s..>....
<<< skipped >>>
GET /ANX_async_usersync.js HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4
HTTP/1.1 200 OK
Server: Apache
ETag: "e3de0e76c13e81e3b0683dac240498eb:1377552334"
Last-Modified: Mon, 26 Aug 2013 21:25:34 GMT
Accept-Ranges: bytes
Content-Type: application/x-javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 509
Connection: keep-alive
...........TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s...|\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H......-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...W:4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X.\...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w.........X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&...M6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,./.,H).|..0g.z...k../g...HTTP/1.1 200 OK..Server: Apache..ETag: "e3de0e76c13e81e3b0683dac240498eb:1377552334"..Last-Modified: Mon, 26 Aug 2013 21:25:34 GMT..Accept-Ranges: bytes..Content-Type: application/x-javascript..Vary: Accept-Encoding..Content-Encoding: gzip..Date: Thu, 21 Aug 2014 09:51:04 GMT..Content-Length: 509..Connection: keep-alive.............TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s...|\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H......-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...W:4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X.\...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w.........X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&...M6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,./.,H).|..0g.z...k../g.......
<<< skipped >>>
GET /p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz0Fhu?d$ L8ih
HTTP/1.1 200 OK
Server: Apache
ETag: "1a825d5acd849546ad35aa925bf5f9f7:1408446966"
Last-Modified: Tue, 19 Aug 2014 11:16:06 GMT
Accept-Ranges: bytes
Content-Length: 5470
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:09 GMT
Connection: keep-alive
GIF89a..X......$..67b...k.....&.....Mb....6..r...Z..t.I........r..6..#|.'..............^...P.......a......{.K..............%.....a...........p..r...h.H..%.........f.1..q......FFF..M...}.nc..n.3V..]...........3]...#e...........---u.....s.....Il,m.H...2[....M}....Dq.cjT...r..i. y..o..w..q..z..o..p..y..x..s..n..v..u..r..v..t..r..q..p..x..w..x..p.....t..z..n..t..&&&.....#s..s..u..u..hjk..q..s........$..%..$.....%..$..q..%..............%.....$T....%......k..{..w.*..&..!.....%...j.....o....U.....!..*|.....WWWAI1FS)...l....u.................$w....#......p....r...|.............%........|..F......z..|||p..o..LX3.....(..9............Ix.........%......n.[.. p.\..k~.@\xF......Tz......Lh...........w........q.I~.]..ox.J.....`{.<......j.2..............o..l.....M...........pt.\.....M...!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a07e3509-56d3-9e47-9312-c420c55db420" xmpMM:DocumentID="xmp.did:64256D6B215211E4932BC583D61BF021" xmpMM:InstanceID="xmp.iid:64256D6A215211E4932BC583D61BF021" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fd28247f-299f
<<< skipped >>>
GET /gpt/pubads_impl_47.js HTTP/1.1
Accept: */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partner.googleadservices.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript
Last-Modified: Wed, 13 Aug 2014 09:40:03 GMT
Date: Tue, 19 Aug 2014 04:32:03 GMT
Expires: Wed, 19 Aug 2015 04:32:03 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 33599
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 191938
Alternate-Protocol: 80:quic
......n.....y..H.8.._.....B..sL"Y..8N...L....i].9D.....?U..ZB$...wgcZ}..U.u..b.....vn/.l{..... c3_.p.v......e:...;..W.s.(.b./.....~3..d.{....."......|B...=.ds>.1..l.o........y....i;........,...f}.~....^=....E.h..l..L....=.Uk.o.l....\Z..8.g...T.......k-&Q..&qd....t4..M...i<...f'Pq<.....T'....r..Fw...{...fq2J]..o..u.=RKo..Q.o.....x..}..`......X^... ...m)..*...bQ.N.4.\.&*....M..bYU...1#......U.bq.H....Y..T.....S..s..Y..%...Q.-fqw1..Vm.n.<.........1..'O.4...~..........5...ttc.z....Y.v.d.A...%a.w.3.......,..t ..u99.b..OG.8....y.U.v..s...._*.x.\.I..$s9..E....p4..z.k...Y.......y5......k.lJ.P.v..._.......2.....D.........;.'.K.uQ\..3m..i..?.%`u..t.. ..<.t..8KC.?...>I......M..mL_......;..........Fg0......._...p6...K.....U..........5x.c.....q<g'O......q..\.iE>......1}/uU}m.xg..T.A..x.S.;.....1.0..q...........!K..4.l..u.../.6X$.nG........Wt.R.......i...........3....x..&......JB.z..<.q.K|....*f.g....<$.z.}.'.Q..71.m...o./.y:.t...r..V........5ot..._.......C-.r.V......g.t...k.-u.....,(}.6.;3............`.r`"....qf.....{...p-..s..U...e^`.^U.;..r.K..m.V.}g.. ...{..r._7.k...@..........0.s.=....>..K.....~...5.b....A.....O.;.}..j!.'.e..a........{D.. ..0.[.6.T g..e......YsaR...B.[]5T.g1...Q._....-....9.....h<..6........6..@......hn7.....%....V...".xc7a...[...9....SWOf...*8.....U..!..$.......k.......`.....Q.@?.?..B.......jbo.d.G..g.k.n..uj...i.A.6.........Bj..[...v-oK...:...D\/.{..paT,....,_......<..9.aa..|.........Y...sq....{.....[0.g.6....:?o..:.(.`0.`....'..Qp..9....n<...e0D....u...).~V..
<<< skipped >>>
GET /offers/images/Theme8/topLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/bgImg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/nextCase.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:59 GMT..Content-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>
GET /offers/images/Theme8/button.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: image/png
Content-Length: 458
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT
ETag: "1b5642f092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:59 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...
GET /rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:09 GMT
Server: Apache/2.2.3 (Red Hat)
Set-Cookie: id=2040815613008858; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com
Set-Cookie: mdata=1|2040815613008858|1408614669; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com
Set-Cookie: OAX=igh79FP1wQ0ABVfH; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com
P3P: CP="NOI DSP COR NID CUR OUR NOR"
Location: /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]
Connection: close
Content-Type: text/plain; charset=UTF-8
GET /js/sha256-min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:02 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT
ETag: "406d0-5aa-4fc68d5e5db4d"
Accept-Ranges: bytes
Content-Length: 1450
Connection: close
Content-Type: text/javascript
/*.CryptoJS v3.1.2.code.google.com/p/crypto-js.(c) 2009-2013 by Jeff Mott. All rights reserved..code.google.com/p/crypto-js/wiki/License.*/.(function(k){for(var g=CryptoJS,h=g.lib,v=h.WordArray,j=h.Hasher,h=g.algo,s=[],t=[],u=function(q){return 4294967296*(q-(q|0))|0},l=2,b=0;64>b;){var d;a:{d=l;for(var w=k.sqrt(d),r=2;r<=w;r )if(!(d%r)){d=!1;break a}d=!0}d&&(8>b&&(s[b]=u(k.pow(l,0.5))),t[b]=u(k.pow(l,1/3)),b );l }var n=[],h=h.SHA256=j.extend({_doReset:function(){this._hash=new v.init(s.slice(0))},_doProcessBlock:function(q,h){for(var a=this._hash.words,c=a[0],d=a[1],b=a[2],k=a[3],f=a[4],g=a[5],j=a[6],l=a[7],e=0;64>e;e ){if(16>e)n[e]=.q[h e]|0;else{var m=n[e-15],p=n[e-2];n[e]=((m<<25|m>>>7)^(m<<14|m>>>18)^m>>>3) n[e-7] ((p<<15|p>>>17)^(p<<13|p>>>19)^p>>>10) n[e-16]}m=l ((f<<26|f>>>6)^(f<<21|f>>>11)^(f<<7|f>>>25)) (f&g^~f&j) t[e] n[e];p=((c<<30|c>>>2)^(c<<19|c>>>13)^(c<<10|c>>>22)) (c&d^c&b^d&b);l=j;j=g;g=f;f=k m|0;k=b;b=d;d=c;c=m p|0}a[0]=a[0] c|0;a[1]=a[1] d|0;a[2]=a[2] b|0;a[3]=a[3] k|0;a[4]=a[4] f|0;a[5]=a[5] g|0;a[6]=a[6] j|0;a[7]=a[7] l|0},_doFinalize:function(){var d=this._data,b=d.words,a=8*this._nDataBytes,c=8*d.sigBytes;.b[c>>>5]|=128<<24-c2;b[(c 64>>>9<<4) 14]=k.floor(a/4294967296);b[(c 64>>>9<<4) 15]=a;d.sigBytes=4*b.length;this._process();return this._hash},clone:functi
<<< skipped >>>
GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: dis.eu.criteo.com
HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Type: image/gif
Expires: -1
Server: Microsoft-IIS/7.5
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 43
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: image/gif..Expires: -1..Server: Microsoft-IIS/7.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 43..GIF89a.............!.......,...........D..;..
GET /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:09 GMT
Server: Apache/2.2.3 (Red Hat)
Location: //ib.adnxs.com/mapuid?member=364&user=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8
GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT
Date: Thu, 21 Aug 2014 09:06:13 GMT
Expires: Thu, 21 Aug 2014 10:06:13 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 29947
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 2629
Alternate-Protocol: 80:quic
...............F....>..R..1.d...j0!^Y....l..jW....@..w.Le.I............@0.....$..}9[.......O....f.O.......6......6...W.?..!.t............C...r....'.}.Y..J5.....?g.|...n.Ec...j.....Q.m..Y..w...m..?}...l.....3.o.>mp..t.g..w.tq;.v...o.-..l...q.lg:z..w..W....zM.....d.9[d.IOU....T#^....;..1..,..o.o.m.......g...}.m5.._u........*ES~.....5.....m......v..%_..w......Z..w.6Y.E.....l......gw.C....l...a..X.:F...o&...a...z.D#...Zq.{...x..V.wk.K..O^..(i.......f.SR/io...c..=.,.^x..*...~..4...:.{=n(J.z(..t(.q..i.p...Y.N.tD..J.=........vXn.K..e.-xH..i..F.1..f.....e.o?..\ew....>~...c2........z..............Gj.zB.;:....2..M.sF.s../..*8..o....x.;....>& n.... .....y......4Ui.@......b.m/.h...?U.....=T.EE.N.i..DMU.e.E....j..Q6...B-.J....>M....:.MZ-.4.Z..._..i.%..m..]..........o.........~.......3...HN..t.................E/[....-..vq..y....-....j......0.xO..U4W..&Jx.ktt.<..u.6oNK..x..h....p.Oh.......P...6...R.C..\.n..m..?..W....6..G.....hn..h.o......!.ep6...T..N..$.......5.)P...3.V......_.O...5..gl.5........c......6.m...^..b...c.y.r..$.....L..p...o.................(,uB..T.2_28....d..us.f1.L..=..&..bV..m<..=........3D..\.Y..r3....A_.Y.G.%.....7|.$t.Z.k..C..\.8?.h...q....naF.i-.......B..`6t.._..h12n....v..".pq..C.h.......x...N.L...p..............f`E@.ha.....m..zj.] h........v..(i....|mv....7.......t......j..j...c.K2...;.4.$;Ve...-o4.~.;..h.M...(*N....m0T.G]5.......K`#.&..Z.V...3......m2.Z.hJ;..F...`Q.QM.?.,..E........@......=.b.........._.Fi.h6........l....2.}$...>.=.N.M)....$eP..]..p%M....|.e......&jJ...x.u...:..
<<< skipped >>>
GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: image/png
Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT
Date: Thu, 21 Aug 2014 08:59:41 GMT
Expires: Thu, 21 Aug 2014 09:59:41 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 88
X-XSS-Protection: 1; mode=block
Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600
Age: 3022
Alternate-Protocol: 80:quic
.PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w...........IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT..Date: Thu, 21 Aug 2014 08:59:41 GMT..Expires: Thu, 21 Aug 2014 09:59:41 GMT..Access-Control-Allow-Origin: *..Timing-Allow-Origin: *..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 88..X-XSS-Protection: 1; mode=block..Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600..Age: 3022..Alternate-Protocol: 80:quic...PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w...........IEND.B`...
GET /cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:12 GMT
Server: Apache/2.2.3 (Red Hat)
Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8
GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671
HTTP/1.1 200 OK
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Type: image/gif
Content-Length: 43
Cache-Control: private, max-age=0, no-cache
Connection: close
GIF89a.............!.......,...........D..;..
GET /p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4
HTTP/1.1 200 OK
Server: Apache
ETag: "9531dfcab239be5053dbfa4ef4277fce:1408543221"
Last-Modified: Wed, 20 Aug 2014 14:00:13 GMT
Accept-Ranges: bytes
Content-Length: 21629
Content-Type: image/jpeg
Date: Thu, 21 Aug 2014 09:51:04 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................Z.............................................................................................."#3.!2CSc..1BRs..Abr...$Qaq..4...........DTt56...d%..Uu7..............................!1..".AQ2.a..q...B#...Rr34...$............?..N.z...:.\..!....5.)......t..[.g.bJ../~Z......84.......7..Z.uZ.b..T...P{"......u9j.e..|*T..]....~'.s....eo..[V...V..c.........}]U.'v..9.]s...5.Y=.1V[...[*3.....3JW.W..p.........%..l.i..U.....lK..g./.....4...:..j...&.f.M.Q....U.z.................h..(..8.^F.R=<M.{LS.h....M...*...t<[.....t.f@....1..M.........wO.D=..I.~......h=.kE|.-n.9&.9!...q2.......\......y.r...h.P.<3.... .WV..f..!.IM~.vI.....fu.m.}.c...P.dV..,F.....ZQ.A..B...W..qx..,........g)...|.k.&G.4.4G.;...e....K..O{?.......B.....V..!......d...q.q.....V.p`..2.....v`..$.k".Z.E^t.=..]..[v.p.$...%......Zm>MJ.....$I.$.dj.r'....p....o9.6..&..\..HBR.(.e.Oy..{...5.)...j[.MR.[..LIk....yF...d.....c9..K_...I....d..1............B...Q....;.....W..0.......S.....~.~.|..............t..P~i......W.....l...K4.....1..~&.W...8..ZQ?_.\..1r.h;w......$.rQ.d...M.b[..0..:gi..-IJ..G.....^....s}...p....$...yp....b:.d.v..kk3. ........Q..{P.k.2.......5X:.?..6o....T....F.....$...j..~....{............7......s...D...h0d.4!,.vw..@$...o'.b..Jb....*.pT._..d.%..T...9.qr^'w&.{...X.~.....-.MF.b|LO.....m.....h.M.$...r.......G....V\..(........ ..hy[.B.u...4}T...?.M..u]
<<< skipped >>>
GET /p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4
HTTP/1.1 200 OK
Server: Apache
ETag: "6ffe88efc10e4300c223a6efe5e670a3:1408542730"
Last-Modified: Wed, 20 Aug 2014 13:52:07 GMT
Accept-Ranges: bytes
Content-Length: 49331
Content-Type: image/jpeg
Date: Thu, 21 Aug 2014 09:51:05 GMT
Connection: keep-alive
......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................X..............................................................................................!1AQ".a2.qR#3...B4..b$.r........CSs..6....c..7.Tt%U.......................!1Q...Aaq...".......2BRb...r...#..3C.4.Sc$............?...........b..bAtI.'[E..q%S.M.....P-#ED...QV..]42.A,..(.&T$.....R]..O..z.d.....b8.{j.B.J.he>..k../..;...AR...n..JJ.@.Z......6.9.q.W'Q[1..dr,EPC%#5D...U.k.R.),yR.7.R*(......PbQ.t2Z[R.0.UU..S...b.j...iru^..&A...K...6k.....U"..........2.p..Q.*......_..x....L.L/y. [..P.TW.._.5.,.......1..<.'\.......-[[h .....v.wU..._.t*....};..b.....*.E3p......P..)...._./...D..f.^.........5........_.. [|.).. X...{.Y^".F..EQ:.n...e....J.....(...U...=@.....2......q....:...s<.W.9cyXu....}...`G.....Qe.S....O-x.Z.....q....5..9.....9K0...6B.O.R_Jk.4F!... 7.Y|'..oEI...\k~..H.....D.|...j.w.2..LfQ .q......@RW>.5mQ~ ..42...Q..5....^. ..O>.6......R..:..k...M.5.77..OHE.1N...*.~.j..4.@.8.Z.c.l....n....5.I.....aO.Z.rb.FM.P...........xL]k..5j.qMTI..........SB.(..'..%............4."iHTN,..b#..d.........../.#..&.f.......R..[f....Z@^.A.....U5$ ....O.C..H..{.U.....^..F,...J.n.......C&.....Z'..Z%.5UZ..]d.T"6).M...."..L.b4.D....'O..o.j.......9Z....-......dE.$..t%..D....#.K9Y..le...;...w..I.v.N....V......)..J...b.mI........2.zg..jL.Xp.8.!.. .U.......i.c .(b........;""...5W$.G...!.W......U._.Xj%*..aR3...Qi.....q_.5.?my...b...
<<< skipped >>>
GET /is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: ak1.abmr.net
HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: hXXp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: 01AI=2-2-25FB066375997C08AA677974C936756369EEB775B3215452B8D97A7A0953AB1B-A1FE72069F55C12A131FFA81D61F21398DF6187ADBE704B79CE071A6719EB0D4; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net
P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"
HTTP/1.1 302 Moved Temporarily..Content-Length: 0..Location: hXXp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: 01AI=2-2-25FB066375997C08AA677974C936756369EEB775B3215452B8D97A7A0953AB1B-A1FE72069F55C12A131FFA81D61F21398DF6187ADBE704B79CE071A6719EB0D4; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net..P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"..
GET /event/img?mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=
HTTP/1.1 302 Moved Temporarily
Server: AkamaiGHost
Content-Length: 0
Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
HTTP/1.1 302 Moved Temporarily..Server: AkamaiGHost..Content-Length: 0..Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"......
GET /event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=; HRL8=CT-1
Connection: Keep-Alive
Host: pixel.mathtag.com
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x12 pid 0x1109 4361
Expires: Thu, 21 Aug 2014 09:51:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:16 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Type: image/gif..Content-Length: 43..Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x12 pid 0x1109 4361..Expires: Thu, 21 Aug 2014 09:51:16 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:16 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com..Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"..GIF89a.............!.......,...........D..;..
GET /cm/x/out HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXp://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI')
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/
Content-Length: 112
Connection: keep-alive
Go to hXXp://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI')....
GET /cm/f/out HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/
Content-Length: 112
Connection: keep-alive
Go to hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI....
GET /cm/g/out?google_nid=adroll4 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:14 GMT
Location: hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/
Content-Length: 117
Connection: keep-alive
Go to hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926HTTP/1.1 302 Moved Temporarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Thu, 21 Aug 2014 09:51:14 GMT..Location: hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/..Content-Length: 117..Connection: keep-alive..Go to hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926..
GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: eu-gmtdmp.gd1.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Connection: close
GIF89a.............!.......,...........D..;..
GET /pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: googleads.g.doubleclick.net
HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 21 Aug 2014 09:51:06 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://VVV.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 76
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Aug-2014 10:06:06 GMT; path=/; domain=.doubleclick.net
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?...HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Date: Thu, 21 Aug 2014 09:51:06 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://VVV.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: cafe..Content-Length: 76..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Aug-2014 10:06:06 GMT; path=/; domain=.doubleclick.net..............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?.......
<<< skipped >>>
GET /pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3
Connection: Keep-Alive
Host: googleads.g.doubleclick.net
HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Date: Thu, 21 Aug 2014 09:51:13 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://VVV.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879
Content-Type: image/gif
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Date: Thu, 21 Aug 2014 09:51:13 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879..Content-Type: image/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..GIF89a.............!.......,...........D.;..
GET /px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.prfct.co
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Cache-control: no-cache="set-cookie"
Content-Type: image/gif
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Server: Jetty(9.0.5.v20130815)
Set-Cookie: pa_uid=pa_YE6NcKMeCbRFLEScY;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT
Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC0C8EF11D2BF2EEF1E82F34F041864DF0CDFDC718E7050E1FA11D9BB039B95618;PATH=/
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Cache-control: no-cache="set-cookie"..Content-Type: image/gif..Expires: Thu, 01 Jan 1970 00:00:00 GMT..P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..Server: Jetty(9.0.5.v20130815)..Set-Cookie: pa_uid=pa_YE6NcKMeCbRFLEScY;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT..Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC0C8EF11D2BF2EEF1E82F34F041864DF0CDFDC718E7050E1FA11D9BB039B95618;PATH=/..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..
GET /pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ== HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: test_cookie=CheckForPermission
HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://adx.adnxs.com/mapuid?member=181&user=
Date: Thu, 21 Aug 2014 09:51:06 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 245
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
Set-Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/; domain=.doubleclick.net
Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://adx.adnxs.com/mapuid?member=181&user=">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://adx.adnxs.com/mapuid?member=181&user=..Date: Thu, 21 Aug 2014 09:51:06 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 245..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..Set-Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://adx.adnxs.com/mapuid?member=181&user=">here</A>...</BODY></HTML>......
<<< skipped >>>
GET /pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3
HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0
Date: Thu, 21 Aug 2014 09:51:14 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 245
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0..Date: Thu, 21 Aug 2014 09:51:14 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 245..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0">here</A>...</BODY></HTML>......
<<< skipped >>>
GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3
HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
Date: Thu, 21 Aug 2014 09:51:16 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 317
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>......
GET /e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: e.nexac.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-type: image/gif
Date: Thu, 21 Aug 2014 09:51:18 GMT
Expires: Wed Sep 15 09:14:42 MDT 2010
P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"
Pragma: no-cache
Server: lighttpd/1.4.28
Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/
Set-Cookie: na_an=1408614678; expires=Sat, 20-Sep-2014 09:51:18 GMT; path=/; domain=.nexac.com
X-Powered-By: Jigawatts
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-type: image/gif..Date: Thu, 21 Aug 2014 09:51:18 GMT..Expires: Wed Sep 15 09:14:42 MDT 2010..P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"..Pragma: no-cache..Server: lighttpd/1.4.28..Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/..Set-Cookie: na_an=1408614678; expires=Sat, 20-Sep-2014 09:51:18 GMT; path=/; domain=.nexac.com..X-Powered-By: Jigawatts..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..
GET /e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.jumptap.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 43
Content-Type: image/gif
Cache-Control: no-cache, max-age=2592000
Server: Jetty(7.6.7.v20120910)
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 43..Content-Type: image/gif..Cache-Control: no-cache, max-age=2592000..Server: Jetty(7.6.7.v20120910)..GIF89a.............!.......,...........D..;....
GET /seg?t=2&add=1459541 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ==
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 0
....
GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QPn=Mde3%$o2(/ZA!*jSH=QL./dmNSPB?j>ni'Gpih®X/<FeyMOoPD 6#xcHg!%FI5#=<I'; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 150
ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":8, "tagtype":"img"});....
GET /pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
Connection: Keep-Alive
Host: ib.adnxs.com
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:06 GMT
GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:06 GMT..GIF89a.............!.......,........@..L..;....
<<< skipped >>>
GET /ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 0..nt>....
GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 150
ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":7, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 150..ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":7, "tagtype":"img"});....
<<< skipped >>>
GET /ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz0Fhu?d$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR`v/roZT; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:08 GMT
Content-Length: 774
document.write('<a href="hXXp://nym1.ib.adnxs.com/click?_Knx0k1igD9kkpGzsKd9P0Jg5dAi29E_ZJKRs7CnfT_8qfHSTWKAP3e7G38xU_k-TcUWCLuo-i4MwfVTAAAAALO7LwCtBwAAKQQAAAIAAADJyxoBP9AGAAAAAQBVU0QAVVNEAKAAWALLCQAA5McAAgUAAQIAAJQANiseKQAAAAA./cnd=!uwbgQQjlye4BEMmX6wgYv6AbIAA./referrer=http://ib.adnxs.com/bounce?/tt?id=3095266/clickenc=http%3A//lp.sharelive.net/?sysid=406&appid=744" target="_blank"><img width="160" height="600" style="border-style: none" src="hXXp://cdn.adnxs.com/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif"/></a>');document.write('<scr' 'ipt type="text/javascript" src="hXXp://dcdn.darchermedia.com/cdn/bv.js?bv=0.008"></scr' 'ipt>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....
<<< skipped >>>
GET /a_usersync?cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:09 GMT..Content-Length: 182..ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});....
<<< skipped >>>
GET /mapuid?member=364&user=2040815613008858 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,........@..L..;....
GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylp<cH:Ti*W@)8Xu/^meB)H; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});....
GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*gjZ>6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HfCkq>=3.)s; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 142
ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*gjZ>6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HfCkq>=3.)s; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 142..ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":5, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AhK:95e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0.`WmNHTMM@!(*IBm$MIX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":7, "tagtype":"img"});....
GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 141..ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":6, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":5, "tagtype":"img"});....
GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 118..ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":4, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":4, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/2#@C1/1J9n2]x2DauGmU9q'w<Ow]Gn%pe?[f?`nfj(6L2]z3I/.zc<SY#G`7IKRz6:TukE=8hT_kM#aIYzx]s(02WVE%zD?; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 113
ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/2#@C1/1J9n2]x2DauGmU9q'w<Ow]Gn%pe?[f?`nfj(6L2]z3I/.zc<SY#G`7IKRz6:TukE=8hT_kM#aIYzx]s(02WVE%zD?; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 113..ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":3, "tagtype":"img"});....
<<< skipped >>>
GET /pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir= HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@
Connection: Keep-Alive
Host: ib.adnxs.com
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=^<5.XQOF; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:13 GMT
GIF89a.............!.......,........@..L..;....
GET /mapuid?member=1471&user=2040815613008858 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,........@..L..;....
GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs L*<V`r_^@pa@.S9WPwgT_:7DV=oPD 6#xbWe]NRFG?.vZeASQ:3:3nq9VwXZS; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs L*<V`r_^@pa@.S9WPwgT_:7DV=oPD 6#xbWe]NRFG?.vZeASQ:3:3nq9VwXZS; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":3, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 169
ANX_async_load({"url":"hXXp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 169..ANX_async_load({"url":"hXXp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614", "c":1, "tagtype":"img"});....
<<< skipped >>>
GET /pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir= HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:15 GMT
GIF89a.............!.......,........@..L..;....
GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":1, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":0, "tagtype":"img"});....
GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqc
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":"img"});....
GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:16 GMT..Content-Length: 0..HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:16 GMT..Content-Length: 0......
<<< skipped >>>
GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:17 GMT
GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:17 GMT..GIF89a.............!.......,........@..L..;nt>....
<<< skipped >>>
GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx]s(01RWW*itG; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Content-Length: 102
ANX_async_load({"url":"hXXp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx]s(01RWW*itG; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length: 102..ANX_async_load({"url":"hXXp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in", "c":1, "tagtype":"img"});....
<<< skipped >>>
GET /setuid?entity=11&code=NC-00000010467304128 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F
Connection: Keep-Alive
Host: ib.adnxs.com
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:18 GMT
GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:18 GMT..GIF89a.............!.......,........@..L..;....
<<< skipped >>>
GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:19 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:19 GMT..Content-Length: 0..
GET /if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: nym1.ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3Macd9s3po!/_3RiNx:M; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 510
<SCRIPT SRC="hXXp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=" TYPE="text/javascript"></SCRIPT>HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3Macd9s3po!/_3RiNx:M; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 510..<SCRIPT SRC="hXXp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAA
<<< skipped >>>
GET /if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEB
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 148
<SCRIPT SRC="hXXp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266" TYPE="text/javascript"></SCRIPT>..HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 148..<SCRIPT SRC="hXXp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266" TYPE="text/javascript"></SCRIPT>....
<<< skipped >>>
GET /is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: ak1.abmr.net
HTTP/1.1 302 Moved Temporarily
Content-Length: 0
Location: hXXp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: 01AI=2-2-11D5DE5315B982453FFC1B127DDFA708AF68DE22869D001BA11FDB1D92AB1550-BFF35046EB015A925D86111169A014CFA2220E9515310C261C7561C6453CBCB6; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net
P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"
HTTP/1.1 302 Moved Temporarily..Content-Length: 0..Location: hXXp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: 01AI=2-2-11D5DE5315B982453FFC1B127DDFA708AF68DE22869D001BA11FDB1D92AB1550-BFF35046EB015A925D86111169A014CFA2220E9515310C261C7561C6453CBCB6; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net..P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"..
GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dps.bing.com
Connection: Keep-Alive
Cookie: MUID=2F6B223C4C616DD806C724A148616EB1
HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 42
Content-Type: image/gif
Expires: 2:51:04 AM
Server: Microsoft-IIS/8.5
TrackingId: b6d56b86-8f34-47bc-aafa-3741ae4c49d7
X-Powered-By: ASP.NET
X-MSEdge-Ref: Ref A: 9EADC1D16D464D5C84E8BF9245A33047 Ref B: 83051D85D07344195EA85793513249CE Ref C: Thu Aug 21 02:51:09 2014 PST
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 2:51:04 AM..Server: Microsoft-IIS/8.5..TrackingId: b6d56b86-8f34-47bc-aafa-3741ae4c49d7..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: 9EADC1D16D464D5C84E8BF9245A33047 Ref B: 83051D85D07344195EA85793513249CE Ref C: Thu Aug 21 02:51:09 2014 PST..Date: Thu, 21 Aug 2014 09:51:09 GMT..GIF89a.............!.......,...........L.;..
GET /updates/u/fcupdater.wys HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)
Host: cdn.wemempoclano.net
Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Age: 183471
Date: Thu, 21 Aug 2014 09:51:10 GMT
Last-Modified: Wed, 23 Oct 2013 14:27:47 GMT
Content-Length: 294
Connection: keep-alive
PK........w.WC....z.........$.0.. .........X.:.....G.:.....G.:........vq.3bdg```.bC=.v. ...Fzfz..z&.@6.7..f; m...%%.V...)yziE.....y.z.....).%.....i..v.^bN.^I..P.^ye)....p.lz..p.8..GlA......PK..-.......w.WC....z.........$....... ......0.. .........X.:.....G.:.....G.:.....PK..........S.........HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..Accept-Ranges: bytes..Age: 183471..Date: Thu, 21 Aug 2014 09:51:10 GMT..Last-Modified: Wed, 23 Oct 2013 14:27:47 GMT..Content-Length: 294..Connection: keep-alive..PK........w.WC....z.........$.0.. .........X.:.....G.:.....G.:........vq.3bdg```.bC=.v. ...Fzfz..z&.@6.7..f; m...%%.V...)yziE.....y.z.....).%.....i..v.^bN.^I..P.^ye)....p.lz..p.8..GlA......PK..-.......w.WC....z.........$....... ......0.. .........X.:.....G.:.....G.:.....PK..........S...........
GET /ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com.ua
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:07 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: adclick_server
Content-Length: 76
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?...HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:07 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: adclick_server..Content-Length: 76..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?.......
GET /ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com.ua
HTTP/1.1 200 OK
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:14 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..GIF89a.............!.......,...........D.;..
GET /mapuid?member=181&user= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
Connection: Keep-Alive
Host: adx.adnxs.com
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:07 GMT
GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:07 GMT..GIF89a.............!.......,........@..L..;..
GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ajax.googleapis.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/javascript; charset=UTF-8
Last-Modified: Fri, 08 Feb 2013 15:35:10 GMT
Date: Fri, 08 Aug 2014 06:25:37 GMT
Expires: Sat, 08 Aug 2015 06:25:37 GMT
Access-Control-Allow-Origin: *
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 32819
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 1135523
Alternate-Protocol: 80:quic
............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V........V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g..Q...S_..Y.....G)..T.".......<......&...*..Z.t%..s@it5..y.c.....p.h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;.....3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE..,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q....v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_........j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*........H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v....n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f..........&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3......i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&
<<< skipped >>>
POST /collect HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: VVV.google-analytics.com
Content-Length: 210
Expect: 100-continue
Connection: Keep-Alive
t=event&ec=Installation_Process&ea=install_start&el=user start to install the app&ev=0&v=1&tid=UA-45411392-1&cid=6d7f6e0c-b90b-4b58-b851-2e2d1d13a422&cm=(organic)&cn=(undefined)&ci=0&cc=(unknown ad)&cs=(direct)
HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:50:57 GMT
Server: Golfe2
Content-Length: 35
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Mon, 07 Aug 1995 23:30:00 GMT..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Access-Control-Allow-Origin: *..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:50:57 GMT..Server: Golfe2..Content-Length: 35..Alternate-Protocol: 80:quic..GIF89a.............,...........D..;..
GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
Cookie: i=6333127b-59e4-4c75-9681-e9f9bbb7943b|1408614672
HTTP/1.1 200 OK
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Type: image/gif
Content-Length: 43
Cache-Control: private, max-age=0, no-cache
Connection: close
GIF89a.............!.......,...........D..;..
GET /tap.php?v=4894|| HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805
Connection: Keep-Alive
Host: pixel.rubiconproject.com
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com
Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com
Content-Length: 49
Keep-Alive: timeout=30, max=9733
Connection: Keep-Alive
Content-Type: image/gif
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..Server: Apache..X-Powered-By: PHP/5.3.3..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com..Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com..Content-Length: 49..Keep-Alive: timeout=30, max=9733..Connection: Keep-Alive..Content-Type: image/gif..GIF89a...................!.......,...........T..;..
GET /cm/w/out HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXps://analytics.twitter.com/i/adsct?p_user_id=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI&p_id=823423
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/
Content-Length: 109
Connection: keep-alive
Go to hXXps://analytics.twitter.com/i/adsct?p_user_id=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI&p_id=823423....
GET /cm/l/out HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:13 GMT
Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/
Content-Length: 85
Connection: keep-alive
Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318bHTTP/1.1 302 Moved Temporarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Thu, 21 Aug 2014 09:51:13 GMT..Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/..Content-Length: 85..Connection: keep-alive..Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b....
GET /cm/g/in?google_ula=1535926,0 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b
Connection: Keep-Alive
Host: d.adroll.com
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b-g_1408614674; Version=1; Expires=Tue, 20-Aug-2019 09:51:14 GMT; Max-Age=157680000; Path=/
X-Result: g.-1.-1.1535926.0.-1
Content-Length: 35
Connection: keep-alive
GIF87a.............,............Q.;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, must-revalidate..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:14 GMT..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b-g_1408614674; Version=1; Expires=Tue, 20-Aug-2019 09:51:14 GMT; Max-Age=157680000; Path=/..X-Result: g.-1.-1.1535926.0.-1..Content-Length: 35..Connection: keep-alive..GIF87a.............,............Q.;..
GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9827
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9827..Connection: Keep-Alive..GIF89a.............!.......,...........D..;....
GET /offers/images/Theme8/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:04 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:04 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:04 GMT..Content-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>
GET /FreeCoinsLandingPage/themes/thankyou/images/free_coins_logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"5837-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: image/png
Content-Length: 5837
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
.PNG........IHDR..."...".....:G......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>
GET /cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:12 GMT
Server: Apache/2.2.3 (Red Hat)
Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:12 GMT..Server: Apache/2.2.3 (Red Hat)..Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858..Connection: close..Content-Type: text/plain; charset=UTF-8..
GET /tag/js/gpt.js HTTP/1.1
Accept: */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googletagservices.com
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 7333933708124470652
Date: Thu, 21 Aug 2014 08:52:51 GMT
Expires: Thu, 21 Aug 2014 09:52:51 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 14500
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=3600
Age: 3489
Alternate-Protocol: 80:quic
...........}iw.8.....GooF.....3cE.I..M.4M..~r(J^.5..4m../..........=g..I..I..@.....OG.....bq-r.~:.%...9...G.2.........}.r..A`..Oo..._c..o[.."......?.....fI.f......8.......a....T.<...".......l..wi<....M&P......>.f.....pU..-.F.....5[N.(...I.I4.....k9...h...v..,....B.Q...'G.8.Y0........,..7.........bg.;......2...[.h.D5.:[..G)H........I,.....;..B......WnP........O.S.E..y...*N...........I.f9....T.....U.......>.....rC.[|2O.qt....V.n....k...1..1.......F..j.}.b7p...b..l.......lrY<........\.F..9.0._...x..4#..u9.....Os....N.9.U.wO.h. ..o.w.".r..G.T6......4l.jU...ft....{....5........^.....4.g......KGWQ..C...>k..g..."d..(...k .Tb.C.V<....o.5...3.Yt].fJ..A..K..c.A.[.;.;..g....b1.7......4...%.,N...9K3QP.%'.....mk..f..w.6_..l=...`p[...Qt......o.w{.o..O..s.]9..v.y..^....u'.:.,),m.1e)....h...f....N...V....\..3.....\.4...B.n..K.-~...`..z......&..).l.*........]..}7..D....\..q.......C.E.#]..|,....O.....;..4J....n..[.Q..O..z...<...,.../.._....W..h.^...3X..q.s.*....t.%...f.OU...7E.Q.h?..m..A.i...A.%....Lr.4..sJ...%o.g.r.......N ~p.u...r..u\.ea8l....$J....6~.?W...%.......U..H.m..v.e=..W.i.. ........Q.F.(...l..|hA..-...i...@vvr?AE.IX... ....z....Z.A..=...f..8#9..S.....v..0i...|.*...5n.....i.$..&o..o....&Y?... .....A...i.h..n.U..&...9.|.XP.a....._=...[...=..>...h..>..1}@..>.TJ....%}.....c......\....N....>..?...qH....}.........._..)&......P?..@}L........_R).......9.@rn.7b...........}0.'...wh..A.....*?. ......a<H..b.A..5...}M...OX....~x{.z...G;!..U;B?P.......o...#".M..:.. .#.s.X_......: ..... ..t.
<<< skipped >>>
GET /r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: r.turn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/
Content-Type: image/gif
Content-Length: 43
Date: Thu, 21 Aug 2014 09:51:13 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0..Pragma: no-cache..Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/..Content-Type: image/gif..Content-Length: 43..Date: Thu, 21 Aug 2014 09:51:13 GMT..GIF89a.............!.......,...........D..;....
GET /r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: r.turn.com
Connection: Keep-Alive
Cookie: uid=7369045053275563920
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Pragma: no-cache
Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/
Content-Type: image/gif
Content-Length: 43
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0..Pragma: no-cache..Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/..Content-Type: image/gif..Content-Length: 43..Date: Thu, 21 Aug 2014 09:51:14 GMT..GIF89a.............!.......,...........D..;..
GET /cm?in=1&pub=345&userid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.rfihub.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Server: nginx/1.5.3
Date: Thu, 21 Aug 2014 09:51:13 GMT
Content-Length: 0
Connection: keep-alive
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT
Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com
Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com
Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=
HTTP/1.1 302 Found..Server: nginx/1.5.3..Date: Thu, 21 Aug 2014 09:51:13 GMT..Content-Length: 0..Connection: keep-alive..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Expires: Thu, 01 Jan 1970 00:00:00 GMT..Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com..Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com..Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=......
<<< skipped >>>
GET /js/core-min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:01 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT
ETag: "406cf-ce2-4fc68d5e5db4d"
Accept-Ranges: bytes
Content-Length: 3298
Connection: close
Content-Type: text/javascript
/*.CryptoJS v3.1.2.code.google.com/p/crypto-js.(c) 2009-2013 by Jeff Mott. All rights reserved..code.google.com/p/crypto-js/wiki/License.*/.var CryptoJS=CryptoJS||function(h,r){var k={},l=k.lib={},n=function(){},f=l.Base={extend:function(a){n.prototype=this;var b=new n;a&&b.mixIn(a);b.hasOwnProperty("init")||(b.init=function(){b.$super.init.apply(this,arguments)});b.init.prototype=b;b.$super=this;return b},create:function(){var a=this.extend();a.init.apply(a,arguments);return a},init:function(){},mixIn:function(a){for(var b in a)a.hasOwnProperty(b)&&(this[b]=a[b]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},clone:function(){return this.init.prototype.extend(this)}},.j=l.WordArray=f.extend({init:function(a,b){a=this.words=a||[];this.sigBytes=b!=r?b:4*a.length},toString:function(a){return(a||s).stringify(this)},concat:function(a){var b=this.words,d=a.words,c=this.sigBytes;a=a.sigBytes;this.clamp();if(c%4)for(var e=0;e<a;e )b[c e>>>2]|=(d[e>>>2]>>>24-8*(e%4)&255)<<24-8*((c e)%4);else if(65535<d.length)for(e=0;e<a;e =4)b[c e>>>2]=d[e>>>2];else b.push.apply(b,d);this.sigBytes =a;return this},clamp:function(){var a=this.words,b=this.sigBytes;a[b>>>2]&=4294967295<<.32-8*(b%4);a.length=h.ceil(b/4)},clone:function(){var a=f.clone.call(this);a.words=this.words.slice(0);return a},random:function(a){for(var b=[],d=0;d<a;d =4)b.push(4294967296*h.random()|0);return new j.init(b,a)}}),m=k.enc={},s=m.Hex={stringify:function(a){var b=a.
<<< skipped >>>
GET /pagead/conversion.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googleadservices.com
Connection: Keep-Alive
HTTP/1.1 200 OK
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Content-Type: text/javascript; charset=UTF-8
ETag: 10951747834593842486
Date: Wed, 20 Aug 2014 21:52:56 GMT
Expires: Thu, 21 Aug 2014 21:52:56 GMT
X-Content-Type-Options: nosniff
Content-Disposition: attachment; filename="f.txt"
Content-Encoding: gzip
Server: cafe
Content-Length: 3638
X-XSS-Protection: 1; mode=block
Age: 43089
Cache-Control: public, max-age=86400
Alternate-Protocol: 80:quic
...........Z.s....=..h:.:\.C....0i..zwM......1.-...9.@....ve.6.I..y3.....J./...y..I.(........N.D....g......y.n..F"..pR..C..x....$...lgq..h,.e.../.....Br..c.<..z.E....i..u....px..\R.a.A....h=.M\5[....TGrm6$\.m...Z...p.N[-..]...pI..&..w.cTPt!...}r..E...x....d...~o.e..{.....7.....*.R'O."HD#....c.........Q.....(.....g;v6.......\|ke}.b...9[.../aE...o^.k......~gQS.\..?....Jwi..d/.Z.......f3.vt.l..D..".V4...~....y.7..).t.<...[h.kt_...y.k.*.......lb.|.Ox..h.i..K...D.g...........X.Y#.n.FH6..=7.,1`...K8.KX''..~..W..z..&.]..f.....0....w..E......?.~.."~.....k-..."[S.....C>..d[..^H../..;.j.&..9W1....X.8.1z...p....>......W.}m..{j..T....v.k.......n.........Z-........w...6.P.|G....C|...P.qh....6..C.ob...n..t..... ...w.].9..J:.".....T.L...!c.7l6.Y...8....uu..x"'J.0i9'..n;4.0,.Cg4B#._..#8.<....)....{......r ...M.......y......N.....5J3q....hq........P...~../e..LjeA.p..E....^...x....QK0o..u^...^n..:S-.....r.....". ..J!tT:$g.F..W.d.....l....m..b......:.Z.[.........T.\u<hL[.*g"........}.:g......\.N./.Q.n.s..pX.....'o...s.....m......]j....3..#.(..b.Da..c...;.|.<.!.Zk....q.....%...Z....;.8...PC........EP' ..X..~..z...:...r2U.X.y<.)..8....~..q"x.Lk&.S1O..e.F.1..^..,..u.O.y]..d.7..Z..1.X.;.F.H....w.I..pZ..O$[..../..H\.j.. . .l.W\....t ../......D.).Aok.U..di'Y....G...e.#....l%...)......i H.".,.b.f.......R..K...(........*2. O?_..F,..w...;.....{.}V.gU.X.....-~_..k....:...^h....B..bEoW;.......7....o.U..!..jvu.B.;.Me9.3...Z...[...LX.~...7.Vf...E.....Y.1....kQ.\.,.(.Z.._......jn&G....6.:...[j....RF..IH.b7.<......@..
<<< skipped >>>
GET /pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googleadservices.com
Connection: Keep-Alive
HTTP/1.1 302 Found
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Date: Thu, 21 Aug 2014 09:51:05 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Server: cafe
Content-Length: 76
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?.......
GET /pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.googleadservices.com
Connection: Keep-Alive
HTTP/1.1 302 Found
P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Date: Thu, 21 Aug 2014 09:51:13 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882
Content-Type: image/gif
X-Content-Type-Options: nosniff
Server: cafe
Content-Length: 42
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Thu, 21 Aug 2014 09:51:13 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882..Content-Type: image/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..GIF89a.............!.......,...........D.;..
GET /c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.bing.com
Connection: Keep-Alive
HTTP/1.1 302 Redirect
Cache-Control: private, no-cache, proxy-revalidate, no-store
Pragma: no-cache
Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Thu, 21-Aug-2014 13:51:06 GMT; path=/;
Set-Cookie: MUID=2F6B223C4C616DD806C724A148616EB1; domain=.bing.com; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/;
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 0
HTTP/1.1 302 Redirect..Cache-Control: private, no-cache, proxy-revalidate, no-store..Pragma: no-cache..Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")..Server: Microsoft-IIS/8.0..X-Powered-By: ASP.NET..P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"..Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Thu, 21-Aug-2014 13:51:06 GMT; path=/;..Set-Cookie: MUID=2F6B223C4C616DD806C724A148616EB1; domain=.bing.com; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/;..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 0..
GET /Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:50:06 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 9773
Connection: keep-alive
..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"83$.Fmkcsez_oajgRvjdo"8.((* 0. .RcbC`r 7.!("P`_F^w3.!6" '.M^nllsJak`.5.WloSqbc.9^\ci_q]tmm.&.Q^pdLaqn.'.NoicqcrD<.300&!=lu\qnHdc_q.:.'.DlU^csBopDfnm_if!61*.=s^SOF!6" '.@qcRLK."8..'.Algl]nbGai^ 7.!("Ma^`kSOF!6"folk3-,^hneao&oac*[ols oj\\i ]ni/-j^a^pp)Cun_ha^Hdc_qOcp`]i8mc`dnib8*1-$sih`=0.._bqqcc917 1.jb[cl=4.(..alomprwd\8 4/ rus`dl8,0#^e^=.!`]60.&!Nar`.5&/).@`dgoajg_i>`pa 5., 7/3,-5241.% >hsevgmmn^qO_fGewn.5. ).O]ympl.3 .&!Afd`[obtb.9)1*.HmhklnhknP\l`.8* .Dgn[m^n^hbuR_o].3 .&!Olc`h<_rblHjsr\dg.8-&!Ripom\eMc`dnCmhe\gbIcma"8..x%y.JnotCs].3 .&!Lrc@p`.8.. .CmhhjgcknSupc.23% JimetguYobmkNxleq.2.) .1!("P`_F^w.4!., M]bDcv03.: .$.KcmiqpN_h].3 Scqpu_g.(.Q^pdLaqn.&.Dl]tob_n].% Mln`uaoA?.8/3 .AjrYtlMc`dn"8 $.BqT[hpFmmAilr^fk.:/'.@qcRLK.: .$.>vbOQH2 5..% @ilial_Ddgc.4!., J^a^pRLK.: cloi8,)cerc^l)mfb'`lpq(lmZah(bkm-*ga_com.@yl\ed\Mc`dnSam]`g=l`earg_5-00#pned;-1!]gpnh`=/4(./$i_``p;1 ,$`itjtpta_603,%oyq]ao61/ cbb; .c[;/. .R_o].3 .&!=dbdldhl^fC]t_.2.*06,8)12/.3.*.;mpitdjplcpLdcKctk.3 .&!Lawjmo.8* .Eda]^mgs_!6-/'.KkmjiseolMYo^ 7'0("Bdk^kcm[m_yP\l`.8* .Sj`]k:dq_qEnqoYge 7* .VgmlpZjL`earAjehZlaFhje 5..v*x.Oksr@p`.8.. .Pp`=s^ 7.!("AjekhlbhsPyn`.51*.Gnjirdr\mglhSupcn.5./*-,-7 '.M^eH_x.: .$.KcdEdu62.2..*.LdlopoF\fc.4!Ripom\e.*.XkuRpZ`.?`]dhep\ljk.(.EkcsnZ\lc.&!Lrm_m^mGA.9.8*.9gp_vmNbfcm.5)*.CrSago>jkGkms]lj.2,% Br
<<< skipped >>>
GET /Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0 HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:50:54 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK......
GET /Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19
Host: data.getserverinfo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:00 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 8
Connection: keep-alive
..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:00 GMT..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....
GET /ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com
HTTP/1.1 302 Found
Location: hXXp://VVV.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y
Cache-Control: private, max-age=43200
Date: Thu, 21 Aug 2014 09:51:06 GMT
Expires: Thu, 21 Aug 2014 09:51:06 GMT
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 706
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y..Cache-Control: private, max-age=43200..Date: Thu, 21 Aug 2014 09:51:06 GMT..Expires: Thu, 21 Aug 2014 09:51:06 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Server: adclick_server..Content-Length: 706..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEA
<<< skipped >>>
GET /ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: VVV.google.com
HTTP/1.1 302 Found
Location: hXXp://VVV.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y
Cache-Control: private, max-age=43200
Date: Thu, 21 Aug 2014 09:51:14 GMT
Expires: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: adclick_server
Content-Length: 346
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y..Cache-Control: private, max-age=43200..Date: Thu, 21 Aug 2014 09:51:14 GMT..Expires: Thu, 21 Aug 2014 09:51:14 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Server: adclick_server..Content-Length: 346..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y">here</A>...</BODY></HTML>....
<<< skipped >>>
GET /cdn/bv.js?bv=0.008 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dcdn.darchermedia.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Type: application/x-javascript
Content-Length: 10245
Connection: keep-alive
Last-Modified: Tue, 19 Aug 2014 04:17:46 GMT
Vary: Accept-Encoding
ETag: "53f2cfea-2805"
Server: NetDNA-cache/2.2
X-Cache: HIT
Accept-Ranges: bytes
/*************************************************************************.* .* DARCHER LLC INTELLECTUAL PROPERTY.* __________________.* .* [2014] DARCHER LLC <support@darchermedia.com>.* All Rights Reserved..* .* NOTICE: All information contained herein is, and remains.* the property of DARCHER LLC dba DARCHER MEDIA and its suppliers,.* if any. The intellectual and technical concepts contained.* herein are proprietary to DARCHER LLC dba DARCHER MEDIA.* and its suppliers and covered by U.S. and Foreign Patents,.* patents in process, and are protected by trade secret or copyright law..* Dissemination of this information or reproduction of this material.* is strictly forbidden unless prior written permission is obtained.* from DARCHER LLC <support@darchermedia.com>..*/..var _0xb840=["\x72\x61\x6E\x64\x6F\x6D","\x66\x6C\x6F\x6F\x72","\x63\x75\x72\x72\x65\x6E\x74\x53\x63\x72\x69\x70\x74","\x55\x5A\x78\x63\x52\x54\x78\x51\x25\x78\x40\x57\x6D\x4D\x25\x44\x76\x39\x48\x55\x54\x45\x3F\x23\x5A\x2A\x52\x36\x6B\x23\x38\x41\x40\x6E\x65\x43\x6B\x62\x44\x5A\x4E\x47\x76\x7A\x56\x5A\x23\x46\x64\x67\x5A\x26\x4E\x65\x36\x36\x21\x56\x78\x72\x35\x64\x75\x7A\x54\x4E\x32\x5A\x77\x21\x25\x4B\x64\x43\x51\x68\x62\x73\x4B\x53\x32\x25\x57\x5F\x6D\x32\x7A\x4A\x73\x24\x50\x75\x52\x67\x40\x47\x34\x26\x68\x55\x57\x43\x4A\x65\x77\x2D\x79\x55\x23\x35\x74\x21\x46\x52\x76\x25\x42\x62\x5E\x62\x4C\x2B\x46\x70\x41\x56\x58\x37","\x70\x75\x73\x68","\x73\x6C\x69\x63\x65","\x72\x6F\x75\x6E\x64","\x73\x70\x6C\x69\x63\x65","\x44\x2A\x48\x3
<<< skipped >>>
GET /pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: d.adroll.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Cache-Control: no-store, no-cache, must-revalidate
Date: Thu, 21 Aug 2014 09:51:12 GMT
Location: hXXp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js
P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
Pragma: no-cache
Server: nginx/1.4.7
Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/
X-Conversion-Currency:
X-Conversion-Value: 0
Content-Length: 0
Connection: keep-alive
HTTP/1.1 302 Moved Temporarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Thu, 21 Aug 2014 09:51:12 GMT..Location: hXXp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/..X-Conversion-Currency: ..X-Conversion-Value: 0..Content-Length: 0..Connection: keep-alive......
GET /d/FreeCoinsApp.exe HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.freecoins.co
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Content-Type: application/octet-stream
Age: 46300
Date: Thu, 21 Aug 2014 09:50:02 GMT
Last-Modified: Tue, 12 Aug 2014 10:47:11 GMT
Content-Length: 19969368
Connection: keep-alive
MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@.......................... ......zM1......................................t...........v............0..............................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc....v.......x...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....
<<< skipped >>>
GET /FreeCoinsLandingPage/themes/thankyou/images/desttop_bg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"20943-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: image/png
Content-Length: 20943
Date: Thu, 21 Aug 2014 09:51:03 GMT
Connection: close
.PNG........IHDR...V.........5 ......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......
<<< skipped >>>
GET /mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flex.msn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: public
Content-Type: application/x-javascript; charset=utf-8
Content-Encoding: gzip
Expires: Thu, 21 Aug 2014 10:06:03 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
Content-Length: 488
.............`.I.%&/m.{.J.J..t...`.$..@.........iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;..8..]....../.6....i.Wyu.....*........}l^..N...zyx..i....M>.U.."_....=-s....l..17...j.||...............g...../... .....f...n..g.............>n..g......}|oo/......t....}.og......{...<...x....z.........O........Vy..y../.%.z....d...;....~....UY.[........~..I...D~^..._~2....?..........g......>z.L.b.....>n.w.....3..........OR.*...]..|.#..?..t............}D...u..............
GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:49:15 GMT
Expires: Thu, 21 Aug 2014 11:49:15 GMT
Last-Modified: Thu, 31 Jul 2014 23:23:53 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11119
Cache-Control: public, max-age=7200
Age: 110
Alternate-Protocol: 80:quic
...........}{W.....|......a...N..Eo..[K.!..%.RB.:..B......d;...<..5C........'........\....Q2T#.||..|t>...a&N...P..E,.I.}..'.i&....N[......".n.$....2<M..(...N.B..<OP`..~."/M....O..<-3.....S.ne.8..s..SO\.:I...?e..G)r.(.&2K^..s...}M...,K..4C...{f.h$.NG...B............z"E.S99.....q.f...4.h...I.@.4...G:.Fj4@.1.a..8...2.n#9.........:....D^..`N..A..!..F..>.Y.a....4.G..... .$.S.^D...5...{...m..]..1@.5.cY>.5e...2.b1......{..z..{..z..L...p...HRG....F.'>b.c...>0...#...........2I..I..h{.2.&....-.t[.i..b..<.8";q7..g&w/*U<..>U.QY...R..s.m.Z-....V..3.O.#.T...n.........8hQS.........z....W..w.....?8|.....O..|.&c.............t.M/......k..........^.......m=hY..;.....5.....89o|...%-.R....a*{..E.m....,............l........w~w.lt...y........_.h....... ..VW.....h.\.*l....d..i. .....z.I*.....R7.-;..Z..;... Y..n...jO........ ...u..D..#h..%aw.@..1...TE2... .K.......R>.c.r.h._.........kO.]-m.Yy..E3.c.....'........._&.....%tp...72.Z...)..O.d.... .*T*:h"/..:..ju....=5..f.....7....l&......ir>.H.;..j.oP.:....Y......4h...*........U...D .....B..d...P.L ivY...1S.....o..L.]...}....N.....q7....?K@....~V...?..g...;.....S..y..........7[*.B..:..q.s.m-.....2....W]...X:.eT...$i..-...w...<^=^].w&t..::\o....R.f}c..X....H..>...j".....A....i........]/..*F}).MmD...ju8..*H.....B ...<.6..#.*.......>..-.."..%....n% ....6.n.-z8..D.:......Buz....uAB B....$y.0W.....P~....s....U.%....]b.&u....O4x.....W..ykT...`.k.}7M{..m.7.V...2M. ....7f.:.....6[o.....'c,.=..<.b.....U..8..0.Z.D'b/.#5..)..\w....GO~.a<..O.
<<< skipped >>>
GET /collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Pragma: no-cache
Expires: Mon, 07 Aug 1995 23:30:00 GMT
Access-Control-Allow-Origin: *
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Date: Wed, 20 Aug 2014 22:04:40 GMT
Server: Golfe2
Content-Length: 35
Age: 42386
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Alternate-Protocol: 80:quic
GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Wed, 20 Aug 2014 22:04:40 GMT..Server: Golfe2..Content-Length: 35..Age: 42386..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Protocol: 80:quic..GIF89a.............,...........D..;..
GET /?provider=captify&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: x.skimresources.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Content-Type: text/html; charset=UTF-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Location: hXXp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Server: TornadoServer/2.4.1
Set-Cookie: skimGUID=1d2182171d38f63bead29a52dfc1bed2; Domain=.skimresources.com; expires=Fri, 21 Aug 2015 09:51:18 GMT; Path=/
Content-Length: 0
Connection: keep-alive
HTTP/1.1 302 Found..Content-Type: text/html; charset=UTF-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Location: hXXp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805..P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"..Server: TornadoServer/2.4.1..Set-Cookie: skimGUID=1d2182171d38f63bead29a52dfc1bed2; Domain=.skimresources.com; expires=Fri, 21 Aug 2015 09:51:18 GMT; Path=/..Content-Length: 0..Connection: keep-alive..
GET /dpixel?source=appnexus&eid=5&id=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cms.quantserve.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Connection: close
Content-Type: image/gif
Set-Cookie: mc=53f5c111-6e765-7acdf-772b7; expires=Sat, 20-Feb-2016 09:51:13 GMT; path=/; domain=.quantserve.com
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
Cache-Control: private, no-cache, no-store, proxy-revalidate
Pragma: no-cache
Expires: Fri, 04 Aug 1978 12:00:00 GMT
Content-Length: 35
Date: Thu, 21 Aug 2014 09:51:13 GMT
Server: QS
GIF89a.......,.................D..;..
GET /CA_Servlet/trackingServlet?getGAparams=1 HTTP/1.1
Host: VVV.freecoins.co
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=UTF-8
Content-Length: 127
Vary: Accept-Encoding
Date: Thu, 21 Aug 2014 09:50:56 GMT
Connection: close
{"cm":"(organic)","cn":"(undefined)","ci":"0","cid":"6d7f6e0c-b90b-4b58-b851-2e2d1d13a422","cc":"(unknown ad)","cs":"(direct)"}..
GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3
HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
Date: Thu, 21 Aug 2014 09:51:17 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 317
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1..Date: Thu, 21 Aug 2014 09:51:17 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 317..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>....
<<< skipped >>>
GET /tt?id=3092585 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 0
....
GET /bounce?/tt?id=3092585 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=2303909238682748008; sess=1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 1027
<script>!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.' c '&id=3092585"></scr' 'ipt>')}();</script>....
<<< skipped >>>
GET /bounce?/tt?id=3092599 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=2303909238682748008; sess=1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 1027
<script>!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.' c '&id=3092599"></scr' 'ipt>')}();</script>....
<<< skipped >>>
GET /ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 634
document.write('<a href="hXXp://nym1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAANv5fmq8dKM_AAAAAAAAAAAAAAAAAAAAAAqC-xhAJjkFTcUWCLuo-i4IwfVTAAAAAGkwLwAQCgAA_AkAAAIAAAASsBsBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAbbYAAgUAAQIAAJAAKRa4zwAAAAA./cnd=!owaGPQiV8KsCEJLg7ggY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3092585/clickenc=http://VVV.gamesgirl.net/" target="_blank"><img width="160" height="600" style="border-style: none" src="hXXp://cdn.adnxs.com/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg"/></a>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....
<<< skipped >>>
GET /a_usersync?cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 124
ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=3385203591170409805", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 124..ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=3385203591170409805", "c":9, "tagtype":"img"});....
<<< skipped >>>
GET /ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j
Connection: Keep
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 1441
!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="http://ib.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.' c '&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc="></scr' 'ipt>')}();....
<<< skipped >>>
GET /seg?t=2&add=1418586 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz0<OctCÃ^mhpB=L_>W9]mU [J)*c!_(i.)MAEX/<FexB#Isr.-O.Z8q!85^_5znu^; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 0
....
GET /px?t=2&id=157720&other=aXlHoNTekoQSgLGK HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3uz016QPn=Mde3%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*iA5wf; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:06 GMT
GIF89a.............!.......,........@..L..;....
GET /ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Al
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3uz016QPn=Mde3%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*iA5wf; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:06 GMT
Content-Length: 1257
document.write('<iframe frameborder="0" width="160" height="600" marginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd%3D%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1"></iframe>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....
<<< skipped >>>
GET /ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s
Connection: Keep-Alive
Host: ib.adnxs.com
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 0..nt>....
GET /ttj?id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$h
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:07 GMT
Content-Length: 1075
!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="http://ib.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.' c '&id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266"></scr' 'ipt>')}();....
<<< skipped >>>
GET /ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:08 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:08 GMT..Content-Length: 0..nt>....
GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:08 GMT
Content-Length: 145
ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:08 GMT..Content-Length: 145..ANX_async_load({"url":"http://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]", "c":6, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});....
GET /a_usersync?cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:09 GMT
Content-Length: 182
ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:09 GMT..Content-Length: 182..ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylp<cH:Ti*W@)8Xu/^meB)H; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});....
GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AhK:95e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0.`WmNHTMM@!(*IBm$MIX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 141
ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":7, "tagtype":"img"});....
GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:10 GMT
Content-Length: 142
ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":7, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 142..ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":7, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`Nbn
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":6, "tagtype":"img"});....
GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 177
ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 177..ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805", "c":6, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":5, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 128
ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=3385203591170409805", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 128..ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=3385203591170409805", "c":5, "tagtype":"img"});....
<<< skipped >>>
GET /seg?add=1392486&t=2 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:13 GMT
Content-Length: 0
....
GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3m
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz016QQy(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:/!*yXt!'0/Vw>L qib%9]C[bf*G1OZfO@W/.Fsu90[UA)iD`18sX#ENkQ9Lm0eZfVcQh)/HzKS-*yXvYFlq$69q>U; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:13 GMT
Content-Length: 123
ANX_async_load({"url":"hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805", "c":4, "tagtype":"img"});....
GET /pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI') HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,........@..L..;....
GET /mapuid?member=1471&user=2040815613008858 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:14 GMT
GIF89a.............!.......,........@..L..;....
GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=^<5.XQOF
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 117
ANX_async_load({"url":"hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805", "c":2, "tagtype":"img"});....
GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 123
ANX_async_load({"url":"hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 123..ANX_async_load({"url":"http://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805", "c":4, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 113
ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 113..ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":2, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 149
ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":0, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":0, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 0
....
GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:16 GMT
Content-Length: 148
ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":"img"});....
GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:16 GMT
GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:16 GMT..GIF89a.............!.......,........@..L..;nt>....
<<< skipped >>>
GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Length: 43
Content-Type: image/gif
Date: Thu, 21 Aug 2014 09:51:17 GMT
GIF89a.............!.......,........@..L..;....
GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:17 GMT
Content-Length: 122
ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:17 GMT..Content-Length: 122..ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});>....
<<< skipped >>>
GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3m
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:17 GMT
Content-Length: 122
ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:17 GMT..Content-Length: 122..ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});>....
<<< skipped >>>
GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Content-Length: 119
ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=captify&uid=3385203591170409805", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length: 119..ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=captify&uid=3385203591170409805", "c":1, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:18 GMT
Content-Length: 195
ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE]", "c":0, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length: 195..ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE]", "c":0, "tagtype":"img"});....
<<< skipped >>>
GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.weqTx5e6AqeU#-2*b Bp<=3k?p6^<>.XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@YN:RVC:)6tq=yF$=1!4h>fP*0yGCGp`b$AE]^e)W:?L*D8Ozi6hvWG]R^b4kcqNmIp?SYzx^Mi*)xp96*k6^`'82; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:19 GMT
Content-Length: 135
ANX_async_load({"url":"hXXp://rt.legolas-media.com/lgapnx?ci=12&ti=44011&pbi=10817&apid=3385203591170409805", "c":0, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.weqTx5e6AqeU#-2*b Bp<=3k?p6^<>.XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@YN:RVC:)6tq=yF$=1!4h>fP*0yGCGp`b$AE]^e)W:?L*D8Ozi6hvWG]R^b4kcqNmIp?SYzx^Mi*)xp96*k6^`'82; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Content-..
<<< skipped >>>
GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: image2.pubmatic.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:12 GMT
Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6
Set-Cookie: KRTBCOOKIE_57=476-uid:3385203591170409805; domain=pubmatic.com; expires=Sun, 20-Aug-2017 09:51:12 GMT; path=/
Set-Cookie: PUBRETARGET=78_1503222672; domain=pubmatic.com; expires=Sun, 20-Aug-2017 09:51:12 GMT; path=/
Content-Length: 42
P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Connection: close
Content-Type: image/gif; charset=utf-8
GIF89a.............!.......,...........D.;..
GET /offers/images/Theme8/topComp.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/bodyImg.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:58 GMT
Content-Type: image/png
Content-Length: 1914
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT
ETag: "36dd864c691ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:58 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...0PLTE................................................{.......IDATx......:..`..p..J.4.ty.:......)v..\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..]..8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._..d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..>).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8........KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y..)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y...... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S.....W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>.@.Bi....HS)eM.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J...,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*
<<< skipped >>>
GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/button_over.png HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:59 GMT
Content-Type: image/png
Content-Length: 921
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT
ETag: "f072da2a092ce1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:59 GMT
X-Cache: HIT
Accept-Ranges: bytes
.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[........sL..?@.o....y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K........YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N........*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..tsvP!.U0.q.......9z.e ..0.ALt..@l..2iR.2............. .>=...{WVim....f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o6......@..........n.^......IEND.B`.HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:50:59 GMT..Content-Type: image/png..Content-Length: 921..Connection: keep-alive..Cache-Control: max-age=604800..Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT..ETag: "f072da2a092ce1:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..Expires: Thu, 28 Aug 2014 09:50:59 GMT..X-Cache: HIT..Accept-Ranges: bytes...PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8
<<< skipped >>>
GET /mookie/map?anuid=3385203591170409805&mookieid=2040815613008858 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: mookie.bncnt.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-type: text/plain
Connection: close
Content-Length: 0
Date: Thu, 21 Aug 2014 09:50:59 GMT
GET /oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tap.rubiconproject.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Date: Thu, 21 Aug 2014 09:51:10 GMT
Server: TRP Apache-Coyote/1.1
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||
Content-Length: 0
Cache-control: private
Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: au=HZ3WT02I-CD7Q-10.208.162.44; Domain=.rubiconproject.com; Expires=Fri, 19-Aug-2022 09:51:10 GMT; Path=/
Set-Cookie: dq=1|1|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Keep-Alive: timeout=5, max=19
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8
HTTP/1.1 302 Moved Temporarily..Date: Thu, 21 Aug 2014 09:51:10 GMT..Server: TRP Apache-Coyote/1.1..p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||..Content-Length: 0..Cache-control: private..Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: au=HZ3WT02I-CD7Q-10.208.162.44; Domain=.rubiconproject.com; Expires=Fri, 19-Aug-2022 09:51:10 GMT; Path=/..Set-Cookie: dq=1|1|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..Keep-Alive: timeout=5, max=19..Connection: Keep-Alive..Content-Type: text/plain; charset=UTF-8......
<<< skipped >>>
GET /oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tap.rubiconproject.com
Connection: Keep-Alive
Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805; dq=1|1|0|0
HTTP/1.1 302 Moved Temporarily
Date: Thu, 21 Aug 2014 09:51:10 GMT
Server: TRP Apache-Coyote/1.1
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||
Content-Length: 0
Cache-control: private
Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: dq=2|2|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/
Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/
Keep-Alive: timeout=5, max=122
Connection: Keep-Alive
Content-Type: text/plain; charset=UTF-8
HTTP/1.1 302 Moved Temporarily..Date: Thu, 21 Aug 2014 09:51:10 GMT..Server: TRP Apache-Coyote/1.1..p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||..Content-Length: 0..Cache-control: private..Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: dq=2|2|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..Keep-Alive: timeout=5, max=122..Connection: Keep-Alive..Content-Type: text/plain; charset=UTF-8..
GET /tt?id=3092599 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=2473127181019865522; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 0
....
GET /tt?id=3095266 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly
Location: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly..Location: hXXp://ib.adnxs.com/bounce?/tt?id=3095266..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:03 GMT..Content-Length: 0......
GET /bounce?/tt?id=3095266 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 1027
<script>!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.' c '&id=3095266"></scr' 'ipt>')}();</script>....
<<< skipped >>>
GET /ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 633
document.write('<a href="hXXp://nym1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAACuHFtnO96M_AAAAAAAAAAAAAAAAAAAAAPXvdpDQx4slTcUWCLuo-i4IwfVTAAAAAHcwLwAQCgAA_AkAAAIAAACpshsBVuMGAAAAAQBVU0QAVVNEANgCWgCdGAAAl7MAAgUAAQIAAJAAmRmutAAAAAA./cnd=!vwaZPgiV8KsCEKnl7ggY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3092599/clickenc=http://VVV.gamesgirl.net/" target="_blank"><img width="728" height="90" style="border-style: none" src="hXXp://cdn.adnxs.com/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg"/></a>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....
<<< skipped >>>
GET /ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:04 GMT
Content-Length: 909
document.write('<iframe frameborder="0" width="160" height="600" marginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a'%2C 353928, 1408614664);uf('c', 4665015, 1408614664)%3Buf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1"></iframe>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....
<<< skipped >>>
GET /a_usersync?cbfn=ANX_async_load HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ib.adnxs.com
Connection: Keep-Alive
Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly
Content-Type: application/javascript; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 118
ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd", "c":9, "tagtype":"iframe"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 118..ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd", "c":9, "tagtype":"iframe"});....
<<< skipped >>>
GET /seg/?add=1418586,1459541 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.prfct.co
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Cache-control: no-cache="set-cookie"
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: hXXps://pixel.prfct.co/seg/?check_cookie=1&add=1418586,1459541
P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Server: Jetty(9.0.5.v20130815)
Set-Cookie: pa_uid=pa_trixrKxFXQKpexCzd;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT
Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC189DEFF632539AF65322743D460B9CC168CCFFDB1AAE0D5AA3403F0C049FBEDD;PATH=/
Content-Length: 0
Connection: keep-alive
GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Set-Cookie: i=7b5065f4-a2df-4edf-16a9-17679ca07782|1408614671; Version=1; Expires=Fri, 21-Aug-2015 09:51:11 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
P3P: CP="CUR ADM OUR NOR STA NID"
Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 0
Connection: close
GET /?type=1&domainId=2745850&dedup=1&actionid=207232 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 2745850.r.msn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Microsoft-IIS/8.0
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
Date: Thu, 21 Aug 2014 09:51:05 GMT
Connection: close
GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ads.yahoo.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:07 GMT
P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Set-Cookie: B=aud5rvp9vbg8b&b=3&s=os; expires=Sun, 21-Aug-2016 09:51:07 GMT; path=/; domain=.yahoo.com
Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:07 GMT
Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
Cache-Control: private
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Age: 0
Connection: keep-alive
Server: ATS
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:07 GMT..P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: B=aud5rvp9vbg8b&b=3&s=os; expires=Sun, 21-Aug-2016 09:51:07 GMT; path=/; domain=.yahoo.com..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:07 GMT..Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP..Cache-Control: private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Connection: keep-alive..Server: ATS..
GET /e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: e.nexac.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-type: image/gif
Date: Thu, 21 Aug 2014 09:51:17 GMT
Expires: Wed Sep 15 09:14:42 MDT 2010
P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"
Pragma: no-cache
Server: lighttpd/1.4.28
Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/
Set-Cookie: na_an=1408614677; expires=Sat, 20-Sep-2014 09:51:17 GMT; path=/; domain=.nexac.com
X-Powered-By: Jigawatts
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-type: image/gif..Date: Thu, 21 Aug 2014 09:51:17 GMT..Expires: Wed Sep 15 09:14:42 MDT 2010..P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"..Pragma: no-cache..Server: lighttpd/1.4.28..Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/..Set-Cookie: na_an=1408614677; expires=Sat, 20-Sep-2014 09:51:17 GMT; path=/; domain=.nexac.com..X-Powered-By: Jigawatts..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..
GET /377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: idsync.rlcdn.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store
Date: Thu, 21 Aug 2014 09:51:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1
P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
Set-Cookie: ck1=ck1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:14 GMT
Content-Length: 0
Connection: keep-alive
....
GET /377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: idsync.rlcdn.com
Connection: Keep-Alive
Cookie: ck1=ck1
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store
Content-Type: image/gif; charset=ISO-8859-1
Date: Thu, 21 Aug 2014 09:51:14 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
Set-Cookie: rlas3="TA03JilRL6ZfZHiTJV4DPXmXZtGqnF1a473g/aAAnwY=";Version=1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT;Max-Age=15551997
Set-Cookie: rtn1=cb8adb15e36b089ef86b12932f97ce18;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT
Set-Cookie: dids604882570=50313e24fe8f030a80f7a1716f6f091ce6f8375504619c4571885ea1fac72a5acb949ecef93fde87da2430bee7bf9c07;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:13 GMT
Content-Length: 43
Connection: keep-alive
GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Content-Type: image/gif; charset=ISO-8859-1..Date: Thu, 21 Aug 2014 09:51:14 GMT..Expires: Thu, 01 Jan 1970 00:00:00 GMT..P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"..Set-Cookie: rlas3="TA03JilRL6ZfZHiTJV4DPXmXZtGqnF1a473g/aAAnwY=";Version=1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT;Max-Age=15551997..Set-Cookie: rtn1=cb8adb15e36b089ef86b12932f97ce18;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT..Set-Cookie: dids604882570=50313e24fe8f030a80f7a1716f6f091ce6f8375504619c4571885ea1fac72a5acb949ecef93fde87da2430bee7bf9c07;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:13 GMT..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........L..;..
GET /mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flex.msn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: public
Content-Type: application/javascript; charset=utf-8
Content-Encoding: gzip
Expires: Fri, 22 Aug 2014 09:51:04 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
Date: Thu, 21 Aug 2014 09:51:04 GMT
Connection: close
Content-Length: 366
.............`.I.%&/m.{.J.J..t...`.$..@.........iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....Z.u{.:o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>.{w......;.z.h..i...{......_8..Y.<.}.M>:...S..[....C.>!X........T..^...so..e...o..@(..t..~....>.>."....l.....@i....((..{_.............y...I.M...w._rg..aB0...~...y.....
GET /ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: an.z5x.net
Connection: Keep-Alive
HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, private
Pragma: no-cache
Expires: Sat, 15 Nov 2008 16:00:00 GMT
P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
X-XSS-Protection: 0
Location: hXXp://ib.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:05 GMT
Content-Length: 0
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Location: hXXp://ib.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 0..
<<< skipped >>>
GET /installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2 HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: data.getserverinfo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 1527
Connection: keep-alive
..<html>.. <head>.. <title>Thank you for installing Free Coins</title>.. <script type="text/javascript"> </script>.. <script type='text/javascript'>.. var googletag = googletag || {};.. googletag.cmd = googletag.cmd || [];.. (function () {.. var gads = document.createElement('script');.. gads.async = true;.. gads.type = 'text/javascript';.. var useSSL = 'https:' == document.location.protocol;.. gads.src = (useSSL ? 'https:' : 'http:') .. '//VVV.googletagservices.com/tag/js/gpt.js';.. var node = document.getElementsByTagName('script')[0];.. node.parentNode.insertBefore(gads, node);.. })();.. </script>.. <script type='text/javascript'>.. googletag.cmd.push(function () {.. googletag.defineSlot('/5612216/TYP', [1200, 1400], 'div-gpt-ad-1367936933671-0').addService(googletag.pubads());.. googletag.pubads().enableSingleRequest();.. googletag.enableServices();.. });.. </script>.. </head>.. <body>.. <div style="position:relative;left:0px;top:0px;color:white; height: 1px; visibility: hidden;"></div>.. <iframe src="hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins" width=100% height=100% frameborder=0 scrolling=no margin
<<< skipped >>>
GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Set-Cookie: i=6333127b-59e4-4c75-9681-e9f9bbb7943b|1408614672; Version=1; Expires=Fri, 21-Aug-2015 09:51:12 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
P3P: CP="CUR ADM OUR NOR STA NID"
Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Length: 0
Connection: close
GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Set-Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671; Version=1; Expires=Fri, 21-Aug-2015 09:51:11 GMT; Max-Age=31536000; Domain=.openx.net; Path=/
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
P3P: CP="CUR ADM OUR NOR STA NID"
Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
Date: Thu, 21 Aug 2014 09:51:11 GMT
Content-Length: 0
Connection: close
GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9591
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9591..Connection: Keep-Alive..GIF89a.............!.......,...........D..;....
GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:10 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9705
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9705..Connection: Keep-Alive..GIF89a.............!.......,...........D..;....
GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9326
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9326..Connection: Keep-Alive..GIF89a.............!.......,...........D..;..
GET /css/index.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:00 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:41 GMT
ETag: "406bb-42fa-4fc68d5de596e"
Accept-Ranges: bytes
Content-Length: 17146
Connection: close
Content-Type: text/css
body, table, td, tr, div, p, h1, h2, h3, h4, h5, h6, form, fieldset, legend, input, textarea, select, th, tbody { margin: 0; padding: 0; }..img { border: none; }..sup { vertical-align: text-top; }..sub { vertical-align: text-bottom; }..input, textarea, select { font-size: inherit; font-weight: inherit; font-family: inherit; }..body, table, td, tr, div, h1, h2, h3, h4, h5, h6, form, input, textarea, select, th, tbody { font-family: arial; font-size: 12px; }..*,*:before,*:after { -webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box; }../* Start Land CSS */...clear{ clear: both; }..body{ direction: ltr; margin: auto; background: rgb(3,167,235); border-bottom: 1px solid #000; background: url(data:image/svg xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/Pgo8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEgMSIgcHJlc2VydmVBc3BlY3RSYXRpbz0ibm9uZSI CiAgPGxpbmVhckdyYWRpZW50IGlkPSJncmFkLXVjZ2ctZ2VuZXJhdGVkIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSIgeDE9IjAlIiB5MT0iMCUiIHgyPSIwJSIgeTI9IjEwMCUiPgogICAgPHN0b3Agb2Zmc2V0PSIwJSIgc3RvcC1jb2xvcj0iIzAzYTdlYiIgc3RvcC1vcGFjaXR5PSIxIi8 CiAgICA8c3RvcCBvZmZzZXQ9IjEwMCUiIHN0b3AtY29sb3I9IiMwZDQyYTQiIHN0b3Atb3BhY2l0eT0iMSIvPgogIDwvbGluZWFyR3JhZGllbnQ CiAgPHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9IjEiIGhlaWdodD0iMSIgZmlsbD0idXJsKCNncmFkLXVjZ2ctZ2VuZXJhdGVkKSIgLz4KPC9zdmc );....background: -moz-linear-gradient(top, rgba(3,167,235,1) 0%, rgba(13,66,164,1) 100%); ....background: -webkit-gradient(linear, left top, left bot
<<< skipped >>>
GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dis.criteo.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Location: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614
Server: Microsoft-IIS/7.5
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Length: 254
<html><head><title>Object moved</title></head><body>..<h2>Object moved to <a href="hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614">here</a>.</h2>..</body></html>..HTTP/1.1 302 Found..Location: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614..Server: Microsoft-IIS/7.5..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 254..<html><head><title>Object moved</title></head><body>..<h2>Object moved to <a href="hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614">here</a>.</h2>..</body></html>....
GET /j/roundtrip.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: a.adroll.com
Connection: Keep-Alive
HTTP/1.1 200 OK
x-amz-id-2: LE2eIYesxo5swo4NMC7tAainUT30r5JogXU/RXKTrtijeh7 q5UGyMLm4MgpUWWd
x-amz-request-id: 71820825864519DA
Last-Modified: Fri, 15 Aug 2014 17:15:55 GMT
ETag: "d9890eadfd6a83b5319937ea62acdcaf"
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 4679
Cache-Control: must-revalidate, max-age=75
Date: Thu, 21 Aug 2014 09:51:12 GMT
Connection: keep-alive
...........;k..6... (z"...G..W.i.77.q%vv.I]mid..B.G.R!.y.H.}.. ....]..\#..4...&2.'.....7..[.).L'.H.gI.?.i.=L.........W.;...............Rn'9..w..1P...<...0.$rgN.P...$q.0.v,u.s..H.".x....... w.ON.{H..pY.).....F.9s....q.Z.s..C..........6.&.>...f.e/.3.....H.,.....XZN6..J.>...tM6....L\e.....^....x...0...k....y./M.;.......... ]...e.Q....|B~..}.Qe..3.X5h.jR$1e.....6w... .[..=a.p..}..`./..,[...Q.....O.W.!..i(A..i...4..........N..Oc7.v..5...h.u9..I{;...n.!..d.(..''..........Y...y......[x..4.v1.JI...."^[...=.A...,...r,....<....\l)...k.}. .F..nRD....VZfP..t..i{...se .j.....X.F...j..hX-..h........^f...&..]....%...k.Z......j....t..G.......d5.] n.o7Sx......v...^.h/..x.Y.u.!..,.f.../..{-^.&7...[ ......_...K............k..O'..Q8...r..i......{..j..r..eb.9..,..'.P..}.....'E....mV..>.K#g.7...[#.sF.,.2.q......IJ..9).I.B4@...k......V>....iz../..=..........$g....#k..G....G...#x.n.ZX.u"...FV..v.#.d ..O..G.cOx.....A..<W..,.Y.....*-.W.K.AJq....z>...2k.!.=....M.m..-.^..N~....(.8..k.*.....$.....y..74T.R.,...E...a......;......mX.I......w-..Ac2IX.)..9.Q.5=.!..z..(...y...s}H....`....rHYA..Y.]y..U.8...B~...R.Iz..Yn......X] .S.`..)......!.E....=../W?.."..M..o..?..p.....@....S..p.....0 3.*...S..^.WG.Z..9.........?5....G.u....c......_f6.;e9.%H.t..Z.B.CR0..4..D.s.....)R.....@.T.@g1.....D.|.........K....m....l.!c.\.........H....Fsx...c.?............Z. x...H$...Pc8...F....s_'.E.i/.. 2Z.oyb<..(.....c.[P..h..C....x\.c..=...&E..(.."x...)..Hh...R.. ...in..%.i.-J.......P*....x^.7t.*f../.....Q..h..r..y..6..so.....m ..,m..g...
<<< skipped >>>
GET /pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: a.adroll.com
HTTP/1.1 200 OK
x-amz-id-2: MLC7mfQun88l9jNDL5MfqEb5Nsj0EkrQ91NOKYy0QHi7HHtKVAdEIqu6RZL8jH2P
x-amz-request-id: F19D990794E64995
Last-Modified: Wed, 13 Aug 2014 22:36:29 GMT
ETag: "80fa4efff8cbff1a1fac780705fbfe52"
Accept-Ranges: bytes
Content-Type: text/javascript
Server: AmazonS3
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 931
Cache-Control: must-revalidate, max-age=300
Date: Thu, 21 Aug 2014 09:51:13 GMT
Connection: keep-alive
...........V.n.8.}.Wp.....d[.[.0...m.I.E...4.hr,..I..|A.....oI....&..qx...pHN4...B ....#B.....`.dD.(.Y[.O.2...Y5.ec..u..0.j.e..Ajd@.._A.Y..r.*3..T(..*.U.bo.....@-o.$P>.....0V.B..,SI'.".....*3;..*[.* h..1..-..x.@~...c78.......x"../e.\nV`Z...K..d..FK..`..L.......1...#.*)......[<..yv............`.....=......:n...>.?.{B....$8.>:...1...F..nn.........{K....${...P./$.Q.p....d\....`)....H...*8....g..Y..B.u=-........$.T.JF..Za..<.{..m.......M^.../R[&.p0.7.......Fe..a..........YI....0a..'.DW..I.B...M..a.[=ly.W..\w......CY...j..I.L........@...>...i:...i...{..1..rwH3@.....|...?....^?......_..>!..8.V.3#.[K.Q..;.b.....U.Y....K.KBy..<.a.b.....L%..t.......7.?O........0X:/PL^...{...u.).lM......}.pk3...N.le..VCN...G......9.BB....6..<.`....]!..K......M............Q..>{.............Q......2..11.{..X.F.t.O..GC.7.......o.7....ag..`.E8.4j...W(........nf.$..1..1-.P|<..G =...v]....%vQ.X..T.....6...0......Nh.4*.Ed..o....a....[...........uy....HTTP/1.1 200 OK..x-amz-id-2: MLC7mfQun88l9jNDL5MfqEb5Nsj0EkrQ91NOKYy0QHi7HHtKVAdEIqu6RZL8jH2P..x-amz-request-id: F19D990794E64995..Last-Modified: Wed, 13 Aug 2014 22:36:29 GMT..ETag: "80fa4efff8cbff1a1fac780705fbfe52"..Accept-Ranges: bytes..Content-Type: text/javascript..Server: AmazonS3..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 931..Cache-Control: must-revalidate, max-age=300..Date: Thu, 21 Aug 2014 09:51:13 GMT..Connection: keep-alive.............V.n.8.}.Wp.....d[.[.0...m.I.E...4.hr,..I..|A.....oI....&..qx...pHN4...B ....#B.....`.dD.(.Y[.O.2.
<<< skipped >>>
GET /updates/a/desktopapp.wys HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)
Host: cdn.freecoins.co
Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Age: 109207
Date: Thu, 21 Aug 2014 09:51:06 GMT
Last-Modified: Tue, 12 Aug 2014 10:43:54 GMT
Content-Length: 723
Connection: keep-alive
PK...........E98..'...P.....$.0.. ........... .f...D...e...D...e......vq.3b.````.bC=#3v. .$`.g.gh.g........(..Vb.l....8....J_?9%O/.(559?3.X/9_.. %.$.X?Q?-9..@..G.$_.d.^ye)..*...YSw]....q$.:h.8\ %..(...a.!n{].!....)..^D...2.....Y.....H6.4....f#rl6B.Y..Y...J.RrR...r*.t.....3...S...:...E.9.Tp.............z.......Mp..?A.a....8.6..c.)n...m.. ..j3..`...L.v@...v.I}...l............n..6 ..8...N...........lVW.S..f.rl..m...$...........-q.<y........q.ld@..FxJt..H6.y..5N..)Y..../3..6..Wh.......YFxk..IH.........)...p.........-8.mD.....{o?........orj.#<..^.3....;....1y.6...%.H..:.-.....]Fx..H..j..,..8m6#.......b......q.3P,...PK..-..........E98..'...P.....$....... ......0.. ........... .f...D...e...D...e...PK..........S...j.....HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..Accept-Ranges: bytes..Age: 109207..Date: Thu, 21 Aug 2014 09:51:06 GMT..Last-Modified: Tue, 12 Aug 2014 10:43:54 GMT..Content-Length: 723..Connection: keep-alive..PK...........E98..'...P.....$.0.. ........... .f...D...e...D...e......vq.3b.````.bC=#3v. .$`.g.gh.g........(..Vb.l....8....J_?9%O/.(559?3.X/9_.. %.$.X?Q?-9..@..G.$_.d.^ye)..*...YSw]....q$.:h.8\ %..(...a.!n{].!....)..^D...2.....Y.....H6.4....f#rl6B.Y..Y...J.RrR...r*.t.....3...S...:...E.9.Tp.............z.......Mp..?A.a....8.6..c.)n...m.. ..j3..`...L.v@...v.I}...l............n..6 ..8...N...........lVW.S..f.rl..m...$...........-q.<y........q.ld@..FxJt..H6.y..5N..)Y..../3..6..Wh.......YFxk..IH.........)...p.........-8.mD.....{o?........orj.#<..^.3....;....1y.6...%.H..:.-.....]Fx..H..j..,..8m
<<< skipped >>>
GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dps.bing.com
Connection: Keep-Alive
Cookie: MUID=2F6B223C4C616DD806C724A148616EB1
HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 42
Content-Type: image/gif
Expires: 2:51:04 AM
Server: Microsoft-IIS/8.5
TrackingId: efa22998-1ff1-4065-8c49-c55ba1a96922
X-Powered-By: ASP.NET
X-MSEdge-Ref: Ref A: 90AD790EE4E44F15A43A7507ED7480F4 Ref B: 898EFCFC7D9FFA32F0BE9D52BED1B55C Ref C: Thu Aug 21 02:51:09 2014 PST
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,...........L.;....
GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: dps.bing.com
Connection: Keep-Alive
Cookie: MUID=2F6B223C4C616DD806C724A148616EB1
HTTP/1.1 200 OK
Cache-Control: no-cache
Content-Length: 42
Content-Type: image/gif
Expires: 2:51:05 AM
Server: Microsoft-IIS/8.5
TrackingId: cebbe73e-cfd0-43c2-b2bc-9ba5dbcddac3
X-Powered-By: ASP.NET
X-MSEdge-Ref: Ref A: EC694F809EF44FE884B64B93555A741A Ref B: EEEFAC4E2D0E8E5851CC732C27CC94EC Ref C: Thu Aug 21 02:51:10 2014 PST
Date: Thu, 21 Aug 2014 09:51:09 GMT
GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 2:51:05 AM..Server: Microsoft-IIS/8.5..TrackingId: cebbe73e-cfd0-43c2-b2bc-9ba5dbcddac3..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: EC694F809EF44FE884B64B93555A741A Ref B: EEEFAC4E2D0E8E5851CC732C27CC94EC Ref C: Thu Aug 21 02:51:10 2014 PST..Date: Thu, 21 Aug 2014 09:51:09 GMT..GIF89a.............!.......,...........L.;..
GET /mstag/mstag.1003102000.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: flex.msn.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: max-age=86400
Content-Type: application/javascript
Content-Encoding: gzip
Last-Modified: Thu, 14 Aug 2014 21:12:05 GMT
Accept-Ranges: bytes
ETag: "804023664b8cf1:0"
Vary: Accept-Encoding
Server: Microsoft-IIS/8.0
Date: Thu, 21 Aug 2014 09:51:03 GMT
Connection: close
Content-Length: 1956
...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...Rc........A..A.Q/>M....ee..............Z^. ..|.!....5d@...n,..2..%.c........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W..V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G.....N.i.n<b....d.X.@..SQpHM.8E...8..!.(..F...L..J.......3..x.....U.w>.S..`..4.4}S.h.....1._.k[.K..pu@.....K.>.e.eKa...Q..m.....\6.~..(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;=.@.uaT ..6...`.....m.....H=U..P.....H_ O[..H..@..C/.Q........p.C..GG..>..>..Q;3\.7....yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u...........JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`
<<< skipped >>>
GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ads.yahoo.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:06 GMT
P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Set-Cookie: B=34pghj19vbg8a&b=3&s=6r; expires=Sun, 21-Aug-2016 09:51:06 GMT; path=/; domain=.yahoo.com
Set-Cookie: RMBX=34pghj19vbg8a&b=3&s=6r&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:06 GMT
Location: hXXp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy
Cache-Control: private
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Age: 0
Connection: keep-alive
Server: ATS
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:06 GMT..P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: B=34pghj19vbg8a&b=3&s=6r; expires=Sun, 21-Aug-2016 09:51:06 GMT; path=/; domain=.yahoo.com..Set-Cookie: RMBX=34pghj19vbg8a&b=3&s=6r&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:06 GMT..Location: hXXp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy..Cache-Control: private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Connection: keep-alive..Server: ATS......
GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: ads.yahoo.com
Connection: Keep-Alive
Cookie: B=aud5rvp9vbg8b&b=3&s=os; RMBX=aud5rvp9vbg8b&b=3&s=os&t=232
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:08 GMT
P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"
Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:08 GMT
Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com
Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
Cache-Control: private
Content-Length: 0
Content-Type: text/plain; charset=utf-8
Age: 0
Connection: keep-alive
Server: ATS
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:08 GMT..P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:08 GMT..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com..Location: http://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP..Cache-Control: private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Connection: keep-alive..Server: ATS..
GET /tap.php?v=4894|| HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.rubiconproject.com
Connection: Keep-Alive
Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com
Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com
Content-Length: 49
Keep-Alive: timeout=30, max=8880
Connection: Keep-Alive
Content-Type: image/gif
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..Server: Apache..X-Powered-By: PHP/5.3.3..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com..Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com..Content-Length: 49..Keep-Alive: timeout=30, max=8880..Connection: Keep-Alive..Content-Type: image/gif..GIF89a...................!.......,...........T..;..
GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:50:02 GMT
Content-Type: text/css
Content-Length: 20706
Connection: keep-alive
Cache-Control: max-age=604800
Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT
ETag: "ca38195cd123cd1:0"
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
Expires: Thu, 28 Aug 2014 09:50:02 GMT
X-Cache: HIT
Accept-Ranges: bytes
/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/UI/Theming/API. */../* Layout helpers.----------------------------------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-accessible { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helper-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.----------------------------------*/..ui-state-disabled { cursor: default !important; }.../* Icons.----------------------------------*/../* states and images */..ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }.../* Misc visuals.----------------------------------*/../* Overlays */..ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/
<<< skipped >>>
GET /offers/images/Theme8/topLine.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:03 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......
<<< skipped >>>
GET /offers/images/Theme8/bgImg.jpg HTTP/1.1
Accept: */*
Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: static.revenyou.com
Connection: Keep-Alive
HTTP/1.1 404 Not Found
Date: Thu, 21 Aug 2014 09:50:04 GMT
Content-Type: text/html
Content-Length: 1245
Connection: keep-alive
X-Powered-By: ASP.NET
Server: NetDNA-cache/2.2
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:04 GMT..Content-Type: text/html..Content-Length: 1245..Connection: keep-aliv
<<< skipped >>>
GET /serve/52dfe62b6897d9bfcf00011e.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tag.perfectaudience.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: max-age=1800
Content-Type: text/javascript
Status: 200 OK
X-Frame-Options: sameorigin
X-Xss-Protection: 1; mode=block
Content-Length: 4436
Accept-Ranges: bytes
Date: Thu, 21 Aug 2014 09:51:05 GMT
Via: 1.1 varnish
Age: 0
Connection: keep-alive
X-Served-By: cache-dfw1835-DFW
X-Cache: MISS
X-Cache-Hits: 0
X-Timer: S1408614665.946026802,VS0,VE48
Vary: Accept-Encoding
window._pa = window._pa || {};._pa.segments = [{"name":"All visitors","id":1418586,"regex":".*"},{"name":"Users that downloaded the app","id":1459541,"regex":"/FreeCoinsLandingPage/thankyou\\.jsp/?([?#].*)*$"}];._pa.conversions = [{"name":"Successful Installation","id":"157720","regex":"/FreeCoinsLandingPage/thankyou\\.jsp/?([?#].*)*$"},{"name":"Successful install","id":"169355","regex":"/installer/thankyou\\?/?([?#].*)*$"},{"name":"JCCasino Download","id":"180231","regex":"/software\\-download//?([?#].*)*$"},{"name":"Bingo Register","id":"180782","regex":"/registration\\.aspx/?([?#].*)*$"}];._pa.conversionEvents = [];._pa.segmentEvents = [];._pa.rtbId = '7094';._pa.siteId = '52dfe62b6897d9bfcf00011e';.!function(){function e(e,t,p){a(e,t,p),n(e,t)}function a(e,a,n){if(null==n||isNaN(n))var t=_pa.pixelHost "seg?t=2&add=" e;else var t=_pa.pixelHost "seg?t=2&add=" e ":" n;_pa.createImageTag("segments",e,t,a)}function n(e,a){var n=_pa.paRtbHost "seg/?add=" e;_pa.productId&&(n =":" encodeURIComponent(_pa.productId)),r?_pa.createImageTag("paRtbSegments",e,n,a):i.push({id:e,name:a})}function t(){if(r=!0,0!==i.length){for(var e=[],a=[],n=0;n<i.length;n ){var t=i[n],p=t.id,o=t.name;_pa.productId&&(p =":" encodeURIComponent(_pa.productId)),e.push(p),a.push(o)}var p=e.join(","),o=a.join(","),d=_pa.paRtbHost "seg/?add=" p;_pa.createImageTag("paRtbSegments",p,d,o)}}function p(e,a,n,t){n=n||_pa.orderId,t=t||_pa.revenue;var p="";n&&""!==n&&(n=n.toString().replace(/@.*/,"@"),p ="&order_id=" encodeURIComponent(n)),t&&""!==t
<<< skipped >>>
GET /rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE] HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: t.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:19 GMT
Server: Apache/2.2.3 (Red Hat)
Location: hXXp://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=2040815613008858
Connection: close
Content-Type: text/plain; charset=UTF-8
GET /event/img?mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: pixel.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=
HTTP/1.1 302 Moved Temporarily
Server: AkamaiGHost
Content-Length: 0
Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc
Expires: Thu, 21 Aug 2014 09:51:15 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:15 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
HTTP/1.1 302 Moved Temporarily..Server: AkamaiGHost..Content-Length: 0..Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"......
GET /event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=; HRL8=CT-1
Connection: Keep-Alive
Host: pixel.mathtag.com
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x20 pid 0x7f47 32583
Expires: Thu, 21 Aug 2014 09:51:16 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 21 Aug 2014 09:51:16 GMT
Connection: keep-alive
Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT
P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Type: image/gif..Content-Length: 43..Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x20 pid 0x7f47 32583..Expires: Thu, 21 Aug 2014 09:51:16 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:16 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com..Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"..GIF89a.............!.......,...........D..;..
GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: us-u.openx.net
Connection: Keep-Alive
Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671
HTTP/1.1 200 OK
Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)
Pragma: no-cache
P3P: CP="CUR ADM OUR NOR STA NID"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Date: Thu, 21 Aug 2014 09:51:12 GMT
Content-Type: image/gif
Content-Length: 43
Cache-Control: private, max-age=0, no-cache
Connection: close
GIF89a.............!.......,...........D..;..
GET /FreeCoinsLandingPage/themes/thankyou/css/index.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"1666-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
a..............200...TQo.0.~...pR_....$Y.[..i.....#..x162N........4............G..._.....?...k......*U...CR..A....?zP{PN..h.Z.6C.{. ].?g.6.x X.$.rY.pi........,....B. TD.\&...&.rY.... ^...*M.N@*......~d......^`......#...T...6.ez.. i.....k(..f..../J..........s)?...T;.%......L.}Gc<.5&2..H.w...t..r...Bq...c/..(..h....M..~.^....&...."....[n..mKS..[.|.."\n2,..L.....L`.....kA..-.).n...Z...YH...F.N.f...l.'H.-\.~.......x..z....>.sL.....B.D.,7...6..._..g...<.?.]..].@].............y......A.....(@.;-....W.`.8-\|......8..4L...5..1 ..%...&...8e..` ..^...M`..)ojA.}r..Be.....V..).xz.2........._o."..P-}Xhj"_..u.:.....q...W..4:..8<....}...VK.....i.'...>.dq...t..g.!.~.Z.}..U.`.v<......O......0..
GET /js/jquery.cookie.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:01 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT
ETag: "406ce-c17-4fc68d5e5db4d"
Accept-Ranges: bytes
Content-Length: 3095
Connection: close
Content-Type: text/javascript
/*!. * jQuery Cookie Plugin v1.4.0. * hXXps://github.com/carhartl/jquery-cookie. *. * Copyright 2013 Klaus Hartl. * Released under the MIT license. */.(function (factory) {..if (typeof define === 'function' && define.amd) {...// AMD. Register as anonymous module....define(['jquery'], factory);..} else {...// Browser globals....factory(jQuery);..}.}(function ($) {...var pluses = /\ /g;...function encode(s) {...return config.raw ? s : encodeURIComponent(s);..}...function decode(s) {...return config.raw ? s : decodeURIComponent(s);..}...function stringifyCookieValue(value) {...return encode(config.json ? JSON.stringify(value) : String(value));..}...function parseCookieValue(s) {...if (s.indexOf('"') === 0) {....// This is a quoted cookie as according to RFC2068, unescape.......s = s.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');...}....try {....// Replace server-side written pluses with spaces.....// If we can't decode the cookie, ignore it, it's unusable.....s = decodeURIComponent(s.replace(pluses, ' '));...} catch(e) {....return;...}....try {....// If we can't parse the cookie, ignore it, it's unusable.....return config.json ? JSON.parse(s) : s;...} catch(e) {}..}...function read(s, converter) {...var value = config.raw ? s : parseCookieValue(s);...return $.isFunction(converter) ? converter(value) : value;..}...var config = $.cookie = function (key, value, options) {....// Write...if (value !== undefined && !$.isFunction(value)) {....options = $.extend({}, config.defaults, options);.....if (typeof opt
<<< skipped >>>
GET /FreeCoinsLandingPage/themes/thankyou/images/bg_body.jpg HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"53305-1403623016000"
Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT
Content-Type: image/jpeg
Content-Length: 53305
Date: Thu, 21 Aug 2014 09:51:03 GMT
Connection: close
......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:12:30 18:50:38....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................d...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?.M...c.....xR..m<..J..(EH......... I..Ai.....i.....I....l04v...B.{%.....hE ....#.p;...`X;h|.....aA._".LJ..e..r...i......'..2..}D4..4..U5..).5..>.lc..2>$...,4.`@.g.....`Hj......~.B..î..?..,%.P.-.y.0.Mrw.........VCC@h. J....\?F~J..........~!...Ii........<4W.f.Gc.@.........@V5.ee.7..............s...$.......{.]..i..Y.X..:..Jh ..n%..CG....ELaW....i.......(.....=l......R..x...Z....P.".x(.......Z.=......0.4<...2.Kv..?w....i......5...X`.b.]e....-....Y.\....S!.of...B...v.rS.f..V....6.c.@.*.....k#S.CD..........5.....Gez.{..........!..Gb...4.. c..L..S$.E{t.....h.........#D....=....Dx..n..D}......]{...G.%..5.XC.......UV.7L.'.U.cN..{f........V.....j.EMce.K....L....S.V. X......@...u...
<<< skipped >>>
GET /s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Connection: Keep-Alive
Host: d2tjil5tz17cbz.cloudfront.net
HTTP/1.1 200 OK
Content-Type: image/gif
Content-Length: 43
Connection: keep-alive
Date: Thu, 21 Aug 2014 09:51:20 GMT
x-amz-meta-cb-modifiedtime: Tue, 08 May 2012 12:38:45 GMT
Last-Modified: Mon, 19 May 2014 15:26:46 GMT
ETag: "45cf913e5d9d3c9b2058033056d3dd23"
Accept-Ranges: bytes
Server: AmazonS3
X-Cache: Miss from cloudfront
Via: 1.1 c739a168fcf19d0acf0a618f6eb437d2.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zCVEUT1QNdT6fVUAD0zbTCj1BVADOEzWXOWxhaiviyigb7_TPllnhA==
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..Date: Thu, 21 Aug 2014 09:51:20 GMT..x-amz-meta-cb-modifiedtime: Tue, 08 May 2012 12:38:45 GMT..Last-Modified: Mon, 19 May 2014 15:26:46 GMT..ETag: "45cf913e5d9d3c9b2058033056d3dd23"..Accept-Ranges: bytes..Server: AmazonS3..X-Cache: Miss from cloudfront..Via: 1.1 c739a168fcf19d0acf0a618f6eb437d2.cloudfront.net (CloudFront)..X-Amz-Cf-Id: zCVEUT1QNdT6fVUAD0zbTCj1BVADOEzWXOWxhaiviyigb7_TPllnhA==..GIF89a.............!.......,...........D..;..
GET /fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI HTTP/1.1
Accept: */*
Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.facebook.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 02:51:14 PDT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Pragma: public
X-XSS-Protection: 0
Cache-Control: public, max-age=0
Expires: Thu, 21 Aug 2014 02:51:14 PDT
X-UA-Compatible: IE=edge,chrome=1
Content-Encoding: gzip
X-FB-Debug: /LOc 4/dXoyzwMthIKyvsprUDn5uwbU7Nit WyS6T/N3zP8D avDYdWKrSv 0IpwMh3i4wjllQhTobQncItvA==
Transfer-Encoding: chunked
Connection: keep-alive
2f............r.t..Ldd`dh`....,. Z.D.d...\...........a....v.h. .....0..HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 02:51:14 PDT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Pragma: public..X-XSS-Protection: 0..Cache-Control: public, max-age=0..Expires: Thu, 21 Aug 2014 02:51:14 PDT..X-UA-Compatible: IE=edge,chrome=1..Content-Encoding: gzip..X-FB-Debug: /LOc 4/dXoyzwMthIKyvsprUDn5uwbU7Nit WyS6T/N3zP8D avDYdWKrSv 0IpwMh3i4wjllQhTobQncItvA==..Transfer-Encoding: chunked..Connection: keep-alive..2f............r.t..Ldd`dh`....,. Z.D.d...\...........a....v.h. .....0..
GET /cm?in=1&pub=345&userid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: p.rfihub.com
Connection: Keep-Alive
Cookie: e=ai; rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA; hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==; eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=; euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=; ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA
HTTP/1.1 302 Found
Server: nginx/1.5.3
Date: Thu, 21 Aug 2014 09:51:15 GMT
Content-Length: 0
Connection: keep-alive
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8x8nBMt7V19DSND/YuDwSyHB2dguLTzPwcDWwBVqvNsiMAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNwXiWYwofEsAtukdrDQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT
Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com
Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com
Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=
HTTP/1.1 302 Found..Server: nginx/1.5.3..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 0..Connection: keep-alive..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Expires: Thu, 01 Jan 1970 00:00:00 GMT..Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8x8nBMt7V19DSND/YuDwSyHB2dguLTzPwcDWwBVqvNsiMAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNwXiWYwofEsAtukdrDQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com..Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com..Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=..
<<< skipped >>>
GET /safeframe/1-0-0/html/container.html HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: tpc.googlesyndication.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Type: text/html
Last-Modified: Tue, 14 Jan 2014 13:13:27 GMT
Date: Tue, 12 Aug 2014 18:51:55 GMT
Expires: Wed, 12 Aug 2015 18:51:55 GMT
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 1287
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=31536000
Age: 745146
Alternate-Protocol: 80:quic
......n....VyS.8...Oa<.G".....4.#C.Q.B.= Iw.[q\.;......>.N..;;.3MyO...]Vs...}{w}d..8..j....9.<...*R.....8.|,.v.(.¶.R....As..O.e..h.J.0..p..*J.B...4|P.(.4..Z6`...BMeb.....m..y.m..BU.!....a.].....E!W.lm..4.. ..j$.8....0...n.2..!I`Lh.l.....:@b.<S.I .WCb^M..&.So......w.u....szd........DaR.... .718.P...t;.......?.&....4..*.0.a.$.X.!.......A.O...[..5X.]..h..(0.9.y[.Q...4.B....v..I...*....a......M=MD:4.ZO.6.<.g.@/...G.z.....^.FI..=.4...7 ..N.R.h.a....arQ..L.!.N.:.-.P....B.D...=...n.a....e".`J....'\f.8N."s]j.(.%!9..@..`.<..<..v.`... g...Y....6.......C....h.......b.s_..G.......-....2..v6.#EL...je;....p.......d."...]U.e..b.s.R.[O.j.E...../.X..p.".......b.^/..R..w.....|.........V....@.=...,........l"..n._..,.......8............"...u....U. .._y.[.i..../T...C..GQ,...yYx.7...h...mL.;.#.zla.-..lw:n;.O..I9......ZC..q5..j&uN.rY...fO......7..;Y..e.......I...{.U..Y..}L..G...1..^....~..P..Sp~.....H/...f..w...).T.8...~s.X..w.X....*..Q5...l.$I.Q......8z...p....b.$.....D.4...p...og.A.$..uj.t.t.....u..ej...e.]....Sa.G.....A.;_.s.)A.5..i&....*.].9....."..(..C...n\.....M..j..V..h....3..e..z...n...]_..d.\;.kW..&"..D...h...T7I..R].u.....).t....e.........C.;.......=...]A!{o...l"..........H..*.o{..E..w..PD.......po.L#L5v....i.gUM....8.....5f..3^...U.l....-............... ......S.S.......Si.......
<<< skipped >>>
POST /CA_Servlet/trackingServlet HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Host: VVV.freecoins.co
Content-Length: 10
Expect: 100-continue
Connection: Keep-Alive
HTTP/1.1 100 Continue
....
GET /index.php?&productname=Free Coins HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.gamehub.ws
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:00 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.13
Set-Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
4169..<!DOCTYPE html>..<html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en" lang="en">.. <head>.. <title>GameHub</title>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>.. <meta name="description" content="" />.. <meta name="keywords" content="" />.. <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate">.. <meta http-equiv="Pragma" content="no-cache">.. <meta http-equiv="Expires" content="0">.. <link type="text/css" rel="StyleSheet" href="css/index.css" />.. <script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>.. <script src="js/jquery.cookie.js"></script>.. <script src="js/core-min.js"></script>.. <script src="js/sha256-min.js"></script>.. <script>window.FB_APP_ID = "1430933670481682";</script>.. <script src="js/facebookConnect.js"></script>.. <script src="js/gamesHub.js"></script>.. <!-- TEST ENV -->.. <!--<script src="//test.maudau.com/AdsBar/api?appid=5464&get=images&adSizeType=1"></script>.. <script>window.casino=MauDauOBJ</script>.. <script src="//test
<<< skipped >>>
GET /updates/m/fcmonitor.wys HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)
Host: cdn.wemempoclano.net
Cache-Control: no-store,no-cache
Pragma: no-cache
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
Age: 50159
Date: Thu, 21 Aug 2014 09:51:09 GMT
Last-Modified: Tue, 12 Aug 2014 13:00:40 GMT
Content-Length: 497
Connection: keep-alive
PK........v`.E.X..E...{.....$.0.. ...........zR.......N.......N.......vq.3b.````.bC=C3v. .$`.g.gh.g.........a. 1`v...@.QRR`......W....[.........Z._Z..X.Z.........Y._....W....E.....9...y..).......r:.p..... ......8...p..02.......R.....1.).?.y.mD..R..2.....y..'X.".'x........kqz.....Q. F...y.. .^.....1%^1..W.q{... *.W.....%^1..WLp{e.Lf.WtC.>...)%^1..WLq{.-.. ..T.qz.... 1'.*...9.....)y.?.:..#..PK..-.......v`.E.X..E...{.....$....... ......0.. ...........zR.......N.......N....PK..........S...........
GET /FreeCoinsLandingPage/thankyou.jsp HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.freecoins.co
Connection: Keep-Alive
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1; Path=/FreeCoinsLandingPage
Content-Type: text/html
Transfer-Encoding: chunked
Content-Encoding: gzip
Vary: Accept-Encoding
Date: Thu, 21 Aug 2014 09:51:02 GMT
Connection: close
a..............200...Y.s.H..|. &...9#...y....S6vlr...E..H.-4Z=0l...u........SU........cH.}......C...i....2.9n.P.a.U5...E})....B.R.&H. Q....P........W.2j.C9.y..foH.g.CD$O..O....q.k......#..UB=.}]...RF,......#>n(g.....{S.).*g.%d.PC-k..R?`a#.......s..5........7%E![....E.f...,z&!...b.@.3....S......2....C6b...k."BZ..&... -6@...?.r~.-.g9..U.Yami.ui.Oyd...u.#.......(...{.9..p3.VI.R.&5Bv..Q...p...'$.....H."...L.k1...@...kL>&.C.@-.....x.B....tQ.=X.......e.\....;....|................M.......%."..D......l.?|.R....!FZ.~..Jz.xtr...xzs...5...200......n..........n..b.;...{r?^.~..}....m.$gW..^j.......ku.o[w....@..A.$.`.Bf..V.Y.bSV\.....\.L..N.......%.E.1.A..Q2...?6.Jb>.I...A.G..9&..L(}G.B.\{........:.cf:......Px..yu.....c u....P..V.....s.../....TL...\.G.....g"\.^%..1.....\.Dx..y.@X...@L X.{.Z...Is...=U.....$.}...l..#d.....%...O&..........*..9}.i..U....=.w...b.....e..,.0.W!..!.Kw.[w.&x......C....t..0'Xf.;.t..D.4^U..[$....$... z..z....A~B.d..]%V....esd.......|..$.....!..r.. ..`.Z.\ 5h...m....j...f....i....(p%.$....i.b.1.`y.0..CZfy:84..AiP(0Z<..bz.)@......200...O1O...B].LCn....i23..D).....].0-..BO..".M..t....q.TT^s)-\1.r.......^...U...$.m.>.Tm$.~...>.Tl$.....:t........q....".:p..F....y......:.&T........ \(....N........!l........v.qY.".`A`ENR{.....;f~..[.\~%"...}......^..|.....'.......>7!R*...I.||X..._z.*. ......0.!2...7..n.rK~{.8t.......og_..?l.k9(}..^.%`L.........E..^.v_....-....z............b........?....O.....By..v...jZ.t......).....v;.2.8JD.!..3./5....u...isLj...4..t...576....#H.7]9..n..G....~ ...5.bjb..k
<<< skipped >>>
GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: sync.mathtag.com
Connection: Keep-Alive
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x3 pid 0x417b 16763
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; domain=.mathtag.com; path=/; expires=Fri, 21-Aug-2015 09:51:14 GMT
Location: hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct
Expires: Thu, 21 Aug 2014 09:51:13 GMT
....
GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: sync.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x4 pid 0x4a46 19014
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Location: hXXp://pixel.mathtag.com/event/img?mm_bnc
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Expires: Thu, 21 Aug 2014 09:51:13 GMT
....
GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: sync.mathtag.com
Connection: Keep-Alive
Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=
HTTP/1.1 302 Found
Date: Thu, 21 Aug 2014 09:51:14 GMT
Content-Type: image/gif
Content-Length: 0
Connection: keep-alive
Keep-Alive: timeout=360
Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x6 pid 0x42be 17086
Cache-Control: no-cache
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Location: hXXp://pixel.mathtag.com/event/img?mm_bnc
Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT
Expires: Thu, 21 Aug 2014 09:51:13 GMT
HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Type: image/gif..Content-Length: 0..Connection: keep-alive..Keep-Alive: timeout=360..Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x6 pid 0x42be 17086..Cache-Control: no-cache..P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"..Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT..Location: hXXp://pixel.mathtag.com/event/img?mm_bnc..Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT..Expires: Thu, 21 Aug 2014 09:51:13 GMT..
GET //offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:50:01 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 7542
Connection: keep-alive
.<html>. <head>. . <style type="text/css">. .ui-progressbar-value { background-image: url(images/pbar-ani.gif); }. </style>. . <link type="text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css" rel="stylesheet" />. <link href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css" rel="stylesheet" type="text/css" />. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js"></script>. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js"></script>.. <title>2 - NonProduct (Free Coins)</title><script type='text/javascript'></script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89px; height:26px; cursor:pointer; bottom: 8px; margin-l
<<< skipped >>>
GET //offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: direct.the-apps-track.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Aug 2014 09:51:03 GMT
Server: Microsoft-IIS/8.0
X-AspNet-Version: 4.0.30319
X-AspNetMvc-Version: 4.0
X-Powered-By: ASP.NET
Content-Length: 6258
Connection: keep-alive
<html>. <head>. <title>4 - NonProduct (Free Coins)</title><script type='text/javascript'></script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89px; height:26px; cursor:pointer; bottom: 8px; margin-left:1px; right: 1%; background:url("hXXp://static.revenyou.com/offers/images/Theme8/button.png");} .divAccept { text-align:center; font-family:Arial halvetica; width:89px; position:absolute; font-size:12px; bottom: 7px; margin-left:1px; right: 2%;} .divDecline { text-align:center;height:26px; bottom: 8px; cursor:pointer; font-family:Arial helvetica; font-size:12px; position:absolute; left:1%; padding-top: 4px;} .divAgreementLeadP{ position:absolute; bottom:46px; left:3px;font-size:10px; } #divAgreementLeadPWelcome {bottom:46px;position:absolute;left:187px;font-size:10px;} a:visited { color:Blue;
<<< skipped >>>
GET /activity?_o=62795&_t=cm_apn_in HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: m.xp1.ru4.com
Connection: Keep-Alive
HTTP/1.1 302 Moved Temporarily
Server: Sun-Java-System-Web-Server/7.0
Date: Thu, 21 Aug 2014 09:51:18 GMT
P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"
Pragma: no-cache
Set-cookie: X1ID=NC-00000010467304128; domain=.ru4.com; path=/; expires=Thu, 21-Feb-2016 05:51:18 GMT
Set-cookie: TMP_X1ID=NC-00000010467304128; domain=.ru4.com; path=/
Location: hXXp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128
Content-length: 0
HTTP/1.1 302 Moved Temporarily..Server: Sun-Java-System-Web-Server/7.0..Date: Thu, 21 Aug 2014 09:51:18 GMT..P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"..Pragma: no-cache..Set-cookie: X1ID=NC-00000010467304128; domain=.ru4.com; path=/; expires=Thu, 21-Feb-2016 05:51:18 GMT..Set-cookie: TMP_X1ID=NC-00000010467304128; domain=.ru4.com; path=/..Location: hXXp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128..Content-length: 0..
GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cm.g.doubleclick.net
Connection: Keep-Alive
Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3
HTTP/1.1 302 Found
P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
Date: Thu, 21 Aug 2014 09:51:16 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Content-Type: text/html; charset=UTF-8
Server: HTTP server (unknown)
Content-Length: 317
X-XSS-Protection: 1; mode=block
Alternate-Protocol: 80:quic
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1..Date: Thu, 21 Aug 2014 09:51:16 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 317..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>....
<<< skipped >>>
GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1
Accept: */*
Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: gmtdmp.mookie1.com
Connection: Keep-Alive
Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH
HTTP/1.1 200 OK
Date: Thu, 21 Aug 2014 09:51:11 GMT
P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/
Cache-Control: private, no-store, no-cache
Pragma: no-cache
Expires: Fri, 30 Oct 1998 14:19:41 GMT
Content-Type: image/gif
Content-Length: 43
Keep-Alive: timeout=1, max=9649
Connection: Keep-Alive
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9649..Connection: Keep-Alive..GIF89a.............!.......,...........D..;..
Map
The not-a-virus connects to the servers at the folowing location(s):
Strings from Dumps
%original file name%.exe_580:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe /PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe /PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe
1.2.2
1.2.2
Extract: %f
Extract: %f
%u byte%c
%u byte%c
(%u byte%c)
(%u byte%c)
%d.%d%d Ë%c
%d.%d%d Ë%c
inflate 1.2.2 Copyright 1995-2004 Mark Adler
inflate 1.2.2 Copyright 1995-2004 Mark Adler
GetProcessHeap
GetProcessHeap
nsisunz.dll
nsisunz.dll
operator
operator
GetProcessWindowStation
GetProcessWindowStation
portuguese-brazilian
portuguese-brazilian
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.zip
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.zip
onsBv3.dat
onsBv3.dat
rdms.zip
rdms.zip
NSTRU~1.DAT
NSTRU~1.DAT
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp
:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp
c:\%original file name%.exe
c:\%original file name%.exe
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp
%original file name%.exe
%original file name%.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst1.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst1.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp
/PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
/PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true
Nullsoft Install System v2.46
Nullsoft Install System v2.46
WUSER32.DLL
WUSER32.DLL
Setup.exe
Setup.exe
rdms.exe_484:
.text
.text
`.rdata
`.rdata
@.data
@.data
.rsrc
.rsrc
@.reloc
@.reloc
SSh,bJ
SSh,bJ
.CGy,
.CGy,
SShT&J
SShT&J
FTPj
FTPj
YPSSSh
YPSSSh
,4,56,789
,4,56,789
xSSSh
xSSSh
FTPjKS
FTPjKS
FtPj;S
FtPj;S
C.PjRV
C.PjRV
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegCreateKeyTransactedW
RegCreateKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyTransactedW
RegDeleteKeyExW
RegDeleteKeyExW
%d/%d/%d %d:%d:%d
%d/%d/%d %d:%d:%d
X:X:X:X:X:X
X:X:X:X:X:X
large file support is disabled
large file support is disabled
unknown operation
unknown operation
SQL logic error or missing database
SQL logic error or missing database
foreign_keys
foreign_keys
sqlite_compileoption_get
sqlite_compileoption_get
sqlite_compileoption_used
sqlite_compileoption_used
sqlite_log
sqlite_log
sqlite_source_id
sqlite_source_id
sqlite_version
sqlite_version
sqlite_attach
sqlite_attach
sqlite_detach
sqlite_detach
sqlite_stat1
sqlite_stat1
sqlite_rename_parent
sqlite_rename_parent
sqlite_rename_trigger
sqlite_rename_trigger
sqlite_rename_table
sqlite_rename_table
GetProcessHeap
GetProcessHeap
RowKey
RowKey
3.7.16.2
3.7.16.2
SQLite format 3
SQLite format 3
CREATE TABLE sqlite_master(
CREATE TABLE sqlite_master(
sql text
sql text
CREATE TEMP TABLE sqlite_temp_master(
CREATE TEMP TABLE sqlite_temp_master(
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY
922337203685477580
922337203685477580
SQLITE_
SQLITE_
?API call with %s database connection pointer
?API call with %s database connection pointer
OsError 0x%x (%u)
OsError 0x%x (%u)
os_win.c:%d: (%d) %s(%s) - %s
os_win.c:%d: (%d) %s(%s) - %s
delayed %dms for lock/sharing conflict
delayed %dms for lock/sharing conflict
%s\etilqs_
%s\etilqs_
%s\%s
%s\%s
cannot limit WAL size: %s
cannot limit WAL size: %s
2nd reference to page %d
2nd reference to page %d
invalid page number %d
invalid page number %d
%s(%d)
%s(%d)
keyinfo(%d
keyinfo(%d
%r %s BY term out of range - should be between 1 and %d
%r %s BY term out of range - should be between 1 and %d
Expression tree is too large (maximum depth %d)
Expression tree is too large (maximum depth %d)
too many SQL variables
too many SQL variables
variable number must be between ?1 and ?%d
variable number must be between ?1 and ?%d
too many columns in %s
too many columns in %s
%s OR name=%Q
%s OR name=%Q
type='trigger' AND (%s)
type='trigger' AND (%s)
table %s may not be altered
table %s may not be altered
sqlite_
sqlite_
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
access to %s.%s.%s is prohibited
access to %s.%s.%s is prohibited
access to %s.%s is prohibited
access to %s.%s is prohibited
object name reserved for internal use: %s
object name reserved for internal use: %s
duplicate column name: %s
duplicate column name: %s
too many columns on %s
too many columns on %s
DELETE FROM %Q.%s WHERE %s=%Q
DELETE FROM %Q.%s WHERE %s=%Q
sqlite_stat%d
sqlite_stat%d
unknown column "%s" in foreign key definition
unknown column "%s" in foreign key definition
number of columns in foreign key does not match the number of columns in the referenced table
number of columns in foreign key does not match the number of columns in the referenced table
foreign key on %s should reference only one column of table %T
foreign key on %s should reference only one column of table %T
a JOIN clause is required before %s
a JOIN clause is required before %s
cannot modify %s because it is a view
cannot modify %s because it is a view
table %s may not be modified
table %s may not be modified
Cforeign key mismatch - "%w" referencing "%w"
Cforeign key mismatch - "%w" referencing "%w"
error during initialization: %s
error during initialization: %s
no entry point [%s] in shared library [%s]
no entry point [%s] in shared library [%s]
unable to open shared library [%s]
unable to open shared library [%s]
sqlite3_extension_init
sqlite3_extension_init
unknown or unsupported join type: %T %T%s%T
unknown or unsupported join type: %T %T%s%T
RIGHT and FULL OUTER JOINs are not currently supported
RIGHT and FULL OUTER JOINs are not currently supported
USE TEMP B-TREE FOR %s
USE TEMP B-TREE FOR %s
COMPOUND SUBQUERIES %d AND %d %s(%s)
COMPOUND SUBQUERIES %d AND %d %s(%s)
%s:%d
%s:%d
no such index: %s
no such index: %s
SCAN TABLE %s %s%s(~%d rows)
SCAN TABLE %s %s%s(~%d rows)
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d
sqlite_master
sqlite_master
sqlite_temp_master
sqlite_temp_master
vtable constructor did not declare schema: %s
vtable constructor did not declare schema: %s
vtable constructor failed: %s
vtable constructor failed: %s
no such module: %s
no such module: %s
table %s: xBestIndex returned an invalid plan
table %s: xBestIndex returned an invalid plan
%s (~%lld rows)
%s (~%lld rows)
%s VIRTUAL TABLE INDEX %d:%s
%s VIRTUAL TABLE INDEX %d:%s
%s (rowid)
%s (rowid)
%s (rowid>?)
%s (rowid>?)
%s (rowid>? AND rowid)
%s (rowid>? AND rowid)
%s (rowid=?)
%s (rowid=?)
%s USING INTEGER PRIMARY KEY
%s USING INTEGER PRIMARY KEY
%s USING %s%sINDEX%s%s%s
%s USING %s%sINDEX%s%s%s
%s AS %s
%s AS %s
%s TABLE %s
%s TABLE %s
%s SUBQUERY %d
%s SUBQUERY %d
database corruption at line %d of [%.10s]
database corruption at line %d of [%.10s]
misuse at line %d of [%.10s]
misuse at line %d of [%.10s]
cannot open file at line %d of [%.10s]
cannot open file at line %d of [%.10s]
failed to allocate %u bytes of memory
failed to allocate %u bytes of memory
failed memory resize %u to %u bytes
failed memory resize %u to %u bytes
foreign key constraint failed
foreign key constraint failed
unable to use function %s in the requested context
unable to use function %s in the requested context
zeroblob(%d)
zeroblob(%d)
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%s(%s)
%s %T cannot reference objects in database %s
%s %T cannot reference objects in database %s
default value of column [%s] is not constant
default value of column [%s] is not constant
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d
no such collation sequence: %s
no such collation sequence: %s
%s - %s
%s - %s
malformed database schema (%s)
malformed database schema (%s)
cannot join using column %s - column not present in both tables
cannot join using column %s - column not present in both tables
cannot have both ON and USING clauses in the same join
cannot have both ON and USING clauses in the same join
a NATURAL join may not have an ON or USING clause
a NATURAL join may not have an ON or USING clause
%s.%s
%s.%s
%s-shm
%s-shm
bind on a busy prepared statement: [%s]
bind on a busy prepared statement: [%s]
%s: %s
%s: %s
%s: %s.%s
%s: %s.%s
%s: %s.%s.%s
%s: %s.%s.%s
misuse of aliased aggregate %s
misuse of aliased aggregate %s
not authorized to use function: %s
not authorized to use function: %s
too many terms in %s BY clause
too many terms in %s BY clause
EXECUTE %s%s SUBQUERY %d
EXECUTE %s%s SUBQUERY %d
%.*s"%w"%s
%.*s"%w"%s
%s%.*s"%w"
%s%.*s"%w"
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q
Cannot add a PRIMARY KEY column
Cannot add a PRIMARY KEY column
invalid name: "%s"
invalid name: "%s"
automatic extension loading failed: %s
automatic extension loading failed: %s
d-d-d d:d:d
d-d-d d:d:d
d:d:d
d:d:d
d-d-d
d-d-d
M@d
M@d
SELECTs to the left and right of %s do not have the same number of result columns
SELECTs to the left and right of %s do not have the same number of result columns
LIMIT clause should come after %s not before
LIMIT clause should come after %s not before
ORDER BY clause should come after %s not before
ORDER BY clause should come after %s not before
BmTindexed columns are not unique
BmTindexed columns are not unique
Recovered %d frames from WAL file %s
Recovered %d frames from WAL file %s
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)
Failed to read ptrmap key=%d
Failed to read ptrmap key=%d
failed to get page %d
failed to get page %d
%d of %d pages missing from overflow list starting at %d
%d of %d pages missing from overflow list starting at %d
freelist leaf count too big on page %d
freelist leaf count too big on page %d
Fragmentation of %d bytes reported as %d on page %d
Fragmentation of %d bytes reported as %d on page %d
Multiple uses for byte %d of page %d
Multiple uses for byte %d of page %d
Corruption detected in cell %d on page %d
Corruption detected in cell %d on page %d
On page %d at right child:
On page %d at right child:
On tree page %d cell %d:
On tree page %d cell %d:
btreeInitPage() returns error code %d
btreeInitPage() returns error code %d
unable to get the page. error code=%d
unable to get the page. error code=%d
Page %d:
Page %d:
Outstanding page count goes from %d to %d during this analysis
Outstanding page count goes from %d to %d during this analysis
Pointer map page %d is referenced
Pointer map page %d is referenced
Page %d is never used
Page %d is never used
sqlite3_get_table() called with two or more incompatible queries
sqlite3_get_table() called with two or more incompatible queries
no such vfs: %s
no such vfs: %s
%s mode not allowed: %s
%s mode not allowed: %s
no such %s mode: %s
no such %s mode: %s
MJ delete: %s
MJ delete: %s
-mjX9X
-mjX9X
MJ collide: %s
MJ collide: %s
%s-mjXXXXXX9XXz
%s-mjXXXXXX9XXz
database %s is locked
database %s is locked
cannot detach database %s
cannot detach database %s
no such database: %s
no such database: %s
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')
unknown database: %s
unknown database: %s
unknown database %s
unknown database %s
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
PRIMARY KEY must be unique
PRIMARY KEY must be unique
constraint %s failed
constraint %s failed
%s.%s may not be NULL
%s.%s may not be NULL
database schema is locked: %s
database schema is locked: %s
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0
PRAGMA vacuum_db.synchronous=OFF
PRAGMA vacuum_db.synchronous=OFF
cannot VACUUM - SQL statements in progress
cannot VACUUM - SQL statements in progress
misuse of aggregate: %s()
misuse of aggregate: %s()
constraint failed at %d in [%s]
constraint failed at %d in [%s]
abort at %d in [%s]: %s
abort at %d in [%s]: %s
database table is locked: %s
database table is locked: %s
cannot change %s wal mode from within a transaction
cannot change %s wal mode from within a transaction
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid
cannot commit transaction - SQL statements in progress
cannot commit transaction - SQL statements in progress
cannot release savepoint - SQL statements in progress
cannot release savepoint - SQL statements in progress
no such savepoint: %s
no such savepoint: %s
cannot open savepoint - SQL statements in progress
cannot open savepoint - SQL statements in progress
statement aborts at %d: [%s] %s
statement aborts at %d: [%s] %s
cannot use index: %s
cannot use index: %s
at most %d tables in a join
at most %d tables in a join
cannot open value of type %s
cannot open value of type %s
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid
unsupported file format
unsupported file format
no such trigger: %S
no such trigger: %S
unable to open database: %s
unable to open database: %s
database %s is already in use
database %s is already in use
too many attached databases - max %d
too many attached databases - max %d
sqlite_sequence
sqlite_sequence
there is already an index named %s
there is already an index named %s
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
DELETE FROM %Q.%s WHERE name=%Q AND type='index'
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped
no such index: %S
no such index: %S
unable to identify the object to be reindexed
unable to identify the object to be reindexed
no such table: %s
no such table: %s
%s.%s.%s
%s.%s.%s
too many references to "%s": max 65535
too many references to "%s": max 65535
sqlite_subquery_%p_
sqlite_subquery_%p_
cannot create INSTEAD OF trigger on table: %S
cannot create INSTEAD OF trigger on table: %S
cannot create %s trigger on view: %S
cannot create %s trigger on view: %S
cannot open %s column for writing
cannot open %s column for writing
no such column: "%s"
no such column: "%s"
indexed
indexed
foreign key
foreign key
cannot open view: %s
cannot open view: %s
cannot open virtual table: %s
cannot open virtual table: %s
sqlite_altertab_%s
sqlite_altertab_%s
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
CREATE%s INDEX %.*s
CREATE%s INDEX %.*s
table %s has no column named %s
table %s has no column named %s
sqlite_autoindex_%s_%d
sqlite_autoindex_%s_%d
index %s already exists
index %s already exists
there is already a table named %s
there is already a table named %s
virtual tables may not be indexed
virtual tables may not be indexed
views may not be indexed
views may not be indexed
table %s may not be indexed
table %s may not be indexed
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY
table "%s" has more than one primary key
table "%s" has more than one primary key
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE %Q.sqlite_sequence(name,seq)
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d
CREATE %s %.*s
CREATE %s %.*s
view %s is circularly defined
view %s is circularly defined
table %S has no column named %s
table %S has no column named %s
%d values for %d columns
%d values for %d columns
table %S has %d columns but %d values were supplied
table %S has %d columns but %d values were supplied
*** in database %s ***
*** in database %s ***
unsupported encoding: %s
unsupported encoding: %s
foreign_key_check
foreign_key_check
foreign_key_list
foreign_key_list
no such column: %s
no such column: %s
there is already another table or index with this name: %s
there is already another table or index with this name: %s
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
view %s may not be altered
view %s may not be altered
-- TRIGGER %s
-- TRIGGER %s
use DROP VIEW to delete view %s
use DROP VIEW to delete view %s
use DROP TABLE to delete table %s
use DROP TABLE to delete table %s
table %s may not be dropped
table %s may not be dropped
sqlite_stat
sqlite_stat
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers
<