Skip to main content

notavirus.AdWare.Win32.OutBrowse.g_84bd722fea


not-a-virus:AdWare.Win32.OutBrowse.g (Kaspersky), mzpefinder_pcap_file.YR (Lavasoft MAS)Behaviour: Adware

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 84bd722fea6da21d35d2b9c5aad0561a

SHA1: eef93a8b6bb4660fa835c4b6306a4c30d2b669ff

SHA256: c965ab55d777fad99d0a00f8af2b4f286194211513910aa20c183f469a973067

SSDeep: 12288:K5UnYdbT2wW c1fFbftgCin2JI6J8bc1YT/AAUHnOiNh:K5UnY03lgd2J0bqAU

Size: 567000 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2009-12-06 00:50:52

Analyzed on: WindowsXP SP3 32-bit

Summary: Adware. Delivers advertising content in a manner or context that may be unexpected and unwanted by users. Many adware applications also perform tracking functions. Users may want to remove adware if they object to such tracking, do not wish to see the advertising caused by the program or are frustrated by its effects on system performance.

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The not-a-virus creates the following process(es):

wmic.exe:1680
ping.exe:408
FreeCoinsApp.exe:2028
RegisterInstallStart.exe:1984
wyUpdate4.exe:2432
wyUpdate4.exe:2076
wyUpdate4.exe:2616
%original file name%.exe:580
find.exe:1252

The not-a-virus injects its code into the following process(es):

rdms.exe:484
SystemMonitor.exe:1988
FCUpdater.exe:1484
FCMonitor.exe:2024
FCUI.exe:1596

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process rdms.exe:484 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (2785 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\button[1].png (458 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (9863 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bodyImg[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_over[1].png (921 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (6189 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\914086145550\FreeCoinsApp.exe (5370360 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe (5680176 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (1086 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (5774 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91408614555 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (0 bytes)

The process wmic.exe:1680 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (238 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (0 bytes)

The process FreeCoinsApp.exe:2028 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\gpi.bat (143 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\send_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\global.properties.xml (1638 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\close_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_horizontal_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\popup_multi.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\noInternet.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_content_footer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\body_ad_purple.png (6 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\FreeCoins\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll (5568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\search_box.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\jquery.custom-scrollbar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\loading_img.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\query_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\openThankYou.bat (340 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\notifications_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\share_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\ok_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe.config (263 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert_1.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\arrow.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.min.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tray_icon_on.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\aPop.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\BG_settings.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RunAppMonitor.bat (102 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\background_body.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (4232 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe (7168 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallAddiotionals.bat (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_vertical_middle_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\redeemed_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_OFF_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email-30X1.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-1.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_bg.png (36 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg2.png (87 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\storageManager.js (2193 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\runApp.bat (28 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe (1965 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_blue.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.dll (7384 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_center_slice.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\alert_skin_4.html (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_background.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\Thumbs.db (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll (14768 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\index_skin_4.html (56 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\BG_alert.png (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\Stumbleupon32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe (22 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\main_v4.css (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\facebook_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_gray.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_empty.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallNet35xp.bat (446 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\settings_body.png (15 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\redeem_now.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery-1.9.1.min.js (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\lifeCycleManager.js (42 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\setting_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\settings_link.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\BG_popUP.png (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\time_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\production.properties.xml (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\DAutils.dll (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionManager.js (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Desktop\FreeCoins.lnk (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_bottom.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionPopupUI.js (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-2.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\pcc.bat (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.cookie.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\coupons_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\verifyUninstall.bat (464 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\googlePlus32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\search_noresults.png (63 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\borderItem.jpg (30 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\errorHandling.js (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\twitter32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\mail_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Thumbs.db (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\body.png (2979 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\save_btn.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\lock.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\browsers.css (1428 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_ON_settings_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_48.ico (27 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\json2.js (51 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\time_left_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_face.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\minimize_app.png (2997 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\close_app.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_32.ico (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.png (12 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\SetupNET35.exe (49498 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\gmail32X32.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe (26 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\locked_popup_face2.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\transparent.gif (126 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\counter_all.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_logo.png (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\utils.js (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\image_2.jpg (33 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_left.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\email32X32.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_history_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe.config (270 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\locked_popup_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\ourScrollBar.css (9 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn_click.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\yahoo32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.xml (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\close_btn_fBack.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_16.ico (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\production.properties.xml (2 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\client.wyc (1568 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\alertManager.js (2286 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\uiManager.js (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\home_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_64x64.ico (48 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_top.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\installPath.txt (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\header_image.png (6312 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\invite_friends_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\alerts.xml (1302 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\facebook32X32.png (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (6 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\alerts.xml (651 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_right.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_gray.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\global.properties.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\DAutils.dll (3136 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\promotionPopup_skin_4.html (20 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\down.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\up.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_body.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\close_btn.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg.png (4704 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email_bg.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate4.exe (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe.config (546 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_close.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.js (75 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_pointer.png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\commManager.js (21 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon.png (6 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsm3.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (0 bytes)

The process wyUpdate4.exe:2432 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (497 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2504 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (0 bytes)

The process wyUpdate4.exe:2076 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (723 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2213 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (0 bytes)

The process wyUpdate4.exe:2616 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (294 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\w2685 (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (0 bytes)

The process %original file name%.exe:580 makes changes in the file system.


The not-a-virus creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\nsisunz.dll (211 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (57028 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (4583 bytes)

The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (0 bytes)

The process FCUI.exe:1596 makes changes in the file system.


The not-a-virus deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Application Data\FreeCoins\fcud.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Application Data\FreeCoins (0 bytes)

Registry activity

The process rdms.exe:484 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\0\win32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid32]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\ProxyStubClsid]
"(Default)" = "{00020424-0000-0000-C000-000000000046}"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}\TypeLib]
"Version" = "1.0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}]
"(Default)" = "CBrowserExternal Class"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\Version]
"(Default)" = "1.0"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\HELPDIR]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\TypeLib]
"(Default)" = "{03771AEF-400D-4A13-B712-25878EC4A3F5}"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0]
"(Default)" = "SmartInstallerLib"

[HKCR\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}]
"(Default)" = "IBrowserExternals"

[HKCR\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}\LocalServer32]
"(Default)" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"
"ServerExecutable" = "C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 A1 58 46 71 74 44 60 A7 C0 91 57 FA 37 F2 2E"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCR\TypeLib\{03771AEF-400D-4A13-B712-25878EC4A3F5}\1.0\FLAGS]
"(Default)" = "0"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The not-a-virus deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process wmic.exe:1680 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF 4B F7 64 58 1C D8 97 44 64 2C A0 C0 0B 74 8E"

The process ping.exe:408 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA DA 71 5B B8 A8 FC 45 0D B0 F7 BE B2 0F B9 8B"

The process FreeCoinsApp.exe:2028 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"DisplayName" = "Free Coins Desktop App 1.26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"

"Common Desktop" = "%Documents and Settings%\All Users\Desktop"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"URLInfoAbout" = "http://www.freecoins.co"
"UninstallString" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe"
"Publisher" = "Free Coins."

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

[HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION]
"FCUI.exe" = "7000"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKCU\Software\FreeCoins]
"RegistrationStatus" = "1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Free Coins Desktop App]
"DisplayVersion" = "1.26"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "84 14 00 13 4D 1C E6 39 A6 7E 2B 0E 5E 1C 1F F8"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\FreeCoins]
"InstallPath" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins"

[HKCU\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION]
"FCUI.exe" = "7000"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"

"FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"

The process RegisterInstallStart.exe:1984 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 5B 66 FF FD 8C AC D1 BF 07 09 86 7F 77 C6 CF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\FreeCoins]
"GoogleAnalyticsJsoned" = "{""cm"":""(organic)""

The process SystemMonitor.exe:1988 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 67 2E E3 07 FA B9 CF BE 90 B0 66 1B D7 D1 2E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process wyUpdate4.exe:2432 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C1 E4 64 E4 E3 B5 EC 00 57 49 E1 CF 9C 1A DB A3"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process wyUpdate4.exe:2076 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 74 B7 FD 7F F7 77 C5 B4 39 9F 62 44 9D B1 9E"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process wyUpdate4.exe:2616 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B9 44 60 6A CC 6B 7C C2 AE BF 8B 24 48 05 B1 B5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

The process FCUpdater.exe:1484 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F8 B5 25 6D 7F B1 78 C2 33 36 02 39 57 D5 33 53"

[HKCU\Software\FreeCoins]
"FreeCoinsIEExt" = "1"
"FreeCoinsFFExt" = "1"
"FreeCoinsInstall" = "2014-8-21-12-50"

The process FCMonitor.exe:2024 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2B 1A 55 A2 78 14 E7 4D 24 DE E1 65 7E E5 86 38"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

The process %original file name%.exe:580 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 06 97 70 90 FE 7C 60 FF 2D 22 A7 D0 B2 3D 8A"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process FCUI.exe:1596 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePrefix" = ":2014082120140822:"
"CacheRepair" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "FCUI.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheLimit" = "8192"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1407762306"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 17 40 EF 34 79 D8 4C C2 CC 99 26 C3 6F C5 31"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CacheOptions" = "11"

[HKCU\Software\FreeCoins]
"FreeCoinsUUID" = "6d2d1975-0e9c-4d2b-b9ec-faf7bf8f0dbc"
"ver" = "1.26"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014082120140822]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012014082120140822\"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

The not-a-virus modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The not-a-virus modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"

The not-a-virus modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

To automatically run itself each time Windows is booted, the not-a-virus adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"

The not-a-virus deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]

The process find.exe:1252 makes changes in the system registry.


The not-a-virus creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CB 78 51 53 89 09 42 98 F1 0E 5C 87 19 44 75 98"

Dropped PE files

MD5 File path
97156d3730ca295bceb65005e43e1556c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\DAutils.dll
462b4784eda015ee2222a685f54708fec:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\FCUI.exe
f2d9d327dd1c6f7242d279087d1b9a0cc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll
96bc18f8dee95af3771763dee0e15986c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll
410be2d16ea77628b919414213734785c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe
aafb99a979d4cbe4c0505408bd826f87c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe
9d40de3d6ebfcc6d8501c6629fa2b259c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\SetupNET35.exe
37c753d5ab2dba14e7b7e1dc56b87c27c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\wyUpdate.exe
0776370846dfe1d108cbd098db162f35c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\FreeCoins\wyUpdate4.exe
91ec4108ee17d0a6800f49d6755138dfc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\914086145550\FreeCoinsApp.exe
2a5ef58458b77e20115182851d0e4bf9c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso2.tmp\Convert.dll
5f13dbc378792f23e598079fc1e4422bc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nso2.tmp\nsisunz.dll
b950b7d00028a589f3a6b9889de51782c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\rdms.exe
91ec4108ee17d0a6800f49d6755138dfc:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    wmic.exe:1680
    ping.exe:408
    FreeCoinsApp.exe:2028
    RegisterInstallStart.exe:1984
    wyUpdate4.exe:2432
    wyUpdate4.exe:2076
    wyUpdate4.exe:2616
    %original file name%.exe:580
    find.exe:1252

  2. Delete the original not-a-virus file.
  3. Delete or disinfect the following files created/modified by the not-a-virus:

    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\DynamicOfferScreen[1].htm (2785 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\button[1].png (458 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\ui-bg_inset-hard_100_fcfdfd_1x100[1].png (88 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jquery-ui.min[1].js (9863 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\bodyImg[1].png (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\button_over[1].png (921 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\jquery-ui[1].css (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\ui-bg_gloss-wave_75_2191c0_500x100[1].png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\jquery-ui-1.8.19.custom[1].css (6189 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\914086145550\FreeCoinsApp.exe (5370360 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\FreeCoinsApp[1].exe (5680176 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\DynamicOfferScreen[1].htm (1086 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\jquery.min[1].js (5774 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\91408614555.txt (238 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\gpi.bat (143 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\send_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\global.properties.xml (1638 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-1.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\close_btn.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\DAutils.dll (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_horizontal_middle_slice.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\arrow.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\popup_multi.png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\noInternet.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\coins_icon.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_content_footer.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\body_ad_purple.png (6 bytes)
    %Documents and Settings%\%current user%\Start Menu\Programs\FreeCoins\FreeCoins.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Interop.SHDocVw.dll (5568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\search_box.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\jquery.custom-scrollbar.css (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\loading_img.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\query_link.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\body-2.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\openThankYou.bat (340 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\notifications_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\share_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\ok_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\SystemMonitor.exe.config (263 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert_1.png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\arrow.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.min.js (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\down.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tray_icon_on.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\aPop.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\BG_settings.png (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RunAppMonitor.bat (102 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\background_body.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsc5.tmp (4232 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe (7168 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallAddiotionals.bat (575 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_vertical_middle_slice.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\redeemed_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_OFF_settings_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email-30X1.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-1.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_bg.png (36 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\FCUI.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\client.wyc (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg2.png (87 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_top.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\storageManager.js (2193 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\runApp.bat (28 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_48.ico (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\production.properties.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\installPath.txt (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\lock.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\uninst.exe (1965 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\alerts.xml (651 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_blue.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\coins_btn.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.dll (7384 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\nsExec.dll (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_center_slice.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\alert_skin_4.html (4 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_background.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\Newtonsoft.Json.xml (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_bg.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\Thumbs.db (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.dll (14768 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\index_skin_4.html (56 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\BG_alert.png (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\Stumbleupon32X32.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\up.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\main_v4.css (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\facebook_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_32.ico (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate4.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_gray.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_empty.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\InstallNet35xp.bat (446 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\client.wyc (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\settings_body.png (15 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\redeem_now.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery-1.9.1.min.js (6312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\time_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\lifeCycleManager.js (42 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\verifyUninstall.bat (464 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\setting_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\settings_link.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\notification\BG_popUP.png (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe (13 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\time_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\thumb_bottom.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\production.properties.xml (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\DAutils.dll (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\System.dll (11 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionManager.js (63 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_64x64.ico (48 bytes)
    %Documents and Settings%\%current user%\Desktop\FreeCoins.lnk (1 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_bottom.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\promotionPopupUI.js (18 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\body-2.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\pcc.bat (82 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon_click.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterUninstall.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.cookie.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\coupons_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\verifyUninstall.bat (464 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\googlePlus32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\search_noresults.png (63 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\borderItem.jpg (30 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\errorHandling.js (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\twitter32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\mail_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Thumbs.db (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\body.png (2979 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Scroller\top.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\save_btn.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\lock.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\wyUpdate.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\browsers.css (1428 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\setting_tab\frequency_ON_settings_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_48.ico (27 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\json2.js (51 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\time_left_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_16.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\locked_popup_face.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\minimize_app.png (2997 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\close_app.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\desktop_icons\FCA_icon_32.ico (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.png (12 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\SetupNET35.exe (49498 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\gmail32X32.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe (26 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\locked_popup_face2.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\transparent.gif (126 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\Share_icon.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\home_tab\counter_all.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_logo.png (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\utils.js (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\image_2.jpg (33 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\thumb_left.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\email32X32.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\redeemed_history_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon_click.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns6.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe.config (270 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\locked_popup_bg.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\ourScrollBar.css (9 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\coins_icon.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_locked_popup\invite_friends_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_icon.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\coins_btn_click.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\config\global.properties.xml (819 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\yahoo32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\Newtonsoft.Json.xml (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\close_btn_fBack.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_16.ico (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\production.properties.xml (2 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\client.wyc (1568 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\alertManager.js (2286 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\uiManager.js (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\tab_bar\home_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\install_icons\FCA_icon_install_64x64.ico (48 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\vertical\track_top.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\installPath.txt (73 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\header_image.png (6312 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\FreeCoinsApp_invite_popup\archive\invite_friends_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\config\alerts.xml (1302 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\icons\facebook32X32.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nsx4.tmp\ns7.tmp (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\alerts.xml (651 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\down.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\horizontal\track_right.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\share_btn_gray.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\config\global.properties.xml (819 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\DAutils.dll (3136 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\promotionPopup_skin_4.html (20 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroller\down.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCU\wyUpdate4.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\scroll_bar\scroller\up.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_body.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\Share_btn\close_btn.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\feedback_bg.png (4704 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\feedback\email_bg.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FCM\wyUpdate4.exe (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\RegisterInstallStart.exe.config (546 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\alert\alert_close.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\power_up_icon.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\libs\jquery.custom-scrollbar.js (75 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\hover_block\hover_block_pointer.png (3 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\js\commManager.js (21 bytes)
    %Documents and Settings%\%current user%\Local Settings\Application Data\FreeCoins\web\css\skins\4\images\redeemed_page\free_spin_icon.png (6 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w2504\fcmonitor.wys (497 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w2213\desktopapp.wys (723 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\w2685\fcupdater.wys (294 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\nsisunz.dll (211 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.dat (8368 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\rdms.zip (57028 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\instructionsBv3.exe (398737 bytes)
    %Documents and Settings%\%current user%\Local Settings\Temp\nso2.tmp\Convert.dll (4583 bytes)

  4. Delete the following value(s) in the autorun key (How to Work with System Registry):

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "FreeCoinsUpdater" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCU\FCUpdater.exe"

    [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
    "FreeCoinsStartup" = "%Documents and Settings%\%current user%\Local Settings\Application Data\FCM\FCMonitor.exe"

  5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  6. Reboot the computer.
*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

Static Analysis

VersionInfo

Company Name:
Product Name: Setup.exe
Product Version: 1.0
Legal Copyright:
Legal Trademarks:
Original Filename:
Internal Name:
File Version:
File Description:
Comments:
Language: Language Neutral

Company Name: Product Name: Setup.exeProduct Version: 1.0 Legal Copyright: Legal Trademarks: Original Filename: Internal Name: File Version: File Description: Comments: Language: Language Neutral

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text409623628240644.46394856b32eb77dfd6fb67f21d6543272da5
.rdata28672476451203.4982dc77f8a1e6985a4361c55642680ddb4f
.data3686415471210243.32787922d4ce117d7d5b3ac2cffe4b0b5e4f
.ndata1925123686400d41d8cd98f00b204e9800998ecf8427e
.rsrc229376312035842.72195ecb2f57811e1216779bf9790e5ace50c

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:


Total found: 48
55f698dfa9f4d0becb76c70b86a35e89
37a35826b44a6f7dc08f2efa7dc5edcb
98074817f9a780ea48cfd72a1247d983
6cb1e085f1893765d316b2ac3d0a7cb7
35d0d82e99ab227a8036a61f77ee390e
243184caa5aecebf185a6b99d9c3e08e
de5df25bad894c285472140860b2dd84
74112916e3582d7bab8e654f188506b8
6b3c2dd4ebcede91f226d82c1c6089c6
eaba4aaf1128a9ca05a39f34231c52bc
000054aeade704f5ca8b1a0493550b71
41140783f703a6df7462369dbe3f852d
bc786b8de7507076f13911c5809f8659
611a21c471eac31ccb70dc393a7c66fb
a1829913b550e46c3544a0605e40f862
d988f8070ab8f0bfd3e40845d3300874
c0106ff9927efd05d3e74d3cd79f6797
c0b58298dee466313a5e17b969d070ee
824ba00bf5cc85f85979a5b617716eb4
0c303f04c92ab2c13e92e90a1f21794e
2c4293931465af9d6cd990a3e8bf60d8
1c54228ca5c48ccb1d09875d39541b5e
7554f68b2e1e2fbff6083e995b0787ea
d4232c4e272ef986fe85195221a9ba1f
20283c332f55101dceb6b874952fb88a

Network Activity

URLs

URL IP
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4
hxxp://freecoins.vo.llnwd.net/d/FreeCoinsApp.exe
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.5/jquery.min.js
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topLine.jpg
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png
hxxp://googleapis.l.google.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/topComp.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bgImg.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bottomLine.jpg
hxxp://smartinstaller.elasticbeanstalk.com/Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0
hxxp://smartinstaller.elasticbeanstalk.com/Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O
hxxp://www.freecoins.co/CA_Servlet/trackingServlet?getGAparams=1
hxxp://www.freecoins.co/CA_Servlet/trackingServlet
hxxp://www.google.com/collect
hxxp://smartinstaller.elasticbeanstalk.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://smartinstaller.elasticbeanstalk.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/bodyImg.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/nextCase.jpg
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button_over.png
hxxp://staticrevenyou.outbrowse.netdna-cdn.com/offers/images/Theme8/button.png
hxxp://www.gamehub.ws/index.php?&productname=Free Coins
hxxp://www.gamehub.ws/css/index.css
hxxp://googleapis.l.google.com/ajax/libs/jquery/1.9.1/jquery.min.js
hxxp://pagead46.l.doubleclick.net/tag/js/gpt.js
hxxp://www.gamehub.ws/js/jquery.cookie.js
hxxp://partnerad.l.doubleclick.net/gpt/pubads_impl_47.js
hxxp://pagead-googlehosted.l.google.com/safeframe/1-0-0/html/container.html
hxxp://www.gamehub.ws/js/core-min.js
hxxp://www.gamehub.ws/js/sha256-min.js
hxxp://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/css/index.css
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/free_coins_logo.png
hxxp://ib.anycast.adnxs.com/tt?id=3092585
hxxp://ib.anycast.adnxs.com/tt?id=3092599
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/bg_body.jpg
hxxp://www.freecoins.co/FreeCoinsLandingPage/themes/thankyou/images/desttop_bg.png
hxxp://ib.anycast.adnxs.com/tt?id=3095266
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3092585
hxxp://flex.msn.com.nsatc.net/mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3092599
hxxp://ib.anycast.adnxs.com/bounce?/tt?id=3095266
hxxp://flex.msn.com.nsatc.net/mstag/mstag.1003102000.js
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266
hxxp://flex.msn.com.nsatc.net/mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600
hxxp://a1961.g.akamai.net/ANX_async_usersync.js
hxxp://a1961.g.akamai.net/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg
hxxp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1
hxxp://a1961.g.akamai.net/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg
hxxp://ib.anycast.adnxs.com/a_usersync?cbfn=ANX_async_load
hxxp://partnerad.l.doubleclick.net/pagead/conversion.js
hxxp://r.msn.com.nsatc.net/?type=1&domainId=2745850&dedup=1&actionid=207232
hxxp://partnerad.l.doubleclick.net/pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
hxxp://ib.anycast.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://www.google.com/analytics.js
hxxp://a.ssl.fastly.net/serve/52dfe62b6897d9bfcf00011e.js
hxxp://pagead46.l.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://www.google.com/collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601
hxxp://ib.anycast.adnxs.com/seg?t=2&add=1418586
hxxp://c.live.com.nsatc.net/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd
hxxp://ib.anycast.adnxs.com/seg?t=2&add=1459541
hxxp://ib.anycast.adnxs.com/px?t=2&id=157720&other=aXlHoNTekoQSgLGK
hxxp://www.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://prod-pixel-collector-1097235636.us-east-1.elb.amazonaws.com/seg/?add=1418586,1459541
hxxp://prod-pixel-collector-1097235636.us-east-1.elb.amazonaws.com/px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094
hxxp://freecoins.vo.llnwd.net/updates/a/desktopapp.wys
hxxp://ib.anycast.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load
hxxp://ds-any-world.ngd.ysm.yahoodns.net/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
hxxp://ib.anycast.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")
hxxp://partnerad.l.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ==
hxxp://www.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y
hxxp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1
hxxp://ib.anycast.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy
hxxp://ib.anycast.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
hxxp://ib.anycast.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load
hxxp://ib.anycast.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://ib.anycast.adnxs.com/mapuid?member=181&user=
hxxp://ib.anycast.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://ib.anycast.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load
hxxp://a1961.g.akamai.net/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif
hxxp://darcher3.darcherllc1.netdna-cdn.com/cdn/bv.js?bv=0.008
hxxp://freecoins.vo.llnwd.net/updates/m/fcmonitor.wys
hxxp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]208.71.121.1
hxxp://t.mookie1.com/rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]208.71.121.1
hxxp://any.edge.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus
hxxp://ib.anycast.adnxs.com/mapuid?member=364&user=2040815613008858
hxxp://ib.anycast.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load
hxxp://freecoins.vo.llnwd.net/updates/u/fcupdater.wys
hxxp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=338520359117040980595.131.122.226
hxxp://na.gmtdmp.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805
hxxp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30
hxxp://pixel.rubiconproject.net.akadns.net/tap.php?v=4894||
hxxp://ib.anycast.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?id=537072399&val=3385203591170409805
hxxp://prod-mkt-d.d.xx.openx.com.akadns.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
hxxp://pug33000.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805
hxxp://a1945.g.akamai.net/j/roundtrip.js
hxxp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]208.71.121.1
hxxp://ib.anycast.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw=
hxxp://a1945.g.akamai.net/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js
hxxp://eqv-ad-lb4.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805
hxxp://ac-na.quantserve.com.akadns.net/dpixel?source=appnexus&eid=5&id=3385203591170409805
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/w/out
hxxp://partnerad.l.doubleclick.net/pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876
hxxp://ib.anycast.adnxs.com/seg?add=1392486&t=2
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/x/out
hxxp://pagead46.l.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/f/out
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/l/out
hxxp://www.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/g/out?google_nid=adroll4
hxxp://www.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y
hxxp://partnerad.l.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926
hxxp://star.c10r.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI
hxxp://r.turn.com.akadns.net/r/bd?ddc=1&pid=54&cver=1&uid=338520359117040980569.194.244.11
hxxp://ib.anycast.adnxs.com/mapuid?member=1471&user=2040815613008858
hxxp://adservers-users-1-1251423768.us-east-1.elb.amazonaws.com/cm/g/in?google_ula=1535926,0
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b
hxxp://ib.anycast.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805
hxxp://idsync-ext.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1
hxxp://pixel-origin.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct
hxxp://ib.anycast.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load
hxxp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t
hxxp://e6791.b.akamaiedge.net/event/img?mm_bnc
hxxp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hxxp://ib.adnxs.com/seg?add=67361474.119.118.94
hxxp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hxxp://ib.adnxs.com/seg?add=673614
hxxp://a1945.g.akamai.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc
hxxp://a1945.g.akamai.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc
hxxp://ib.anycast.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load
hxxp://e6791.b.akamaiedge.net/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc
hxxp://e6791.b.akamaiedge.net/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc
hxxp://ib.anycast.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load
hxxp://partnerad.l.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805
hxxp://ib.anycast.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
hxxp://p-aws-oregon-tag-01-1110002569.us-west-2.elb.amazonaws.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684
hxxp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in199.38.164.155
hxxp://ib.anycast.adnxs.com/setuid?entity=11&code=NC-00000010467304128
hxxp://x.skimresources.com/?provider=captify&uid=338520359117040980554.85.113.130
hxxp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE]208.71.121.1
hxxp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805
hxxp://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=2040815613008858
hxxp://ib.adnxs.com/a_usersync?c=4&cbfn=ANX_async_load
hxxp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805
hxxp://cdn.adnxs.com/ANX_async_usersync.js
hxxp://pixel.mathtag.com/event/img?mm_bnc
hxxp://www.googleadservices.com/pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp
hxxp://ib.adnxs.com/a_usersync?c=6&cbfn=ANX_async_load
hxxp://ib.adnxs.com/a_usersync?c=9&cbfn=ANX_async_load
hxxp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css198.232.124.224
hxxp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus
hxxp://cdn.wemempoclano.net/updates/u/fcupdater.wys
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP
hxxp://static.revenyou.com/offers/images/Theme8/button_over.png198.232.124.224
hxxp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805
hxxp://a.adroll.com/j/roundtrip.js
hxxp://ib.adnxs.com/bounce?/tt?id=3092585
hxxp://ib.adnxs.com/a_usersync?c=7&cbfn=ANX_async_load
hxxp://static.revenyou.com/offers/images/Theme8/button.png198.232.124.224
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct
hxxp://adx.adnxs.com/mapuid?member=181&user=
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599
hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://cdn.adnxs.com/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585
hxxp://d.adroll.com/cm/g/out?google_nid=adroll4
hxxp://ib.adnxs.com/a_usersync?c=3&cbfn=ANX_async_load
hxxp://www.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y
hxxp://ib.adnxs.com/a_usersync?c=1&cbfn=ANX_async_load
hxxp://flex.msn.com/mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js
hxxp://d.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw=
hxxp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy
hxxp://ib.adnxs.com/seg?t=2&add=1459541
hxxp://data.getserverinfo.com/Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=054.83.205.127
hxxp://static.revenyou.com/offers/images/Theme8/topComp.png198.232.124.224
hxxp://ib.adnxs.com/a_usersync?c=0&cbfn=ANX_async_load
hxxp://ib.adnxs.com/tt?id=3095266
hxxp://ib.adnxs.com/a_usersync?c=5&cbfn=ANX_async_load
hxxp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc
hxxp://www.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI
hxxp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128
hxxp://d.adroll.com/cm/f/out
hxxp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=338520359117040980564.94.107.19
hxxp://ib.adnxs.com/a_usersync?cbfn=ANX_async_load
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hxxp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=
hxxp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1
hxxp://pixel.prfct.co/seg/?add=1418586,1459541
hxxp://data.getserverinfo.com/Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O54.83.205.127
hxxp://www.google-analytics.com/collect
hxxp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ==173.194.43.109
hxxp://partner.googleadservices.com/gpt/pubads_impl_47.js
hxxp://static.revenyou.com/offers/images/Theme8/topLine.jpg198.232.124.224
hxxp://data.getserverinfo.com/Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.454.83.205.127
hxxp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd
hxxp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0
hxxp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=268454.200.162.182
hxxp://www.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y
hxxp://ib.adnxs.com/tt?id=3092599
hxxp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc
hxxp://ib.adnxs.com/a_usersync?c=2&cbfn=ANX_async_load
hxxp://static.revenyou.com/offers/images/Theme8/nextCase.jpg198.232.124.224
hxxp://www.googleadservices.com/pagead/conversion.js
hxxp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png74.125.201.95
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css74.125.201.95
hxxp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=254.83.205.127
hxxp://ib.adnxs.com/a_usersync?c=8&cbfn=ANX_async_load
hxxp://cdn.freecoins.co/updates/a/desktopapp.wys
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js74.125.201.95
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js74.125.201.95
hxxp://cdn.wemempoclano.net/updates/m/fcmonitor.wys
hxxp://ib.adnxs.com/mapuid?member=364&user=2040815613008858
hxxp://ib.adnxs.com/mapuid?member=1471&user=2040815613008858
hxxp://ib.adnxs.com/tt?id=3092585
hxxp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=338520359117040980569.194.244.11
hxxp://ib.adnxs.com/px?t=2&id=157720&other=aXlHoNTekoQSgLGK
hxxp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")
hxxp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882
hxxp://ib.adnxs.com/seg?add=1392486&t=2
hxxp://d.adroll.com/cm/w/out
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266
hxxp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png74.125.201.95
hxxp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805208.71.121.14
hxxp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js
hxxp://d.adroll.com/cm/l/out
hxxp://flex.msn.com/mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600
hxxp://static.revenyou.com/offers/images/Theme8/bgImg.jpg198.232.124.224
hxxp://d.adroll.com/cm/x/out
hxxp://ib.adnxs.com/bounce?/tt?id=3092599
hxxp://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js74.125.201.95
hxxp://cdn.freecoins.co/d/FreeCoinsApp.exe
hxxp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805173.194.43.109
hxxp://cdn.adnxs.com/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif
hxxp://dcdn.darchermedia.com/cdn/bv.js?bv=0.008
hxxp://www.google-analytics.com/collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://www.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601
hxxp://d.adroll.com/cm/g/in?google_ula=1535926,0
hxxp://tpc.googlesyndication.com/safeframe/1-0-0/html/container.html173.194.43.106
hxxp://tag.perfectaudience.com/serve/52dfe62b6897d9bfcf00011e.js23.235.44.130
hxxp://www.googleadservices.com/pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876
hxxp://www.google-analytics.com/analytics.js
hxxp://flex.msn.com/mstag/mstag.1003102000.js
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1
hxxp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hxxp://ib.adnxs.com/bounce?/tt?id=3095266
hxxp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc
hxxp://www.googletagservices.com/tag/js/gpt.js
hxxp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926173.194.43.109
hxxp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b
hxxp://static.revenyou.com/offers/images/Theme8/bottomLine.jpg198.232.124.224
hxxp://pixel.prfct.co/px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094
hxxp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&
hxxp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1
hxxp://ib.adnxs.com/seg?t=2&add=1418586
hxxp://static.revenyou.com/offers/images/Theme8/bodyImg.png198.232.124.224
hxxp://cdn.adnxs.com/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg
hxxp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805
hxxp://pixel.rubiconproject.com/tap.php?v=4894||
hxxp://2745850.r.msn.com/?type=1&domainId=2745850&dedup=1&actionid=207232

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/css; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Thu, 21 Aug 2014 09:06:21 GMT

Expires: Thu, 21 Aug 2014 10:06:21 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 6091

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 2621

Alternate-Protocol: 80:quic

...........=k.....3...E...yl.=.=.....7@..6..~...e.#K.$.#A..=.!%J|iz...;@Z.:...y..}..........X.H~{G...O~......-.M^M....@o..c.....Og.s............!/.Ms.\\...'t.&qy..........hN.,fE..r*.V.f..O.>.."...G._.... s.WO8f....v...dJ>O...H ..o..>..! v.o~y...gg.....#.D.,?BwgQ...&.,B.h.%. .'.d.1...R...&.M...1..l.3.?.u..t.B.u...F....e....&q..7.bq.bv| ........... V..z;.j.A_.kr.I.J...e.z..A.yV0........0..5i.C.%,. .L..iY4Q.}...t......y..U.q.h.f..-K.....3.6...H..Y..|..u.....\d[T.........>......|...Y...T.*...<..X..F.S.:.4..G.<.r`k.&?........0.p.w gEcN..=.'8a...E......~...$OXJOy.s)...ud..\tQ.Z$$;..|.}g@G..m^...S2.gn.h......;V.yy.!...{4..U%D>x....{...2.SV....!Y<....3..e...cMTb.5.,f...r..$Or..%X...78.I.>..Y.99@.........U......4....5.......2.......UY.<.W EY.h.<.U.l2c.....V.J..T.^...owo.....(...|...Sh..~x..l..ovyY.7...M... ..v2.%.j....Np1_....4...M...9.~.,y.V..b.-...i.&i.q...W7......*1.QP.k:C..^.k6..T.\.u,..LW.(S<)5.............X...ZW...#.UC*.:nT;.....\<._.. J.YK.:9.H}3....U.B..$..W..f$l]^m....@..c..........0.h...l.q.,(."......l.%........:.A..y.'n.. ..j:.q2.]r..M...j.JSQ....i.8...J...".iZ.V.....5..'S:.*..C..V.Y.!S.k*.:FT.tv...1.P.A.e..r.h......-..uGZ6.(.....l..!5....z....2M!.?.G.........'....U>..-aH/ .E.D.T{J..C!...tK.!.a.v..~......$....5 ..xj.u...P...x.@ F{..S..R.O.<d#.E%PS.//......5fV.4...1..S.......mw..#..o Q. .....p_yI..ox.....UM.uP....b.v0GE.....A....X.!pX4.......Y-o..f9.....L.p$.........;..P...Q.b........mZe..$s..].8..t...M...o......X...S".>..1A*.....2h......D.j8Y..wL..^.| ....1...`C

<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/jquery-ui.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Thu, 21 Aug 2014 08:52:26 GMT

Expires: Thu, 21 Aug 2014 09:52:26 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 51558

X-XSS-Protection: 1; mode=block

Age: 3457

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Alternate-Protocol: 80:quic

............iw...0....d...-.@......."...x{,y.<....n.M....ZB...w...AP...9.L,.k_n..n.{.......V..G..<........}......n.........l..Y....z3..................E1.-.uz..........ZXI..rZm....../X...4.......@..Z......yUlB..U#..L...1p.>...2...].....M(...J.....e..I......5...9...e.....&.........W..y...f./..j..}^....r...n.._7.j.o..v.i./a.7uq......r.%.,......j9..Y.s......@..$...... \...H...=....?....y...}W..b].G..|-....wG.N.O<.H.Q...'w......H.....*.....?..Uo..n..Z=..U...I...*..,....J.@.b.....l.[@E1.....jq<..V.d.=.n......,..o... .gY.G....N%$f..u..."J.....xvrR..$.q..i....l..m7....p...]./!.......JF0..^.. ...Q.....H..q...._wr"9..S].I/_.....~M...Z..U5..^q.z..U...k..........Q.........v...[.v..`:UJvIo^-...........n.;..{o....p.CliS-J..w27...F.....v .{...t..........g._._...~z......wz.......gP.K.....W....w/.ym......B.cH....?~..~/.~..../...._.........4..s........x..z|...^|.../.._..?.z..............?.......?=......N......_<...3.n..I/..../ e.Rd../U...|...O.....Pi.~.....=.5..%~z...oh..?.._~J.?.?.....0....g.. ....0....W...x....W.k|)....h....n...7Y....c..l.Y..._...3.D.f.,n..G?.'h...*.l...ZN...R...q..F.;.*/f6T.q-3........Z.n..y\&.].......*.C..p..I.U.Z/....`..W..k<.Pn]....OtJR...P...j.n...z]W''..z.o.b.....m...K...u.)..%.v{.8p9..T....4U......X..U.o'...T.....D...G.tc.3o....8./.a.NK^...........q?I.0.....)-..m.\..m...@.0......\..{.>........D..n..Gp..)R:...>.D ....d.nV.......C....pWe.?Xl.B.....6} .Q.4...j....^.6q..3..>5w\.....'.@....&6...?ok..$.;....[...!Vo........vx}{s.L.dA...6......8.r......bt.>"a........0...I~;....

<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_gloss-wave_75_2191c0_500x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Thu, 21 Aug 2014 09:46:20 GMT

Expires: Thu, 21 Aug 2014 10:46:20 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 3457

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 223

Alternate-Protocol: 80:quic

.PNG........IHDR.......d.....p..}...HIDATx...K..N................q..B....6...._.d.c.......*...V......|U.......w-...p..>Z..........`............`............`............`............`............`............`............`.......@.....:n.K>.u.....X..V..G........l.9......j6.x..xu..y...I... gZ.D.L...........4[OG.8.|d.....;.N[O..lz.M....{..ne.Z1..VlO...e..k.g.........k.6.r..........be'`t#..zu39.|[..6=9....4..H."...-Cd.D.z.3c.g...S.,..D7.h.H=O.F6.{7.....H6G...S.......U.9.%w....`C.....y.G^@......O..........0.l.....0.Z.4..H..[.k..Z..Z..zm].v.......J.$ZMZ..yK.....Z.4.Z.Z.Z.Gr..M..j.b..Z^.1c.E........,....6&.9....3)....[W.vH...a...k~....,.........1..k.R..........iWd....M.V..O)..?y.....W...._<....p.p....`............`..b.......:............:.............Xj)...w.....-?M.bE|[...I.eki......&.U.6.........l4.[..N.F.....|...qc.Zj.7.....;.f/..w..=......}L[...k.E.S/.x....3-...^.R....."Z.........[........:.;...n.Z..~.....;.....%w....P7...'R^....E[?.C...X.$.^Y.Yj...}...iS.O.....m........r%..4yy.r..I.....Io...'i..;..._....K.7.%.Q../.\......X....3;_........[...[..ti.........._.-..Z.l;j)e.L.lyf"Dm..^4...-.|G.E VdRD..M....S[.{.i6G...~/7V.h....M..;^.1~.}.;......=9.]S2....y.w|Y.#s(..X..;....:=....Y_#.\r......RkY.$.e.mk..n.E|..m|....kk...O.......'......-..n.z..XZ}m\H.._e.....V.x9........!.../.xs......f.......5.Zl .......x.....].?/..9r......h...]^}M....<....;..........p.p....`........}.....n..~....4............. ^=..kc...|j..4{u[.......H.2...Y1......R..|x.5M......j..4.%..x......!ij....bXcT..^[$=V.4<m^.=~..Yo.E..s..>....

<<< skipped >>>

GET /ANX_async_usersync.js HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4

HTTP/1.1 200 OK

Server: Apache

ETag: "e3de0e76c13e81e3b0683dac240498eb:1377552334"

Last-Modified: Mon, 26 Aug 2013 21:25:34 GMT

Accept-Ranges: bytes

Content-Type: application/x-javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Date: Thu, 21 Aug 2014 09:51:04 GMT

Content-Length: 509

Connection: keep-alive

...........TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s...|\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H......-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...W:4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X.\...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w.........X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&...M6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,./.,H).|..0g.z...k../g...HTTP/1.1 200 OK..Server: Apache..ETag: "e3de0e76c13e81e3b0683dac240498eb:1377552334"..Last-Modified: Mon, 26 Aug 2013 21:25:34 GMT..Accept-Ranges: bytes..Content-Type: application/x-javascript..Vary: Accept-Encoding..Content-Encoding: gzip..Date: Thu, 21 Aug 2014 09:51:04 GMT..Content-Length: 509..Connection: keep-alive.............TM..0.=.....\Q.p.*Z.ho.'.H.E.=I....N....g.$m.v....)...f.s...|\.-D..,...(..V3]...FfN~...q...[X....2jg.p...8.........,.M).E...H......-P..Dn...;...M..h.....v.6r.ADx4.Nl..'......z....O.k.U.....x.k...1...W:4F....Y.)w.D.c6B.d..I.......H...;.....X.L./1.h.c..(.t.6N.4.o..N:C..X.\...G....F..5}G(..v.K.].......2..<."S.[.)m....`i..r....ax...j...w.........X.v..F....t.XX.n."'_.Md.0..........L..[oR.4........>..(.&...M6...p..mu.?..I....z........^[..\.(d....Q...F..@..\.../..:6..!.^. ..,./.,H).|..0g.z...k../g.......

<<< skipped >>>

GET /p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz0Fhu?d$ L8ih

HTTP/1.1 200 OK

Server: Apache

ETag: "1a825d5acd849546ad35aa925bf5f9f7:1408446966"

Last-Modified: Tue, 19 Aug 2014 11:16:06 GMT

Accept-Ranges: bytes

Content-Length: 5470

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:09 GMT

Connection: keep-alive

GIF89a..X......$..67b...k.....&.....Mb....6..r...Z..t.I........r..6..#|.'..............^...P.......a......{.K..............%.....a...........p..r...h.H..%.........f.1..q......FFF..M...}.nc..n.3V..]...........3]...#e...........---u.....s.....Il,m.H...2[....M}....Dq.cjT...r..i. y..o..w..q..z..o..p..y..x..s..n..v..u..r..v..t..r..q..p..x..w..x..p.....t..z..n..t..&&&.....#s..s..u..u..hjk..q..s........$..%..$.....%..$..q..%..............%.....$T....%......k..{..w.*..&..!.....%...j.....o....U.....!..*|.....WWWAI1FS)...l....u.................$w....#......p....r...|.............%........|..F......z..|||p..o..LX3.....(..9............Ix.........%......n.[.. p.\..k~.@\xF......Tz......Lh...........w........q.I~.]..ox.J.....`{.<......j.2..............o..l.....M...........pt.\.....M...!..XMP DataXMP<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="hXXp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="hXXp://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:a07e3509-56d3-9e47-9312-c420c55db420" xmpMM:DocumentID="xmp.did:64256D6B215211E4932BC583D61BF021" xmpMM:InstanceID="xmp.iid:64256D6A215211E4932BC583D61BF021" xmp:CreatorTool="Adobe Photoshop CC 2014 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:fd28247f-299f

<<< skipped >>>

GET /gpt/pubads_impl_47.js HTTP/1.1

Accept: */*

Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partner.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript

Last-Modified: Wed, 13 Aug 2014 09:40:03 GMT

Date: Tue, 19 Aug 2014 04:32:03 GMT

Expires: Wed, 19 Aug 2015 04:32:03 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 33599

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 191938

Alternate-Protocol: 80:quic

......n.....y..H.8.._.....B..sL"Y..8N...L....i].9D.....?U..ZB$...wgcZ}..U.u..b.....vn/.l{..... c3_.p.v......e:...;..W.s.(.b./.....~3..d.{....."......|B...=.ds>.1..l.o........y....i;........,...f}.~....^=....E.h..l..L....=.Uk.o.l....\Z..8.g...T.......k-&Q..&qd....t4..M...i<...f'Pq<.....T'....r..Fw...{...fq2J]..o..u.=RKo..Q.o.....x..}..`......X^... ...m)..*...bQ.N.4.\.&*....M..bYU...1#......U.bq.H....Y..T.....S..s..Y..%...Q.-fqw1..Vm.n.<.........1..'O.4...~..........5...ttc.z....Y.v.d.A...%a.w.3.......,..t ..u99.b..OG.8....y.U.v..s...._*.x.\.I..$s9..E....p4..z.k...Y.......y5......k.lJ.P.v..._.......2.....D.........;.'.K.uQ\..3m..i..?.%`u..t.. ..<.t..8KC.?...>I......M..mL_......;..........Fg0......._...p6...K.....U..........5x.c.....q<g'O......q..\.iE>......1}/uU}m.xg..T.A..x.S.;.....1.0..q...........!K..4.l..u.../.6X$.nG........Wt.R.......i...........3....x..&......JB.z..<.q.K|....*f.g....<$.z.}.'.Q..71.m...o./.y:.t...r..V........5ot..._.......C-.r.V......g.t...k.-u.....,(}.6.;3............`.r`"....qf.....{...p-..s..U...e^`.^U.;..r.K..m.V.}g.. ...{..r._7.k...@..........0.s.=....>..K.....~...5.b....A.....O.;.}..j!.'.e..a........{D.. ..0.[.6.T g..e......YsaR...B.[]5T.g1...Q._....-....9.....h<..6........6..@......hn7.....%....V...".xc7a...[...9....SWOf...*8.....U..!..$.......k.......`.....Q.@?.?..B.......jbo.d.G..g.k.n..uj...i.A.6.........Bj..[...v-oK...:...D\/.{..paT,....,_......<..9.aa..|.........Y...sq....{.....[0.g.6....:?o..:.(.`0.`....'..Qp..9....n<...e0D....u...).~V..

<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:58 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:58 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<< skipped >>>

GET /offers/images/Theme8/nextCase.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:59 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:59 GMT..Content-Type: text/html..Content-Length: 1245..Connection: keep-aliv

<<< skipped >>>

GET /offers/images/Theme8/button.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:50:59 GMT

Content-Type: image/png

Content-Length: 458

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:12 GMT

ETag: "1b5642f092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 28 Aug 2014 09:50:59 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...lIDATx...1..p....at.`...[_)...&.........~...C..V$z.J.w.Wi........../..<........R.H)s..i....t.....}2M...9i.&..(..c.....l.&.0`.&a..f...p...R.Jr....bA....$.....cr....u....sq..x....?..> ..pu`.h..C.......$w$..gY. .....%9MS...V.....IF'..0].;..HF..]b..Hr..pW...k..{..EQD.....-L.....#..H.u.. ..lF....j".,<........<. ......18....\.....oI...^.....:..._......rU.<Z`..d..E.|.0.......B.....IEND.B`...

GET /rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t.mookie1.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:09 GMT

Server: Apache/2.2.3 (Red Hat)

Set-Cookie: id=2040815613008858; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com

Set-Cookie: mdata=1|2040815613008858|1408614669; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com

Set-Cookie: OAX=igh79FP1wQ0ABVfH; expires=Sun, 20-Sep-15 09:51:09 GMT; path=/; domain=.mookie1.com

P3P: CP="NOI DSP COR NID CUR OUR NOR"

Location: /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]

Connection: close

Content-Type: text/plain; charset=UTF-8

GET /js/sha256-min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.gamehub.ws

Connection: Keep-Alive

Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:02 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT

ETag: "406d0-5aa-4fc68d5e5db4d"

Accept-Ranges: bytes

Content-Length: 1450

Connection: close

Content-Type: text/javascript

/*.CryptoJS v3.1.2.code.google.com/p/crypto-js.(c) 2009-2013 by Jeff Mott. All rights reserved..code.google.com/p/crypto-js/wiki/License.*/.(function(k){for(var g=CryptoJS,h=g.lib,v=h.WordArray,j=h.Hasher,h=g.algo,s=[],t=[],u=function(q){return 4294967296*(q-(q|0))|0},l=2,b=0;64>b;){var d;a:{d=l;for(var w=k.sqrt(d),r=2;r<=w;r )if(!(d%r)){d=!1;break a}d=!0}d&&(8>b&&(s[b]=u(k.pow(l,0.5))),t[b]=u(k.pow(l,1/3)),b );l }var n=[],h=h.SHA256=j.extend({_doReset:function(){this._hash=new v.init(s.slice(0))},_doProcessBlock:function(q,h){for(var a=this._hash.words,c=a[0],d=a[1],b=a[2],k=a[3],f=a[4],g=a[5],j=a[6],l=a[7],e=0;64>e;e ){if(16>e)n[e]=.q[h e]|0;else{var m=n[e-15],p=n[e-2];n[e]=((m<<25|m>>>7)^(m<<14|m>>>18)^m>>>3) n[e-7] ((p<<15|p>>>17)^(p<<13|p>>>19)^p>>>10) n[e-16]}m=l ((f<<26|f>>>6)^(f<<21|f>>>11)^(f<<7|f>>>25)) (f&g^~f&j) t[e] n[e];p=((c<<30|c>>>2)^(c<<19|c>>>13)^(c<<10|c>>>22)) (c&d^c&b^d&b);l=j;j=g;g=f;f=k m|0;k=b;b=d;d=c;c=m p|0}a[0]=a[0] c|0;a[1]=a[1] d|0;a[2]=a[2] b|0;a[3]=a[3] k|0;a[4]=a[4] f|0;a[5]=a[5] g|0;a[6]=a[6] j|0;a[7]=a[7] l|0},_doFinalize:function(){var d=this._data,b=d.words,a=8*this._nDataBytes,c=8*d.sigBytes;.b[c>>>5]|=128<<24-c2;b[(c 64>>>9<<4) 14]=k.floor(a/4294967296);b[(c 64>>>9<<4) 15]=a;d.sigBytes=4*b.length;this._process();return this._hash},clone:functi

<<< skipped >>>

GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: dis.eu.criteo.com

HTTP/1.1 200 OK

Cache-Control: no-cache

Pragma: no-cache

Content-Type: image/gif

Expires: -1

Server: Microsoft-IIS/7.5

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Date: Thu, 21 Aug 2014 09:51:15 GMT

Content-Length: 43

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Control: no-cache..Pragma: no-cache..Content-Type: image/gif..Expires: -1..Server: Microsoft-IIS/7.5..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 43..GIF89a.............!.......,...........D..;..

GET /rsp/cc?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE] HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:09 GMT

Server: Apache/2.2.3 (Red Hat)

Location: //ib.adnxs.com/mapuid?member=364&user=2040815613008858

Connection: close

Content-Type: text/plain; charset=UTF-8

GET /ajax/libs/jquery/1.5/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Mon, 02 Apr 2012 18:24:28 GMT

Date: Thu, 21 Aug 2014 09:06:13 GMT

Expires: Thu, 21 Aug 2014 10:06:13 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 29947

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 2629

Alternate-Protocol: 80:quic

...............F....>..R..1.d...j0!^Y....l..jW....@..w.Le.I............@0.....$..}9[.......O....f.O.......6......6...W.?..!.t............C...r....'.}.Y..J5.....?g.|...n.Ec...j.....Q.m..Y..w...m..?}...l.....3.o.>mp..t.g..w.tq;.v...o.-..l...q.lg:z..w..W....zM.....d.9[d.IOU....T#^....;..1..,..o.o.m.......g...}.m5.._u........*ES~.....5.....m......v..%_..w......Z..w.6Y.E.....l......gw.C....l...a..X.:F...o&...a...z.D#...Zq.{...x..V.wk.K..O^..(i.......f.SR/io...c..=.,.^x..*...~..4...:.{=n(J.z(..t(.q..i.p...Y.N.tD..J.=........vXn.K..e.-xH..i..F.1..f.....e.o?..\ew....>~...c2........z..............Gj.zB.;:....2..M.sF.s../..*8..o....x.;....>& n.... .....y......4Ui.@......b.m/.h...?U.....=T.EE.N.i..DMU.e.E....j..Q6...B-.J....>M....:.MZ-.4.Z..._..i.%..m..]..........o.........~.......3...HN..t.................E/[....-..vq..y....-....j......0.xO..U4W..&Jx.ktt.<..u.6oNK..x..h....p.Oh.......P...6...R.C..\.n..m..?..W....6..G.....hn..h.o......!.ep6...T..N..$.......5.)P...3.V......_.O...5..gl.5........c......6.m...^..b...c.y.r..$.....L..p...o.................(,uB..T.2_28....d..us.f1.L..=..&..bV..m<..=........3D..\.Y..r3....A_.Y.G.%.....7|.$t.Z.k..C..\.8?.h...q....naF.i-.......B..`6t.._..h12n....v..".pq..C.h.......x...N.L...p..............f`E@.ha.....m..zj.] h........v..(i....|mv....7.......t......j..j...c.K2...;.4.$;Ve...-o4.~.;..h.M...(*N....m0T.G]5.......K`#.&..Z.V...3......m2.Z.hJ;..F...`Q.QM.?.,..E........@......=.b.........._.Fi.h6........l....2.}$...>.=.N.M)....$eP..]..p%M....|.e......&jJ...x.u...:..

<<< skipped >>>

GET /ajax/libs/jqueryui/1.8/themes/start/images/ui-bg_inset-hard_100_fcfdfd_1x100.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: image/png

Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT

Date: Thu, 21 Aug 2014 08:59:41 GMT

Expires: Thu, 21 Aug 2014 09:59:41 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 88

X-XSS-Protection: 1; mode=block

Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600

Age: 3022

Alternate-Protocol: 80:quic

.PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w...........IEND.B`.HTTP/1.1 200 OK..Content-Type: image/png..Last-Modified: Fri, 12 Oct 2012 18:27:19 GMT..Date: Thu, 21 Aug 2014 08:59:41 GMT..Expires: Thu, 21 Aug 2014 09:59:41 GMT..Access-Control-Allow-Origin: *..Timing-Allow-Origin: *..X-Content-Type-Options: nosniff..Server: sffe..Content-Length: 88..X-XSS-Protection: 1; mode=block..Cache-Control: public, must-revalidate, proxy-revalidate, max-age=3600..Age: 3022..Alternate-Protocol: 80:quic...PNG........IHDR.......d.....G,Z`....IDAT..c.....&.....G0..ed.......w...........IEND.B`...

GET /cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:12 GMT

Server: Apache/2.2.3 (Red Hat)

Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858

Connection: close

Content-Type: text/plain; charset=UTF-8

GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671

HTTP/1.1 200 OK

Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)

Pragma: no-cache

P3P: CP="CUR ADM OUR NOR STA NID"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Type: image/gif

Content-Length: 43

Cache-Control: private, max-age=0, no-cache

Connection: close

GIF89a.............!.......,...........D..;..

GET /p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4

HTTP/1.1 200 OK

Server: Apache

ETag: "9531dfcab239be5053dbfa4ef4277fce:1408543221"

Last-Modified: Wed, 20 Aug 2014 14:00:13 GMT

Accept-Ranges: bytes

Content-Length: 21629

Content-Type: image/jpeg

Date: Thu, 21 Aug 2014 09:51:04 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................Z.............................................................................................."#3.!2CSc..1BRs..Abr...$Qaq..4...........DTt56...d%..Uu7..............................!1..".AQ2.a..q...B#...Rr34...$............?..N.z...:.\..!....5.)......t..[.g.bJ../~Z......84.......7..Z.uZ.b..T...P{"......u9j.e..|*T..]....~'.s....eo..[V...V..c.........}]U.'v..9.]s...5.Y=.1V[...[*3.....3JW.W..p.........%..l.i..U.....lK..g./.....4...:..j...&.f.M.Q....U.z.................h..(..8.^F.R=<M.{LS.h....M...*...t<[.....t.f@....1..M.........wO.D=..I.~......h=.kE|.-n.9&.9!...q2.......\......y.r...h.P.<3.... .WV..f..!.IM~.vI.....fu.m.}.c...P.dV..,F.....ZQ.A..B...W..qx..,........g)...|.k.&G.4.4G.;...e....K..O{?.......B.....V..!......d...q.q.....V.p`..2.....v`..$.k".Z.E^t.=..]..[v.p.$...%......Zm>MJ.....$I.$.dj.r'....p....o9.6..&..\..HBR.(.e.Oy..{...5.)...j[.MR.[..LIk....yF...d.....c9..K_...I....d..1............B...Q....;.....W..0.......S.....~.~.|..............t..P~i......W.....l...K4.....1..~&.W...8..ZQ?_.\..1r.h;w......$.rQ.d...M.b[..0..:gi..-IJ..G.....^....s}...p....$...yp....b:.d.v..kk3. ........Q..{P.k.2.......5X:.?..6o....T....F.....$...j..~....{............7......s...D...h0d.4!,.vw..@$...o'.b..Jb....*.pT._..d.%..T...9.qr^'w&.{...X.~.....-.MF.b|LO.....m.....h.M.$...r.......G....V\..(........ ..hy[.B.u...4}T...?.M..u]

<<< skipped >>>

GET /p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4

HTTP/1.1 200 OK

Server: Apache

ETag: "6ffe88efc10e4300c223a6efe5e670a3:1408542730"

Last-Modified: Wed, 20 Aug 2014 13:52:07 GMT

Accept-Ranges: bytes

Content-Length: 49331

Content-Type: image/jpeg

Date: Thu, 21 Aug 2014 09:51:05 GMT

Connection: keep-alive

......JFIF.....d.d......Ducky.......<......Adobe.d.................................................................................................................................................X..............................................................................................!1AQ".a2.qR#3...B4..b$.r........CSs..6....c..7.Tt%U.......................!1Q...Aaq...".......2BRb...r...#..3C.4.Sc$............?...........b..bAtI.'[E..q%S.M.....P-#ED...QV..]42.A,..(.&T$.....R]..O..z.d.....b8.{j.B.J.he>..k../..;...AR...n..JJ.@.Z......6.9.q.W'Q[1..dr,EPC%#5D...U.k.R.),yR.7.R*(......PbQ.t2Z[R.0.UU..S...b.j...iru^..&A...K...6k.....U"..........2.p..Q.*......_..x....L.L/y. [..P.TW.._.5.,.......1..<.'\.......-[[h .....v.wU..._.t*....};..b.....*.E3p......P..)...._./...D..f.^.........5........_.. [|.).. X...{.Y^".F..EQ:.n...e....J.....(...U...=@.....2......q....:...s<.W.9cyXu....}...`G.....Qe.S....O-x.Z.....q....5..9.....9K0...6B.O.R_Jk.4F!... 7.Y|'..oEI...\k~..H.....D.|...j.w.2..LfQ .q......@RW>.5mQ~ ..42...Q..5....^. ..O>.6......R..:..k...M.5.77..OHE.1N...*.~.j..4.@.8.Z.c.l....n....5.I.....aO.Z.rb.FM.P...........xL]k..5j.qMTI..........SB.(..'..%............4."iHTN,..b#..d.........../.#..&.f.......R..[f....Z@^.A.....U5$ ....O.C..H..{.U.....^..F,...J.n.......C&.....Z'..Z%.5UZ..]d.T"6).M...."..L.b4.D....'O..o.j.......9Z....-......dE.$..t%..D....#.K9Y..le...;...w..I.v.N....V......)..J...b.mI........2.zg..jL.Xp.8.!.. .U.......i.c .(b........;""...5W$.G...!.W......U._.Xj%*..aR3...Qi.....q_.5.?my...b...

<<< skipped >>>

GET /is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: ak1.abmr.net

HTTP/1.1 302 Moved Temporarily

Content-Length: 0

Location: hXXp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc

Expires: Thu, 21 Aug 2014 09:51:15 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Thu, 21 Aug 2014 09:51:15 GMT

Connection: keep-alive

Set-Cookie: 01AI=2-2-25FB066375997C08AA677974C936756369EEB775B3215452B8D97A7A0953AB1B-A1FE72069F55C12A131FFA81D61F21398DF6187ADBE704B79CE071A6719EB0D4; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net

P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"

HTTP/1.1 302 Moved Temporarily..Content-Length: 0..Location: hXXp://pixel.mathtag.com/event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: 01AI=2-2-25FB066375997C08AA677974C936756369EEB775B3215452B8D97A7A0953AB1B-A1FE72069F55C12A131FFA81D61F21398DF6187ADBE704B79CE071A6719EB0D4; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net..P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"..

GET /event/img?mm_bnc HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.mathtag.com

Connection: Keep-Alive

Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost

Content-Length: 0

Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc

Expires: Thu, 21 Aug 2014 09:51:15 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Thu, 21 Aug 2014 09:51:15 GMT

Connection: keep-alive

Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com

P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"

HTTP/1.1 302 Moved Temporarily..Server: AkamaiGHost..Content-Length: 0..Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"......

GET /event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=; HRL8=CT-1

Connection: Keep-Alive

Host: pixel.mathtag.com

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 43

Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x12 pid 0x1109 4361

Expires: Thu, 21 Aug 2014 09:51:16 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Thu, 21 Aug 2014 09:51:16 GMT

Connection: keep-alive

Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com

Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT

P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Type: image/gif..Content-Length: 43..Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x12 pid 0x1109 4361..Expires: Thu, 21 Aug 2014 09:51:16 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:16 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com..Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"..GIF89a.............!.......,...........D..;..

GET /cm/x/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Thu, 21 Aug 2014 09:51:13 GMT

Location: hXXp://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI')

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.4.7

Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/

Content-Length: 112

Connection: keep-alive

Go to hXXp://ib.adnxs.com/pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI')....

GET /cm/f/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Thu, 21 Aug 2014 09:51:13 GMT

Location: hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.4.7

Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/

Content-Length: 112

Connection: keep-alive

Go to hXXp://VVV.facebook.com/fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI....

GET /cm/g/out?google_nid=adroll4 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Thu, 21 Aug 2014 09:51:14 GMT

Location: hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.4.7

Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/

Content-Length: 117

Connection: keep-alive

Go to hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926HTTP/1.1 302 Moved Temporarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Thu, 21 Aug 2014 09:51:14 GMT..Location: hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/..Content-Length: 117..Connection: keep-alive..Go to hXXp://cm.g.doubleclick.net/pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926..

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: eu-gmtdmp.gd1.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:10 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Connection: close

GIF89a.............!.......,...........D..;..

GET /pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: googleads.g.doubleclick.net

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Thu, 21 Aug 2014 09:51:06 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Aug-2014 10:06:06 GMT; path=/; domain=.doubleclick.net

............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?...HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Date: Thu, 21 Aug 2014 09:51:06 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://VVV.google.com/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: cafe..Content-Length: 76..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..Set-Cookie: test_cookie=CheckForPermission; expires=Thu, 21-Aug-2014 10:06:06 GMT; path=/; domain=.doubleclick.net..............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?.......

<<< skipped >>>

GET /pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3

Connection: Keep-Alive

Host: googleads.g.doubleclick.net

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Date: Thu, 21 Aug 2014 09:51:13 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://VVV.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Date: Thu, 21 Aug 2014 09:51:13 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://VVV.google.com/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879..Content-Type: image/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..GIF89a.............!.......,...........D.;..

GET /px/?id=157720&other=aXlHoNTekoQSgLGK&a_id=7094 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.prfct.co

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Cache-control: no-cache="set-cookie"

Content-Type: image/gif

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Server: Jetty(9.0.5.v20130815)

Set-Cookie: pa_uid=pa_YE6NcKMeCbRFLEScY;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT

Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC0C8EF11D2BF2EEF1E82F34F041864DF0CDFDC718E7050E1FA11D9BB039B95618;PATH=/

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Cache-control: no-cache="set-cookie"..Content-Type: image/gif..Expires: Thu, 01 Jan 1970 00:00:00 GMT..P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..Server: Jetty(9.0.5.v20130815)..Set-Cookie: pa_uid=pa_YE6NcKMeCbRFLEScY;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT..Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC0C8EF11D2BF2EEF1E82F34F041864DF0CDFDC718E7050E1FA11D9BB039B95618;PATH=/..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..

GET /pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ== HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: test_cookie=CheckForPermission

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://adx.adnxs.com/mapuid?member=181&user=

Date: Thu, 21 Aug 2014 09:51:06 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 245

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

Set-Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/; domain=.doubleclick.net

Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://adx.adnxs.com/mapuid?member=181&user=">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://adx.adnxs.com/mapuid?member=181&user=..Date: Thu, 21 Aug 2014 09:51:06 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 245..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..Set-Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/; domain=.doubleclick.net..Set-Cookie: test_cookie=; expires=Mon, 21-Jul-2008 23:59:00 GMT; path=/; domain=.doubleclick.net..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://adx.adnxs.com/mapuid?member=181&user=">here</A>...</BODY></HTML>......

<<< skipped >>>

GET /pixel?google_sc&google_nid=artb&google_hm=5LrF-sMQpP_eyRBlZ9Qxiw&google_ula=1535926 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0

Date: Thu, 21 Aug 2014 09:51:14 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 245

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0..Date: Thu, 21 Aug 2014 09:51:14 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 245..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://d.adroll.com/cm/g/in?google_ula=1535926,0">here</A>...</BODY></HTML>......

<<< skipped >>>

GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1

Date: Thu, 21 Aug 2014 09:51:16 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 317

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>......

GET /e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: e.nexac.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-type: image/gif

Date: Thu, 21 Aug 2014 09:51:18 GMT

Expires: Wed Sep 15 09:14:42 MDT 2010

P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"

Pragma: no-cache

Server: lighttpd/1.4.28

Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/

Set-Cookie: na_an=1408614678; expires=Sat, 20-Sep-2014 09:51:18 GMT; path=/; domain=.nexac.com

X-Powered-By: Jigawatts

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-type: image/gif..Date: Thu, 21 Aug 2014 09:51:18 GMT..Expires: Wed Sep 15 09:14:42 MDT 2010..P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"..Pragma: no-cache..Server: lighttpd/1.4.28..Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/..Set-Cookie: na_an=1408614678; expires=Sat, 20-Sep-2014 09:51:18 GMT; path=/; domain=.nexac.com..X-Powered-By: Jigawatts..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..

GET /e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.jumptap.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:15 GMT

Content-Length: 43

Content-Type: image/gif

Cache-Control: no-cache, max-age=2592000

Server: Jetty(7.6.7.v20120910)

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 43..Content-Type: image/gif..Cache-Control: no-cache, max-age=2592000..Server: Jetty(7.6.7.v20120910)..GIF89a.............!.......,...........D..;....

GET /seg?t=2&add=1459541 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus1&google_sc&google_hm=MzM4NTIwMzU5MTE3MDQwOTgwNQ==

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:06 GMT

Content-Length: 0

....

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QPn=Mde3%$o2(/ZA!*jSH=QL./dmNSPB?j>ni'Gpih®X/<FeyMOoPD 6#xcHg!%FI5#=<I'; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:06 GMT

Content-Length: 150

ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":8, "tagtype":"img"});....

GET /pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1") HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s

Connection: Keep-Alive

Host: ib.adnxs.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:06 GMT

GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:06 GMT..GIF89a.............!.......,........@..L..;....

<<< skipped >>>

GET /ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:07 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 0..nt>....

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:07 GMT

Content-Length: 150

ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":7, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 150..ANX_async_load({"url":"hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1", "c":7, "tagtype":"img"});....

<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=3&id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz0Fhu?d$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR`v/roZT; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:08 GMT

Content-Length: 774

document.write('<a href="hXXp://nym1.ib.adnxs.com/click?_Knx0k1igD9kkpGzsKd9P0Jg5dAi29E_ZJKRs7CnfT_8qfHSTWKAP3e7G38xU_k-TcUWCLuo-i4MwfVTAAAAALO7LwCtBwAAKQQAAAIAAADJyxoBP9AGAAAAAQBVU0QAVVNEAKAAWALLCQAA5McAAgUAAQIAAJQANiseKQAAAAA./cnd=!uwbgQQjlye4BEMmX6wgYv6AbIAA./referrer=http://ib.adnxs.com/bounce?/tt?id=3095266/clickenc=http%3A//lp.sharelive.net/?sysid=406&appid=744" target="_blank"><img width="160" height="600" style="border-style: none" src="hXXp://cdn.adnxs.com/p/1a/82/5d/5a/1a825d5acd849546ad35aa925bf5f9f7.gif"/></a>');document.write('<scr' 'ipt type="text/javascript" src="hXXp://dcdn.darchermedia.com/cdn/bv.js?bv=0.008"></scr' 'ipt>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....

<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:09 GMT

Content-Length: 182

ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:09 GMT..Content-Length: 182..ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});....

<<< skipped >>>

GET /mapuid?member=364&user=2040815613008858 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:09 GMT

GIF89a.............!.......,........@..L..;....

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylp<cH:Ti*W@)8Xu/^meB)H; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:10 GMT

Content-Length: 141

ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});....

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*gjZ>6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HfCkq>=3.)s; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:10 GMT

Content-Length: 142

ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*gjZ>6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HfCkq>=3.)s; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 142..ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":5, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AhK:95e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0.`WmNHTMM@!(*IBm$MIX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:10 GMT

Content-Length: 141

ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":7, "tagtype":"img"});....

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:11 GMT

Content-Length: 141

ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 141..ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":6, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:11 GMT

Content-Length: 118

ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":5, "tagtype":"img"});....

GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjRÛ41M5:3nqaG1Wu=

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:11 GMT

Content-Length: 118

ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 118..ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":4, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Length: 148

ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":4, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/2#@C1/1J9n2]x2DauGmU9q'w<Ow]Gn%pe?[f?`nfj(6L2]z3I/.zc<SY#G`7IKRz6:TukE=8hT_kM#aIYzx]s(02WVE%zD?; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Length: 113

ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/2#@C1/1J9n2]x2DauGmU9q'w<Ow]Gn%pe?[f?`nfj(6L2]z3I/.zc<SY#G`7IKRz6:TukE=8hT_kM#aIYzx]s(02WVE%zD?; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 113..ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":3, "tagtype":"img"});....

<<< skipped >>>

GET /pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir= HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@

Connection: Keep-Alive

Host: ib.adnxs.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=^<5.XQOF; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:13 GMT

GIF89a.............!.......,........@..L..;....

GET /mapuid?member=1471&user=2040815613008858 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:14 GMT

GIF89a.............!.......,........@..L..;....

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs L*<V`r_^@pa@.S9WPwgT_:7DV=oPD 6#xbWe]NRFG?.vZeASQ:3:3nq9VwXZS; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Length: 149

ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs L*<V`r_^@pa@.S9WPwgT_:7DV=oPD 6#xbWe]NRFG?.vZeASQ:3:3nq9VwXZS; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":3, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Length: 169

ANX_async_load({"url":"hXXp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 169..ANX_async_load({"url":"hXXp://dis.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614", "c":1, "tagtype":"img"});....

<<< skipped >>>

GET /pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir= HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:15 GMT

GIF89a.............!.......,........@..L..;....

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:15 GMT

Content-Length: 149

ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":1, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:16 GMT

Content-Length: 148

ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":0, "tagtype":"img"});....

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqc

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:16 GMT

Content-Length: 148

ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":"img"});....

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:16 GMT

Content-Length: 148

ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:16 GMT..Content-Length: 0..HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:16 GMT..Content-Length: 0......

<<< skipped >>>

GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:17 GMT

GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:17 GMT..GIF89a.............!.......,........@..L..;nt>....

<<< skipped >>>

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx]s(01RWW*itG; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:18 GMT

Content-Length: 102

ANX_async_load({"url":"hXXp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx]s(01RWW*itG; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length: 102..ANX_async_load({"url":"hXXp://m.xp1.ru4.com/activity?_o=62795&_t=cm_apn_in", "c":1, "tagtype":"img"});....

<<< skipped >>>

GET /setuid?entity=11&code=NC-00000010467304128 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F

Connection: Keep-Alive

Host: ib.adnxs.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:18 GMT

GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:18 GMT..GIF89a.............!.......,........@..L..;....

<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:19 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:19 GMT..Content-Length: 0..

GET /if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: nym1.ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3Macd9s3po!/_3RiNx:M; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:05 GMT

Content-Length: 510

<SCRIPT SRC="hXXp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=" TYPE="text/javascript"></SCRIPT>HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3Macd9s3po!/_3RiNx:M; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 510..<SCRIPT SRC="hXXp://an.z5x.net/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAA

<<< skipped >>>

GET /if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEB

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:07 GMT

Content-Length: 148

<SCRIPT SRC="hXXp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266" TYPE="text/javascript"></SCRIPT>..HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$hpB<AtQE[MmU [J)*a1FQm.@:24C.04n@ES$bjcmJJy31$UZ60-Zk`<; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 148..<SCRIPT SRC="hXXp://ib.adnxs.com/ttj?id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266" TYPE="text/javascript"></SCRIPT>....

<<< skipped >>>

GET /is/pixel.mathtag.com?U=/event/img&V=3-N0UWPX1D/qF 6WgIPrUyzGiPU rOGmgSy SaJoS0DXExvQoiCNDyIQ==&I=E8555A9E9909C20&D=mathtag.com&01AD=1&mm_bnc HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: ak1.abmr.net

HTTP/1.1 302 Moved Temporarily

Content-Length: 0

Location: hXXp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc

Expires: Thu, 21 Aug 2014 09:51:15 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Thu, 21 Aug 2014 09:51:15 GMT

Connection: keep-alive

Set-Cookie: 01AI=2-2-11D5DE5315B982453FFC1B127DDFA708AF68DE22869D001BA11FDB1D92AB1550-BFF35046EB015A925D86111169A014CFA2220E9515310C261C7561C6453CBCB6; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net

P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"

HTTP/1.1 302 Moved Temporarily..Content-Length: 0..Location: hXXp://pixel.mathtag.com/event/img?01AD=3Won9I4tJ-UHFmtTsigvVSxzaG5xmm48PFhRdejlBU-hsY9ezziNT2A&01RI=E8555A9E9909C20&01NA=na&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: 01AI=2-2-11D5DE5315B982453FFC1B127DDFA708AF68DE22869D001BA11FDB1D92AB1550-BFF35046EB015A925D86111169A014CFA2220E9515310C261C7561C6453CBCB6; expires=Fri, 21-Aug-2015 09:51:15 GMT; path=/; domain=.abmr.net..P3P: policyref="hXXp://VVV.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"..

GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dps.bing.com

Connection: Keep-Alive

Cookie: MUID=2F6B223C4C616DD806C724A148616EB1

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 42

Content-Type: image/gif

Expires: 2:51:04 AM

Server: Microsoft-IIS/8.5

TrackingId: b6d56b86-8f34-47bc-aafa-3741ae4c49d7

X-Powered-By: ASP.NET

X-MSEdge-Ref: Ref A: 9EADC1D16D464D5C84E8BF9245A33047 Ref B: 83051D85D07344195EA85793513249CE Ref C: Thu Aug 21 02:51:09 2014 PST

Date: Thu, 21 Aug 2014 09:51:09 GMT

GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 2:51:04 AM..Server: Microsoft-IIS/8.5..TrackingId: b6d56b86-8f34-47bc-aafa-3741ae4c49d7..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: 9EADC1D16D464D5C84E8BF9245A33047 Ref B: 83051D85D07344195EA85793513249CE Ref C: Thu Aug 21 02:51:09 2014 PST..Date: Thu, 21 Aug 2014 09:51:09 GMT..GIF89a.............!.......,...........L.;..

GET /updates/u/fcupdater.wys HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)

Host: cdn.wemempoclano.net

Cache-Control: no-store,no-cache

Pragma: no-cache

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

Age: 183471

Date: Thu, 21 Aug 2014 09:51:10 GMT

Last-Modified: Wed, 23 Oct 2013 14:27:47 GMT

Content-Length: 294

Connection: keep-alive

PK........w.WC....z.........$.0.. .........X.:.....G.:.....G.:........vq.3bdg```.bC=.v. ...Fzfz..z&.@6.7..f; m...%%.V...)yziE.....y.z.....).%.....i..v.^bN.^I..P.^ye)....p.lz..p.8..GlA......PK..-.......w.WC....z.........$....... ......0.. .........X.:.....G.:.....G.:.....PK..........S.........HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..Accept-Ranges: bytes..Age: 183471..Date: Thu, 21 Aug 2014 09:51:10 GMT..Last-Modified: Wed, 23 Oct 2013 14:27:47 GMT..Content-Length: 294..Connection: keep-alive..PK........w.WC....z.........$.0.. .........X.:.....G.:.....G.:........vq.3bdg```.bC=.v. ...Fzfz..z&.@6.7..f; m...%%.V...)yziE.....y.z.....).%.....i..v.^bN.^I..P.^ye)....p.lz..p.8..GlA......PK..-.......w.WC....z.........$....... ......0.. .........X.:.....G.:.....G.:.....PK..........S...........

GET /ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com.ua

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:07 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: adclick_server

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?...HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:07 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Content-Encoding: gzip..Server: adclick_server..Content-Length: 76..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?.......

GET /ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com.ua

HTTP/1.1 200 OK

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:14 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

GIF89a.............!.......,...........D.;HTTP/1.1 200 OK..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:14 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..X-Content-Type-Options: nosniff..Server: adclick_server..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..GIF89a.............!.......,...........D.;..

GET /mapuid?member=181&user= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s

Connection: Keep-Alive

Host: adx.adnxs.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:07 GMT

GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:07 GMT..GIF89a.............!.......,........@..L..;..

GET /ajax/libs/jquery/1.9.1/jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ajax.googleapis.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/javascript; charset=UTF-8

Last-Modified: Fri, 08 Feb 2013 15:35:10 GMT

Date: Fri, 08 Aug 2014 06:25:37 GMT

Expires: Sat, 08 Aug 2015 06:25:37 GMT

Access-Control-Allow-Origin: *

Timing-Allow-Origin: *

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 32819

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 1135523

Alternate-Protocol: 80:quic

............{{...7...."........o...v..q.[cg'-E..HPBL....RD....[kf0.Pq.~.sNZ.....f......._..M...wg.?...vG.<8z2.........E...q...:z..GT.._.f.....t.de.....uT..b.|.o6iv..._E..:.F.x...O..6..*?QUp....2U.4..6I.<.T.%.E>....R1....4^..tIm...ZE.{5..3..<.....|4.3.D-.r.-o..]......4[$....:Z...UUP_...........|....z.mF.r...f......Q..?..-3.0..F..^.F....l.O........\..f.|1..t..NG2U.}tz.jxz.^G.o......./^\.>......#*........../.../........|zp2{...N.3*....~.\../O'...g...g.;.~.M.Tx..,g.....).y..w*@...i.^...]........2 ..n;.\.'..'/f....*.4:..oP...f..]Ul..2^.....V........V.P.N....z......o3z.........aC..,.....K.\p...x......WiY%YR.v.*..^.......<_oVI..a>*.xq....$8>....u%......n ..V?.Q.:..4....o.~.g..Q...S_..Y.....G)..T.".......<......&...*..Z.t%..s@it5..y.c.....p.h...X.*/. .H.....){4U.y...I`..&-.. y.....L.O....Lf..X<..1M.w.xD;;.....3zgn...'S.....g.~3Jn.9-..... .....3..A..e#.....".-i.S..].9..3..=GE..,..R*.gs..j.M..0.._'.u......E.|.....K.Q'FY.H^..'.(.OK.\.-.T...8...Q....v||5J..Vq.}{.K2..K..z.R....o_..G..t.L....NF.W.}....."{.NLP|.T_........j..,P..q.Q..o..<.x...Q..t=..$nJ.%:S...,..N...*.......d.`....M...)....T.7....|$...[......E..h.......`b.......iQ.w...-n>.=OIw..*........H...r.....h..V.Aj..&t..9M..is.j.t]~../...ik......l.p.....mT.=[E..7v....n./$...y=T.X.s...J......j.w.W.|.x..F..*..:....>K...d....f..........&...7./.2-..P......j.?X.p.....9u.Ae.0...D.....~f.......&...l6..3......i}.(.. m.Je.x...p5.:..d...gWz...G..@.*\.2/*..............>...g..`...w....f.....\.D...#D...E.%.......G..s`K.*.WI...NI.......LeO...&

<<< skipped >>>

POST /collect HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.google-analytics.com

Content-Length: 210

Expect: 100-continue

Connection: Keep-Alive

t=event&ec=Installation_Process&ea=install_start&el=user start to install the app&ev=0&v=1&tid=UA-45411392-1&cid=6d7f6e0c-b90b-4b58-b851-2e2d1d13a422&cm=(organic)&cn=(undefined)&ci=0&cc=(unknown ad)&cs=(direct)

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:50:57 GMT

Server: Golfe2

Content-Length: 35

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Mon, 07 Aug 1995 23:30:00 GMT..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Access-Control-Allow-Origin: *..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:50:57 GMT..Server: Golfe2..Content-Length: 35..Alternate-Protocol: 80:quic..GIF89a.............,...........D..;..

GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

Cookie: i=6333127b-59e4-4c75-9681-e9f9bbb7943b|1408614672

HTTP/1.1 200 OK

Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)

Pragma: no-cache

P3P: CP="CUR ADM OUR NOR STA NID"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Type: image/gif

Content-Length: 43

Cache-Control: private, max-age=0, no-cache

Connection: close

GIF89a.............!.......,...........D..;..

GET /tap.php?v=4894|| HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805

Connection: Keep-Alive

Host: pixel.rubiconproject.com

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:11 GMT

Server: Apache

X-Powered-By: PHP/5.3.3

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com

Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com

Content-Length: 49

Keep-Alive: timeout=30, max=9733

Connection: Keep-Alive

Content-Type: image/gif

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..Server: Apache..X-Powered-By: PHP/5.3.3..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com..Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com..Content-Length: 49..Keep-Alive: timeout=30, max=9733..Connection: Keep-Alive..Content-Type: image/gif..GIF89a...................!.......,...........T..;..

GET /cm/w/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Thu, 21 Aug 2014 09:51:13 GMT

Location: hXXps://analytics.twitter.com/i/adsct?p_user_id=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI&p_id=823423

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.4.7

Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:13 GMT; Max-Age=157680000; Path=/

Content-Length: 109

Connection: keep-alive

Go to hXXps://analytics.twitter.com/i/adsct?p_user_id=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI&p_id=823423....

GET /cm/l/out HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Thu, 21 Aug 2014 09:51:13 GMT

Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.4.7

Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/

Content-Length: 85

Connection: keep-alive

Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318bHTTP/1.1 302 Moved Temporarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Thu, 21 Aug 2014 09:51:13 GMT..Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/..Content-Length: 85..Connection: keep-alive..Go to hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b....

GET /cm/g/in?google_ula=1535926,0 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b

Connection: Keep-Alive

Host: d.adroll.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, must-revalidate

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:14 GMT

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.4.7

Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b-g_1408614674; Version=1; Expires=Tue, 20-Aug-2019 09:51:14 GMT; Max-Age=157680000; Path=/

X-Result: g.-1.-1.1535926.0.-1

Content-Length: 35

Connection: keep-alive

GIF87a.............,............Q.;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, must-revalidate..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:14 GMT..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b-g_1408614674; Version=1; Expires=Tue, 20-Aug-2019 09:51:14 GMT; Max-Age=157680000; Path=/..X-Result: g.-1.-1.1535926.0.-1..Content-Length: 35..Connection: keep-alive..GIF87a.............,............Q.;..

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gmtdmp.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:10 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Keep-Alive: timeout=1, max=9827

Connection: Keep-Alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9827..Connection: Keep-Alive..GIF89a.............!.......,...........D..;....

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:04 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:04 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:04 GMT..Content-Type: text/html..Content-Length: 1245..Connection: keep-aliv

<<< skipped >>>

GET /FreeCoinsLandingPage/themes/thankyou/images/free_coins_logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freecoins.co

Connection: Keep-Alive

Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"5837-1403623016000"

Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT

Content-Type: image/png

Content-Length: 5837

Date: Thu, 21 Aug 2014 09:51:02 GMT

Connection: close

.PNG........IHDR..."...".....:G......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE] HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:12 GMT

Server: Apache/2.2.3 (Red Hat)

Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858

Connection: close

Content-Type: text/plain; charset=UTF-8

HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:12 GMT..Server: Apache/2.2.3 (Red Hat)..Location: //ib.adnxs.com/mapuid?member=1471&user=2040815613008858..Connection: close..Content-Type: text/plain; charset=UTF-8..

GET /tag/js/gpt.js HTTP/1.1

Accept: */*

Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googletagservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 7333933708124470652

Date: Thu, 21 Aug 2014 08:52:51 GMT

Expires: Thu, 21 Aug 2014 09:52:51 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 14500

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=3600

Age: 3489

Alternate-Protocol: 80:quic

...........}iw.8.....GooF.....3cE.I..M.4M..~r(J^.5..4m../..........=g..I..I..@.....OG.....bq-r.~:.%...9...G.2.........}.r..A`..Oo..._c..o[.."......?.....fI.f......8.......a....T.<...".......l..wi<....M&P......>.f.....pU..-.F.....5[N.(...I.I4.....k9...h...v..,....B.Q...'G.8.Y0........,..7.........bg.;......2...[.h.D5.:[..G)H........I,.....;..B......WnP........O.S.E..y...*N...........I.f9....T.....U.......>.....rC.[|2O.qt....V.n....k...1..1.......F..j.}.b7p...b..l.......lrY<........\.F..9.0._...x..4#..u9.....Os....N.9.U.wO.h. ..o.w.".r..G.T6......4l.jU...ft....{....5........^.....4.g......KGWQ..C...>k..g..."d..(...k .Tb.C.V<....o.5...3.Yt].fJ..A..K..c.A.[.;.;..g....b1.7......4...%.,N...9K3QP.%'.....mk..f..w.6_..l=...`p[...Qt......o.w{.o..O..s.]9..v.y..^....u'.:.,),m.1e)....h...f....N...V....\..3.....\.4...B.n..K.-~...`..z......&..).l.*........]..}7..D....\..q.......C.E.#]..|,....O.....;..4J....n..[.Q..O..z...<...,.../.._....W..h.^...3X..q.s.*....t.%...f.OU...7E.Q.h?..m..A.i...A.%....Lr.4..sJ...%o.g.r.......N ~p.u...r..u\.ea8l....$J....6~.?W...%.......U..H.m..v.e=..W.i.. ........Q.F.(...l..|hA..-...i...@vvr?AE.IX... ....z....Z.A..=...f..8#9..S.....v..0i...|.*...5n.....i.$..&o..o....&Y?... .....A...i.h..n.U..&...9.|.XP.a....._=...[...=..>...h..>..1}@..>.TJ....%}.....c......\....N....>..?...qH....}.........._..)&......P?..@}L........_R).......9.@rn.7b...........}0.'...wh..A.....*?. ......a<H..b.A..5...}M...OX....~x{.z...G;!..U;B?P.......o...#".M..:.. .#.s.X_......: ..... ..t.

<<< skipped >>>

GET /r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: r.turn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0

Pragma: no-cache

Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/

Content-Type: image/gif

Content-Length: 43

Date: Thu, 21 Aug 2014 09:51:13 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0..Pragma: no-cache..Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/..Content-Type: image/gif..Content-Length: 43..Date: Thu, 21 Aug 2014 09:51:13 GMT..GIF89a.............!.......,...........D..;....

GET /r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: r.turn.com

Connection: Keep-Alive

Cookie: uid=7369045053275563920

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"

Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0

Pragma: no-cache

Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/

Content-Type: image/gif

Content-Length: 43

Date: Thu, 21 Aug 2014 09:51:14 GMT

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV"..Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0..Pragma: no-cache..Set-Cookie: uid=7369045053275563920; Domain=.turn.com; Expires=Tue, 17-Feb-2015 09:51:14 GMT; Path=/..Content-Type: image/gif..Content-Length: 43..Date: Thu, 21 Aug 2014 09:51:14 GMT..GIF89a.............!.......,...........D..;..

GET /cm?in=1&pub=345&userid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p.rfihub.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Server: nginx/1.5.3

Date: Thu, 21 Aug 2014 09:51:13 GMT

Content-Length: 0

Connection: keep-alive

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT

Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT

Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT

Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com

Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com

Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=

HTTP/1.1 302 Found..Server: nginx/1.5.3..Date: Thu, 21 Aug 2014 09:51:13 GMT..Content-Length: 0..Connection: keep-alive..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Expires: Thu, 01 Jan 1970 00:00:00 GMT..Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:13 GMT..Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com..Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com..Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=......

<<< skipped >>>

GET /js/core-min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.gamehub.ws

Connection: Keep-Alive

Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:01 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT

ETag: "406cf-ce2-4fc68d5e5db4d"

Accept-Ranges: bytes

Content-Length: 3298

Connection: close

Content-Type: text/javascript

/*.CryptoJS v3.1.2.code.google.com/p/crypto-js.(c) 2009-2013 by Jeff Mott. All rights reserved..code.google.com/p/crypto-js/wiki/License.*/.var CryptoJS=CryptoJS||function(h,r){var k={},l=k.lib={},n=function(){},f=l.Base={extend:function(a){n.prototype=this;var b=new n;a&&b.mixIn(a);b.hasOwnProperty("init")||(b.init=function(){b.$super.init.apply(this,arguments)});b.init.prototype=b;b.$super=this;return b},create:function(){var a=this.extend();a.init.apply(a,arguments);return a},init:function(){},mixIn:function(a){for(var b in a)a.hasOwnProperty(b)&&(this[b]=a[b]);a.hasOwnProperty("toString")&&(this.toString=a.toString)},clone:function(){return this.init.prototype.extend(this)}},.j=l.WordArray=f.extend({init:function(a,b){a=this.words=a||[];this.sigBytes=b!=r?b:4*a.length},toString:function(a){return(a||s).stringify(this)},concat:function(a){var b=this.words,d=a.words,c=this.sigBytes;a=a.sigBytes;this.clamp();if(c%4)for(var e=0;e<a;e )b[c e>>>2]|=(d[e>>>2]>>>24-8*(e%4)&255)<<24-8*((c e)%4);else if(65535<d.length)for(e=0;e<a;e =4)b[c e>>>2]=d[e>>>2];else b.push.apply(b,d);this.sigBytes =a;return this},clamp:function(){var a=this.words,b=this.sigBytes;a[b>>>2]&=4294967295<<.32-8*(b%4);a.length=h.ceil(b/4)},clone:function(){var a=f.clone.call(this);a.words=this.words.slice(0);return a},random:function(a){for(var b=[],d=0;d<a;d =4)b.push(4294967296*h.random()|0);return new j.init(b,a)}}),m=k.enc={},s=m.Hex={stringify:function(a){var b=a.

<<< skipped >>>

GET /pagead/conversion.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 200 OK

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Content-Type: text/javascript; charset=UTF-8

ETag: 10951747834593842486

Date: Wed, 20 Aug 2014 21:52:56 GMT

Expires: Thu, 21 Aug 2014 21:52:56 GMT

X-Content-Type-Options: nosniff

Content-Disposition: attachment; filename="f.txt"

Content-Encoding: gzip

Server: cafe

Content-Length: 3638

X-XSS-Protection: 1; mode=block

Age: 43089

Cache-Control: public, max-age=86400

Alternate-Protocol: 80:quic

...........Z.s....=..h:.:\.C....0i..zwM......1.-...9.@....ve.6.I..y3.....J./...y..I.(........N.D....g......y.n..F"..pR..C..x....$...lgq..h,.e.../.....Br..c.<..z.E....i..u....px..\R.a.A....h=.M\5[....TGrm6$\.m...Z...p.N[-..]...pI..&..w.cTPt!...}r..E...x....d...~o.e..{.....7.....*.R'O."HD#....c.........Q.....(.....g;v6.......\|ke}.b...9[.../aE...o^.k......~gQS.\..?....Jwi..d/.Z.......f3.vt.l..D..".V4...~....y.7..).t.<...[h.kt_...y.k.*.......lb.|.Ox..h.i..K...D.g...........X.Y#.n.FH6..=7.,1`...K8.KX''..~..W..z..&.]..f.....0....w..E......?.~.."~.....k-..."[S.....C>..d[..^H../..;.j.&..9W1....X.8.1z...p....>......W.}m..{j..T....v.k.......n.........Z-........w...6.P.|G....C|...P.qh....6..C.ob...n..t..... ...w.].9..J:.".....T.L...!c.7l6.Y...8....uu..x"'J.0i9'..n;4.0,.Cg4B#._..#8.<....)....{......r ...M.......y......N.....5J3q....hq........P...~../e..LjeA.p..E....^...x....QK0o..u^...^n..:S-.....r.....". ..J!tT:$g.F..W.d.....l....m..b......:.Z.[.........T.\u<hL[.*g"........}.:g......\.N./.Q.n.s..pX.....'o...s.....m......]j....3..#.(..b.Da..c...;.|.<.!.Zk....q.....%...Z....;.8...PC........EP' ..X..~..z...:...r2U.X.y<.)..8....~..q"x.Lk&.S1O..e.F.1..^..,..u.O.y]..d.7..Z..1.X.;.F.H....w.I..pZ..O$[..../..H\.j.. . .l.W\....t ../......D.).Aok.U..di'Y....G...e.#....l%...)......i H.".,.b.f.......R..K...(........*2. O?_..F,..w...;.....{.}V.gU.X.....-~_..k....:...^h....B..bEoW;.......7....o.U..!..jvu.B.;.Me9.3...Z...[...LX.~...7.Vf...E.....Y.1....kQ.\.,.(.Z.._......jn&G....6.:...[j....RF..IH.b7.<......@..

<<< skipped >>>

GET /pagead/conversion/976381674/?random=1408614622354&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Thu, 21 Aug 2014 09:51:05 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Content-Encoding: gzip

Server: cafe

Content-Length: 76

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

............(....I.O.T(...I.UJJL.N/./.K.M.../.*)J. .H,J. Q......R`....h.?.......

GET /pagead/conversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.googleadservices.com

Connection: Keep-Alive

HTTP/1.1 302 Found

P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"

Date: Thu, 21 Aug 2014 09:51:13 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882

Content-Type: image/gif

X-Content-Type-Options: nosniff

Server: cafe

Content-Length: 42

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

GIF89a.............!.......,...........D.;HTTP/1.1 302 Found..P3P: policyref="hXXp://VVV.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"..Date: Thu, 21 Aug 2014 09:51:13 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Location: hXXp://googleads.g.doubleclick.net/pagead/viewthroughconversion/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&guid=ON&script=0&ord=9927692427449876&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&convclickts=0&random=500434882..Content-Type: image/gif..X-Content-Type-Options: nosniff..Server: cafe..Content-Length: 42..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..GIF89a.............!.......,...........D.;..

GET /c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.bing.com

Connection: Keep-Alive

HTTP/1.1 302 Redirect

Cache-Control: private, no-cache, proxy-revalidate, no-store

Pragma: no-cache

Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")

Server: Microsoft-IIS/8.0

X-Powered-By: ASP.NET

P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"

Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Thu, 21-Aug-2014 13:51:06 GMT; path=/;

Set-Cookie: MUID=2F6B223C4C616DD806C724A148616EB1; domain=.bing.com; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/;

Date: Thu, 21 Aug 2014 09:51:05 GMT

Content-Length: 0

HTTP/1.1 302 Redirect..Cache-Control: private, no-cache, proxy-revalidate, no-store..Pragma: no-cache..Location: hXXp://ib.adnxs.com/pxj?bidder=108&action=SetMSCookies("MUID=2F6B223C4C616DD806C724A148616EB1|TOptOut=|EANON=A%3d%26E%3dFFF%26W%3d1")..Server: Microsoft-IIS/8.0..X-Powered-By: ASP.NET..P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"..Set-Cookie: ANONCHK=1; domain=c.bing.com; expires=Thu, 21-Aug-2014 13:51:06 GMT; path=/;..Set-Cookie: MUID=2F6B223C4C616DD806C724A148616EB1; domain=.bing.com; expires=Sat, 20-Aug-2016 09:51:06 GMT; path=/;..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 0..

GET /Installer/Flow?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&version=4.4 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:50:06 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 9773

Connection: keep-alive

..Sv.NlmsAxc.2..*.JqaEv`.5. ).Bkmnjf`grQsoa"83$.Fmkcsez_oajgRvjdo"8.((* 0. .RcbC`r 7.!("P`_F^w3.!6" '.M^nllsJak`.5.WloSqbc.9^\ci_q]tmm.&.Q^pdLaqn.'.NoicqcrD<.300&!=lu\qnHdc_q.:.'.DlU^csBopDfnm_if!61*.=s^SOF!6" '.@qcRLK."8..'.Algl]nbGai^ 7.!("Ma^`kSOF!6"folk3-,^hneao&oac*[ols oj\\i ]ni/-j^a^pp)Cun_ha^Hdc_qOcp`]i8mc`dnib8*1-$sih`=0.._bqqcc917 1.jb[cl=4.(..alomprwd\8 4/ rus`dl8,0#^e^=.!`]60.&!Nar`.5&/).@`dgoajg_i>`pa 5., 7/3,-5241.% >hsevgmmn^qO_fGewn.5. ).O]ympl.3 .&!Afd`[obtb.9)1*.HmhklnhknP\l`.8* .Dgn[m^n^hbuR_o].3 .&!Olc`h<_rblHjsr\dg.8-&!Ripom\eMc`dnCmhe\gbIcma"8..x%y.JnotCs].3 .&!Lrc@p`.8.. .CmhhjgcknSupc.23% JimetguYobmkNxleq.2.) .1!("P`_F^w.4!., M]bDcv03.: .$.KcmiqpN_h].3 Scqpu_g.(.Q^pdLaqn.&.Dl]tob_n].% Mln`uaoA?.8/3 .AjrYtlMc`dn"8 $.BqT[hpFmmAilr^fk.:/'.@qcRLK.: .$.>vbOQH2 5..% @ilial_Ddgc.4!., J^a^pRLK.: cloi8,)cerc^l)mfb'`lpq(lmZah(bkm-*ga_com.@yl\ed\Mc`dnSam]`g=l`earg_5-00#pned;-1!]gpnh`=/4(./$i_``p;1 ,$`itjtpta_603,%oyq]ao61/ cbb; .c[;/. .R_o].3 .&!=dbdldhl^fC]t_.2.*06,8)12/.3.*.;mpitdjplcpLdcKctk.3 .&!Lawjmo.8* .Eda]^mgs_!6-/'.KkmjiseolMYo^ 7'0("Bdk^kcm[m_yP\l`.8* .Sj`]k:dq_qEnqoYge 7* .VgmlpZjL`earAjehZlaFhje 5..v*x.Oksr@p`.8.. .Pp`=s^ 7.!("AjekhlbhsPyn`.51*.Gnjirdr\mglhSupcn.5./*-,-7 '.M^eH_x.: .$.KcdEdu62.2..*.LdlopoF\fc.4!Ripom\e.*.XkuRpZ`.?`]dhep\ljk.(.EkcsnZ\lc.&!Lrm_m^mGA.9.8*.9gp_vmNbfcm.5)*.CrSago>jkGkms]lj.2,% Br

<<< skipped >>>

GET /Installer/Track?pubid=5492&distid=19036&productid=6303&subpubid=0&campaignid=0&networkid=1&reqid=135181431&dfb=0&os=5.1&iev=6.0&ffv=&chromev=&macaddress=00:0C:29:FD:55:AD&netv=&d1=NUMBER&d2=NUMBER&d3=NUMBER&d4=NUMBER&d5=NUMBER&ds1=&hb=2&systembit=32&vm=1&machineguid=75ed9567-aa58-4c8e-a8ea-3cad7c47ab03&status=0&installedid=6303&offerscreenid=&offerorder=7&downloadduration=53188&installduration=94&issecond=0 HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:50:54 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive

..OK......

GET /Installer/TrackFinish?reqid=135181431&x=y&clickid=wMA0G5248NF6F5LD0L2BH52O HTTP/1.1

User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.19 (KHTML, like Gecko) Chrome/18.0.1025.142 Safari/535.19

Host: data.getserverinfo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:00 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 8

Connection: keep-alive

..OK..HTTP/1.1 200 OK..Cache-Control: private..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:00 GMT..Server: Microsoft-IIS/8.0..X-AspNet-Version: 4.0.30319..X-AspNetMvc-Version: 4.0..X-Powered-By: ASP.NET..Content-Length: 8..Connection: keep-alive....OK....

GET /ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y

Cache-Control: private, max-age=43200

Date: Thu, 21 Aug 2014 09:51:06 GMT

Expires: Thu, 21 Aug 2014 09:51:06 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 706

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google.com.ua/ads/conversion/976381674/?random=1607940989&cv=7&fst=1408614622354&num=1&fmt=2&value=0&label=PJzXCJ63zgcQ6s3J0QM&bg=ffffff&hl=en&guid=ON&u_h=846&u_w=1276&u_ah=818&u_aw=1276&u_cd=32&u_his=1&u_tz=180&u_nplug=0&u_nmime=0&frm=0&url=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&cdct=2&convclickts=0&random=4279697415&ipr=y..Cache-Control: private, max-age=43200..Date: Thu, 21 Aug 2014 09:51:06 GMT..Expires: Thu, 21 Aug 2014 09:51:06 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Server: adclick_server..Content-Length: 706..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEA

<<< skipped >>>

GET /ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: VVV.google.com

HTTP/1.1 302 Found

Location: hXXp://VVV.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y

Cache-Control: private, max-age=43200

Date: Thu, 21 Aug 2014 09:51:14 GMT

Expires: Thu, 21 Aug 2014 09:51:14 GMT

Content-Type: text/html; charset=UTF-8

X-Content-Type-Options: nosniff

Server: adclick_server

Content-Length: 346

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://VVV.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..Location: hXXp://VVV.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y..Cache-Control: private, max-age=43200..Date: Thu, 21 Aug 2014 09:51:14 GMT..Expires: Thu, 21 Aug 2014 09:51:14 GMT..Content-Type: text/html; charset=UTF-8..X-Content-Type-Options: nosniff..Server: adclick_server..Content-Length: 346..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://www.google.com.ua/ads/user-lists/933633792/?label=Ly1uCJjJ2A4QgL6YvQM&script=0&ct_cookie_present=false&random=1098627879&ipr=y">here</A>...</BODY></HTML>....

<<< skipped >>>

GET /cdn/bv.js?bv=0.008 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dcdn.darchermedia.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:09 GMT

Content-Type: application/x-javascript

Content-Length: 10245

Connection: keep-alive

Last-Modified: Tue, 19 Aug 2014 04:17:46 GMT

Vary: Accept-Encoding

ETag: "53f2cfea-2805"

Server: NetDNA-cache/2.2

X-Cache: HIT

Accept-Ranges: bytes

/*************************************************************************.* .* DARCHER LLC INTELLECTUAL PROPERTY.* __________________.* .* [2014] DARCHER LLC <support@darchermedia.com>.* All Rights Reserved..* .* NOTICE: All information contained herein is, and remains.* the property of DARCHER LLC dba DARCHER MEDIA and its suppliers,.* if any. The intellectual and technical concepts contained.* herein are proprietary to DARCHER LLC dba DARCHER MEDIA.* and its suppliers and covered by U.S. and Foreign Patents,.* patents in process, and are protected by trade secret or copyright law..* Dissemination of this information or reproduction of this material.* is strictly forbidden unless prior written permission is obtained.* from DARCHER LLC <support@darchermedia.com>..*/..var _0xb840=["\x72\x61\x6E\x64\x6F\x6D","\x66\x6C\x6F\x6F\x72","\x63\x75\x72\x72\x65\x6E\x74\x53\x63\x72\x69\x70\x74","\x55\x5A\x78\x63\x52\x54\x78\x51\x25\x78\x40\x57\x6D\x4D\x25\x44\x76\x39\x48\x55\x54\x45\x3F\x23\x5A\x2A\x52\x36\x6B\x23\x38\x41\x40\x6E\x65\x43\x6B\x62\x44\x5A\x4E\x47\x76\x7A\x56\x5A\x23\x46\x64\x67\x5A\x26\x4E\x65\x36\x36\x21\x56\x78\x72\x35\x64\x75\x7A\x54\x4E\x32\x5A\x77\x21\x25\x4B\x64\x43\x51\x68\x62\x73\x4B\x53\x32\x25\x57\x5F\x6D\x32\x7A\x4A\x73\x24\x50\x75\x52\x67\x40\x47\x34\x26\x68\x55\x57\x43\x4A\x65\x77\x2D\x79\x55\x23\x35\x74\x21\x46\x52\x76\x25\x42\x62\x5E\x62\x4C\x2B\x46\x70\x41\x56\x58\x37","\x70\x75\x73\x68","\x73\x6C\x69\x63\x65","\x72\x6F\x75\x6E\x64","\x73\x70\x6C\x69\x63\x65","\x44\x2A\x48\x3

<<< skipped >>>

GET /pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7?pv=48237268584.942344&cookie=&keyw= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: d.adroll.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Cache-Control: no-store, no-cache, must-revalidate

Date: Thu, 21 Aug 2014 09:51:12 GMT

Location: hXXp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js

P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"

Pragma: no-cache

Server: nginx/1.4.7

Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/

X-Conversion-Currency:

X-Conversion-Value: 0

Content-Length: 0

Connection: keep-alive

HTTP/1.1 302 Moved Temporarily..Cache-Control: no-store, no-cache, must-revalidate..Date: Thu, 21 Aug 2014 09:51:12 GMT..Location: hXXp://a.adroll.com/pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js..P3P: CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"..Pragma: no-cache..Server: nginx/1.4.7..Set-Cookie: __adroll=e4bac5fac310a4ffdec9106567d4318b; Version=1; Expires=Tue, 20-Aug-2019 09:51:12 GMT; Max-Age=157680000; Path=/..X-Conversion-Currency: ..X-Conversion-Value: 0..Content-Length: 0..Connection: keep-alive......

GET /d/FreeCoinsApp.exe HTTP/1.1

Accept: */*

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cdn.freecoins.co

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

Content-Type: application/octet-stream

Age: 46300

Date: Thu, 21 Aug 2014 09:50:02 GMT

Last-Modified: Tue, 12 Aug 2014 10:47:11 GMT

Content-Length: 19969368

Connection: keep-alive

MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................^...........0.......p....@.......................... ......zM1......................................t...........v............0..............................................................p...............................text...L\.......^.................. ..`.rdata.......p.......b..............@..@.data...X\...........v..............@....ndata...................................rsrc....v.......x...z..............@..@........................................................................................................................................................................................................................................................................................................................................................................U....\.}..t .}.F.E.u..H....h.B..H.P.u..u..u...Hr@..B...SV.5p.B..E.WP.u...Lr@..e...E..E.P.u...Pr@..}..e....Dp@........FR..VV..U... M.......M....3.....FQ.....NU..M..........VT..U.....FP..E...............E.P.M...Hp@..E...E.P.E.P.u...Tr@..u....E..9}...w....~X.te.v4..Lp@....E.tU.}.j.W.E......E.......Pp@..vXW..Tp@..u..5Xp@.W...E..E.h ...Pj.h`.B.W..Xr@..u.W...u....E.P.u...\r@._^3.[.....L$....B...Si.....VW.T.....tO.q.3.;5..B.sB..i......D.......t.G.....t...O..t .....u...3....3...F.....;5..B.r._^[...U..QQ.U.SV..i....

<<< skipped >>>

GET /FreeCoinsLandingPage/themes/thankyou/images/desttop_bg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freecoins.co

Connection: Keep-Alive

Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"20943-1403623016000"

Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT

Content-Type: image/png

Content-Length: 20943

Date: Thu, 21 Aug 2014 09:51:03 GMT

Connection: close

.PNG........IHDR...V.........5 ......pHYs................OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*!..J.!...Q..EE...........Q,......!.........{.k........>...........H3Q5...B..........@..$p....d!s.#...~<< ".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<. ...*..x..<.$9E.[.-q.WW..(.I. .6a.a.@..y..2.4..............x.....6..._-...."bb.....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<......$.2].G......L......b...G.......".Ib.X*..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt.......o..(...h...w..?.G.%..fI.q..^D$.T..?....D..*.A....,.........`6.B$..B.B.d..r`)..B(....*`/.@.4.Qh..p...U..=p..a...(....A...a!...b.X#......!.H...$ ...Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6....h...>C.0....3.l0...B.8,..c.."......V.....c..w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9., .......3...!.[..b@q..S.(R.jJ....4..e.2AU..R...T.5.ZB...R.Q...4u.9...IK......h.h.i..t.....N..W...G.....w.......g(.....g.w...L......T071......oUX*.*|.....J.&..*/T.......U.U.T..^S}.FU3S......U..P.S.Sg.;...g.oT?.~Y...Y.L.OC.Q.._... .c..x,!k...u.5.&...|v*......=...9C3J3W.R..f?...q..tN..(...~....).)..4L.1e\k....X.H.Q.G..6......E.Y...A.J'\'Gg.....S.S.....M=:....k....Dw.n.....^..Lo..y....}/.T.m...G.X...$.....<.5qo<./...QC].@C.a.a......<..F.F..i.\.$.m.m..&.&!&KM.M..RM..).;L;L........5.=1.2.......

<<< skipped >>>

GET /mstag/site/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/mstag.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: flex.msn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/x-javascript; charset=utf-8

Content-Encoding: gzip

Expires: Thu, 21 Aug 2014 10:06:03 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Thu, 21 Aug 2014 09:51:02 GMT

Connection: close

Content-Length: 488

.............`.I.%&/m.{.J.J..t...`.$..@.........iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;..8..]....../.6....i.Wyu.....*........}l^..N...zyx..i....M>.U.."_....=-s....l..17...j.||...............g...../... .....f...n..g.............>n..g......}|oo/......t....}.og......{...<...x....z.........O........Vy..y../.%.z....d...;....~....UY.[........~..I...D~^..._~2....?..........g......>z.L.b.....>n.w.....3..........OR.*...]..|.#..?..t............}D...u..............

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:49:15 GMT

Expires: Thu, 21 Aug 2014 11:49:15 GMT

Last-Modified: Thu, 31 Jul 2014 23:23:53 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11119

Cache-Control: public, max-age=7200

Age: 110

Alternate-Protocol: 80:quic

...........}{W.....|......a...N..Eo..[K.!..%.RB.:..B......d;...<..5C........'........\....Q2T#.||..|t>...a&N...P..E,.I.}..'.i&....N[......".n.$....2<M..(...N.B..<OP`..~."/M....O..<-3.....S.ne.8..s..SO\.:I...?e..G)r.(.&2K^..s...}M...,K..4C...{f.h$.NG...B............z"E.S99.....q.f...4.h...I.@.4...G:.Fj4@.1.a..8...2.n#9.........:....D^..`N..A..!..F..>.Y.a....4.G..... .$.S.^D...5...{...m..]..1@.5.cY>.5e...2.b1......{..z..{..z..L...p...HRG....F.'>b.c...>0...#...........2I..I..h{.2.&....-.t[.i..b..<.8";q7..g&w/*U<..>U.QY...R..s.m.Z-....V..3.O.#.T...n.........8hQS.........z....W..w.....?8|.....O..|.&c.............t.M/......k..........^.......m=hY..;.....5.....89o|...%-.R....a*{..E.m....,............l........w~w.lt...y........_.h....... ..VW.....h.\.*l....d..i. .....z.I*.....R7.-;..Z..;... Y..n...jO........ ...u..D..#h..%aw.@..1...TE2... .K.......R>.c.r.h._.........kO.]-m.Yy..E3.c.....'........._&.....%tp...72.Z...)..O.d.... .*T*:h"/..:..ju....=5..f.....7....l&......ir>.H.;..j.oP.:....Y......4h...*........U...D .....B..d...P.L ivY...1S.....o..L.]...}....N.....q7....?K@....~V...?..g...;.....S..y..........7[*.B..:..q.s.m-.....2....W]...X:.eT...$i..-...w...<^=^].w&t..::\o....R.f}c..X....H..>...j".....A....i........]/..*F}).MmD...ju8..*H.....B ...<.6..#.*.......>..-.."..%....n% ....6.n.-z8..D.:......Buz....uAB B....$y.0W.....P~....s....U.%....]b.&u....O4x.....W..ykT...`.k.}7M{..m.7.V...2M. ....7f.:.....6[o.....'c,.=..<.b.....U..8..0.Z.D'b/.#5..)..\w....GO~.a<..O.

<<< skipped >>>

GET /collect?v=1&_v=j24&a=308130690&t=pageview&_s=1&dl=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&ul=en-us&de=utf-8&dt=Thank You - For installing our free coins app!&sd=32-bit&sr=1276x846&vp=1256x693&je=0&fl=11.6 r602&_u=ME~&cid=1694826787.1408614623&tid=UA-46704880-1&z=1050236601 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Pragma: no-cache

Expires: Mon, 07 Aug 1995 23:30:00 GMT

Access-Control-Allow-Origin: *

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Date: Wed, 20 Aug 2014 22:04:40 GMT

Server: Golfe2

Content-Length: 35

Age: 42386

Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate

Alternate-Protocol: 80:quic

GIF89a.............,...........D..;HTTP/1.1 200 OK..Pragma: no-cache..Expires: Mon, 07 Aug 1995 23:30:00 GMT..Access-Control-Allow-Origin: *..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Date: Wed, 20 Aug 2014 22:04:40 GMT..Server: Golfe2..Content-Length: 35..Age: 42386..Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate..Alternate-Protocol: 80:quic..GIF89a.............,...........D..;..

GET /?provider=captify&uid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: x.skimresources.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Content-Type: text/html; charset=UTF-8

Date: Thu, 21 Aug 2014 09:51:18 GMT

Location: hXXp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805

P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"

Server: TornadoServer/2.4.1

Set-Cookie: skimGUID=1d2182171d38f63bead29a52dfc1bed2; Domain=.skimresources.com; expires=Fri, 21 Aug 2015 09:51:18 GMT; Path=/

Content-Length: 0

Connection: keep-alive

HTTP/1.1 302 Found..Content-Type: text/html; charset=UTF-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Location: hXXp://d2tjil5tz17cbz.cloudfront.net/s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805..P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"..Server: TornadoServer/2.4.1..Set-Cookie: skimGUID=1d2182171d38f63bead29a52dfc1bed2; Domain=.skimresources.com; expires=Fri, 21 Aug 2015 09:51:18 GMT; Path=/..Content-Length: 0..Connection: keep-alive..

GET /dpixel?source=appnexus&eid=5&id=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cms.quantserve.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Connection: close

Content-Type: image/gif

Set-Cookie: mc=53f5c111-6e765-7acdf-772b7; expires=Sat, 20-Feb-2016 09:51:13 GMT; path=/; domain=.quantserve.com

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"

Cache-Control: private, no-cache, no-store, proxy-revalidate

Pragma: no-cache

Expires: Fri, 04 Aug 1978 12:00:00 GMT

Content-Length: 35

Date: Thu, 21 Aug 2014 09:51:13 GMT

Server: QS

GIF89a.......,.................D..;..

GET /CA_Servlet/trackingServlet?getGAparams=1 HTTP/1.1

Host: VVV.freecoins.co

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Content-Type: text/html;charset=UTF-8

Content-Length: 127

Vary: Accept-Encoding

Date: Thu, 21 Aug 2014 09:50:56 GMT

Connection: close

{"cm":"(organic)","cn":"(undefined)","ci":"0","cid":"6d7f6e0c-b90b-4b58-b851-2e2d1d13a422","cc":"(unknown ad)","cs":"(direct)"}..

GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1

Date: Thu, 21 Aug 2014 09:51:17 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 317

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1..Date: Thu, 21 Aug 2014 09:51:17 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 317..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>....

<<< skipped >>>

GET /tt?id=3092585 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/tt?id=3092585

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:03 GMT

Content-Length: 0

....

GET /bounce?/tt?id=3092585 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=2303909238682748008; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:03 GMT

Content-Length: 1027

<script>!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.' c '&id=3092585"></scr' 'ipt>')}();</script>....

<<< skipped >>>

GET /bounce?/tt?id=3092599 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=2303909238682748008; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=2303909238682748008; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:04 GMT

Content-Length: 1027

<script>!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.' c '&id=3092599"></scr' 'ipt>')}();</script>....

<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614663&bdh=jRZCxo1plb_xYRHd5q5vN4403Wk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092585 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:04 GMT

Content-Length: 634

document.write('<a href="hXXp://nym1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAANv5fmq8dKM_AAAAAAAAAAAAAAAAAAAAAAqC-xhAJjkFTcUWCLuo-i4IwfVTAAAAAGkwLwAQCgAA_AkAAAIAAAASsBsBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAbbYAAgUAAQIAAJAAKRa4zwAAAAA./cnd=!owaGPQiV8KsCEJLg7ggY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3092585/clickenc=http://VVV.gamesgirl.net/" target="_blank"><img width="160" height="600" style="border-style: none" src="hXXp://cdn.adnxs.com/p/6f/fe/88/ef/6ffe88efc10e4300c223a6efe5e670a3.jpg"/></a>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....

<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:05 GMT

Content-Length: 124

ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=3385203591170409805", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 124..ANX_async_load({"url":"hXXps://VVV.facebook.com/fr/u.php?p=391363987594223&m=3385203591170409805", "c":9, "tagtype":"img"});....

<<< skipped >>>

GET /ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j

Connection: Keep

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:06 GMT

Content-Length: 1441

!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="http://ib.adnxs.com/ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.' c '&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc="></scr' 'ipt>')}();....

<<< skipped >>>

GET /seg?t=2&add=1418586 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.Erk#WDgEREfybX%m3uz0<OctCí^mhpB=L_>W9]mU [J)*c!_(i.)MAEX/<FexB#Isr.-O.Z8q!85^_5znu^; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ads.yahoo.com/cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:06 GMT

Content-Length: 0

....

GET /px?t=2&id=157720&other=aXlHoNTekoQSgLGK HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3uz016QPn=Mde3%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*iA5wf; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:06 GMT

GIF89a.............!.......,........@..L..;....

GET /ttj?ttjb=1&bdc=1408614666&bdh=Ruxn66toDlu8Vs0uNcxhbBauki0.&bdref=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&bdtop=false&bdifs=2&id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Al

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3uz016QPn=Mde3%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*iA5wf; path=/; expires=Wed, 19-Nov-2014 09:51:06 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:06 GMT

Content-Length: 1257

document.write('<iframe frameborder="0" width="160" height="600" marginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd%3D%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1"></iframe>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....

<<< skipped >>>

GET /ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QPn=Mde3%$mKE['5nYjSH=QKteFscepbU)PB2.5mAD#6KvV(d5)[J!7.-uuEg3s

Connection: Keep-Alive

Host: ib.adnxs.com

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:07 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:07 GMT..Content-Length: 0..nt>....

GET /ttj?id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M41.Erk#WDgEREfybX%m3uz016QQy QmD$h

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:07 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:07 GMT

Content-Length: 1075

!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="http://ib.adnxs.com/ttj?ttjb=1&bdc=1408614667&bdh=4WHPn1OMzejgkmZq3ytYfO3WvOc.' c '&id=3128243&cb=1408614666&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266"></scr' 'ipt>')}();....

<<< skipped >>>

GET /ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUKEgiOjxgQChgBIAEoATCKgtefBRCKgtefBRgB; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:08 GMT

Content-Length: 0

HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:08 GMT..Content-Length: 0..nt>....

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEVNsVDgEREfybX%m3uz016QQy QmD$hpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZa_vj81fjX)/OSpCiPE_Z.XR]%/rJBP

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:08 GMT

Content-Length: 145

ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk; path=/; expires=Wed, 19-Nov-2014 09:51:08 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:08 GMT..Content-Length: 145..ANX_async_load({"url":"http://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=//ib.adnxs.com/mapuid?member=364&user=[MOOKIE]", "c":6, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:09 GMT

Content-Length: 182

ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});....

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]F7/.XDgEREfybX%m3uz016QQy$ L8ihpB=L_>W9]mU [J)*c!_(i.'GLHm5iq1CGZv2o`x>$x@K//j%[AM42R]`yKlSgIhJY.DKk

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:09 GMT

Content-Length: 182

ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg; path=/; expires=Wed, 19-Nov-2014 09:51:09 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:09 GMT..Content-Length: 182..ANX_async_load({"url":"hXXp://dps.bing.com/AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus", "c":9, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylp<cH:Ti*W@)8Xu/^meB)H; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:10 GMT

Content-Length: 141

ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});....

GET /a_usersync?c=9&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/QE:2jUDgEREfybX%m3uz016QQy*8TuyhpB<bJ0)B^mU [J)*`$$Q4N-zGr)S4lpPa?LHm5iq1CGZv2o`x>$x@K.w$ %6KvV(d5)[J!.]^>qQusg

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:10 GMT

Content-Length: 148

ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://eu-gmtdmp.gd1.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":8, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AhK:95e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0.`WmNHTMM@!(*IBm$MIX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:10 GMT

Content-Length: 141

ANX_async_load({"url":"hXXp://gmtdmp.mookie1.com/tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805", "c":7, "tagtype":"img"});....

GET /a_usersync?c=8&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*dWIy(e6AqeU#-2*b Bp<?fD1x-#b-gXM'HHowlW?bnU2q/o%y'(i.'xki'#EaMF=ZtQCBVibo_9t) 8uVePLq:7D>*Isr.-O.Ylpk%`h!XrSO0NS3Cl[(jdu

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:10 GMT

Content-Length: 142

ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":7, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/AepbG-e6AqeU#-2*b Bp<?fD1x-#b-gXM'FsqV(`NbnU2q/or<C.uNl1J0''_4=^`5:0 O?FwO-n[8yblapsRPgs0#8PZ5$(HGi5(3m:Bhjyf:HFP='pmP_-oqjR%g![[XZ9*DtX; path=/; expires=Wed, 19-Nov-2014 09:51:10 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:10 GMT..Content-Length: 142..ANX_async_load({"url":"hXXp://tap.rubiconproject.com/oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30", "c":7, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mfm^c0e6AqeU#-2*b Bp<?fD1x7>sP0XM'FsqV(`Nbn

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:11 GMT

Content-Length: 118

ANX_async_load({"url":"hXXp://us-u.openx.net/w/1.0/sd?id=537072399&val=3385203591170409805", "c":6, "tagtype":"img"});....

GET /a_usersync?c=7&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.wh.v04e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(LixLb$klZt(d(F9yF[f0Ebf1>!zp$lNJ$%'xAUn-Pj5wX.91EQ?563OSXwff2vtq*y##O2aQ@(b'AT:/1.325Qw'KHE$fG

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:11 GMT

Content-Length: 177

ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805", "c":6, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4; path=/; expires=Wed, 19-Nov-2014 09:51:11 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:11 GMT..Content-Length: 177..ANX_async_load({"url":"hXXp://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805", "c":6, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40LgN>u2e6AqeU#-2*b Bp<?fD1x7>sP0XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD(`Y8sWz:NkQ9Lm0eZfVcQh)@=V_[K 7Q1X'g^`!.xyiah?c4

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Length: 148

ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':A$R[?:?gMb*0Y3%QOI_mPoZ<IRD*wJDQ1/R50Z7N5ar.%Us9@zG]R^b4sj(JHfF-JtptRo2f=l-.u:t/aV#d-; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 148..ANX_async_load({"url":"hXXp://t.mookie1.com/cms?min_age=2&rurl=//ib.adnxs.com/mapuid?member=1471&user=[MOOKIE]", "c":5, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=6&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/bhgVC6e6AqeU#-2*b Bp<?fD1x!^HCLXM'F1]0r/OmU [J

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Length: 128

ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=3385203591170409805", "c":5, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@; path=/; expires=Wed, 19-Nov-2014 09:51:12 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:12 GMT..Content-Length: 128..ANX_async_load({"url":"hXXp://cms.quantserve.com/dpixel?source=appnexus&eid=5&id=3385203591170409805", "c":5, "tagtype":"img"});....

<<< skipped >>>

GET /seg?add=1392486&t=2 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=%Sa _Xo@

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:13 GMT

Content-Length: 0

....

GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz016QQy!NobdhpB=*jbbVes)xqcQ3m

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz016QQy(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:/!*yXt!'0/Vw>L qib%9]C[bf*G1OZfO@W/.Fsu90[UA)iD`18sX#ENkQ9Lm0eZfVcQh)/HzKS-*yXvYFlq$69q>U; path=/; expires=Wed, 19-Nov-2014 09:51:13 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:13 GMT

Content-Length: 123

ANX_async_load({"url":"hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805", "c":4, "tagtype":"img"});....

GET /pxj?bidder=172&seg=802787&action=setuid('ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI') HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:14 GMT

GIF89a.............!.......,........@..L..;....

GET /mapuid?member=1471&user=2040815613008858 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BQvGJ3$b

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:14 GMT

GIF89a.............!.......,........@..L..;....

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/IE:X*YDgEREfybX%m3uz0 )Hli(ZxGthpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/1t4KfG6rCZ:8id jdKs_AsKR/1fpVB/7fz`5p'lgQ.*9cjsl'wlkVG.D`E7]]`yKliAh-ebzBj>cIGV`X'g^`!=^<5.XQOF

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0 )Hli%(HTlhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<^p(H<@@jXHm5G]KPX[*AxDPwhNbmMs.(08NsqAlNmjIfvFMQ]C!<`oOuA9ph$xtK2`2wMU#cLBbNe!@BX-GJF2d; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Length: 117

ANX_async_load({"url":"hXXp://r.turn.com/r/bd?ddc=1&pid=54&cver=1&uid=3385203591170409805", "c":2, "tagtype":"img"});....

GET /a_usersync?c=5&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.NEs8>[DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1[q[Gr)T@aii5ypg3Z1Ylq5OoS8<o4r*OKQpO79kf<B'_*QFEK!Z0rTE[*O%0h^#Qa6u[9(r9W`t'j^?_*?j

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Length: 123

ANX_async_load({"url":"hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805", "c":4, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/8EVt4ZDgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6O#xH9>Ius9Y]-^so]?K4uMA%hG4oLS[.`h>z!?>IKRz6:TukE=8hT_kMyARYzx]s(0.2-I`m'm; path=/; expires=Wed, 19-Nov-2014 09:51:14 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 123..ANX_async_load({"url":"http://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805", "c":4, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4.oF7TG]DgEREfybX%m3uz0/u9*j=Mde3%$s.)EjvtRG<:3:bvswScepq1_d634b$klZt(d(F9yF[f0Ebf<VGqCVc#]aWA1_1I`2Gg/A3pM>G@l`u6Y`K1YX'Hl>eDq%S9inn[iSaLPMX]wboOt#Qi>p`lu9(t38HH:iph!$JS(bL]tR`9ny?4svJgc!Yx

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:15 GMT

Content-Length: 113

ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 113..ANX_async_load({"url":"hXXp://p.rfihub.com/cm?in=1&pub=345&userid=3385203591170409805", "c":2, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M41.E:X*YDgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=/-=j>sbB0jvkIfvFMQSSh3HKDc^PfJwtpv/DAlF=S(ta?sN![_iPN3y@x

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:15 GMT

Content-Length: 149

ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":0, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1; path=/; expires=Wed, 19-Nov-2014 09:51:15 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 149..ANX_async_load({"url":"hXXp://pixel.jumptap.com/e/v1/pixel/networks/1/partners/7142/users/3385203591170409805;noCookies=t", "c":0, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=0&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:16 GMT

Content-Length: 0

....

GET /a_usersync?c=4&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/rEs8>[DgEREfybX%m3uz0/u9 u 5Q:#hpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzO[auR4y<(Q>npN9@cu%>_@:U3EG6gQ[653-(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7BpboPD 6#xbWe]NRFG?.vZeASQ:3:3ns (ZmK1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:16 GMT

Content-Length: 148

ANX_async_load({"url":"hXXp://cm.g.doubleclick.net/pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805", "c":3, "tagtype":"img"});....

GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:16 GMT

GIF89a.............!.......,........@..L..;HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7; path=/; expires=Wed, 19-Nov-2014 09:51:16 GMT; domain=.adnxs.com; HttpOnly..Content-Length: 43..Content-Type: image/gif..Date: Thu, 21 Aug 2014 09:51:16 GMT..GIF89a.............!.......,........@..L..;nt>....

<<< skipped >>>

GET /setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u#h0/hhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KKs$h7

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Content-Length: 43

Content-Type: image/gif

Date: Thu, 21 Aug 2014 09:51:17 GMT

GIF89a.............!.......,........@..L..;....

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@ZMi*PVeQ7^apq_UVnwzN']Jm.=R`G9ZNJ_!//nWS]YuY9%b:i^004*EiPE_(Xnp%/3vy¯OdU*5Qw'KLi1UR

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:17 GMT

Content-Length: 122

ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:17 GMT..Content-Length: 122..ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});>....

<<< skipped >>>

GET /a_usersync?c=3&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40]EVt4ZDgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3m

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:17 GMT

Content-Length: 122

ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40<F7TG]DgEREfybX%m3uz0/u9 u)t8lxhpB=*jbbVes)xqcQ3ms Pp2!@lm2siaXS R>$xTg>8M!*edD$/8?VW^G6rCZ:)<]D*Q[fzOM4dW[am?n=n0xya#T1e737G@p23tqfPo_7uY#gk9?y8WXj=?Af*G1OZfO@W.vpekYCYEl^r?mgEm0>4ej$FOX-kZtV[S2t=pe/.BHxx[%%'Xba['i=!!.lB6wk9a; path=/; expires=Wed, 19-Nov-2014 09:51:17 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:17 GMT..Content-Length: 122..ANX_async_load({"url":"hXXp://e.nexac.com/e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684", "c":2, "tagtype":"img"});>....

<<< skipped >>>

GET /a_usersync?c=2&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40*fR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:18 GMT

Content-Length: 119

ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=captify&uid=3385203591170409805", "c":1, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4/AdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHJ:0niSl-Op4xL[4r(?0Xi).'8`I%NAYVxOY80@Z5)(23/.kCoYTZ_LSKbtRj(6L2fM=7FS[.`h?$HwjIKRz6:TukE=8hT_UrFg]Yzx^Mi*)xp96 wWY]F/F; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length: 119..ANX_async_load({"url":"hXXp://x.skimresources.com/?provider=captify&uid=3385203591170409805", "c":1, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M4/AfR537e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soPD 6#xbWe]NRFG?.vZeASQ:3C3P(S@%?:HK.p0$

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:18 GMT

Content-Length: 195

ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE]", "c":0, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@XgHb`=.t27e7^`>x*c@.S9WPwgT_:7=5soW8wj*J.jv9(t38HH:kfVcQh)azM(Ba)btXbl-?9!%r(s9n`5j; path=/; expires=Wed, 19-Nov-2014 09:51:18 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:18 GMT..Content-Length: 195..ANX_async_load({"url":"hXXp://t.mookie1.com/rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE]", "c":0, "tagtype":"img"});....

<<< skipped >>>

GET /a_usersync?c=1&cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIg-kXEAoYASABKAEwjILXnwUKEgiMihgQChgBIAEoATCIgtefBQoSCI6PGBAKGAEgASgBMIqC158FEIyC158FGAI.; anj=dTM7k!M40mdX=S1e6AqeU#-2*b Bp<=3k?p E(reXM'F1]0r/OmU [J

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.weqTx5e6AqeU#-2*b Bp<=3k?p6^<>.XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@YN:RVC:)6tq=yF$=1!4h>fP*0yGCGp`b$AE]^e)W:?L*D8Ozi6hvWG]R^b4kcqNmIp?SYzx^Mi*)xp96*k6^`'82; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:19 GMT

Content-Length: 135

ANX_async_load({"url":"hXXp://rt.legolas-media.com/lgapnx?ci=12&ti=44011&pbi=10817&apid=3385203591170409805", "c":0, "tagtype":"img"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M4.weqTx5e6AqeU#-2*b Bp<=3k?p6^<>.XM'F1]0r/OmU [J) 1b3(Lix]aFkfVIuK((VePyRW1Pl1RPQ':MvN:@jg!f:Pl87d3'3Ky$^oG3@/%K`W#PyxHQ*`KoiAMN!yjwE1xU<C /<?3Vt$8rLdE_#kwXs F%nyS[4(fp(@YN:RVC:)6tq=yF$=1!4h>fP*0yGCGp`b$AE]^e)W:?L*D8Ozi6hvWG]R^b4kcqNmIp?SYzx^Mi*)xp96*k6^`'82; path=/; expires=Wed, 19-Nov-2014 09:51:19 GMT; domain=.adnxs.com; HttpOnly..Content-..

<<< skipped >>>

GET /AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTc4JnRsPTE1NzY4MDA=&piggybackCookie=uid:3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: image2.pubmatic.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:12 GMT

Server: Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.1e-fips mod_fastcgi/2.4.6

Set-Cookie: KRTBCOOKIE_57=476-uid:3385203591170409805; domain=pubmatic.com; expires=Sun, 20-Aug-2017 09:51:12 GMT; path=/

Set-Cookie: PUBRETARGET=78_1503222672; domain=pubmatic.com; expires=Sun, 20-Aug-2017 09:51:12 GMT; path=/

Content-Length: 42

P3P: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Connection: close

Content-Type: image/gif; charset=utf-8

GIF89a.............!.......,...........D.;..

GET /offers/images/Theme8/topComp.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:58 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<< skipped >>>

GET /offers/images/Theme8/bodyImg.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:50:58 GMT

Content-Type: image/png

Content-Length: 1914

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 10:27:32 GMT

ETag: "36dd864c691ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 28 Aug 2014 09:50:58 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR.......:.....j.......sRGB.........gAMA......a.... cHRM..z&..............u0...`..:....p..Q<...0PLTE................................................{.......IDATx......:..`..p..J.4.ty.:......)v..\....,.fwv..U...!.....b.f.....Cy(..OW......w......]R..l..2My}<..]..8hn{*..X.).m..4w.U.J.....u..l.J...<...>uJ.....i.>o.%......I.\..S......U.D.}OK..J`......sJ`.}..M.9%..A....u.T.%........K....OQ..._..d.>..L....]I. U.].c.Je...|.W.U?..E.}...*.vZ...K...M....).W...^V..>).e(.].Z.}dg%@....S.*/...........Y.W.]}...|.SgO........rrj...4UY../..r.~.....Z.ep.wui.sP^..X.g%$(.......C........Ze....4yn}....U.({.V..{o..}O...w.G.Q.^..r..p....0y............8......6.v....zz~....-...F*..f.F]...R..*. -......e{mO.s.i.9.U....zz.6.f.T>.f.DQ%.. ...l.q\N."eA({_W7..Q.....d........>...Y.."e.\....s,.. .Li)%....R.o.....C.9wQ....8........KNY..t..)...k...v)P*.....I...4&../.{)..qe..R.'...2..*..d.z&.T;y..)Q*....)R..2..)Tj.B..)V..b..)W......QB!rj.B.J)..N)b*...R)q..<S...z%.LPr..%.LQ2.4e.....q&*c.De,..J.x& ig...g..b.(.g..p.)Qf..uf*1g..af .Y...... .;(.....s......r.v. ...s'...K.0wS.....sG%.......-.R..}......4S.....W.....=.9eN(..OS..Jt(...<...P.(..DJ;_)..Y. ..7.>.@.Bi....HS)eM.qi;...........$.z%.[..P...SJzT*E]......2zT.t..L%6.TJ..Y.a...}.V..J...,.....H... ....;..2_._/[.^/[.\.W.\.!..%oT*y.Z....#Q.Bw.FI.7...H..2Jt.*..../........2.F..X.....gqJ.q:.U.q.. V...B..s.(.J2.x..()#1@.'d4.Hh.h.J.I.i.G.#.;.J....*Q$Z..?.........sR..D.<...| ......2.1b.A3...v.....X.y{..R....{h..pzJ.I.).Y..Kn.z;%Jn..c.W...bL........t..!...A..(..*

<<< skipped >>>

GET /offers/images/Theme8/bottomLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:59 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<< skipped >>>

GET /offers/images/Theme8/button_over.png HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:50:59 GMT

Content-Type: image/png

Content-Length: 921

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT

ETag: "f072da2a092ce1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 28 Aug 2014 09:50:59 GMT

X-Cache: HIT

Accept-Ranges: bytes

.PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8........Y......O.......[........sL..?@.o....y..-.....Lc.0......O..|z.O/...k.....e...n..!......G.p...9....3. .'?7 ..GD@..{.<....C$....N.........Q...<.,@...].;Q.'<.(.X.r.,.6.......QrB..h..d&r....6....G..Shr.... .....4r..= ..f.....B.qP..l.K........YB.Z....H....../:.l.(.S.D...nM7..P.%R........&_uR.H6A..(raP.H9...[\D. .(....d...`.8.A......r5Q..........:v.e....u.....-&.1.....&.........Z.|....).L...$....)K%a-....b..a*{<(W..P<..w7_Z.....h.%6.N........*\FB...A...#..f.N...C..(.p...........K.|..5d..3u-........(.k. 7..6..tsvP!.U0.q.......9z.e ..0.ALt..@l..2iR.2............. .>=...{WVim....f.c6.:...|.....0X.yk...../z..!.SHW.d......o.s........a..8..g.|zvg...o6......@..........n.^......IEND.B`.HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:50:59 GMT..Content-Type: image/png..Content-Length: 921..Connection: keep-alive..Cache-Control: max-age=604800..Last-Modified: Mon, 05 Aug 2013 17:21:05 GMT..ETag: "f072da2a092ce1:0"..X-Powered-By: ASP.NET..Server: NetDNA-cache/2.2..Expires: Thu, 28 Aug 2014 09:50:59 GMT..X-Cache: HIT..Accept-Ranges: bytes...PNG........IHDR...Y............m....tEXtSoftware.Adobe ImageReadyq.e<...;IDATx..Z;o.1..Y.D...W."$=D..*=BPR@..5..........DHi...M.i...e.r............;..N.h..=.|..x6..f..pf...n...yX...>z......`87.3...t.e:.sh..e..z.A....G.p..IZ.z...?Ra8

<<< skipped >>>

GET /mookie/map?anuid=3385203591170409805&mookieid=2040815613008858 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: mookie.bncnt.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-type: text/plain

Connection: close

Content-Length: 0

Date: Thu, 21 Aug 2014 09:50:59 GMT

GET /oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tap.rubiconproject.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Date: Thu, 21 Aug 2014 09:51:10 GMT

Server: TRP Apache-Coyote/1.1

p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||

Content-Length: 0

Cache-control: private

Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/

Set-Cookie: au=HZ3WT02I-CD7Q-10.208.162.44; Domain=.rubiconproject.com; Expires=Fri, 19-Aug-2022 09:51:10 GMT; Path=/

Set-Cookie: dq=1|1|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/

Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/

Keep-Alive: timeout=5, max=19

Connection: Keep-Alive

Content-Type: text/plain; charset=UTF-8

HTTP/1.1 302 Moved Temporarily..Date: Thu, 21 Aug 2014 09:51:10 GMT..Server: TRP Apache-Coyote/1.1..p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||..Content-Length: 0..Cache-control: private..Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: au=HZ3WT02I-CD7Q-10.208.162.44; Domain=.rubiconproject.com; Expires=Fri, 19-Aug-2022 09:51:10 GMT; Path=/..Set-Cookie: dq=1|1|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..Keep-Alive: timeout=5, max=19..Connection: Keep-Alive..Content-Type: text/plain; charset=UTF-8......

<<< skipped >>>

GET /oz/feeds/appnexus/tokens?token=3385203591170409805&expires=30 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tap.rubiconproject.com

Connection: Keep-Alive

Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805; dq=1|1|0|0

HTTP/1.1 302 Moved Temporarily

Date: Thu, 21 Aug 2014 09:51:10 GMT

Server: TRP Apache-Coyote/1.1

p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||

Content-Length: 0

Cache-control: private

Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/

Set-Cookie: dq=2|2|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/

Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/

Keep-Alive: timeout=5, max=122

Connection: Keep-Alive

Content-Type: text/plain; charset=UTF-8

HTTP/1.1 302 Moved Temporarily..Date: Thu, 21 Aug 2014 09:51:10 GMT..Server: TRP Apache-Coyote/1.1..p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Location: hXXp://pixel.rubiconproject.com/tap.php?v=4894||..Content-Length: 0..Cache-control: private..Set-Cookie: cd=false; Domain=.rubiconproject.com; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: dq=2|2|0|0; Expires=Fri, 21-Aug-2015 09:51:10 GMT; Path=/..Set-Cookie: put_1986=3385203591170409805; Domain=.rubiconproject.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: SERVERID=; Expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/..Keep-Alive: timeout=5, max=122..Connection: Keep-Alive..Content-Type: text/plain; charset=UTF-8..

GET /tt?id=3092599 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=2473127181019865522; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:03 GMT

Content-Length: 0

....

GET /tt?id=3095266 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly

Location: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:03 GMT

Content-Length: 0

HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=0; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:03 GMT; domain=.adnxs.com; HttpOnly..Location: hXXp://ib.adnxs.com/bounce?/tt?id=3095266..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:03 GMT..Content-Length: 0......

GET /bounce?/tt?id=3095266 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:04 GMT

Content-Length: 1027

<script>!function(){function n(n){try{if(!window.location.ancestorOrigins)return;for(var r=0,o=window.location.ancestorOrigins.length;o>r;r )n.call(null,window.location.ancestorOrigins[r],r)}catch(t){}return[]}function r(n){var r,o=[];do try{r=r?r.parent:window,n.call(null,r,o)}catch(t){return o.push({referrer:null,location:null,isTop:!1}),o}while(r!==window.top);return o}var o=r(function(n,r){try{r.push({referrer:n.document.referrer||null,location:n.location.href||null,isTop:n===window.top})}catch(o){r.push({referrer:null,location:null,isTop:n===window.top})}});n(function(n,r){o[r].ancestor=n});for(var t="",e=!1,i=o.length-1,l=o.length-1;l>=0;l--)if(t=o[l].location,!t&&l>0&&(t=o[l-1].referrer,t||(t=o[l-1].ancestor)),t){e=window.location.ancestorOrigins?!0:l==o.length-1&&o[o.length-1].isTop;break}t=encodeURIComponent(t);var c="&bdref=" t "&bdtop=" e "&bdifs=" i;document.write('<script src="hXXp://ib.adnxs.com/ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.' c '&id=3095266"></scr' 'ipt>')}();</script>....

<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3092599 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.NCxrEQDgEREfybX%m3ux[#uqzhcb7D%-]7s4; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:04 GMT

Content-Length: 633

document.write('<a href="hXXp://nym1.ib.adnxs.com/click?AAAAAAAAAAAAAAAAAAAAACuHFtnO96M_AAAAAAAAAAAAAAAAAAAAAPXvdpDQx4slTcUWCLuo-i4IwfVTAAAAAHcwLwAQCgAA_AkAAAIAAACpshsBVuMGAAAAAQBVU0QAVVNEANgCWgCdGAAAl7MAAgUAAQIAAJAAmRmutAAAAAA./cnd=!vwaZPgiV8KsCEKnl7ggY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3092599/clickenc=http://VVV.gamesgirl.net/" target="_blank"><img width="728" height="90" style="border-style: none" src="hXXp://cdn.adnxs.com/p/95/31/df/ca/9531dfcab239be5053dbfa4ef4277fce.jpg"/></a>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....

<<< skipped >>>

GET /ttj?ttjb=1&bdc=1408614664&bdh=BlL4JXKEB7xq-EnYVMkT0tBsxwk.&bdref=http://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp&bdtop=true&bdifs=1&id=3095266 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M4.ND>6NRDgEREfybX%m3ux[3M`$P)h9uk@!cmR; path=/; expires=Wed, 19-Nov-2014 09:51:04 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:04 GMT

Content-Length: 909

document.write('<iframe frameborder="0" width="160" height="600" marginheight="0" marginwidth="0" target="_blank" scrolling="no" src="http://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a'%2C 353928, 1408614664);uf('c', 4665015, 1408614664)%3Buf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1"></iframe>');document.write('<scr' 'ipt src="hXXp://cdn.adnxs.com/ANX_async_usersync.js"></scr' 'ipt>');....

<<< skipped >>>

GET /a_usersync?cbfn=ANX_async_load HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092585

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ib.adnxs.com

Connection: Keep-Alive

Cookie: uuid2=3385203591170409805; sess=1; icu=ChIIjIoYEAoYASABKAEwiILXnwUQiILXnwUYAA..; anj=dTM7k!M4/8DunaTDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6)KulOb.@3j

HTTP/1.1 200 OK

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly

Content-Type: application/javascript; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:05 GMT

Content-Length: 118

ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd", "c":9, "tagtype":"iframe"});HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Set-Cookie: uuid2=3385203591170409805; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: sess=1; path=/; expires=Fri, 22-Aug-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Set-Cookie: anj=dTM7k!M40DE:2jUDgEREfybX%m3ux[3Macd9s3r*%$s`'>fG$OjSH=QL(a@6N3OVg`oOuA9q$m*hxMW>; path=/; expires=Wed, 19-Nov-2014 09:51:05 GMT; domain=.adnxs.com; HttpOnly..Content-Type: application/javascript; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 118..ANX_async_load({"url":"hXXp://c.bing.com/c.gif?anx_uid=3385203591170409805&Red3=MSAN_pd", "c":9, "tagtype":"iframe"});....

<<< skipped >>>

GET /seg/?add=1418586,1459541 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.prfct.co

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Cache-control: no-cache="set-cookie"

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXps://pixel.prfct.co/seg/?check_cookie=1&add=1418586,1459541

P3P: CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Server: Jetty(9.0.5.v20130815)

Set-Cookie: pa_uid=pa_trixrKxFXQKpexCzd;Path=/;Domain=.prfct.co;Expires=Sat, 22-Nov-2014 09:51:06 GMT

Set-Cookie: AWSELB=B91D518304C41D26F2E262C1B04B163CFB753805FF1D7986C47DE59261A4C141DD42C6C8DC189DEFF632539AF65322743D460B9CC168CCFFDB1AAE0D5AA3403F0C049FBEDD;PATH=/

Content-Length: 0

Connection: keep-alive

GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Set-Cookie: i=7b5065f4-a2df-4edf-16a9-17679ca07782|1408614671; Version=1; Expires=Fri, 21-Aug-2015 09:51:11 GMT; Max-Age=31536000; Domain=.openx.net; Path=/

Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)

P3P: CP="CUR ADM OUR NOR STA NID"

Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805

Date: Thu, 21 Aug 2014 09:51:11 GMT

Content-Length: 0

Connection: close

GET /?type=1&domainId=2745850&dedup=1&actionid=207232 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 2745850.r.msn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Microsoft-IIS/8.0

p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo

Date: Thu, 21 Aug 2014 09:51:05 GMT

Connection: close

GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ads.yahoo.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:07 GMT

P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"

Set-Cookie: B=aud5rvp9vbg8b&b=3&s=os; expires=Sun, 21-Aug-2016 09:51:07 GMT; path=/; domain=.yahoo.com

Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:07 GMT

Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP

Cache-Control: private

Content-Length: 0

Content-Type: text/plain; charset=utf-8

Age: 0

Connection: keep-alive

Server: ATS

HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:07 GMT..P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: B=aud5rvp9vbg8b&b=3&s=os; expires=Sun, 21-Aug-2016 09:51:07 GMT; path=/; domain=.yahoo.com..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:07 GMT..Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP..Cache-Control: private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Connection: keep-alive..Server: ATS..

GET /e/xrefid.xgi?na_exid=3385203591170409805&na_pid=2684 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: e.nexac.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-type: image/gif

Date: Thu, 21 Aug 2014 09:51:17 GMT

Expires: Wed Sep 15 09:14:42 MDT 2010

P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"

Pragma: no-cache

Server: lighttpd/1.4.28

Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/

Set-Cookie: na_an=1408614677; expires=Sat, 20-Sep-2014 09:51:17 GMT; path=/; domain=.nexac.com

X-Powered-By: Jigawatts

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-type: image/gif..Date: Thu, 21 Aug 2014 09:51:17 GMT..Expires: Wed Sep 15 09:14:42 MDT 2010..P3P: policyref="hXXp://VVV.nextaction.net/P3P/PolicyReferences.xml", CP="NOI DSP COR NID CURa ADMa DEVa TAIo PSAo PSDo HISa OUR DELa SAMo UNRo OTRo BUS UNI PUR COM NAV INT DEM STA PRE"..Pragma: no-cache..Server: lighttpd/1.4.28..Set-Cookie: na_tc=Y; expires=Sun, 30-Nov-2014 22:00:00 GMT; domain=.nexac.com; path=/..Set-Cookie: na_an=1408614677; expires=Sat, 20-Sep-2014 09:51:17 GMT; path=/; domain=.nexac.com..X-Powered-By: Jigawatts..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........D..;..

GET /377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: idsync.rlcdn.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-cache, no-store

Date: Thu, 21 Aug 2014 09:51:14 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Location: hXXp://idsync.rlcdn.com/377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Set-Cookie: ck1=ck1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:14 GMT

Content-Length: 0

Connection: keep-alive

....

GET /377928.gif?partner_uid=e4bac5fac310a4ffdec9106567d4318b&redirect=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: idsync.rlcdn.com

Connection: Keep-Alive

Cookie: ck1=ck1

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store

Content-Type: image/gif; charset=ISO-8859-1

Date: Thu, 21 Aug 2014 09:51:14 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"

Set-Cookie: rlas3="TA03JilRL6ZfZHiTJV4DPXmXZtGqnF1a473g/aAAnwY=";Version=1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT;Max-Age=15551997

Set-Cookie: rtn1=cb8adb15e36b089ef86b12932f97ce18;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT

Set-Cookie: dids604882570=50313e24fe8f030a80f7a1716f6f091ce6f8375504619c4571885ea1fac72a5acb949ecef93fde87da2430bee7bf9c07;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:13 GMT

Content-Length: 43

Connection: keep-alive

GIF89a.............!.......,...........L..;HTTP/1.1 200 OK..Cache-Control: no-cache, no-store..Content-Type: image/gif; charset=ISO-8859-1..Date: Thu, 21 Aug 2014 09:51:14 GMT..Expires: Thu, 01 Jan 1970 00:00:00 GMT..P3P: CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"..Set-Cookie: rlas3="TA03JilRL6ZfZHiTJV4DPXmXZtGqnF1a473g/aAAnwY=";Version=1;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT;Max-Age=15551997..Set-Cookie: rtn1=cb8adb15e36b089ef86b12932f97ce18;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:11 GMT..Set-Cookie: dids604882570=50313e24fe8f030a80f7a1716f6f091ce6f8375504619c4571885ea1fac72a5acb949ecef93fde87da2430bee7bf9c07;Domain=.rlcdn.com;Expires=Tue, 17-Feb-2015 09:51:13 GMT..Content-Length: 43..Connection: keep-alive..GIF89a.............!.......,...........L..;..

GET /mstag/tag/322eefce-0cd2-4a6e-ab4c-6b3b11ea2493/analytics.js?ver=1312081600 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: flex.msn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: public

Content-Type: application/javascript; charset=utf-8

Content-Encoding: gzip

Expires: Fri, 22 Aug 2014 09:51:04 GMT

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

Date: Thu, 21 Aug 2014 09:51:04 GMT

Connection: close

Content-Length: 366

.............`.I.%&/m.{.J.J..t...`.$..@.........iG#).*..eVe]f.@......{....{....;.N'...?\fd.l..J...!....?~|.?"....i[T..;.}~qz..i.~...6.._....Z.u{.:o.>....j..{.lT...r....2.]R..)....iGm...6.b...?.3.>...^>.{w......;.z.h..i...{......_8..Y.<.}.M>:...S..[....C.>!X........T..^...so..e...o..@(..t..~....>.>."....l.....@i....((..{_.............y...I.M...w._rg..aB0...~...y.....

GET /ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc= HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: an.z5x.net

Connection: Keep-Alive

HTTP/1.1 302 Found

Cache-Control: no-store, no-cache, private

Pragma: no-cache

Expires: Sat, 15 Nov 2008 16:00:00 GMT

P3P: policyref="hXXp://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

X-XSS-Protection: 0

Location: hXXp://ib.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:05 GMT

Content-Length: 0

HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, private..Pragma: no-cache..Expires: Sat, 15 Nov 2008 16:00:00 GMT..P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"..X-XSS-Protection: 0..Location: hXXp://ib.adnxs.com/ttj?id=3319347&size=160x600&position=above&cb=1408614664&referrer=hXXp://ib.adnxs.com/bounce?/tt?id=3095266&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=!vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266/clickenc=..Content-Type: text/html; charset=utf-8..Date: Thu, 21 Aug 2014 09:51:05 GMT..Content-Length: 0..

<<< skipped >>>

GET /installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2 HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: data.getserverinfo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:03 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 1527

Connection: keep-alive

..<html>.. <head>.. <title>Thank you for installing Free Coins</title>.. <script type="text/javascript"> </script>.. <script type='text/javascript'>.. var googletag = googletag || {};.. googletag.cmd = googletag.cmd || [];.. (function () {.. var gads = document.createElement('script');.. gads.async = true;.. gads.type = 'text/javascript';.. var useSSL = 'https:' == document.location.protocol;.. gads.src = (useSSL ? 'https:' : 'http:') .. '//VVV.googletagservices.com/tag/js/gpt.js';.. var node = document.getElementsByTagName('script')[0];.. node.parentNode.insertBefore(gads, node);.. })();.. </script>.. <script type='text/javascript'>.. googletag.cmd.push(function () {.. googletag.defineSlot('/5612216/TYP', [1200, 1400], 'div-gpt-ad-1367936933671-0').addService(googletag.pubads());.. googletag.pubads().enableSingleRequest();.. googletag.enableServices();.. });.. </script>.. </head>.. <body>.. <div style="position:relative;left:0px;top:0px;color:white; height: 1px; visibility: hidden;"></div>.. <iframe src="hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins" width=100% height=100% frameborder=0 scrolling=no margin

<<< skipped >>>

GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Set-Cookie: i=6333127b-59e4-4c75-9681-e9f9bbb7943b|1408614672; Version=1; Expires=Fri, 21-Aug-2015 09:51:12 GMT; Max-Age=31536000; Domain=.openx.net; Path=/

Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)

P3P: CP="CUR ADM OUR NOR STA NID"

Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Length: 0

Connection: close

GET /w/1.0/sd?id=537072399&val=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Set-Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671; Version=1; Expires=Fri, 21-Aug-2015 09:51:11 GMT; Max-Age=31536000; Domain=.openx.net; Path=/

Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)

P3P: CP="CUR ADM OUR NOR STA NID"

Location: hXXp://us-u.openx.net/w/1.0/sd?cc=1&id=537072399&val=3385203591170409805

Date: Thu, 21 Aug 2014 09:51:11 GMT

Content-Length: 0

Connection: close

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gmtdmp.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:10 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Keep-Alive: timeout=1, max=9591

Connection: Keep-Alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9591..Connection: Keep-Alive..GIF89a.............!.......,...........D..;....

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gmtdmp.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:10 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Keep-Alive: timeout=1, max=9705

Connection: Keep-Alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:10 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:10 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9705..Connection: Keep-Alive..GIF89a.............!.......,...........D..;....

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gmtdmp.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:11 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/

Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Keep-Alive: timeout=1, max=9326

Connection: Keep-Alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9326..Connection: Keep-Alive..GIF89a.............!.......,...........D..;..

GET /css/index.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.gamehub.ws

Connection: Keep-Alive

Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:00 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 22 Jun 2014 08:51:41 GMT

ETag: "406bb-42fa-4fc68d5de596e"

Accept-Ranges: bytes

Content-Length: 17146

Connection: close

Content-Type: text/css

body, table, td, tr, div, p, h1, h2, h3, h4, h5, h6, form, fieldset, legend, input, textarea, select, th, tbody { margin: 0; padding: 0; }..img { border: none; }..sup { vertical-align: text-top; }..sub { vertical-align: text-bottom; }..input, textarea, select { font-size: inherit; font-weight: inherit; font-family: inherit; }..body, table, td, tr, div, h1, h2, h3, h4, h5, h6, form, input, textarea, select, th, tbody { font-family: arial; font-size: 12px; }..*,*:before,*:after { -webkit-box-sizing: border-box; -moz-box-sizing: border-box; box-sizing: border-box; }../* Start Land CSS */...clear{ clear: both; }..body{ direction: ltr; margin: auto; background: rgb(3,167,235); border-bottom: 1px solid #000; background: url(data:image/svg xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiA/Pgo8c3ZnIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgd2lkdGg9IjEwMCUiIGhlaWdodD0iMTAwJSIgdmlld0JveD0iMCAwIDEgMSIgcHJlc2VydmVBc3BlY3RSYXRpbz0ibm9uZSI CiAgPGxpbmVhckdyYWRpZW50IGlkPSJncmFkLXVjZ2ctZ2VuZXJhdGVkIiBncmFkaWVudFVuaXRzPSJ1c2VyU3BhY2VPblVzZSIgeDE9IjAlIiB5MT0iMCUiIHgyPSIwJSIgeTI9IjEwMCUiPgogICAgPHN0b3Agb2Zmc2V0PSIwJSIgc3RvcC1jb2xvcj0iIzAzYTdlYiIgc3RvcC1vcGFjaXR5PSIxIi8 CiAgICA8c3RvcCBvZmZzZXQ9IjEwMCUiIHN0b3AtY29sb3I9IiMwZDQyYTQiIHN0b3Atb3BhY2l0eT0iMSIvPgogIDwvbGluZWFyR3JhZGllbnQ CiAgPHJlY3QgeD0iMCIgeT0iMCIgd2lkdGg9IjEiIGhlaWdodD0iMSIgZmlsbD0idXJsKCNncmFkLXVjZ2ctZ2VuZXJhdGVkKSIgLz4KPC9zdmc );....background: -moz-linear-gradient(top, rgba(3,167,235,1) 0%, rgba(13,66,164,1) 100%); ....background: -webkit-gradient(linear, left top, left bot

<<< skipped >>>

GET /dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dis.criteo.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Location: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614

Server: Microsoft-IIS/7.5

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Length: 254

<html><head><title>Object moved</title></head><body>..<h2>Object moved to <a href="hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614">here</a>.</h2>..</body></html>..HTTP/1.1 302 Found..Location: hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614..Server: Microsoft-IIS/7.5..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Length: 254..<html><head><title>Object moved</title></head><body>..<h2>Object moved to <a href="hXXp://dis.eu.criteo.com/dis/usersync.aspx?r=7&p=19&cp=apx&eid=3385203591170409805&url=hXXp://ib.adnxs.com/seg?add=673614">here</a>.</h2>..</body></html>....

GET /j/roundtrip.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: a.adroll.com

Connection: Keep-Alive

HTTP/1.1 200 OK

x-amz-id-2: LE2eIYesxo5swo4NMC7tAainUT30r5JogXU/RXKTrtijeh7 q5UGyMLm4MgpUWWd

x-amz-request-id: 71820825864519DA

Last-Modified: Fri, 15 Aug 2014 17:15:55 GMT

ETag: "d9890eadfd6a83b5319937ea62acdcaf"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 4679

Cache-Control: must-revalidate, max-age=75

Date: Thu, 21 Aug 2014 09:51:12 GMT

Connection: keep-alive

...........;k..6... (z"...G..W.i.77.q%vv.I]mid..B.G.R!.y.H.}.. ....]..\#..4...&2.'.....7..[.).L'.H.gI.?.i.=L.........W.;...............Rn'9..w..1P...<...0.$rgN.P...$q.0.v,u.s..H.".x....... w.ON.{H..pY.).....F.9s....q.Z.s..C..........6.&.>...f.e/.3.....H.,.....XZN6..J.>...tM6....L\e.....^....x...0...k....y./M.;.......... ]...e.Q....|B~..}.Qe..3.X5h.jR$1e.....6w... .[..=a.p..}..`./..,[...Q.....O.W.!..i(A..i...4..........N..Oc7.v..5...h.u9..I{;...n.!..d.(..''..........Y...y......[x..4.v1.JI...."^[...=.A...,...r,....<....\l)...k.}. .F..nRD....VZfP..t..i{...se .j.....X.F...j..hX-..h........^f...&..]....%...k.Z......j....t..G.......d5.] n.o7Sx......v...^.h/..x.Y.u.!..,.f.../..{-^.&7...[ ......_...K............k..O'..Q8...r..i......{..j..r..eb.9..,..'.P..}.....'E....mV..>.K#g.7...[#.sF.,.2.q......IJ..9).I.B4@...k......V>....iz../..=..........$g....#k..G....G...#x.n.ZX.u"...FV..v.#.d ..O..G.cOx.....A..<W..,.Y.....*-.W.K.AJq....z>...2k.!.=....M.m..-.^..N~....(.8..k.*.....$.....y..74T.R.,...E...a......;......mX.I......w-..Ac2IX.)..9.Q.5=.!..z..(...y...s}H....`....rHYA..Y.]y..U.8...B~...R.Iz..Yn......X] .S.`..)......!.E....=../W?.."..M..o..?..p.....@....S..p.....0 3.*...S..^.WG.Z..9.........?5....G.u....c......_f6.;e9.%H.t..Z.B.CR0..4..D.s.....)R.....@.T.@g1.....D.|.........K....m....l.!c.\.........H....Fsx...c.?............Z. x...H$...Pc8...F....s_'.E.i/.. 2Z.oyb<..(.....c.[P..h..C....x\.c..=...&E..(.."x...)..Hh...R.. ...in..%.i.-J.......P*....x^.7t.*f../.....Q..h..r..y..6..so.....m ..,m..g...

<<< skipped >>>

GET /pixel/IVJEIJM6ARGD3MQS6TWQUL/DHXUP5D75NFZBL27FRE4N7/L4VIOKD3MBH75C5T6UGS6V.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: a.adroll.com

HTTP/1.1 200 OK

x-amz-id-2: MLC7mfQun88l9jNDL5MfqEb5Nsj0EkrQ91NOKYy0QHi7HHtKVAdEIqu6RZL8jH2P

x-amz-request-id: F19D990794E64995

Last-Modified: Wed, 13 Aug 2014 22:36:29 GMT

ETag: "80fa4efff8cbff1a1fac780705fbfe52"

Accept-Ranges: bytes

Content-Type: text/javascript

Server: AmazonS3

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Length: 931

Cache-Control: must-revalidate, max-age=300

Date: Thu, 21 Aug 2014 09:51:13 GMT

Connection: keep-alive

...........V.n.8.}.Wp.....d[.[.0...m.I.E...4.hr,..I..|A.....oI....&..qx...pHN4...B ....#B.....`.dD.(.Y[.O.2...Y5.ec..u..0.j.e..Ajd@.._A.Y..r.*3..T(..*.U.bo.....@-o.$P>.....0V.B..,SI'.".....*3;..*[.* h..1..-..x.@~...c78.......x"../e.\nV`Z...K..d..FK..`..L.......1...#.*)......[<..yv............`.....=......:n...>.?.{B....$8.>:...1...F..nn.........{K....${...P./$.Q.p....d\....`)....H...*8....g..Y..B.u=-........$.T.JF..Za..<.{..m.......M^.../R[&.p0.7.......Fe..a..........YI....0a..'.DW..I.B...M..a.[=ly.W..\w......CY...j..I.L........@...>...i:...i...{..1..rwH3@.....|...?....^?......_..>!..8.V.3#.[K.Q..;.b.....U.Y....K.KBy..<.a.b.....L%..t.......7.?O........0X:/PL^...{...u.).lM......}.pk3...N.le..VCN...G......9.BB....6..<.`....]!..K......M............Q..>{.............Q......2..11.{..X.F.t.O..GC.7.......o.7....ag..`.E8.4j...W(........nf.$..1..1-.P|<..G =...v]....%vQ.X..T.....6...0......Nh.4*.Ed..o....a....[...........uy....HTTP/1.1 200 OK..x-amz-id-2: MLC7mfQun88l9jNDL5MfqEb5Nsj0EkrQ91NOKYy0QHi7HHtKVAdEIqu6RZL8jH2P..x-amz-request-id: F19D990794E64995..Last-Modified: Wed, 13 Aug 2014 22:36:29 GMT..ETag: "80fa4efff8cbff1a1fac780705fbfe52"..Accept-Ranges: bytes..Content-Type: text/javascript..Server: AmazonS3..Vary: Accept-Encoding..Content-Encoding: gzip..Content-Length: 931..Cache-Control: must-revalidate, max-age=300..Date: Thu, 21 Aug 2014 09:51:13 GMT..Connection: keep-alive.............V.n.8.}.Wp.....d[.[.0...m.I.E...4.hr,..I..|A.....oI....&..qx...pHN4...B ....#B.....`.dD.(.Y[.O.2.

<<< skipped >>>

GET /updates/a/desktopapp.wys HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)

Host: cdn.freecoins.co

Cache-Control: no-store,no-cache

Pragma: no-cache

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

Age: 109207

Date: Thu, 21 Aug 2014 09:51:06 GMT

Last-Modified: Tue, 12 Aug 2014 10:43:54 GMT

Content-Length: 723

Connection: keep-alive

PK...........E98..'...P.....$.0.. ........... .f...D...e...D...e......vq.3b.````.bC=#3v. .$`.g.gh.g........(..Vb.l....8....J_?9%O/.(559?3.X/9_.. %.$.X?Q?-9..@..G.$_.d.^ye)..*...YSw]....q$.:h.8\ %..(...a.!n{].!....)..^D...2.....Y.....H6.4....f#rl6B.Y..Y...J.RrR...r*.t.....3...S...:...E.9.Tp.............z.......Mp..?A.a....8.6..c.)n...m.. ..j3..`...L.v@...v.I}...l............n..6 ..8...N...........lVW.S..f.rl..m...$...........-q.<y........q.ld@..FxJt..H6.y..5N..)Y..../3..6..Wh.......YFxk..IH.........)...p.........-8.mD.....{o?........orj.#<..^.3....;....1y.6...%.H..:.-.....]Fx..H..j..,..8m6#.......b......q.3P,...PK..-..........E98..'...P.....$....... ......0.. ........... .f...D...e...D...e...PK..........S...j.....HTTP/1.1 200 OK..Server: Apache-Coyote/1.1..Accept-Ranges: bytes..Age: 109207..Date: Thu, 21 Aug 2014 09:51:06 GMT..Last-Modified: Tue, 12 Aug 2014 10:43:54 GMT..Content-Length: 723..Connection: keep-alive..PK...........E98..'...P.....$.0.. ........... .f...D...e...D...e......vq.3b.````.bC=#3v. .$`.g.gh.g........(..Vb.l....8....J_?9%O/.(559?3.X/9_.. %.$.X?Q?-9..@..G.$_.d.^ye)..*...YSw]....q$.:h.8\ %..(...a.!n{].!....)..^D...2.....Y.....H6.4....f#rl6B.Y..Y...J.RrR...r*.t.....3...S...:...E.9.Tp.............z.......Mp..?A.a....8.6..c.)n...m.. ..j3..`...L.v@...v.I}...l............n..6 ..8...N...........lVW.S..f.rl..m...$...........-q.<y........q.ld@..FxJt..H6.y..5N..)Y..../3..6..Wh.......YFxk..IH.........)...p.........-8.mD.....{o?........orj.#<..^.3....;....1y.6...%.H..:.-.....]Fx..H..j..,..8m

<<< skipped >>>

GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dps.bing.com

Connection: Keep-Alive

Cookie: MUID=2F6B223C4C616DD806C724A148616EB1

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 42

Content-Type: image/gif

Expires: 2:51:04 AM

Server: Microsoft-IIS/8.5

TrackingId: efa22998-1ff1-4065-8c49-c55ba1a96922

X-Powered-By: ASP.NET

X-MSEdge-Ref: Ref A: 90AD790EE4E44F15A43A7507ED7480F4 Ref B: 898EFCFC7D9FFA32F0BE9D52BED1B55C Ref C: Thu Aug 21 02:51:09 2014 PST

Date: Thu, 21 Aug 2014 09:51:09 GMT

GIF89a.............!.......,...........L.;....

GET /AI/Api/v1/UserRest.svc/Provider/1AC1C520-232B-4E3D-B0CC-A52AC15EB7D4/User/3385203591170409805/gif?meta=appNexus HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: dps.bing.com

Connection: Keep-Alive

Cookie: MUID=2F6B223C4C616DD806C724A148616EB1

HTTP/1.1 200 OK

Cache-Control: no-cache

Content-Length: 42

Content-Type: image/gif

Expires: 2:51:05 AM

Server: Microsoft-IIS/8.5

TrackingId: cebbe73e-cfd0-43c2-b2bc-9ba5dbcddac3

X-Powered-By: ASP.NET

X-MSEdge-Ref: Ref A: EC694F809EF44FE884B64B93555A741A Ref B: EEEFAC4E2D0E8E5851CC732C27CC94EC Ref C: Thu Aug 21 02:51:10 2014 PST

Date: Thu, 21 Aug 2014 09:51:09 GMT

GIF89a.............!.......,...........L.;HTTP/1.1 200 OK..Cache-Control: no-cache..Content-Length: 42..Content-Type: image/gif..Expires: 2:51:05 AM..Server: Microsoft-IIS/8.5..TrackingId: cebbe73e-cfd0-43c2-b2bc-9ba5dbcddac3..X-Powered-By: ASP.NET..X-MSEdge-Ref: Ref A: EC694F809EF44FE884B64B93555A741A Ref B: EEEFAC4E2D0E8E5851CC732C27CC94EC Ref C: Thu Aug 21 02:51:10 2014 PST..Date: Thu, 21 Aug 2014 09:51:09 GMT..GIF89a.............!.......,...........L.;..

GET /mstag/mstag.1003102000.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: flex.msn.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=86400

Content-Type: application/javascript

Content-Encoding: gzip

Last-Modified: Thu, 14 Aug 2014 21:12:05 GMT

Accept-Ranges: bytes

ETag: "804023664b8cf1:0"

Vary: Accept-Encoding

Server: Microsoft-IIS/8.0

Date: Thu, 21 Aug 2014 09:51:03 GMT

Connection: close

Content-Length: 1956

...........Xm..... :LG&.8J:.MB.N.$N........Y.@$(....@....{....vM>H$v.],......."...qw<qr...g.]e,v.S.(.......P........t:Eao.j.H..Y...A(.3wx%N.....b..f...9.......W...).J....3...j..xQn.........:!.,"..*.EY....Ct........X......$.)G....:...,..Q......\...|...s.%.b.K...Q..7w.r...t..{.I..e .....1._9..3.....Fx%...i.U..9.))....*._K&..Y.p.Y.*.*)E...I_f...]S.#..TE.......c..0..u..M.!...q.0..s....G9Y:...wK.....^.kZf..g1`)Z...Rc........A..A.Q/>M....ee..............Z^. ..|.!....5d@...n,..2..%.c........,.,...c...?..-/.r G...Q..d...?..-.!......i.....3....{..[..H.|.........b.4..kH...t....A.!.y..v.. .:..uuu..VC.....^..2.>....M.oQ.W..V.4....u.....d(l.."':......V .b..e0....{....0...9Y.Q........b.~s....Z...2..:.....2....'T.(......L.r..H0V.[...C..k.)..T....J.#.T.i...Ve..G.....N.i.n<b....d.X.@..SQpHM.8E...8..!.(..F...L..J.......3..x.....U.w>.S..`..4.4}S.h.....1._.k[.K..pu@.....K.>.e.eKa...Q..m.....\6.~..(x....9.....r..F.....M...)n%..84W...6..?..X..>........xC..oL....s.......... ...w...$!...,......l.........$..fH....K.S.;.A$....{... ...e.....$..P....C.....:....s.|...,.(3..k2#...o...g!..q...'.m.....R((-..N.w .....!a.J.4... ML.x$....`Z...tj...{..'..[.2.n.;=.@.uaT ..6...`.....m.....H=U..P.....H_ O[..H..@..C/.Q........p.C..GG..>..>..Q;3\.7....yk..Y.)..{.........H`..{.1.rPc.5.|..t..S. ra. .....0......c.S~...]..6.....f....X....A.a.a..A.c;..3....<[...y.v...N....^R.r ..Z&.u.=.._.2u...*p.=..\h.....a.!m.........g.&..d.).t`...H........>....U...u...........JC.....l-..8w..p{..k...\.......s..@.$1G2....l.spb.,.Q...3.`

<<< skipped >>>

GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ads.yahoo.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:06 GMT

P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"

Set-Cookie: B=34pghj19vbg8a&b=3&s=6r; expires=Sun, 21-Aug-2016 09:51:06 GMT; path=/; domain=.yahoo.com

Set-Cookie: RMBX=34pghj19vbg8a&b=3&s=6r&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:06 GMT

Location: hXXp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy

Cache-Control: private

Content-Length: 0

Content-Type: text/plain; charset=utf-8

Age: 0

Connection: keep-alive

Server: ATS

HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:06 GMT..P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: B=34pghj19vbg8a&b=3&s=6r; expires=Sun, 21-Aug-2016 09:51:06 GMT; path=/; domain=.yahoo.com..Set-Cookie: RMBX=34pghj19vbg8a&b=3&s=6r&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:06 GMT..Location: hXXp://ib.adnxs.com/ymapuid?xid=gI5ek2F6taF94glZRNJAwFuy..Cache-Control: private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Connection: keep-alive..Server: ATS......

GET /cms/v1?esig=1~17e68b1b86afcfd8436104fe567484ccc2161b0f&nwid=10000602235&sigv=1 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3092599

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: ads.yahoo.com

Connection: Keep-Alive

Cookie: B=aud5rvp9vbg8b&b=3&s=os; RMBX=aud5rvp9vbg8b&b=3&s=os&t=232

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:08 GMT

P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"

Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:08 GMT

Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com

Location: hXXp://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP

Cache-Control: private

Content-Length: 0

Content-Type: text/plain; charset=utf-8

Age: 0

Connection: keep-alive

Server: ATS

HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:08 GMT..P3P: policyref="hXXp://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV"..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Sat, 20-Aug-2016 09:51:08 GMT..Set-Cookie: RMBX=aud5rvp9vbg8b&b=3&s=os&t=232; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT; domain=.yahoo.com..Location: http://ib.adnxs.com/ymapuid?xid=f9KWdCgo9LW7Ch3tC3nCtTRP..Cache-Control: private..Content-Length: 0..Content-Type: text/plain; charset=utf-8..Age: 0..Connection: keep-alive..Server: ATS..

GET /tap.php?v=4894|| HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.rubiconproject.com

Connection: Keep-Alive

Cookie: cd=false; au=HZ3WT02I-CD7Q-10.208.162.44; put_1986=3385203591170409805

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:11 GMT

Server: Apache

X-Powered-By: PHP/5.3.3

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com

Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com

Content-Length: 49

Keep-Alive: timeout=30, max=8880

Connection: Keep-Alive

Content-Type: image/gif

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..Server: Apache..X-Powered-By: PHP/5.3.3..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: rpb=4894=1; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.rubiconproject.com..Set-Cookie: rpx=4894=40633,0,1,,; expires=Sat, 20-Sep-2014 09:51:11 GMT; path=/; domain=.pixel.rubiconproject.com..Content-Length: 49..Keep-Alive: timeout=30, max=8880..Connection: Keep-Alive..Content-Type: image/gif..GIF89a...................!.......,...........T..;..

GET /offers/ui/css/start/jquery-ui-1.8.19.custom.css HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:50:02 GMT

Content-Type: text/css

Content-Length: 20706

Connection: keep-alive

Cache-Control: max-age=604800

Last-Modified: Thu, 26 Apr 2012 17:23:56 GMT

ETag: "ca38195cd123cd1:0"

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

Expires: Thu, 28 Aug 2014 09:50:02 GMT

X-Cache: HIT

Accept-Ranges: bytes

/*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/UI/Theming/API. */../* Layout helpers.----------------------------------*/..ui-helper-hidden { display: none; }..ui-helper-hidden-accessible { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,1px,1px); }..ui-helper-reset { margin: 0; padding: 0; border: 0; outline: 0; line-height: 1.3; text-decoration: none; font-size: 100%; list-style: none; }..ui-helper-clearfix:before, .ui-helper-clearfix:after { content: ""; display: table; }..ui-helper-clearfix:after { clear: both; }..ui-helper-clearfix { zoom: 1; }..ui-helper-zfix { width: 100%; height: 100%; top: 0; left: 0; position: absolute; opacity: 0; filter:Alpha(Opacity=0); }.../* Interaction Cues.----------------------------------*/..ui-state-disabled { cursor: default !important; }.../* Icons.----------------------------------*/../* states and images */..ui-icon { display: block; text-indent: -99999px; overflow: hidden; background-repeat: no-repeat; }.../* Misc visuals.----------------------------------*/../* Overlays */..ui-widget-overlay { position: absolute; top: 0; left: 0; width: 100%; height: 100%; }.../*!. * jQuery UI CSS Framework 1.8.19. *. * Copyright 2012, AUTHORS.txt (hXXp://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * hXXp://jquery.org/license. *. * hXXp://docs.jquery.com/

<<< skipped >>>

GET /offers/images/Theme8/topLine.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:03 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>......

<<< skipped >>>

GET /offers/images/Theme8/bgImg.jpg HTTP/1.1

Accept: */*

Referer: hXXp://direct.the-apps-track.com//offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0&

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: static.revenyou.com

Connection: Keep-Alive

HTTP/1.1 404 Not Found

Date: Thu, 21 Aug 2014 09:50:04 GMT

Content-Type: text/html

Content-Length: 1245

Connection: keep-alive

X-Powered-By: ASP.NET

Server: NetDNA-cache/2.2

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "hXXp://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns="hXXp://VVV.w3.org/1999/xhtml">..<head>..<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>..<title>404 - File or directory not found.</title>..<style type="text/css">..<!--..body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}..fieldset{padding:0 15px 10px 15px;} ..h1{font-size:2.4em;margin:0;color:#FFF;}..h2{font-size:1.7em;margin:0;color:#CC0000;} ..h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} ..#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;..background-color:#555555;}..#content{margin:0 0 0 2%;position:relative;}...content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}..-->..</style>..</head>..<body>..<div id="header"><h1>Server Error</h1></div>..<div id="content">.. <div class="content-container"><fieldset>.. <h2>404 - File or directory not found.</h2>.. <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>.. </fieldset></div>..</div>..</body>..</html>..HTTP/1.1 404 Not Found..Date: Thu, 21 Aug 2014 09:50:04 GMT..Content-Type: text/html..Content-Length: 1245..Connection: keep-aliv

<<< skipped >>>

GET /serve/52dfe62b6897d9bfcf00011e.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tag.perfectaudience.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: max-age=1800

Content-Type: text/javascript

Status: 200 OK

X-Frame-Options: sameorigin

X-Xss-Protection: 1; mode=block

Content-Length: 4436

Accept-Ranges: bytes

Date: Thu, 21 Aug 2014 09:51:05 GMT

Via: 1.1 varnish

Age: 0

Connection: keep-alive

X-Served-By: cache-dfw1835-DFW

X-Cache: MISS

X-Cache-Hits: 0

X-Timer: S1408614665.946026802,VS0,VE48

Vary: Accept-Encoding

window._pa = window._pa || {};._pa.segments = [{"name":"All visitors","id":1418586,"regex":".*"},{"name":"Users that downloaded the app","id":1459541,"regex":"/FreeCoinsLandingPage/thankyou\\.jsp/?([?#].*)*$"}];._pa.conversions = [{"name":"Successful Installation","id":"157720","regex":"/FreeCoinsLandingPage/thankyou\\.jsp/?([?#].*)*$"},{"name":"Successful install","id":"169355","regex":"/installer/thankyou\\?/?([?#].*)*$"},{"name":"JCCasino Download","id":"180231","regex":"/software\\-download//?([?#].*)*$"},{"name":"Bingo Register","id":"180782","regex":"/registration\\.aspx/?([?#].*)*$"}];._pa.conversionEvents = [];._pa.segmentEvents = [];._pa.rtbId = '7094';._pa.siteId = '52dfe62b6897d9bfcf00011e';.!function(){function e(e,t,p){a(e,t,p),n(e,t)}function a(e,a,n){if(null==n||isNaN(n))var t=_pa.pixelHost "seg?t=2&add=" e;else var t=_pa.pixelHost "seg?t=2&add=" e ":" n;_pa.createImageTag("segments",e,t,a)}function n(e,a){var n=_pa.paRtbHost "seg/?add=" e;_pa.productId&&(n =":" encodeURIComponent(_pa.productId)),r?_pa.createImageTag("paRtbSegments",e,n,a):i.push({id:e,name:a})}function t(){if(r=!0,0!==i.length){for(var e=[],a=[],n=0;n<i.length;n ){var t=i[n],p=t.id,o=t.name;_pa.productId&&(p =":" encodeURIComponent(_pa.productId)),e.push(p),a.push(o)}var p=e.join(","),o=a.join(","),d=_pa.paRtbHost "seg/?add=" p;_pa.createImageTag("paRtbSegments",p,d,o)}}function p(e,a,n,t){n=n||_pa.orderId,t=t||_pa.revenue;var p="";n&&""!==n&&(n=n.toString().replace(/@.*/,"@"),p ="&order_id=" encodeURIComponent(n)),t&&""!==t

<<< skipped >>>

GET /rsp?dnv=[TIMESTAMP]&rurl=http://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=[MOOKIE] HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: t.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:19 GMT

Server: Apache/2.2.3 (Red Hat)

Location: hXXp://mookie.bncnt.com/mookie/map?anuid=3385203591170409805&mookieid=2040815613008858

Connection: close

Content-Type: text/plain; charset=UTF-8

GET /event/img?mm_bnc HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: pixel.mathtag.com

Connection: Keep-Alive

Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost

Content-Length: 0

Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc

Expires: Thu, 21 Aug 2014 09:51:15 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Thu, 21 Aug 2014 09:51:15 GMT

Connection: keep-alive

Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com

P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"

HTTP/1.1 302 Moved Temporarily..Server: AkamaiGHost..Content-Length: 0..Location: hXXp://ak1.abmr.net/is/pixel.mathtag.com?U=/event/img&V=3-cMxGrO1ll8ALKws8gQvv0jTwvsz4Dw75P/hQypl4Wlj2J12s6Caq8w==&I=14FA840B092808F&D=mathtag.com&01AD=1&mm_bnc..Expires: Thu, 21 Aug 2014 09:51:15 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:15 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-1; expires=Thu, 18-Sep-2014 09:51:15 GMT; path=/; domain=.mathtag.com..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"......

GET /event/img?01AD=3vJy_ZwmkrhivK0L1WT2RggzuwXsDtqBZZoUS9diWlRNJzkXHss4XrA&01RI=14FA840B092808F&01NA=na&mm_bnc HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=; HRL8=CT-1

Connection: Keep-Alive

Host: pixel.mathtag.com

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 43

Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x20 pid 0x7f47 32583

Expires: Thu, 21 Aug 2014 09:51:16 GMT

Cache-Control: max-age=0, no-cache, no-store

Pragma: no-cache

Date: Thu, 21 Aug 2014 09:51:16 GMT

Connection: keep-alive

Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com

Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT

P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Type: image/gif..Content-Length: 43..Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x20 pid 0x7f47 32583..Expires: Thu, 21 Aug 2014 09:51:16 GMT..Cache-Control: max-age=0, no-cache, no-store..Pragma: no-cache..Date: Thu, 21 Aug 2014 09:51:16 GMT..Connection: keep-alive..Set-Cookie: HRL8=CT-USR; expires=Thu, 18-Sep-2014 09:51:16 GMT; path=/; domain=.mathtag.com..Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:16 GMT..P3P: CP="NON DSP ADM DEV PSD OUR IND STP PHY PRE NAV UNI"..GIF89a.............!.......,...........D..;..

GET /w/1.0/sd?cc=1&id=537072399&val=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: us-u.openx.net

Connection: Keep-Alive

Cookie: i=46eebf79-16d2-4434-067b-7056609eb927|1408614671

HTTP/1.1 200 OK

Server: MochiWeb/1.1 WebMachine/1.10.5 (jokes are better explained)

Pragma: no-cache

P3P: CP="CUR ADM OUR NOR STA NID"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Date: Thu, 21 Aug 2014 09:51:12 GMT

Content-Type: image/gif

Content-Length: 43

Cache-Control: private, max-age=0, no-cache

Connection: close

GIF89a.............!.......,...........D..;..

GET /FreeCoinsLandingPage/themes/thankyou/css/index.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freecoins.co

Connection: Keep-Alive

Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"1666-1403623016000"

Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Thu, 21 Aug 2014 09:51:02 GMT

Connection: close

a..............200...TQo.0.~...pR_....$Y.[..i.....#..x162N........4............G..._.....?...k......*U...CR..A....?zP{PN..h.Z.6C.{. ].?g.6.x X.$.rY.pi........,....B. TD.\&...&.rY.... ^...*M.N@*......~d......^`......#...T...6.ez.. i.....k(..f..../J..........s)?...T;.%......L.}Gc<.5&2..H.w...t..r...Bq...c/..(..h....M..~.^....&...."....[n..mKS..[.|.."\n2,..L.....L`.....kA..-.).n...Z...YH...F.N.f...l.'H.-\.~.......x..z....>.sL.....B.D.,7...6..._..g...<.?.]..].@].............y......A.....(@.;-....W.`.8-\|......8..4L...5..1 ..%...&...8e..` ..^...M`..)ojA.}r..Be.....V..).xz.2........._o."..P-}Xhj"_..u.:.....q...W..4:..8<....}...VK.....i.'...>.dq...t..g.!.~.Z.}..U.`.v<......O......0..

GET /js/jquery.cookie.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.gamehub.ws/index.php?&productname=Free Coins

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.gamehub.ws

Connection: Keep-Alive

Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:01 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 22 Jun 2014 08:51:42 GMT

ETag: "406ce-c17-4fc68d5e5db4d"

Accept-Ranges: bytes

Content-Length: 3095

Connection: close

Content-Type: text/javascript

/*!. * jQuery Cookie Plugin v1.4.0. * hXXps://github.com/carhartl/jquery-cookie. *. * Copyright 2013 Klaus Hartl. * Released under the MIT license. */.(function (factory) {..if (typeof define === 'function' && define.amd) {...// AMD. Register as anonymous module....define(['jquery'], factory);..} else {...// Browser globals....factory(jQuery);..}.}(function ($) {...var pluses = /\ /g;...function encode(s) {...return config.raw ? s : encodeURIComponent(s);..}...function decode(s) {...return config.raw ? s : decodeURIComponent(s);..}...function stringifyCookieValue(value) {...return encode(config.json ? JSON.stringify(value) : String(value));..}...function parseCookieValue(s) {...if (s.indexOf('"') === 0) {....// This is a quoted cookie as according to RFC2068, unescape.......s = s.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');...}....try {....// Replace server-side written pluses with spaces.....// If we can't decode the cookie, ignore it, it's unusable.....s = decodeURIComponent(s.replace(pluses, ' '));...} catch(e) {....return;...}....try {....// If we can't parse the cookie, ignore it, it's unusable.....return config.json ? JSON.parse(s) : s;...} catch(e) {}..}...function read(s, converter) {...var value = config.raw ? s : parseCookieValue(s);...return $.isFunction(converter) ? converter(value) : value;..}...var config = $.cookie = function (key, value, options) {....// Write...if (value !== undefined && !$.isFunction(value)) {....options = $.extend({}, config.defaults, options);.....if (typeof opt

<<< skipped >>>

GET /FreeCoinsLandingPage/themes/thankyou/images/bg_body.jpg HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freecoins.co

Connection: Keep-Alive

Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

ETag: W/"53305-1403623016000"

Last-Modified: Tue, 24 Jun 2014 15:16:56 GMT

Content-Type: image/jpeg

Content-Length: 53305

Date: Thu, 21 Aug 2014 09:51:03 GMT

Connection: close

......Exif..MM.*.............................b...........j.(...........1.........r.2...........i....................'.......'.Adobe Photoshop CS5 Windows.2013:12:30 18:50:38....................................................................................&.(.........................................H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................d...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE..t6..U.e.....u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te......u..F...............Vfv........'7GWgw.................?.M...c.....xR..m<..J..(EH......... I..Ai.....i.....I....l04v...B.{%.....hE ....#.p;...`X;h|.....aA._".LJ..e..r...i......'..2..}D4..4..U5..).5..>.lc..2>$...,4.`@.g.....`Hj......~.B..î..?..,%.P.-.y.0.Mrw.........VCC@h. J....\?F~J..........~!...Ii........<4W.f.Gc.@.........@V5.ee.7..............s...$.......{.]..i..Y.X..:..Jh ..n%..CG....ELaW....i.......(.....=l......R..x...Z....P.".x(.......Z.=......0.4<...2.Kv..?w....i......5...X`.b.]e....-....Y.\....S!.of...B...v.rS.f..V....6.c.@.*.....k#S.CD..........5.....Gez.{..........!..Gb...4.. c..L..S$.E{t.....h.........#D....=....Dx..n..D}......]{...G.%..5.XC.......UV.7L.'.U.cN..{f........V.....j.EMce.K....L....S.V. X......@...u...

<<< skipped >>>

GET /s.gif?uid1=1d2182171d38f63bead29a52dfc1bed2&uid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Connection: Keep-Alive

Host: d2tjil5tz17cbz.cloudfront.net

HTTP/1.1 200 OK

Content-Type: image/gif

Content-Length: 43

Connection: keep-alive

Date: Thu, 21 Aug 2014 09:51:20 GMT

x-amz-meta-cb-modifiedtime: Tue, 08 May 2012 12:38:45 GMT

Last-Modified: Mon, 19 May 2014 15:26:46 GMT

ETag: "45cf913e5d9d3c9b2058033056d3dd23"

Accept-Ranges: bytes

Server: AmazonS3

X-Cache: Miss from cloudfront

Via: 1.1 c739a168fcf19d0acf0a618f6eb437d2.cloudfront.net (CloudFront)

X-Amz-Cf-Id: zCVEUT1QNdT6fVUAD0zbTCj1BVADOEzWXOWxhaiviyigb7_TPllnhA==

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Content-Type: image/gif..Content-Length: 43..Connection: keep-alive..Date: Thu, 21 Aug 2014 09:51:20 GMT..x-amz-meta-cb-modifiedtime: Tue, 08 May 2012 12:38:45 GMT..Last-Modified: Mon, 19 May 2014 15:26:46 GMT..ETag: "45cf913e5d9d3c9b2058033056d3dd23"..Accept-Ranges: bytes..Server: AmazonS3..X-Cache: Miss from cloudfront..Via: 1.1 c739a168fcf19d0acf0a618f6eb437d2.cloudfront.net (CloudFront)..X-Amz-Cf-Id: zCVEUT1QNdT6fVUAD0zbTCj1BVADOEzWXOWxhaiviyigb7_TPllnhA==..GIF89a.............!.......,...........D..;..

GET /fr/u.php?t=2592000&p=443937282305007&m=ZTRiYWM1ZmFjMzEwYTRmZmRlYzkxMDY1NjdkNDMxOGI HTTP/1.1

Accept: */*

Referer: hXXp://VVV.freecoins.co/FreeCoinsLandingPage/thankyou.jsp

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.facebook.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 02:51:14 PDT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Pragma: public

X-XSS-Protection: 0

Cache-Control: public, max-age=0

Expires: Thu, 21 Aug 2014 02:51:14 PDT

X-UA-Compatible: IE=edge,chrome=1

Content-Encoding: gzip

X-FB-Debug: /LOc 4/dXoyzwMthIKyvsprUDn5uwbU7Nit WyS6T/N3zP8D avDYdWKrSv 0IpwMh3i4wjllQhTobQncItvA==

Transfer-Encoding: chunked

Connection: keep-alive

2f............r.t..Ldd`dh`....,. Z.D.d...\...........a....v.h. .....0..HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 02:51:14 PDT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Pragma: public..X-XSS-Protection: 0..Cache-Control: public, max-age=0..Expires: Thu, 21 Aug 2014 02:51:14 PDT..X-UA-Compatible: IE=edge,chrome=1..Content-Encoding: gzip..X-FB-Debug: /LOc 4/dXoyzwMthIKyvsprUDn5uwbU7Nit WyS6T/N3zP8D avDYdWKrSv 0IpwMh3i4wjllQhTobQncItvA==..Transfer-Encoding: chunked..Connection: keep-alive..2f............r.t..Ldd`dh`....,. Z.D.d...\...........a....v.h. .....0..

GET /cm?in=1&pub=345&userid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://ib.adnxs.com/bounce?/tt?id=3095266

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: p.rfihub.com

Connection: Keep-Alive

Cookie: e=ai; rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA; hl=H4sIAAAAAAAAANNSTHR0Mi8pswwLtLV19DSND/YuB7EcHZ2C4tPMvE1NbAE5he4GIwAAAA==; eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNzY2sJzFiMw3NAAAAdzhOzQAAAA=; euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=; ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA

HTTP/1.1 302 Found

Server: nginx/1.5.3

Date: Thu, 21 Aug 2014 09:51:15 GMT

Content-Length: 0

Connection: keep-alive

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT

Expires: Thu, 01 Jan 1970 00:00:00 GMT

Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT

Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8x8nBMt7V19DSND/YuDwSyHB2dguLTzPwcDWwBVqvNsiMAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT

Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNwXiWYwofEsAtukdrDQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT

Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com

Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com

Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=

HTTP/1.1 302 Found..Server: nginx/1.5.3..Date: Thu, 21 Aug 2014 09:51:15 GMT..Content-Length: 0..Connection: keep-alive..P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"..Set-Cookie: e=ai;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Expires: Thu, 01 Jan 1970 00:00:00 GMT..Set-Cookie: rud=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjaS4jU0MbAwMzQxMzc2NjQAAPQ9Btk0AAAA;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Set-Cookie: hl=H4sIAAAAAAAAANNSTHR0Mi8x8nBMt7V19DSND/YuDwSyHB2dguLTzPwcDWwBVqvNsiMAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Set-Cookie: eud=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMI3iNTQxsDAzNDEzNwXiWYwofEsAtukdrDQAAAA=;Path=/;Domain=.rfihub.com;Expires=Mon, 06-Feb-2017 09:51:15 GMT..Set-Cookie: euds=H4sIAAAAAAAAABMSNja2MDUyMDa1NDQ0NzAxsLQwMAUAM5GG2RUAAAA=;Path=/;Domain=.rfihub.com..Set-Cookie: ruds=H4sIAAAAAAAAAOMSTja3MDM3MjI1MzE2NDcyNzE1MBfiM9TNds90rSwtcCwpTjYCALo/pXElAAAA;Path=/;Domain=.rfihub.com..Location: hXXp://ib.adnxs.com/pxj?bidder=18&seg=378601&action=setuids('786722564317274507','');&redir=..

<<< skipped >>>

GET /safeframe/1-0-0/html/container.html HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: tpc.googlesyndication.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Vary: Accept-Encoding

Content-Encoding: gzip

Content-Type: text/html

Last-Modified: Tue, 14 Jan 2014 13:13:27 GMT

Date: Tue, 12 Aug 2014 18:51:55 GMT

Expires: Wed, 12 Aug 2015 18:51:55 GMT

X-Content-Type-Options: nosniff

Server: sffe

Content-Length: 1287

X-XSS-Protection: 1; mode=block

Cache-Control: public, max-age=31536000

Age: 745146

Alternate-Protocol: 80:quic

......n....VyS.8...Oa<.G".....4.#C.Q.B.= Iw.[q\.;......>.N..;;.3MyO...]Vs...}{w}d..8..j....9.<...*R.....8.|,.v.(.¶.R....As..O.e..h.J.0..p..*J.B...4|P.(.4..Z6`...BMeb.....m..y.m..BU.!....a.].....E!W.lm..4.. ..j$.8....0...n.2..!I`Lh.l.....:@b.<S.I .WCb^M..&.So......w.u....szd........DaR.... .718.P...t;.......?.&....4..*.0.a.$.X.!.......A.O...[..5X.]..h..(0.9.y[.Q...4.B....v..I...*....a......M=MD:4.ZO.6.<.g.@/...G.z.....^.FI..=.4...7 ..N.R.h.a....arQ..L.!.N.:.-.P....B.D...=...n.a....e".`J....'\f.8N."s]j.(.%!9..@..`.<..<..v.`... g...Y....6.......C....h.......b.s_..G.......-....2..v6.#EL...je;....p.......d."...]U.e..b.s.R.[O.j.E...../.X..p.".......b.^/..R..w.....|.........V....@.=...,........l"..n._..,.......8............"...u....U. .._y.[.i..../T...C..GQ,...yYx.7...h...mL.;.#.zla.-..lw:n;.O..I9......ZC..q5..j&uN.rY...fO......7..;Y..e.......I...{.U..Y..}L..G...1..^....~..P..Sp~.....H/...f..w...).T.8...~s.X..w.X....*..Q5...l.$I.Q......8z...p....b.$.....D.4...p...og.A.$..uj.t.t.....u..ej...e.]....Sa.G.....A.;_.s.)A.5..i&....*.].9....."..(..C...n\.....M..j..V..h....3..e..z...n...]_..d.\;.kW..&"..D...h...T7I..R].u.....).t....e.........C.;.......=...]A!{o...l"..........H..*.o{..E..w..PD.......po.L#L5v....i.gUM....8.....5f..3^...U.l....-............... ......S.S.......Si.......

<<< skipped >>>

POST /CA_Servlet/trackingServlet HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Host: VVV.freecoins.co

Content-Length: 10

Expect: 100-continue

Connection: Keep-Alive

HTTP/1.1 100 Continue

....

GET /index.php?&productname=Free Coins HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://data.getserverinfo.com/installer/thankyou?productid=6303&pubid=5492&distid=19036&countryid=262&reqid=135181431&sysbit=32&dfb=0&hb=2

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.gamehub.ws

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:00 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.13

Set-Cookie: PHPSESSID=nv2eqk0r5kkbhm40a5ja5vir55; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0

Pragma: no-cache

Connection: close

Transfer-Encoding: chunked

Content-Type: text/html; charset=utf-8

4169..<!DOCTYPE html>..<html xmlns="hXXp://VVV.w3.org/1999/xhtml" xml:lang="en" lang="en">.. <head>.. <title>GameHub</title>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>.. <meta name="description" content="" />.. <meta name="keywords" content="" />.. <meta http-equiv="Cache-Control" content="no-cache, no-store, must-revalidate">.. <meta http-equiv="Pragma" content="no-cache">.. <meta http-equiv="Expires" content="0">.. <link type="text/css" rel="StyleSheet" href="css/index.css" />.. <script src="//ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js"></script>.. <script src="js/jquery.cookie.js"></script>.. <script src="js/core-min.js"></script>.. <script src="js/sha256-min.js"></script>.. <script>window.FB_APP_ID = "1430933670481682";</script>.. <script src="js/facebookConnect.js"></script>.. <script src="js/gamesHub.js"></script>.. <!-- TEST ENV -->.. <!--<script src="//test.maudau.com/AdsBar/api?appid=5464&get=images&adSizeType=1"></script>.. <script>window.casino=MauDauOBJ</script>.. <script src="//test

<<< skipped >>>

GET /updates/m/fcmonitor.wys HTTP/1.1

User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 6.1; en-US; wyUpdate)

Host: cdn.wemempoclano.net

Cache-Control: no-store,no-cache

Pragma: no-cache

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Accept-Ranges: bytes

Age: 50159

Date: Thu, 21 Aug 2014 09:51:09 GMT

Last-Modified: Tue, 12 Aug 2014 13:00:40 GMT

Content-Length: 497

Connection: keep-alive

PK........v`.E.X..E...{.....$.0.. ...........zR.......N.......N.......vq.3b.````.bC=C3v. .$`.g.gh.g.........a. 1`v...@.QRR`......W....[.........Z._Z..X.Z.........Y._....W....E.....9...y..).......r:.p..... ......8...p..02.......R.....1.).?.y.mD..R..2.....y..'X.".'x........kqz.....Q. F...y.. .^.....1%^1..W.q{... *.W.....%^1..WLp{e.Lf.WtC.>...)%^1..WLq{.-.. ..T.qz.... 1'.*...9.....)y.?.:..#..PK..-.......v`.E.X..E...{.....$....... ......0.. ...........zR.......N.......N....PK..........S...........

GET /FreeCoinsLandingPage/thankyou.jsp HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.freecoins.co

Connection: Keep-Alive

HTTP/1.1 200 OK

Server: Apache-Coyote/1.1

Set-Cookie: JSESSIONID=97CA31BDD45F163F4794551DC111D3D1; Path=/FreeCoinsLandingPage

Content-Type: text/html

Transfer-Encoding: chunked

Content-Encoding: gzip

Vary: Accept-Encoding

Date: Thu, 21 Aug 2014 09:51:02 GMT

Connection: close

a..............200...Y.s.H..|. &...9#...y....S6vlr...E..H.-4Z=0l...u........SU........cH.}......C...i....2.9n.P.a.U5...E})....B.R.&H. Q....P........W.2j.C9.y..foH.g.CD$O..O....q.k......#..UB=.}]...RF,......#>n(g.....{S.).*g.%d.PC-k..R?`a#.......s..5........7%E![....E.f...,z&!...b.@.3....S......2....C6b...k."BZ..&... -6@...?.r~.-.g9..U.Yami.ui.Oyd...u.#.......(...{.9..p3.VI.R.&5Bv..Q...p...'$.....H."...L.k1...@...kL>&.C.@-.....x.B....tQ.=X.......e.\....;....|................M.......%."..D......l.?|.R....!FZ.~..Jz.xtr...xzs...5...200......n..........n..b.;...{r?^.~..}....m.$gW..^j.......ku.o[w....@..A.$.`.Bf..V.Y.bSV\.....\.L..N.......%.E.1.A..Q2...?6.Jb>.I...A.G..9&..L(}G.B.\{........:.cf:......Px..yu.....c u....P..V.....s.../....TL...\.G.....g"\.^%..1.....\.Dx..y.@X...@L X.{.Z...Is...=U.....$.}...l..#d.....%...O&..........*..9}.i..U....=.w...b.....e..,.0.W!..!.Kw.[w.&x......C....t..0'Xf.;.t..D.4^U..[$....$... z..z....A~B.d..]%V....esd.......|..$.....!..r.. ..`.Z.\ 5h...m....j...f....i....(p%.$....i.b.1.`y.0..CZfy:84..AiP(0Z<..bz.)@......200...O1O...B].LCn....i23..D).....].0-..BO..".M..t....q.TT^s)-\1.r.......^...U...$.m.>.Tm$.~...>.Tl$.....:t........q....".:p..F....y......:.&T........ \(....N........!l........v.qY.".`A`ENR{.....;f~..[.\~%"...}......^..|.....'.......>7!R*...I.||X..._z.*. ......0.!2...7..n.rK~{.8t.......og_..?l.k9(}..^.%`L.........E..^.v_....-....z............b........?....O.....By..v...jZ.t......).....v;.2.8JD.!..3./5....u...isLj...4..t...576....#H.7]9..n..G....~ ...5.bjb..k

<<< skipped >>>

GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sync.mathtag.com

Connection: Keep-Alive

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Type: image/gif

Content-Length: 0

Connection: keep-alive

Keep-Alive: timeout=360

Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x3 pid 0x417b 16763

Cache-Control: no-cache

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Set-Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; domain=.mathtag.com; path=/; expires=Fri, 21-Aug-2015 09:51:14 GMT

Location: hXXp://sync.mathtag.com/sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct

Expires: Thu, 21 Aug 2014 09:51:13 GMT

....

GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805&mm_bnc&mm_bct HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sync.mathtag.com

Connection: Keep-Alive

Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Type: image/gif

Content-Length: 0

Connection: keep-alive

Keep-Alive: timeout=360

Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x4 pid 0x4a46 19014

Cache-Control: no-cache

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT

Location: hXXp://pixel.mathtag.com/event/img?mm_bnc

Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT

Expires: Thu, 21 Aug 2014 09:51:13 GMT

....

GET /sync/img?mt_exid=13&mt_exuid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: sync.mathtag.com

Connection: Keep-Alive

Cookie: uuid=5d1f53f5-c112-4500-bc9b-7d0d19d612ab; mt_mop=13:1408614674; mt_misc=

HTTP/1.1 302 Found

Date: Thu, 21 Aug 2014 09:51:14 GMT

Content-Type: image/gif

Content-Length: 0

Connection: keep-alive

Keep-Alive: timeout=360

Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x6 pid 0x42be 17086

Cache-Control: no-cache

P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT

Location: hXXp://pixel.mathtag.com/event/img?mm_bnc

Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT

Expires: Thu, 21 Aug 2014 09:51:13 GMT

HTTP/1.1 302 Found..Date: Thu, 21 Aug 2014 09:51:14 GMT..Content-Type: image/gif..Content-Length: 0..Connection: keep-alive..Keep-Alive: timeout=360..Server: mt2/2.10.2.rc1 26c5168 CORE-1658-uuid-random-patch Mar 4 2014 19:08:19 ewr-pixel-x6 pid 0x42be 17086..Cache-Control: no-cache..P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"..Set-Cookie: mt_mop=13:1408614674; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT..Location: hXXp://pixel.mathtag.com/event/img?mm_bnc..Set-Cookie: mt_misc=; domain=.mathtag.com; path=/; expires=Sat, 20-Sep-2014 09:51:14 GMT..Expires: Thu, 21 Aug 2014 09:51:13 GMT..

GET //offers/DynamicOfferScreen?offerid=2&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:50:01 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 7542

Connection: keep-alive

.<html>. <head>. . <style type="text/css">. .ui-progressbar-value { background-image: url(images/pbar-ani.gif); }. </style>. . <link type="text/css" href="hXXp://static.revenyou.com/offers/ui/css/start/jquery-ui-1.8.19.custom.css" rel="stylesheet" />. <link href="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8/themes/start/jquery-ui.css" rel="stylesheet" type="text/css" />. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js"></script>. <script type="text/javascript" src="hXXp://ajax.googleapis.com/ajax/libs/jqueryui/1.8/jquery-ui.min.js"></script>.. <title>2 - NonProduct (Free Coins)</title><script type='text/javascript'></script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89px; height:26px; cursor:pointer; bottom: 8px; margin-l

<<< skipped >>>

GET //offers/DynamicOfferScreen?offerid=4&distid=19036&leadp=6303&countryid=262&sysbit=32&dfb=0&hb=2&external=0& HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: direct.the-apps-track.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: private

Content-Type: text/html; charset=utf-8

Date: Thu, 21 Aug 2014 09:51:03 GMT

Server: Microsoft-IIS/8.0

X-AspNet-Version: 4.0.30319

X-AspNetMvc-Version: 4.0

X-Powered-By: ASP.NET

Content-Length: 6258

Connection: keep-alive

<html>. <head>. <title>4 - NonProduct (Free Coins)</title><script type='text/javascript'></script><style type='text/css'>body { width:100%; height:100%; margin:0px; padding:0px; font-size:font-family:helvetica; font-size:12px;} .divLeadpName { border-bottom-style:groove;border-bottom-width: thin; padding-left:61px; padding-top:9px; font-size:font-family:helvetica; font-style:italic; font-size:25px; font-weight:bold; color:black; position:absolute; width: 100%; background-color: #fff; ba} #divTop {display: none} #divMiddle {background-color: #efecec; height: 100%;} #middle {background-color: #fff;} .divOnNext { position:absolute; width:89px; height:26px; cursor:pointer; bottom: 8px; margin-left:1px; right: 1%; background:url("hXXp://static.revenyou.com/offers/images/Theme8/button.png");} .divAccept { text-align:center; font-family:Arial halvetica; width:89px; position:absolute; font-size:12px; bottom: 7px; margin-left:1px; right: 2%;} .divDecline { text-align:center;height:26px; bottom: 8px; cursor:pointer; font-family:Arial helvetica; font-size:12px; position:absolute; left:1%; padding-top: 4px;} .divAgreementLeadP{ position:absolute; bottom:46px; left:3px;font-size:10px; } #divAgreementLeadPWelcome {bottom:46px;position:absolute;left:187px;font-size:10px;} a:visited { color:Blue;

<<< skipped >>>

GET /activity?_o=62795&_t=cm_apn_in HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: m.xp1.ru4.com

Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily

Server: Sun-Java-System-Web-Server/7.0

Date: Thu, 21 Aug 2014 09:51:18 GMT

P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"

Pragma: no-cache

Set-cookie: X1ID=NC-00000010467304128; domain=.ru4.com; path=/; expires=Thu, 21-Feb-2016 05:51:18 GMT

Set-cookie: TMP_X1ID=NC-00000010467304128; domain=.ru4.com; path=/

Location: hXXp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128

Content-length: 0

HTTP/1.1 302 Moved Temporarily..Server: Sun-Java-System-Web-Server/7.0..Date: Thu, 21 Aug 2014 09:51:18 GMT..P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI"..Pragma: no-cache..Set-cookie: X1ID=NC-00000010467304128; domain=.ru4.com; path=/; expires=Thu, 21-Feb-2016 05:51:18 GMT..Set-cookie: TMP_X1ID=NC-00000010467304128; domain=.ru4.com; path=/..Location: hXXp://ib.adnxs.com/setuid?entity=11&code=NC-00000010467304128..Content-length: 0..

GET /pixel?google_nid=appnexus&google_cm&google_sc&uid=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYAAgUAAQIAAJAAsydv_AAAAAA.&cnd=!Gymhwwi33ZwCEPS10AgYACDWxhswBDgAQAFI1wZQ4vW8AVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEAqAEAsAEAuQHvSc0aa_wAQMEBlbkwoSXxoT_JAfgh3MvKCPw_2QHsUbgehUtOQOABzOII9QEAAAAA&ccd=!vAYYPwi33ZwCEPS10AgY1sYbIAE.&udj=uf('a', 353928, 1408614664);uf('c', 4665015, 1408614664);uf('r', 18094836, 1408614664);&vpid=1249&apid=280253&referrer=http://ib.adnxs.com/bounce?%2Ftt%3Fid%3D3095266&media_subtypes=1&ct=0&rsrc=2&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cm.g.doubleclick.net

Connection: Keep-Alive

Cookie: id=22d9b9c0f2020014||t=1408614666|et=730|cs=002213fd4822e18203ab0698c3

HTTP/1.1 302 Found

P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"

Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1

Date: Thu, 21 Aug 2014 09:51:16 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, must-revalidate

Content-Type: text/html; charset=UTF-8

Server: HTTP server (unknown)

Content-Length: 317

X-XSS-Protection: 1; mode=block

Alternate-Protocol: 80:quic

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>..HTTP/1.1 302 Found..P3P: policyref="hXXp://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"..Location: hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1..Date: Thu, 21 Aug 2014 09:51:16 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, must-revalidate..Content-Type: text/html; charset=UTF-8..Server: HTTP server (unknown)..Content-Length: 317..X-XSS-Protection: 1; mode=block..Alternate-Protocol: 80:quic..<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">.<TITLE>302 Moved</TITLE></HEAD><BODY>.<H1>302 Moved</H1>.The document has moved.<A HREF="hXXp://ib.adnxs.com/setuid?entity=101&uid=3385203591170409805&code=CAESEHTmMTYQ3jAj-x8b24KF31s&google_cver=1">here</A>...</BODY></HTML>....

<<< skipped >>>

GET /tagr/v1/sync?src.platformID=AN&src.visitorID=3385203591170409805 HTTP/1.1

Accept: */*

Referer: hXXp://nym1.ib.adnxs.com/if?enc=RyV1ApoIiz8gYRiw5CqGPyUGgZVDi8w_IGEYsOQqhj9GJXUCmgiLP8pCQRU10tUjTcUWCLuo-i4KwfVTAAAAADOmMgDIAQAArQcAAAIAAAC5dQ4BhuYGAAAAAQBVU0QAVVNEAKAAWALyLwAAaaUAAgUAAQIAAJQA-CF8TgAAAAA.&pubclick=hXXp://nym1.ib.adnxs.com/click?lbkwoSXxoT8VuqV7NtyeP9v5fmq8dKM_Fbqlezbcnj-VuTChJfGhP4wuM91UTd0hTcUWCLuo-i4IwfVTAAAAAOI6LwAQCgAAVwMAAAIAAAD0GhQBVuMGAAAAAQBVU0QAVVNEAKAAWAKdGAAAnuYDAQUAAQIAAJAAtSeU_AAAAAA./cnd=%21vAYYPwi33ZwCEPS10AgY1sYbIAE./referrer=http%3A%2F%2Fib.adnxs.com%2Fbounce%3F%252Ftt%253Fid%253D3095266/clickenc=&cnd=!-R-rRgiVz5ICELnruQgYACCGzRswADgAQABIrQ9Qs8zKAVgAYKUGaABwAHgAgAEAiAEAkAEBmAEBoAEBqAEDsAEAuQFGJXUCmgiLP8EBRiV1ApoIiz_JAWkEaJjYcvc_2QEAAAAAAADwP-ABAPUBAAAAAA..&ccd=!HAY_OQiVz5ICELnruQgYhs0bIAA.&udj=uf('a', 342179, 1408614666);uf('c', 4499349, 1408614666);uf('r', 17724857, 1408614666);&vpid=13&apid=418911&referrer=http://ib.adnxs.com/bounce?/tt?id=3095266&media_subtypes=1&ct=0&rsrc=3&dlo=1

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: gmtdmp.mookie1.com

Connection: Keep-Alive

Cookie: id=2040815613008858; mdata=1|2040815613008858|1408614669; OAX=igh79FP1wQ0ABVfH

HTTP/1.1 200 OK

Date: Thu, 21 Aug 2014 09:51:11 GMT

P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"

Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/

Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/

Cache-Control: private, no-store, no-cache

Pragma: no-cache

Expires: Fri, 30 Oct 1998 14:19:41 GMT

Content-Type: image/gif

Content-Length: 43

Keep-Alive: timeout=1, max=9649

Connection: Keep-Alive

GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Date: Thu, 21 Aug 2014 09:51:11 GMT..P3P: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"..Set-Cookie: id=2040815613008858; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Set-Cookie: mdata=1|2040815613008858|1408614669; Domain=.mookie1.com; Expires=Sat, 20-Sep-2014 09:51:11 GMT; Path=/..Cache-Control: private, no-store, no-cache..Pragma: no-cache..Expires: Fri, 30 Oct 1998 14:19:41 GMT..Content-Type: image/gif..Content-Length: 43..Keep-Alive: timeout=1, max=9649..Connection: Keep-Alive..GIF89a.............!.......,...........D..;..

Map

The not-a-virus connects to the servers at the folowing location(s):

Strings from Dumps

%original file name%.exe_580:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe /PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe /PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe->C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\instructionsBv3.exe

1.2.2

1.2.2

Extract: %f

Extract: %f

%u byte%c

%u byte%c

(%u byte%c)

(%u byte%c)

%d.%d%d Ë%c

%d.%d%d Ë%c

inflate 1.2.2 Copyright 1995-2004 Mark Adler

inflate 1.2.2 Copyright 1995-2004 Mark Adler

GetProcessHeap

GetProcessHeap

nsisunz.dll

nsisunz.dll

operator

operator

GetProcessWindowStation

GetProcessWindowStation

portuguese-brazilian

portuguese-brazilian

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.zip

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\rdms.zip

onsBv3.dat

onsBv3.dat

rdms.zip

rdms.zip

NSTRU~1.DAT

NSTRU~1.DAT

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp

:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp

c:\%original file name%.exe

c:\%original file name%.exe

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp

%original file name%.exe

%original file name%.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst1.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nst1.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nso2.tmp

/PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

/PID=5492 /SUBPID=0 /NETWORKID=1 /DISTID=19036 /CID=0 /PRODUCT_ID=6303 /SERVER_URL=`omn7).`ar\&b^rp_qrepdfah,`il /CLICKID=wMA0G5248NF6F5LD0L2BH52O /D1=NUMBER /D2=NUMBER /D3=NUMBER /D4=NUMBER /D5=NUMBER /PRODUCT_PRIVACY= /PRODUCT_EULA= /PRODUCT_NAME= /EXE_URL= /EXE_CMDLINE= /HOST_BROWSER=2 /THANKYOU_URL= /TIME=1407360161 /VM=2 /DS1= /RUNTIME_WELCOMEIMAGEURL= /IS_RUNTIME=true /RETURNING_USER_DAYS=2 /IS_DYNAMIC_ENCRYPTED=true

Nullsoft Install System v2.46

Nullsoft Install System v2.46

WUSER32.DLL

WUSER32.DLL

Setup.exe

Setup.exe

rdms.exe_484:

.text

.text

`.rdata

`.rdata

@.data

@.data

.rsrc

.rsrc

@.reloc

@.reloc

SSh,bJ

SSh,bJ

.CGy,

.CGy,

SShT&J

SShT&J

FTPj

FTPj

YPSSSh

YPSSSh

,4,56,789

,4,56,789

xSSSh

xSSSh

FTPjKS

FTPjKS

FtPj;S

FtPj;S

C.PjRV

C.PjRV

RegOpenKeyTransactedW

RegOpenKeyTransactedW

RegCreateKeyTransactedW

RegCreateKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyTransactedW

RegDeleteKeyExW

RegDeleteKeyExW

%d/%d/%d %d:%d:%d

%d/%d/%d %d:%d:%d

X:X:X:X:X:X

X:X:X:X:X:X

large file support is disabled

large file support is disabled

unknown operation

unknown operation

SQL logic error or missing database

SQL logic error or missing database

foreign_keys

foreign_keys

sqlite_compileoption_get

sqlite_compileoption_get

sqlite_compileoption_used

sqlite_compileoption_used

sqlite_log

sqlite_log

sqlite_source_id

sqlite_source_id

sqlite_version

sqlite_version

sqlite_attach

sqlite_attach

sqlite_detach

sqlite_detach

sqlite_stat1

sqlite_stat1

sqlite_rename_parent

sqlite_rename_parent

sqlite_rename_trigger

sqlite_rename_trigger

sqlite_rename_table

sqlite_rename_table

GetProcessHeap

GetProcessHeap

RowKey

RowKey

3.7.16.2

3.7.16.2

SQLite format 3

SQLite format 3

CREATE TABLE sqlite_master(

CREATE TABLE sqlite_master(

sql text

sql text

CREATE TEMP TABLE sqlite_temp_master(

CREATE TEMP TABLE sqlite_temp_master(

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

REINDEXEDESCAPEACHECKEYBEFOREIGNOREGEXPLAINSTEADDATABASELECTABLEFTHENDEFERRABLELSEXCEPTRANSACTIONATURALTERAISEXCLUSIVEXISTSAVEPOINTERSECTRIGGEREFERENCESCONSTRAINTOFFSETEMPORARYUNIQUERYATTACHAVINGROUPDATEBEGINNERELEASEBETWEENOTNULLIKECASCADELETECASECOLLATECREATECURRENT_DATEDETACHIMMEDIATEJOINSERTMATCHPLANALYZEPRAGMABORTVALUESVIRTUALIMITWHENWHERENAMEAFTEREPLACEANDEFAULTAUTOINCREMENTCASTCOLUMNCOMMITCONFLICTCROSSCURRENT_TIMESTAMPRIMARYDEFERREDISTINCTDROPFAILFROMFULLGLOBYIFISNULLORDERESTRICTOUTERIGHTROLLBACKROWUNIONUSINGVACUUMVIEWINITIALLY

922337203685477580

922337203685477580

SQLITE_

SQLITE_

?API call with %s database connection pointer

?API call with %s database connection pointer

OsError 0x%x (%u)

OsError 0x%x (%u)

os_win.c:%d: (%d) %s(%s) - %s

os_win.c:%d: (%d) %s(%s) - %s

delayed %dms for lock/sharing conflict

delayed %dms for lock/sharing conflict

%s\etilqs_

%s\etilqs_

%s\%s

%s\%s

cannot limit WAL size: %s

cannot limit WAL size: %s

2nd reference to page %d

2nd reference to page %d

invalid page number %d

invalid page number %d

%s(%d)

%s(%d)

keyinfo(%d

keyinfo(%d

%r %s BY term out of range - should be between 1 and %d

%r %s BY term out of range - should be between 1 and %d

Expression tree is too large (maximum depth %d)

Expression tree is too large (maximum depth %d)

too many SQL variables

too many SQL variables

variable number must be between ?1 and ?%d

variable number must be between ?1 and ?%d

too many columns in %s

too many columns in %s

%s OR name=%Q

%s OR name=%Q

type='trigger' AND (%s)

type='trigger' AND (%s)

table %s may not be altered

table %s may not be altered

sqlite_

sqlite_

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

SELECT tbl,idx,stat FROM %Q.sqlite_stat1

access to %s.%s.%s is prohibited

access to %s.%s.%s is prohibited

access to %s.%s is prohibited

access to %s.%s is prohibited

object name reserved for internal use: %s

object name reserved for internal use: %s

duplicate column name: %s

duplicate column name: %s

too many columns on %s

too many columns on %s

DELETE FROM %Q.%s WHERE %s=%Q

DELETE FROM %Q.%s WHERE %s=%Q

sqlite_stat%d

sqlite_stat%d

unknown column "%s" in foreign key definition

unknown column "%s" in foreign key definition

number of columns in foreign key does not match the number of columns in the referenced table

number of columns in foreign key does not match the number of columns in the referenced table

foreign key on %s should reference only one column of table %T

foreign key on %s should reference only one column of table %T

a JOIN clause is required before %s

a JOIN clause is required before %s

cannot modify %s because it is a view

cannot modify %s because it is a view

table %s may not be modified

table %s may not be modified

Cforeign key mismatch - "%w" referencing "%w"

Cforeign key mismatch - "%w" referencing "%w"

error during initialization: %s

error during initialization: %s

no entry point [%s] in shared library [%s]

no entry point [%s] in shared library [%s]

unable to open shared library [%s]

unable to open shared library [%s]

sqlite3_extension_init

sqlite3_extension_init

unknown or unsupported join type: %T %T%s%T

unknown or unsupported join type: %T %T%s%T

RIGHT and FULL OUTER JOINs are not currently supported

RIGHT and FULL OUTER JOINs are not currently supported

USE TEMP B-TREE FOR %s

USE TEMP B-TREE FOR %s

COMPOUND SUBQUERIES %d AND %d %s(%s)

COMPOUND SUBQUERIES %d AND %d %s(%s)

%s:%d

%s:%d

no such index: %s

no such index: %s

SCAN TABLE %s %s%s(~%d rows)

SCAN TABLE %s %s%s(~%d rows)

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='table', name=%Q, tbl_name=%Q, rootpage=0, sql=%Q WHERE rowid=#%d

sqlite_master

sqlite_master

sqlite_temp_master

sqlite_temp_master

vtable constructor did not declare schema: %s

vtable constructor did not declare schema: %s

vtable constructor failed: %s

vtable constructor failed: %s

no such module: %s

no such module: %s

table %s: xBestIndex returned an invalid plan

table %s: xBestIndex returned an invalid plan

%s (~%lld rows)

%s (~%lld rows)

%s VIRTUAL TABLE INDEX %d:%s

%s VIRTUAL TABLE INDEX %d:%s

%s (rowid)

%s (rowid)

%s (rowid>?)

%s (rowid>?)

%s (rowid>? AND rowid)

%s (rowid>? AND rowid)

%s (rowid=?)

%s (rowid=?)

%s USING INTEGER PRIMARY KEY

%s USING INTEGER PRIMARY KEY

%s USING %s%sINDEX%s%s%s

%s USING %s%sINDEX%s%s%s

%s AS %s

%s AS %s

%s TABLE %s

%s TABLE %s

%s SUBQUERY %d

%s SUBQUERY %d

database corruption at line %d of [%.10s]

database corruption at line %d of [%.10s]

misuse at line %d of [%.10s]

misuse at line %d of [%.10s]

cannot open file at line %d of [%.10s]

cannot open file at line %d of [%.10s]

failed to allocate %u bytes of memory

failed to allocate %u bytes of memory

failed memory resize %u to %u bytes

failed memory resize %u to %u bytes

foreign key constraint failed

foreign key constraint failed

unable to use function %s in the requested context

unable to use function %s in the requested context

zeroblob(%d)

zeroblob(%d)

CREATE TABLE %Q.%s(%s)

CREATE TABLE %Q.%s(%s)

%s %T cannot reference objects in database %s

%s %T cannot reference objects in database %s

default value of column [%s] is not constant

default value of column [%s] is not constant

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

UPDATE %Q.%s SET rootpage=%d WHERE #%d AND rootpage=#%d

no such collation sequence: %s

no such collation sequence: %s

%s - %s

%s - %s

malformed database schema (%s)

malformed database schema (%s)

cannot join using column %s - column not present in both tables

cannot join using column %s - column not present in both tables

cannot have both ON and USING clauses in the same join

cannot have both ON and USING clauses in the same join

a NATURAL join may not have an ON or USING clause

a NATURAL join may not have an ON or USING clause

%s.%s

%s.%s

%s-shm

%s-shm

bind on a busy prepared statement: [%s]

bind on a busy prepared statement: [%s]

%s: %s

%s: %s

%s: %s.%s

%s: %s.%s

%s: %s.%s.%s

%s: %s.%s.%s

misuse of aliased aggregate %s

misuse of aliased aggregate %s

not authorized to use function: %s

not authorized to use function: %s

too many terms in %s BY clause

too many terms in %s BY clause

EXECUTE %s%s SUBQUERY %d

EXECUTE %s%s SUBQUERY %d

%.*s"%w"%s

%.*s"%w"%s

%s%.*s"%w"

%s%.*s"%w"

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q

Cannot add a PRIMARY KEY column

Cannot add a PRIMARY KEY column

invalid name: "%s"

invalid name: "%s"

automatic extension loading failed: %s

automatic extension loading failed: %s

d-d-d d:d:d

d-d-d d:d:d

d:d:d

d:d:d

d-d-d

d-d-d

M@d

M@d

SELECTs to the left and right of %s do not have the same number of result columns

SELECTs to the left and right of %s do not have the same number of result columns

LIMIT clause should come after %s not before

LIMIT clause should come after %s not before

ORDER BY clause should come after %s not before

ORDER BY clause should come after %s not before

BmTindexed columns are not unique

BmTindexed columns are not unique

Recovered %d frames from WAL file %s

Recovered %d frames from WAL file %s

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Bad ptr map entry key=%d expected=(%d,%d) got=(%d,%d)

Failed to read ptrmap key=%d

Failed to read ptrmap key=%d

failed to get page %d

failed to get page %d

%d of %d pages missing from overflow list starting at %d

%d of %d pages missing from overflow list starting at %d

freelist leaf count too big on page %d

freelist leaf count too big on page %d

Fragmentation of %d bytes reported as %d on page %d

Fragmentation of %d bytes reported as %d on page %d

Multiple uses for byte %d of page %d

Multiple uses for byte %d of page %d

Corruption detected in cell %d on page %d

Corruption detected in cell %d on page %d

On page %d at right child:

On page %d at right child:

On tree page %d cell %d:

On tree page %d cell %d:

btreeInitPage() returns error code %d

btreeInitPage() returns error code %d

unable to get the page. error code=%d

unable to get the page. error code=%d

Page %d:

Page %d:

Outstanding page count goes from %d to %d during this analysis

Outstanding page count goes from %d to %d during this analysis

Pointer map page %d is referenced

Pointer map page %d is referenced

Page %d is never used

Page %d is never used

sqlite3_get_table() called with two or more incompatible queries

sqlite3_get_table() called with two or more incompatible queries

no such vfs: %s

no such vfs: %s

%s mode not allowed: %s

%s mode not allowed: %s

no such %s mode: %s

no such %s mode: %s

MJ delete: %s

MJ delete: %s

-mjX9X

-mjX9X

MJ collide: %s

MJ collide: %s

%s-mjXXXXXX9XXz

%s-mjXXXXXX9XXz

database %s is locked

database %s is locked

cannot detach database %s

cannot detach database %s

no such database: %s

no such database: %s

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

INSERT INTO %Q.%s VALUES('trigger',%Q,%Q,0,'CREATE TRIGGER %q')

unknown database: %s

unknown database: %s

unknown database %s

unknown database %s

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

DELETE FROM %Q.sqlite_sequence WHERE name=%Q

PRIMARY KEY must be unique

PRIMARY KEY must be unique

constraint %s failed

constraint %s failed

%s.%s may not be NULL

%s.%s may not be NULL

database schema is locked: %s

database schema is locked: %s

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %'

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND rootpage>0

PRAGMA vacuum_db.synchronous=OFF

PRAGMA vacuum_db.synchronous=OFF

cannot VACUUM - SQL statements in progress

cannot VACUUM - SQL statements in progress

misuse of aggregate: %s()

misuse of aggregate: %s()

constraint failed at %d in [%s]

constraint failed at %d in [%s]

abort at %d in [%s]: %s

abort at %d in [%s]: %s

database table is locked: %s

database table is locked: %s

cannot change %s wal mode from within a transaction

cannot change %s wal mode from within a transaction

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

SELECT name, rootpage, sql FROM '%q'.%s WHERE %s ORDER BY rowid

cannot commit transaction - SQL statements in progress

cannot commit transaction - SQL statements in progress

cannot release savepoint - SQL statements in progress

cannot release savepoint - SQL statements in progress

no such savepoint: %s

no such savepoint: %s

cannot open savepoint - SQL statements in progress

cannot open savepoint - SQL statements in progress

statement aborts at %d: [%s] %s

statement aborts at %d: [%s] %s

cannot use index: %s

cannot use index: %s

at most %d tables in a join

at most %d tables in a join

cannot open value of type %s

cannot open value of type %s

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

SELECT name, rootpage, sql FROM '%q'.%s ORDER BY rowid

unsupported file format

unsupported file format

no such trigger: %S

no such trigger: %S

unable to open database: %s

unable to open database: %s

database %s is already in use

database %s is already in use

too many attached databases - max %d

too many attached databases - max %d

sqlite_sequence

sqlite_sequence

there is already an index named %s

there is already an index named %s

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

DELETE FROM %Q.%s WHERE name=%Q AND type='index'

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

index associated with UNIQUE or PRIMARY KEY constraint cannot be dropped

no such index: %S

no such index: %S

unable to identify the object to be reindexed

unable to identify the object to be reindexed

no such table: %s

no such table: %s

%s.%s.%s

%s.%s.%s

too many references to "%s": max 65535

too many references to "%s": max 65535

sqlite_subquery_%p_

sqlite_subquery_%p_

cannot create INSTEAD OF trigger on table: %S

cannot create INSTEAD OF trigger on table: %S

cannot create %s trigger on view: %S

cannot create %s trigger on view: %S

cannot open %s column for writing

cannot open %s column for writing

no such column: "%s"

no such column: "%s"

indexed

indexed

foreign key

foreign key

cannot open view: %s

cannot open view: %s

cannot open virtual table: %s

cannot open virtual table: %s

sqlite_altertab_%s

sqlite_altertab_%s

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);

CREATE%s INDEX %.*s

CREATE%s INDEX %.*s

table %s has no column named %s

table %s has no column named %s

sqlite_autoindex_%s_%d

sqlite_autoindex_%s_%d

index %s already exists

index %s already exists

there is already a table named %s

there is already a table named %s

virtual tables may not be indexed

virtual tables may not be indexed

views may not be indexed

views may not be indexed

table %s may not be indexed

table %s may not be indexed

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

AUTOINCREMENT is only allowed on an INTEGER PRIMARY KEY

table "%s" has more than one primary key

table "%s" has more than one primary key

CREATE TABLE %Q.sqlite_sequence(name,seq)

CREATE TABLE %Q.sqlite_sequence(name,seq)

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

UPDATE %Q.%s SET type='%s', name=%Q, tbl_name=%Q, rootpage=#%d, sql=%Q WHERE rowid=#%d

CREATE %s %.*s

CREATE %s %.*s

view %s is circularly defined

view %s is circularly defined

table %S has no column named %s

table %S has no column named %s

%d values for %d columns

%d values for %d columns

table %S has %d columns but %d values were supplied

table %S has %d columns but %d values were supplied

*** in database %s ***

*** in database %s ***

unsupported encoding: %s

unsupported encoding: %s

foreign_key_check

foreign_key_check

foreign_key_list

foreign_key_list

no such column: %s

no such column: %s

there is already another table or index with this name: %s

there is already another table or index with this name: %s

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE "%w".sqlite_sequence set name = %Q WHERE name = %Q

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d 18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;

view %s may not be altered

view %s may not be altered

-- TRIGGER %s

-- TRIGGER %s

use DROP VIEW to delete view %s

use DROP VIEW to delete view %s

use DROP TABLE to delete table %s

use DROP TABLE to delete table %s

table %s may not be dropped

table %s may not be dropped

sqlite_stat

sqlite_stat

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

the NOT INDEXED clause is not allowed on UPDATE or DELETE statements within triggers

<