Trojan.NSIS.Androm.3 (AdAware), Trojan.NSIS.StartPage.FD (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: dc7fd4f3cfe333cb005ce5639899f0bf
SHA1: e26aef6eebcb8dbc31224ad3ccec26ac181d1867
SHA256: 232b8da0f5f83f6d1e933fa2fadf6af8f00873ee4c55c8f4df07b93120f14f53
SSDeep: 24576:bTSRVTsof9WbtPZuz y3 w7EH2pJ3rFUgz6CI:PgVTx9WbtPZpi AEoygz6CI
Size: 789566 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
lte.exe:3632
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
No files have been created.
Registry activity
Dropped PE files
MD5 | File path |
---|---|
93417340dabe04e8bd8fafdc34d21377 | c:\Program Files\Kirton\lte.exe |
b55a422f81b798459f38d95346e2e6ef | c:\Program Files\Mozilla Firefox\firefox334.exe |
c8ff52bfddc6898c202c08c4a61a3d22 | c:\Program Files\Pair\Microsoft.Win32.TaskScheduler.dll |
592e0fe4cde9902fc520af6ea67ac903 | c:\Program Files\Pair\lte.exe |
52dbda97fd2fb02ed5168971a4b907b3 | c:\Program Files\Pair\settings.dll |
d562d827f218110a24d4d23c7b8b6af5 | c:\Program Files\asked\undiscounted.exe |
20ecdf461c177e6d951c68247fb76708 | c:\Users\"%CurrentUserName%"\AppData\Local\108502.exe |
8749f1c8fc54d4462dd3aca5d3df367a | c:\Users\"%CurrentUserName%"\AppData\Local\13455.exe |
a08515c2b5eb4f817676b5b9906d4b8f | c:\Users\"%CurrentUserName%"\AppData\Local\40097.exe |
b63fdb3f8bb5dfd5e9cd40dca879c2b8 | c:\Users\"%CurrentUserName%"\AppData\Local\58543.exe |
34b704ab9563fbfb5ac2a7cc6624dcb3 | c:\Users\"%CurrentUserName%"\AppData\Local\83157.exe |
b9380b0bea8854fd9f93cc1fda0dfeac | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll |
93417340dabe04e8bd8fafdc34d21377 | c:\Windows\undefined.exe |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1053 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | validation.sls.microsoft.com |
162.222.193.86 | aoaomo.tremorhub.com |
162.222.193.86 | www.howcast.com |
162.222.193.86 | howcast.com |
192.192.3.8 | www.virustotal.com |
192.192.3.8 | virustotal.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 61440 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 253952 | 2536 | 2560 | 3.13983 | 5b5a2d9d119a78aca9bef9d54b647674 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 519
87af60575e95350381303447cd2e0d96
c9c0ecad3c7691c9fb77d3e12dca89ba
eb908e35f01c51fd6c3145626da78202
739e7f76fb545c28ae4ce1d85e176484
d00d8a9daa2e2b19d952b1b10037467c
6e2c047259d3bc583dc140202340af7e
75182bfb4dd3d1ad7e0ef5e40b70550f
2a4240cfb6b249da0c5dcff5abf3a292
a746426f5bd2a7f239e0e1bc7529897d
0f2fa5e5c2ce26f0b744d19eff724c25
723325cfdc20c18e1ca96e88c9cca948
5cc9fd6672be1ca9538237031c1382c0
f1b56fd3f82b6a0668d00b9f0d6e991f
7f4ee0d326b67cc3e4a3fec3a25dfe3c
293bbf92195165383b202fa6cd4a2ba6
b33ccbf60d223d0df5c7b0c8b376386a
5c7aaa94fa1bbced13b76e9523bde956
da7eaa6230f54eb9da8f6986b5e53c89
0f5b04d97f3e3dc672c37106fbff0b45
9b0f84c736f2651c17fa4592c98ca6f0
10cdbd65f189a3a3a25eec73396c07d1
3642ef122aa6382d10aaf85824e1d78b
ca68f7598e334d1805d20eb245bebded
4684fab20680d9d8b202a59b822e633a
57f41da1ea05d30f6707060f00876d07
Network Activity
URLs
URL | IP |
---|---|
hxxp://d232tmx7gh8bfo.cloudfront.net/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154 | |
hxxp://d232tmx7gh8bfo.cloudfront.net/jquery.min.js | |
hxxp://d232tmx7gh8bfo.cloudfront.net/amg.php | |
hxxp://c.statcounter.com/10114910/0/757d7213/1/ | 104.20.3.47 |
hxxp://www-google-analytics.l.google.com/analytics.js | |
hxxp://aoaomo.tremorhub.com/wp-content/themes/howcast/images/icons/love.png | |
hxxp://8c715ae47b.site.internapcdn.net/page-4.html?lid=937115 | |
hxxp://aoaomo.tremorhub.com/itd.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154 | |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j47&a=1859802888&t=pageview&_s=1&dl=http://www.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154&ul=en-us&de=utf-8&dt=home&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1076447804&cid=931079109.1481019585&tid=UA-74694740-5&_r=1&z=1545378189 | |
hxxp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png | 67.202.94.93 |
hxxp://vi.govids.net/report3.php | 109.201.148.40 |
hxxp://ww.commonsensicalmoderated.pw/a.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154&rnd=1481019585000 | 162.222.193.17 |
hxxp://govids.net/1.js | 162.222.194.11 |
hxxp://govids.net/jwplayer1.js | 162.222.194.11 |
hxxp://aoaomo.tremorhub.com/o.php | |
hxxp://widgets.amung.us/draw/?w=colored&n=1299&c=000000ffffff&p= | 50.23.131.235 |
hxxp://vi.govids.net/bck.php?1481019586000 | 109.201.148.40 |
hxxp://8c715ae47b.site.internapcdn.net/page-4.htm?lid=937115 | |
hxxp://www.statcounter.com.cdnga.net/counter/counter.js | 174.35.61.213 |
hxxp://govids.net/player1.swf | 162.222.194.11 |
hxxp://c.statcounter.com/t.php?sc_project=10675947&java=1&security=299981d6&u1=B72868160DD54F24488A158617CC8C84&sc_random=0.8780735333600617&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://www.govids.net/page-4.html?lid=937115&u=http://www.govids.net/page-4.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 | 104.20.3.47 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j47&a=926932721&t=pageview&_s=1&dl=http://www.govids.net/page-4.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1133922811&cid=1153493406.1481019588&tid=UA-74694740-2&_r=1&z=2010394032 | |
hxxp://8c715ae47b.site.internapcdn.net/css1.css | |
hxxp://8c715ae47b.site.internapcdn.net/img/logo.png | |
hxxp://8c715ae47b.site.internapcdn.net/img/lbg.png | |
hxxp://cs28.wpc.thetacdn.net/5/10/logo.png | |
hxxp://govids.net/ova-jw.swf | 162.222.194.11 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Home videos, Funny Videos - 4&mediaId=2&mediaUrl=hxxp://www.govids.net/4.html&srcPageUrl=hxxp://www.govids.net/4.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,audiencescience,mediamath,TubeMogul-GP,tremornet,Videology,dynadmic,adapTV,eyeview,Pulsepoint,SundaySky,TapAd,1,_dmp_turbine,Bidswitch,rocketfuel,dataxu,BidTheatre,google,videoamp,conversant,appnexus,adgear,beeswax,centro&uid=b15b7484a37d4a1abe3149b882b87266&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=google,conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://dyhd7e8p4cqed.cloudfront.net/crossdomain.xml | |
hxxp://dyhd7e8p4cqed.cloudfront.net/static/noad.xml | |
hxxp://vi.govids.net/crossdomain.xml | 109.201.148.40 |
hxxp://vi.govids.net/v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hxxp://www.govids.net/4.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Home videos, Funny Videos - 4&LR_FORMAT=application/x-shockwave-flash | 109.201.148.40 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Watch Home videos, Funny Videos - 4&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hxxp://www.govids.net/4.html&contentLength=[CONTENT_LENGTH] | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=rocketfuel,dataxu,BidTheatre,TapAd,beeswax,google,Bidswitch,adapTV,Pulsepoint,adgear,dynadmic,mediamath,conversant,audiencescience,_dmp_turbine,appnexus,ignitionone,tremornet,centro,thetradedesk,videoamp,Videology,1,eyeview,TubeMogul-GP&uid=b15b7484a37d4a1abe3149b882b87266&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | |
hxxp://thumb.none1366649718.netdna-cdn.com/crossdomain.xml | |
hxxp://thumb.none1366649718.netdna-cdn.com/abcd.mp4 | |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j47&a=926932721&t=pageview&_s=1&dl=http://www.govids.net/page-4.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1133922811&cid=1153493406.1481019588&tid=UA-74694740-2&_r=1&z=2010394032 | 173.194.32.128 |
hxxp://xlf5t.ads.tremorhub.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Home videos, Funny Videos - 4&mediaId=2&mediaUrl=hxxp://www.govids.net/4.html&srcPageUrl=hxxp://www.govids.net/4.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | 52.203.229.152 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.commonsensicalmoderated.pw/jquery.min.js | 52.222.174.193 |
hxxp://www.govids.net/img/lbg.png | 69.88.149.142 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.google-analytics.com/analytics.js | 173.194.32.128 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Watch Home videos, Funny Videos - 4&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hxxp://www.govids.net/4.html&contentLength=[CONTENT_LENGTH] | 52.206.147.54 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=rocketfuel,dataxu,BidTheatre,TapAd,beeswax,google,Bidswitch,adapTV,Pulsepoint,adgear,dynadmic,mediamath,conversant,audiencescience,_dmp_turbine,appnexus,ignitionone,tremornet,centro,thetradedesk,videoamp,Videology,1,eyeview,TubeMogul-GP&uid=b15b7484a37d4a1abe3149b882b87266&init=true | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/crossdomain.xml | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.statcounter.com/counter/counter.js | 174.35.61.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j47&a=1859802888&t=pageview&_s=1&dl=http://www.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154&ul=en-us&de=utf-8&dt=home&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1076447804&cid=931079109.1481019585&tid=UA-74694740-5&_r=1&z=1545378189 | 173.194.32.128 |
hxxp://l.longtailvideo.com/5/10/logo.png | 93.184.221.48 |
hxxp://www.govids.net/page-4.htm?lid=937115 | 69.88.149.142 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.howcast.com/wp-content/themes/howcast/images/icons/love.png | |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.govids.net/page-4.html?lid=937115 | 69.88.149.142 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://cdn.tremorhub.com/static/noad.xml | 52.222.171.101 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=google,conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://www.govids.net/css1.css | 69.88.149.142 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://cdn.tremorhub.com/crossdomain.xml | 52.222.171.101 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://thm.vidvib.com/abcd.mp4 | 94.31.29.128 |
hxxp://www.govids.net/img/logo.png | 69.88.149.142 |
hxxp://109.201.148.40/bck.php?1481019586000 | |
hxxp://www.commonsensicalmoderated.pw/amg.php | 52.222.174.193 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://we1sb-wwcgk.ads.tremorhub.com/crossdomain.xml | 52.206.147.54 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://partners.tremorhub.com/syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 | 52.71.68.213 |
hxxp://thm.vidvib.com/crossdomain.xml | 94.31.29.128 |
hxxp://partners.tremorhub.com/syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,audiencescience,mediamath,TubeMogul-GP,tremornet,Videology,dynadmic,adapTV,eyeview,Pulsepoint,SundaySky,TapAd,1,_dmp_turbine,Bidswitch,rocketfuel,dataxu,BidTheatre,google,videoamp,conversant,appnexus,adgear,beeswax,centro&uid=b15b7484a37d4a1abe3149b882b87266&init=true | 52.71.68.213 |
hxxp://xlf5t.ads.tremorhub.com/crossdomain.xml | 52.203.229.152 |
hxxp://www.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154 | 52.222.174.193 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 18:27:40 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Tue, 07 Nov 2017 18:27:40 GMT
Connection: close
Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
<<< skipped >>>
GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Timing-Allow-Origin: *
Date: Tue, 06 Dec 2016 08:42:39 GMT
Expires: Tue, 06 Dec 2016 10:42:39 GMT
Last-Modified: Wed, 28 Sep 2016 20:19:01 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11590
Age: 5826
Cache-Control: public, max-age=7200
...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W].b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..~.............>..........GB..N....?...?.I2.....U...o<.....W.;...x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo.....]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]............*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z......Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...zZ...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
<<< skipped >>>
GET /r/collect?v=1&_v=j47&a=1859802888&t=pageview&_s=1&dl=http://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154&ul=en-us&de=utf-8&dt=home&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1076447804&cid=931079109.1481019585&tid=UA-74694740-5&_r=1&z=1545378189 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Tue, 06 Dec 2016 10:19:45 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Tue, 06 Dec 2016 10:19:45 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;....
GET /r/collect?v=1&_v=j47&a=926932721&t=pageview&_s=1&dl=http://VVV.govids.net/page-4.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1133922811&cid=1153493406.1481019588&tid=UA-74694740-2&_r=1&z=2010394032 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Tue, 06 Dec 2016 10:19:47 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Tue, 06 Dec 2016 10:19:47 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: we1sb-wwcgk.ads.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Tue, 06 Dec 2016 10:19:56 GMT
ETag: W/"144-1446501138000"
Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>. <!-- Very Liberal -->. <allow-access-from domain="*" secure="false"/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Watch Home videos, Funny Videos - 4&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.govids.net/4.html&contentLength=[CONTENT_LENGTH] HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: we1sb-wwcgk.ads.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Tue, 06 Dec 2016 10:19:56 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorhub.com; Expires=Wed, 06-Dec-2017 16:08:17 GMT; Path=/
Set-Cookie: tvrg_60409="1,1481019597"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 06-Dec-2016 10:20:57 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
Content-Length: 529
Connection: keep-alive
...........R.n.0... \..-V$ ..H2T'-..a.Jz..`%.e..I.a[.....}\z 8....3.L..f.Em.........J2...{*>^..4.H..Eq......sgSoe...}...z..a%........`.I.....{/Kr6.....B.E..Xl...;X,...J.MsV@...1K.....".9.S.........JH`S.Y._/.p4...I.-.x.......o.I...J...h..7.....{G..g...JSP....%....P-e.......V...*.......\.>[#..v .5.". ....nURt.....'..T.F.7..7.t.E..n............A..].....K..j`...).r...E....Y...Z....... ...........epS..8...E.@.. ..q...8.......j...Y......R.c.V..q.Ak......].....^.....Q.M7.~..4Y..h.0K>..@.BC...~..L......L.. ....F...............z9...HTTP/1.1 200 OK..Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding: gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Tue, 06 Dec 2016 10:19:56 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorhub.com; Expires=Wed, 06-Dec-2017 16:08:17 GMT; Path=/..Set-Cookie: tvrg_60409="1,1481019597"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 06-Dec-2016 10:20:57 GMT; Path=/..Vary: Accept-Encoding..x-tremorvideo-status: NO_AD..Content-Length: 529..Connection: keep-alive.............R.n.0... \..-V$ ..H2T'-..a.Jz..`%.e..I.a[.....}\z 8....3.L..f.Em.........J2...{*>^..4.H..Eq......sgSoe...}...z..a%........`.I.....{/Kr6.....B.E..Xl...;X,...J.MsV@...1K.....".9.S.........JH`S.Y._/.p4...I.-.x.......o.I...J...h..7.....{G..g...JSP....%....P-e.......V...*.......\.>[#..v .5.". ....nURt.....'..T.F.7..7.t.E..n...........
<<< skipped >>>
GET /jwplayer1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 18:27:38 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT
ETag: "4403af-25d37-53444eccf91c0"
Accept-Ranges: bytes
Content-Length: 154935
Cache-Control: max-age=2592000, public
Expires: Tue, 07 Nov 2017 18:27:38 GMT
Connection: close
Content-Type: text/javascriptvar dtn = Date.parse(new Date().toString());..document.write(unescape(>>
'
GET /page-4.html?lid=937115 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:45 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Content-Encoding: gzip101e.............\kS.H..L...z........l.L. .js......).-.-.nH-.'........>>
...a....l..z....<}........#!.Z,...vx.R-).....aW.g..Q..w....#4f.....
..v.9.[......(m....FW...j..]..C......P.~(....4..CS.]..1..6..lSZ*....BZ
.UFFh...q .....v..<I... .t5..>..^..PG-..Uv8.!..0....km.6..[.m...
....}/..h4*."..Q.N$..[....Bj.........!I.^.g..l..^...M.....@....-.*5~..
.r..2..6..T....../]....?o..H... .Xn.cO..m...o..0P.........^...k.....-.
Sg.ez.^.............&....|s.z..w|@.....Psx.u5.Tc........3......:..g...
...$X....IP.~.,.b...Z..ua.S...,.u ..o.X......~........y....4...Z:wI...
...Q......l.97.q..o.xX.RI.......$AkD......^4..mYH...*.Suu.o..v........
,..i........oFp......o.........7v...t3p.............J......P".M....~..
H.{..nl.U}\u.7....i.~.v..f.RZn..rh.....x.P...=Sb....W...._n{"\..b.....
./...Z........tb...Q_.z.B.. ...........V].B....I.JJ.a,.....I.*..lJ.n..
..k..BGDHB....{....\.M.2.Ed...J_#.N..rS.Lf.G.7.b&...T..#y.."..@.k.u...
...T.a.A^|..C..C....V......Z......u.5<t.5..h).W....I...I.L...}...D.
..i........)..jT2...814e&..l.4$....0?P...`.UYT.01.....N..%...h.a.3V..-
).|...03. ....Q.Y...#..H....@.M...(I...5(.C...1. ......(K ...IN.d..u.-
Y.....>..ta.5d.....).#.G...`.._.Z..We..l.......l....t... ..;...#.oa
91...G[.M.yc....*l;.x"".L.3..HJ|...|PnW..9.`.....a...{.TX.YO.u23}n;X.!
.V.4.S.=...).|.._...Lc2A..x.(9..xW...&sz-f.s..d..oL..i.....O.._^.;....
...I..n7._!......G]...Q...6)......wG..................~.....r,.X...Q..
....g.g.?t..v~.........L.....w.......T&..j.<...3...Rx........T.....
.*.^s..:...>..."..o....F....T..[.........K.U/.wG[P...|....w....
GET /page-4.htm?lid=937115 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.govids.net/page-4.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:46 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.come5c..<meta charset="utf-8"><meta http-equiv="X-UA-Compatible">>
content="IE=edge,chrome=1"><img src="hXXp://vi.govids.net/repor
t3.php" border="0" alt="" width="0" height="0"><script type="tex
t/javascript" src="hXXp://govids.net/jwplayer1.js"></script>&
lt;script>var thecc ="ok";</script><script type="text/java
script" src="hXXp://govids.net/1.js"></script><form action
="hXXp://VVV.govids.net/page-4.php" method="get" name="redirect">&l
t;input type="hidden" name="lid" value="937115"></form>..<
script type="text/javascript"> if (top.location!= self.location) {
setTimeout(function () { document.forms['redirect'].submit();}, 60 * 1
000); document.write('<head></head><body bgcolor="#ffff
ff" class="body" topmargin="0" leftmargin="0">');}</script>..
<script type="text/javascript"> if (top.location!= self.location
) { var rc = document.referrer.split('/')[2];if (rc == window.location
.hostname) {document.write('<div id="ova-jwplayer-container" style=
"position:absolute; top:0px; left:0px;width:300px;height:250px;">&l
t;/div>');}}</script>..<script type='text/javascript'>.
.var cb = Math.round(new Date().getTime() / 1000);..var items = Array(
'mp4:lqbyul0x.mp4','mp4:hc6lawyi.mp4','mp4:iblsdh2f.mp4','mp4:nbsyph4t
.mp4','mp4:peyjpa0x.mp4','mp4:9mzecklt.mp4','mp4:vnt9ciyd.mp4','mp4:q5
fufgnb.mp4','mp4:lzcpj8vr.mp4','mp4:pfdxi3pj.mp4','mp4:romfc7uu.mp4','
mp4:qgmcib5y.mp4','mp4:ifgfn0gh.mp4');..var item = items[Math.floo
GET /css1.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1481019587.B72868160DD54F24488A158617CC8C84.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1153493406.1481019588; _gat=1
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:47 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Content-Encoding: gzip293.............U[O.0.~.R..G5.IM.B/.>.(..P..i......cG.{a...s..]7..0
..G....s..w<.........6 ...!..f.o3.||6...&...(...^{..F....t.>X.]L
of...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...M~...9..........#H...W.oi(y.
.....B;.@.....j.y.ke.9M.|.J..N...<8n.2...P.......>_.N...{U.....R
jb.<......oEF.I)..Bm.7...I..`.q28........Y......-P..y..V..rk.....$.
p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<.......Z.D.8 TY`..9P..H3m,..
...A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X#.B...F/...50.3j..da...H..2.
.....f..s\..q.....k.I..4.2..6..4....;(. .Rb(.........Z.,/..S....lur.*.
. ..B.....X....Jc3.P.x...I.$...)..`..F..iZ..E.pK...{F...&.....i..ja1&g
t;..s.&X..Q..~....v...*m...3.Dq".|oo%.MpTn..qU..~..-.q......0..
....
GET /img/lbg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1481019587.B72868160DD54F24488A158617CC8C84.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1153493406.1481019588; _gat=1
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:47 GMT
Content-Type: image/png
Content-Length: 200
Connection: keep-alive
Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT
ETag: "a1bf1-c8-4ebb56fac1880"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Tue, 06 Dec 2016 10:19:47 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21
Nov 2013 20:06:42 GMT..ETag: "a1bf1-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-001.ams002.int
ernap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......
gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b ..
...tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.!
[.....O...........IEND.B`...
GET /counter/counter.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.statcounter.com
Connection: Keep-Alive
Cookie: __cfduid=d3893f81265d3726db45aef407f62888a1481019585; is_unique=sc10114910.1481019585.0; is_visitor_unique=1481019585243773184
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:47 GMT
Server: PWS/8.1.41.3
X-Px: ht h0-s1210.p11-fra.cdngp.net
ETag: W/"576924c5-654e"
Cache-Control: max-age=43200
Expires: Tue, 06 Dec 2016 14:13:53 GMT
Age: 29154
Content-Length: 9529
Content-Type: application/x-javascript
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT
Connection: keep-alive...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u>>
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5. G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
GET /amg.php HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.commonsensicalmoderated.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 359
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Date: Tue, 06 Dec 2016 10:10:59 GMT
Age: 526
X-Cache: Hit from cloudfront
Via: 1.1 e3666efb6956ba7f03c75c3401b8c79e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: kevomxyhv99NrDoJfjRXvU81_SR-R5lNRo3Y9oVcZirJw7tIgMI60w==...<script type="text/javascript">setInterval( "vwu()", 200000);
function vwu(){if(document.images){document.images['viewers'].src = 'h
ttp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png?' Date.parse
(new Date().toString());}}</script><div style="visibility:hid
den"><img name="viewers" src="hXXp://whos.amung.us/cwidget/iebro
wser1/000000ffffff.png"></div>HTTP/1.1 200 OK..Content-Type:
text/html..Content-Length: 359..Connection: keep-alive..Server: Apache
/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Date: Tue, 06 De
c 2016 10:10:59 GMT..Age: 526..X-Cache: Hit from cloudfront..Via: 1.1
e3666efb6956ba7f03c75c3401b8c79e.cloudfront.net (CloudFront)..X-Amz-Cf
-Id: kevomxyhv99NrDoJfjRXvU81_SR-R5lNRo3Y9oVcZirJw7tIgMI60w==.....<
script type="text/javascript">setInterval( "vwu()", 200000);functio
n vwu(){if(document.images){document.images['viewers'].src = 'hXXp://w
hos.amung.us/cwidget/iebrowser1/000000ffffff.png?' Date.parse(new Da
te().toString());}}</script><div style="visibility:hidden">
;<img name="viewers" src="hXXp://whos.amung.us/cwidget/iebrowser1/0
00000ffffff.png"></div>..
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 18:27:40 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Tue, 07 Nov 2017 18:27:40 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....>>
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T.....
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
GET /ova-jw.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 18:27:42 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT
ETag: "4403b3-39741-4fbe0551c3280"
Accept-Ranges: bytes
Content-Length: 235329
Cache-Control: max-age=2592000, public
Expires: Tue, 07 Nov 2017 18:27:42 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q>>
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 18:27:40 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Tue, 06 Dec 2016 18:27:40 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; tvrg_60409="1,1481019590"
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Tue, 06 Dec 2016 10:19:50 GMT
ETag: W/"144-1446501138000"
Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,audiencescience,mediamath,TubeMogul-GP,tremornet,Videology,dynadmic,adapTV,eyeview,Pulsepoint,SundaySky,TapAd,1,_dmp_turbine,Bidswitch,rocketfuel,dataxu,BidTheatre,google,videoamp,conversant,appnexus,adgear,beeswax,centro&uid=b15b7484a37d4a1abe3149b882b87266&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:51 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 516
Connection: keep-alive...........RM..0...W.H.mC .H.D4..V..Qa..j..x.V.m.&.....n.q....y3o.g...
9..(..,.....! 9.......Mh..w.6.. ..i&.....Zk..m-...n.I..[)a..Ri......v.
..D).%...B....S..$.rGY.....A4%9T........6........ih..n.J...$%q....`V..
..:...f.?...<\...X.....?......0m..-..............o. ....."..O.R....
...QK HP.M...)...B0<...-...Q....#......u.....ZF...}Y.1 .-.l.Ph@./..
F0...@T'8.t...F.f@.dpP!H.6.A..t..#...V....5.V8~.x....x.@.3.[.a..a.....
Id.9.;)..wB......lV...X.E.8.?....R..........h-.czDu.I.`..a........yRe.
....J.. a.-.Y.......................
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=google,conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:51 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 534
Connection: keep-alive...........R...0.}.W.H.m.....A)..V...d..j.&.(X$.e;\...@...>D93...3.
..U....B.....^.%S\.b..d.."o.....*...M.%J{.f..9}...`....{LU.....{...v.}
..I..$Ny'.....Mc.N.a.dmng.Z....6My.....$~..xH....N.q.....{.L*.s#..MG..
d..i8...t4..F..8.G......S........:./.....K2.......888....$6.k.Q..85.-:
..9...x...CSBk...6....E...y.Jg......plKxUK....).O.x%..........m....9.=
....!..n....v....X..E.D;..Wz.j........Q>.FC.L....q...y..y4.....$...
..1....V...Wu^" ...H*_.#..B.....vg.7-.......].e...a.......ms.~./..#.ho
0..i\.......?.I.K........V...-..E......... u%.>.......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:51 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1e9.............R...0.}.W.H.7........V m[.d..j.&..X.... ..I.K//}.|f|&l
t;gn..\.zG..K.9.`..P..q.....S?p...p......4.(..FNi.Z...XI].....k.rzva,.
.D..o............P.V...U.u.{i...7g'...v........>......m.%4.K.......
...O<......x....l4.L..`.....NEY...............T.!....&p..h.o8Cy....
.h50dh.db.G..6.R...ia.8u.M.].)PX-.|....-J.i-.4..............ly.g%.Ã.
hNp&tl..J..@%..`......A%.h3..Jmm.s.......$...1.fl...8...<..<....
.k.....Ak.....?}..(.LZY.n......k ..U..R.M.pn..4...hn0.... f.....>..
.......Fv....m m........d.......7.........0......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:51 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 533
Connection: keep-alive...........R...0.}.W.H...\ .%AY...zA.@.V .... .e;@......HU.|f|<s|f.
..:.N ..yd.....^...}d...O.1.?..$..4...C..:2J........e.......FOO.&.Q...
.6Y.q..^.~.D..]..JC.g...4]..{..4......q..e.H....N..9..........IF.b2..|
.p&.7....wG..7...$...".MgN(....%.\..o59h..F.>......%.@A.0..N..].!8\
....2..Tq=0S...F...:3]....S....,m9.. .V@......Y...`...3. :u.H%.fD$...=
..`......N..Vb...3......Q.{.G\.z.&9..7........__.....G)k...R..nr4i....
7.Y.Qk..`..v3....?.e:.n\...^f_Lwa:..?.....ra......*.&sY...[R ....c'Pw.
......L...K.x..(d[?o.;.........7.............?.......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:51 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 485
Connection: keep-alive...........R]..0.|.....[1...J.R.*.T..&G.N'..W..8......p...K.2.....6^..
.....F%.?.{.T..R......1.V..x......4z...%^..^2......r...Y...[Z.......6.
..8..4.a@k4}.w.a.....<...[.b...vO........ ........4...S\5 VF../.>
;.|..E...`1.O..Y8.f.....:....|.....[..z........].. t....{*.....!ZF...=
l.......:..3..OR..t."..J@..{Y.)....k..jp. ...h.*JD{.3.c?...`.:....!...
...n..'..Zo]kJ.p.R..?-.a..d.B.......(..h..f//i..L......<....K..q...
........*.Pk..?(..kC..#..L./4;..0..t..G.......nd...{.0...Z.O.......k..
........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:51 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 504
Connection: keep-alive...........R...0.}.W.H...\ .%AYX$..]5a..Z.I<"...l...w..........g..L
..T........{46.(..q...m......C.......4z(.\GF.u3.,-..e.....,..c..J.nUd|
..KVF.&l...%4..>J;......A.>..{..4a....6q..e.J.................-$
gQ1....[83....l........`....&b........@M..3......%j.............A..U=l
.'.P...2..-k....3.EI8m...=.eY'.U. X!.P....Y.@b(......N. ....4..{.=.$..
..65.......ne...[. .'.....>....]...A....L...qh.n..........0hF.t..r
..?.a:..i...&.Lwe..$..W....U.M..j$.~..8\J...P.a.~./.13......D3P..~.Xw.
.K..}.i.nn.?..................
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:52 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 510
Connection: keep-alive...........R]..0.|.....[.......@%.k.D.....9... .e;@.}7.=...>D.ufw..
.....w..y-"...V........f.?..<~.>&iv.y.......*..3.1..Z.Ma..r..V..
.!.....>O.V.&.......T...6P..%......vyi......u...Z,.,y...D....?.....
...,.S.....7.F........G.`.L.../..l....x...C.k...."...=.......J.pnt....
,..r...aT...g...-...`.M.]Y...*N.V.8..)_.Y...`P...9#:v.H%.fD&...v@.....
A.\t.sV..4.......p.b2.Fd8a#.....hZ..W..o<~~.C.w.WJ../..}.}j.A....Q0
-....k.e....M_5...{,..z.=.O/...G.....".*n]I..[B'.....:...... ....{..:.
H4...............Ws........|.n|........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:52 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 519
Connection: keep-alive...........R...0.}.W.H.VBn.P...VB........9..X`;.......K/R.'.......h~..
^.J3)b......RR&.....?..<y.=.Y~....?.=3.U.S.l.(.RUM1,%......iCL.c...
]...(..$..H].......$...e.Sd.]^ES...v.N../.e../7..(#...o..Q.I.\1......x
.;u...N....c....i1.....Q.G.......(B..>`..h...a.....`C......xS.0J"x`
T..) .Y#(.d..-..B9 .r..pb.......cP...9#j.......Ni.I.@.......L..v..;...
..4.m.....}.M.O.R...."..".....k...z.RJ.?..fx.....8...p8Iu.K)..24yX.>
;....?u..:...Z.}.......}o.....j.[#Z..g...n..y.@w.j'.B....}.I..=#...)..
......m.x..d..........L...........E.......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:52 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1dd..............O..0.....)Rsk...D@D..j.U.*.=.V..G.J0.mH....t.?.......
y.x}n......H,g6.&(..q.O.m..}h..7..,/n2w..C.W&.jc......UuW.............
...e..Yi..I..W %....m.I...I.?.....4c..._....... .....e.54..w..h...gI..
.b..............2\.Q9.Oebj4..2..w....9...E..N..1N.....:.P...|.L...j...
...0..A.kxE. .........Z..D.'8...a..$,@fl.d{.E...5...C..5rg:Ur...&,....
..E.<p....Ee..e.....K....x.T...s.mf8.../A~BJ.W[.*..@..5...G.....x_.
...P..c..FQ..G}.4~.......@.w.S.......&......N.:.i........z$._......0..
....
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:52 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 477
Connection: keep-alive...........R]o.0.}..`H...@H......*M[U..PU......X.!......>^..s.c.s.o
.9.g..cE.2?..|..k.P....>...M...^.....4....e~..^.....4]=e.$.j.sk...l
.... ..<-...?....X..u ..t. ....m.D.^....M....^.U.p...8............&
lt;c.".X.Y...,...j.X,.e...z6.......>.[......v\`.`.i.......'..A8. .;
..P>....(..!.....5/..............CK.FXQ].Q..............q.w.3.P0...
:X..(..|.#....A..q...*\.........1..'?4..)...f..=..eO...d...`...N..K...
tZd....=.9K.Hm...C.tk0.....<...QdV.........&.'.B&.=A......z.K......
2.U.........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:52 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 445
Connection: keep-alive..........dRMo.0...Wd.......;..xi..(.bv.CQ..D$B Y.d'....,..I..#.H*[...
.GcE.r/....*.r.v..T...x..].... -.i.......9..}gP.f.5S.J.Z.M..:p.../_...
Wd%.....Z...j..eQ.r'U......i.k.=}./..........4..H.....b...6..,......i.
..0...8^D.d...lv.sR.......:.hv......r.%.Ip{....W..0T..a>(.R0.....n.
.^..H....=..P/8. 5..t...|.`.<vo.u .#c.....4B.MG.4A.,.$...G.@.. J.$.
.d...//E....;cZ......:..{.....3.Hs*sN...........4.G{.E.@....X...]O....
.G. .......t............=..........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:52 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 451
Connection: keep-alive...........RMo.0...Wd.....q....^........P..e...Z.$9M.../k.....(=.OOL.C
.<..6....M...e.q!.....~.."..~/..B.O4*.fa3gg.Z....vz..I...1.....`{.9
..6....%.....J.>e..Xl.z..U.]....CK^.v}.............h I....G...x....
d.!F..O.`...<...a..a...t.2.....i..._6(...|.......W..p.....Q.oEC.E..
...E.w.$...h^.@h/8v.*.5..S..E....g....R.....^3!q..z..Y...."....g^..8.Y
..a.......]k.....l.\..`..-5/.w.X...wE....A.Y..U..i..<]j2L..\`....@.
ZC.D{x...1.v..........X.Dgo.........\..........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:53 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1c8.............RMo.0...Wx...,.%v....t@..-fw;.E KD,...IN..?&M.u...G.Q|
zd6.uO.........].$.........M.y.).UV....hX(...nk...b5t.n..c}G.Q.cg.R;..
..Y.K..J...oM..}..............%.MK^....U.}._,...?.ST[......%.=.s-x....
.X8.c?...$..'.$.....G*g .....o..gaY...$...q...%..`.;..v../.....1h..3.
!...=.......I...Fp;<.P....5.......F.jm.q..iL...4..DA<m.4l.$.L...
..w.B.^.o.....ak..$Xr.Dq.....D.."?./...n.........X...Kn..e..X}.......s
X%Rd....-.3,. t."...=.*^lqL.........'..n.... ....d........F.<......
0......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:53 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 444
Connection: keep-alive...........RM..0...W......|.$(e....."...Z!'...v,....;P..........<O6
?..s.mx's..O\.d.1.7..\......]......?..P......jF.. :...q..b.r.;3.......
uy..Y.."...R..Q5..../.NU=e.-y.-YM7..."{... ...*........;.Vv..5gy...@&l
t;m...&....4.. J.$m&...?qf........%.C....AR&x.P..TP{. ...EM...s.'D....
B!..*...m.j.O.........Pk...K...b..M.$...,..m`..i.$~..~..............~.
..p...z{1..~. te...;.......j.?.]..z.Bi0.. E..h.?..."{..(2kM........d._
7.F&.=A.6...:o.C.......&{.........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:53 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 425
Connection: keep-alive...........R.n.0... \....%.iH2T'...mP).!........AR.....'....g....]...x
..Q.>.....7C....]....?f..zW....B..4.(...^o.Z.b5.A.#..A.c.7. c.....~
..W^U.lV.?5(...5..(...;k....].Dk.....MU...\.m}..S..t....N.........8@L.
]..."..8].q.%Y..t.....%..y.>..6I`.w..d.....O..=..q.E4.pph... ..-...
...A;p;>.T....[&....r....E...Q..2e..@q.D9...fi.$..UA.4...........gn
...hO..n...L..3......P..q..*6.y.{4.X._..p.VC.......5.M^_..L~ A....|.W.
. ......K.~.......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:54 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive191.............RMO.0.....F..u...rR....j......&.....e;....V......f.f.&
lt;..b'......,.`2.=.m.....S}w......Y..3-..\.4s[.[k....Qtz.7......{vn,.
......../i...>kP..>Z...(.C..Z=PrJ.D V......__.7U]....h .@..tG...
.BsV.y. ..6..h..y...8..,..f:.T..%0...p).q.`.._sVo.\o.4...v...a.B9X...;
.m......A.qi].fB.m.....w.4A..Q..,e....,..&..&K.$y}-).............%....
'......#.e..wT..J.....t..m>.9..~s6.1k.......Jk..|..3.....v..ztX....
d.. ......Sxu.....0......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:53 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 428
Connection: keep-alive...........RMo.0...Wx..[....l.^.....X..P..e...J.$.M.}. k.q.I..#...b../
..J..(].....v`....cs{....S..^7.Zp..B...t;c............h-].,..3....}S_.
UQ3.*~)...1Z..A^5.Zg.~(...I.f.l...U....u..Og9...;....A.b..T= .<....
.. ..A..a.'Q.%YN...,9..8..K.....C..m@.. .-.z..pia..f...EP.<./....c.
..rcFE{....S?.i.E..,..(.~..,.h..I..\..o.7J..?..7j.c.a..d.........\...4
........L...}dG...S.q.P.o.T.J.U......{k.,.Q.....L(..l.;C.d.G..~....[..
........tD........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:53 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 436
Connection: keep-alive...........R]..0.|..p..[....../.@.i...>......=.B.s.._9..~@..F......
..^.#HE{...ln[...P.evUn>..2..~ .....4S..Bg.Ak.@HK`.<.....RJ..^(.
..2....X.yZ. O.K,.....S.X^.k...!E...hAJ.U..<...Z.e.t..Xjn......[.c.
..dm.8........7."/.B?..8i.....()..M...j.. >.t..z...%..1'&.`i....@..
ks.....dC9L...8A..........x..4q.6q....s.....K.....Nf.........[2]..H..T
..2.g$.w3VN.M...&.z...vuUm.ZO.'....).LHP...<]I..=...<.l...YJ..0{
t....a...t#._Z..b.%..... ....)]..........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:54 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 394
Connection: keep-alive............OO.0....)....q..o....HH @4...j.....X.S....]..^8y.~3.?=:..^
.-j.....`.{(.^.r].w.........Z.GY...Aif..7...!Vc........1....X..)...Uu.
3Z.....J..w.....z.....J>/G.J.....d...........m..P...N6..1..(."...i.
.Q<.."..I..i....LNU... ..D.m ..N...U.w.X#hW../.U.J..........O.g...g
q..4.1..q.......Y..OO...0.Z..?..l..@...x .....\....[h.....S..>:..B.
.....d..C...54....-Jk...y!G1.k.....v.d........?".U.......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:55 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive17f.............R.j.0.}....6o.b.. .....-..}(%H.HD..#.l..J.6{y..fFg...
.^.R..$.I..8M.q$.`...6..._...|....?...,4j..m...... ......(...#.t......
......xD.#Pk......B....m6w.}.........5._...].=..,...B.?.oz....H..M..Q-
....y.5E.(.2/..n.|>..$.0T.o.......|'(..n|u...}H.\....I-fc....Uy..E.
s.R&.i....X]ee..L0.[......(..}b...I..4h0.E.......O.!.}F.q......p.K..k.
..I.sH.. ..d.tx._.j....F.o......><.~.......d.......t.y.m.....0..
....
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:54 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 435
Connection: keep-alive...........RMk.0........F...d.m.@`.-..=.bdK.fkYH.i...!i.......7.....^.
gg.Jw.(.p......:q,.C.... ....}u...f..^..}2F..0...z..E;.@k.:f..5....?j.
q1".....Rr5......W.^g..E.-y"%...............NRe......U.b.l.:V.E.r.E-,`
...H.(I.8...h...eE%a.\Sv.T..v|.\..0.S.^.fTM'.?..M.4Y..4.XLC..(..&.a.g0
M..1....QjP....S..@{y.=jk.J_.m....A`......?..W.u.......xpk...f.3..m..{
.E./.:YU.6/...Y..........T.Fk...&..!F..>.EV......L\.m..R.W0x7......
...o......Q.C.........
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:54 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 438
Connection: keep-alive...........R]k.0.|..p...E...l._...h...=.bdkI.........C.....=h....a...?
.G...Xj:s.4.....>5w..Kd....9.V7..`....J.7...!%........GRr.P....ej&g
t;<.yafIN.,.!.. .j....Yu.5....]...9..~......U.W........4.....l t):.
.....n.c........... .......=.a...x....)].....E.1..zR..M.E.qC...4.:^.D.
n.....k..?............pB.z;:)FpB.Z....,VkVl.....p.Z.?!..2.C:.J..-...?.
Y.fWV.......k.....\.....b..C.6\./{.@N.AY..@..N..Y.M.K4.......>.SR..
.....o#.5A:-..._..................
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:55 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive16f..............]O.0.....s......t%..!.!n..!...Xt].v...e".q.]O.{....p.
......jXb.V.4( ..b..\.w..9DW.%....9.. ....[....%h..mK......4.@*.Z..O.u
:6.LK..W.9..Xe..h..n...9....4-s.Y<O..^..i..Ov...4........r(.2)b..4t
.'v....~..~..Q......d..K.....g..k.V. ...V/ .OB/......1....$....N..V...
..!.....-\n..c$.mC...z>.'..=]e.|4.=L'...w.'.i....p..#A..vT^..>..
.V...o:...2%..|u.E......t2.k.....d........3..7.....0......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:55 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 394
Connection: keep-alive............]O.0.....!.rG....lG.e........*;.h4.X.N..?.tt..M.......9..|
.........x...T..v......E.....U..$..2....R.k..!dA..lG1i....}....v4....T
s.......\k.....X......VK.....U[.....#........v..U.h...U5j.m.]K.".Rf.&*
.8.Q.d.$I.4O.B.a....... :%......,.c>...c.......H.Y.............(..H
Y.b.....".F.R;.$.3....8......*....~........[..O...#... .~...K..v;iN!#.
\7.S..... \........t..?.@..us<6... .....f*.e.......
GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:55 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 353
Connection: keep-alive..........d.]o.0.... ....B.*...u...-...1..F....#.._!N.q.....=}.g....s.
j........J..=.....C....M..W....l.T..Q.n.......^:.h.R.m...T...~|.g....Y
..J.u\...Si..b......Kq4.XA........" ....b....x..h.e.Yn.#...XJ).?%....q
..7.h..........b?D.% ..U..4....8@..c.P......D..(.Q4..*.=.c....\.&.Q..
B.JJ...;o.j:.... x..yH...H.C.rj.B..d>g..V C..........m.='B........X
T.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml.
.Date: Tue, 06 Dec 2016 10:19:55 GMT..P3P: CP='This is not a P3P polic
y. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyot
e/1.1..Vary: Accept-Encoding..Content-Length: 353..Connection: keep-al
ive............d.]o.0.... ....B.*...u...-...1..F....#.._!N.q.....=}.g.
...s.j........J..=.....C....M..W....l.T..Q.n.......^:.h.R.m...T...~|.g
....Y..J.u\...Si..b......Kq4.XA........" ....b....x..h.e.Yn.#...XJ).?%
....q..7.h..........b?D.% ..U..4....8@..c.P......D..(.Q4..*.=.c....\.&
.Q.. B.JJ...;o.j:.... x..yH...H.C.rj.B..d>g..V C..........m.='B....
....XT.........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=rocketfuel,dataxu,BidTheatre,TapAd,beeswax,google,Bidswitch,adapTV,Pulsepoint,adgear,dynadmic,mediamath,conversant,audiencescience,_dmp_turbine,appnexus,ignitionone,tremornet,centro,thetradedesk,videoamp,Videology,1,eyeview,TubeMogul-GP&uid=b15b7484a37d4a1abe3149b882b87266&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; tvrg_60409="1,1481019597"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:56 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 516
Connection: keep-alive...........R.n.0... \..-Vd..lH2T'-..a..{..c%.%".I........}\z.8K...p7..
.mo..p)R/.\{=..d\...P|...Y..Y...B.:.%.3...X...o5.R7]9.d.........3....:
...$g.,..A)..Z...6 N...r..o...9 .~.q.%....y.?..).V..._}.....Ls....j8..
h4).M.O ..Q8..8....UZKYo..p^I......]._e.m.>/(.....K...}.@. ..,.:./2
....g(..>........3.x.... ...Cg....WGS........G.....q...X. .-2.-...R
4.$......@h.D@...P9;...4.E.5.$?.].V.m.K..........8.Q.B...Q.N.8..q4..yz
......i-..3.....L...H....4..q..&tju.~.*..m..%sM.....f..r..,4T...w;zFCl
....!.....V...l..%@.......I3........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:57 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive209.............RM..0...W.H..d..%.....j.m.J..V 4..`.......;...q.!.....
.........X....z.^.%S\.b..d.n"o....."....2j.v.&..9=.}g.RfS.=.*.Z.u..:p.
.x_..../.S.I....F.D..uX%Y..Y,...I..)..x....._g.i....4.'IP./..dR....'..
....p8...:.F... ...]0.8...S.......eu._TQ.7....B.G. .......-.ppp....%6.
K.Q..86..:..9.-.x...}s.....m`......?.0..(....{....:J..`. ..*p.SI.A ...
.v..B.F.T...t.[...!0.K.Z.v......&...5...w.0.B..y...8..Q.E.<........
..M..Q...aU..qU.%.R.m....8`9-.*J\I.;9.j..x^u.g..,... ...J.*m.6[.'...=b
............-m...<.T..:....oW.....=;.....d.. .......y@.....0..
t>....
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:56 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 503
Connection: keep-alive...........R.n.@.}.W.H..M.8..`Q'."..U..!.....*fw.............g..{.\...
..v..."v....CQH.E.;...~.....*]f......0S.;..j..Vc-u...B..1.....`..;.O..
.I........P...h,.I...-...}Ov.)..|.~.D._..i.....h .../..(..6.........`&
lt;...&.'.m.0.G8.&.cW*..........>.s^.n.F).".>`...........@Kx....
,.m.B..!C.F!.q.q.>...CcZ.0N.ESt.e..VK..93{n...:.`5/...8.`..%.....9.
.....5.."..JY..D.......\.n..Vk.....j.A.7..A..p... ...L.0..p.....&.....
....i.z.'.E5`...w.8...._#.......h..s.h..p.Cs.I.@..13........i.....^..o
O..;H.v.1.)@......r.>........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:57 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 534
Connection: keep-alive...........R...0.}.W.H..dsa.P...VB..-.>.V..'.Z.X....;........3.c...
.g..88.T...a...........M.?..,....Mz.9../r5..q.ZL-KK.jyh.Q^W.R.....D7*2
.~.'.#..:........6..P.i.w...C.=..MhJ...*.?>..I.<_.."5GA.?..<.
5.3.h........N2.......z......t("Vr..S5......%".!.D.K......x.(...l....$
.(.W.....s.......`C...*.7......<0..L...V...X....HE.........2.u&.D.N
.........K ...9*.5...=..^72c...:........>..M2pmo......s......../...
_.KMG.....9..7.Y.Qk..`...L.Gd..v.N.5.t.......L.3...f.._-L.1..6...2W...
.1..p..;v.u.q... .L%._q..'l.B......._.....g.jS.C......L;..A....
...
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:57 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 483
Connection: keep-alive...........R]o.@.|.........`.m..T...Qq.C.....O....3......./}..zngv...(
w.=. j.z.....b5.j.z......g..U.,.....Ceg..*.....AY..).........u...z_...
;/Kr>.....F.U..:.Y...,.O....Es^....C.||Y..E.r..`."C..t[.T.|n.O....G
.h2...&...l.(..8....W:.>.............L...Jp.w.....:..9.7*....C7Bk..
.v..."D...u.*gj......X.i......D.@..N..B .T....GB...HM.........xjv.u-T.
v..^...B.UC.....Dq.... ..GA4-.8,.Ix{...%..I..S...?e...e...nH.H..Sg....
{..........,Y..Y..^`.<..@...{....S.....?....6...0...z.O......i0.B..
......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:57 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 477
Connection: keep-alive...........RMo.@...WPK.V......\.J..6*.=D..{...^.v.|.........7....<M
<?.......J<.0.z.....&.c..c...w.*[.WZ.....3.x.sz&.3T7.j.A...Z....
:p.M................t..d..i~~.[..b..<.f.....}...Z.fy.t..`.......T..
....D.M..&.d4-.M.M...(..4..>b_'.....`....2x.S...$R.k..._.3..d_....%
...2....`...#[.?.)I9.0.$... .....kY2..%...WJ^...\.D..GF.n..5..t...n...
.vgI7Ru....k..B*.......I..0.`.>.4..i.EA.M.....4...|gLc...p........k
V......lr....!...H...]............(_......e...G\..7..vU|A.............
.........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:58 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 496
Connection: keep-alive...........R.n.@.}.WPK..8.$6.6r HHU...>D..{...^.v....cBC/R..=3{v...
...z?.Pi...rG7..E.0.v....."k.~...U~.y=...=1.U.#'.c.....bT6.....f...V'.
...ln.q..i.]....hu...4?...V....<7.X....e..|...<{..... A.?..D).`S
.Y..lK.......6...n..x.x..]..2a`.......@C..3l..... 4..2.....;..B4..c.{.
2N.....eJ.F5..9..n..0;.`5/...8.`.7J^!....D}.#.....$...X.......v.Q6\.j7
.........4v...a....,.....`\D.WD.ww.......>(...<.....92.9....'...
.[.L._..Yn.s;.'Qv8......].,k.P. ...L.E.C}.i..F.b...WZ...|..v~.8W..K..}
.i..n.?.......)0.........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:57 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 502
Connection: keep-alive...........R]..0.|.....[.K.G@IP.TB..N...N....b.q,.!............=...n4=
V..........qz Y.....&..1t....1]gW...0Q.....Z5!.j.j]6..........Kmcb..}.
..$Jy/..i....Z...*......!"o...)..n.Z&....<...K9E..(....I2YS>....
....Q0...`..c.m. ..0....}..fK......P.....-.j...y..Np.."B.....`......7&
lt;a ...|......1?I. ..V....-_)Y...`P......:..R.3.R...;...C.7.j!;.9.Tn.
].....[x.b.....x@=Z....E..E8.oo.......B.Z.e.p....h.Q8.9.f......q.Z|._.
u....[1.,.......t....i.Y.E..R.L7x$.f...w..&..:@..i.^P...m0.&?o..L~y..M
"N...........3c..........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:58 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 512
Connection: keep-alive...........R]..0.|..........P...CB:.'.....r..X`;.........Vj..Yg....pr.
.N.J3)"...Y....L."k.-...$..>'iv..-./.=6.U.S.m.(.R.u./$......kCL.#..
.M2..0..8..HU.j.....8.....Sh..^D....z..../.Y.%/W..(#.P.7..(.$t.....m.z
C...r...#.l.....8#..^.=3.. w..;5%.E(P.{,....#". .T....a@....O..FI....#
3E........9PF81.OJV.A.X...HN........T.mu...B.T.4T......jcj.3...;..A>
;...xC.....9.(..7......k....8WJ.?....q..h...V..G..v!..A...K.'.e...n.V.
......vV]o.>..f...:..6KD.........%...v=.8.*..5.o0..13..L.b..=opp...
...F.?<a.. ..5..........K\.9.......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:58 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 470
Connection: keep-alive............Oo.@......R}....l..u.*R.D5n.Qd....b.....o..q.....ov..f.&..
...#mD#...]9..e.Bn.g....9..].=[.......43.8..j..VS...-FeS..(g`g..mM.|}X
g7N.g8H....".W...T....`.|.....i.9lW.......&......mt...(K.....$....8.
....6Q4.o.......z.C.....$$..._..:A{&nQ..5=.(8.2...'%I...O..^..b....E.X
....V...".6.(....L.@j.V.9..{...h..vgH5BZ..X..mu!$.[...&E.D..C.....^0-.
./....~~Nc...n.n.?..Y..@.......DE.2......0G....d.?....nw..d..q.x.9....
`...H..\C...w.q......."v.....B...i........d@.I........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:59 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 468
Connection: keep-alive...........R.n.0... T...b.p$....I..E..J{..."...."HJ... ......Yr...n.:.
go.cE..?..|....Pm.?...g..|...6...M4.....~..^.....tC..^.k....u....?..V7
~.W. ...j.f.6G.@.........u.$Z...._..............)4...{TL.....Ev.cQ.&i.
h.].-h..q..a..B.g..#.....5zRp.....0........L....v/......\..P..TR..P..(
.....{z@4..=..aMu.'...5...g....a..Ro.`..`6`.M8o.$Kh......8L.M.EM.F..OO
eN..........d]@.5..z...Q..0.#-`.....[../....iQ.....d.,}'..;..)...<.
.......G.YO&p.nG.."..:!.2....:@8,............J8........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:58 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1a7............dR.n.0.}.Wx...E.%.........[...CQ.....*Y.d'...i....C..&l
t;$.-.....X....&......P....>.L.E...^...-.i.....~...3.....}=i:......
...m.....o." .Wd?.h.f.V..P..1.[..2vv........}...^..U.|j..8E.&..=.Fu..F
.<..4a..I4..M.. ..(..8.f..W:'%.........fG....4....|....kZ....K.....
Hp...j.H..5..... 8v 5..t..>|.`.<...u'.#c..^...B.UO..`Z'q.C.....1
..Y..a.&....K...WtgLg...3.......;...'.Hs,sJ.....o..lih.1...".B....X...
.@ ..f.#.Bf..`....O.._...d...........~.....0......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:58 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 442
Connection: keep-alive...........R.n.0... \...f.p$.z@uR.@.......X.k.hD.$.......}............
}...X....'W..U...v...>.O."..~-W....hT...e^...3....iz>...Y....[..
..w.yS.xyZ.Q.~3.5.S.:Z.m^.....>e/...RT.[.Y.....MY...q..S$h.....U..0
Rd.....8.....I2.. .(.....B.u....`........3...R.g....8*.....($......A .
.pD...B{)..V..@.."...!p.?Y..T...h....K....s...(. .E.>p..h..$.I.\_?&
gt;.)...[c:..=.O@...L.........ey.....x;(=k[...=.....!.......'2..Y.....
....,....v!..Z..e..9{... ....e../........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:59 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 461
Connection: keep-alive...........RQo.0.~..`H..0.RH.D,..L.Z5t{....N.V.e....]..Y..>...g.w.]
:.........\....e.1!..{W~.....C..X.gZp..Ci.6s.k....y......k.1.u..X.....
..b..i..<..A)...jo,o....Y.nR..<.-X....e.~../...?.S..DA.?u.......
,K.M..q...*.$.....Q0.c:...TVsiu.)....<.[7..^.kE...L@..y....,.A..y..
.A0.A......'.-.....4\uBZ...Uk..JH>.Q_E.U.%..1..B.C.M.$..$........u.
R.N.o......`j.In.7.mR...$$....l.}}u=..........%..s.w(........e.47..!y:
.....9.<.BW.....7.....1.&/7.L&.}A^..w.dX.G.......c..........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:19:59 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 437
Connection: keep-alive...........RMo.0...Wd.....#.....4..tk....(..b...,Hr>...,m......'=..
.d/7.-. Z.y.....jZ..*......o..H..eu..G.=Tv.2o...3......z...Y....[.....
.~Q.xyZ.^..4.5.cT..C.W....|H.[.$Z..V...<..4.)...,..8E....=.F..'F.,.
Z6A.Gq8..e..._.0..8.G>.}.}....k...)?(.R4.%r...1M.j.@:...v.{B[.....V
..N'...!..m,.V(G..K.p....~Ge.....$.0...Pc.G.:I.:......<e.6?3.5.z ..
.X..6m.N....|INL..]k^.j>.v?...)'.......q.,O..L.[....w....2........%
6{.a.2{..{...............l..........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 418
Connection: keep-alive...........RMo.0...Wx.....#.........[....(..bba.,Hr...)Y....'=J.||...V
>..4V.....,.P.=.j].w...E8....z..h.......*...SB.A..n`Q.Kb...7...`...
.e}.....-.....>Z..CI.Cn.X..... Z...w.W...0.....(..8.......V..gF..8[
.I.gy:a..(&..x.%c........N......%r..\..7.......C....h#8. ..........xp3
<Y..P..K............1..".4....0... ...yr~..HK....1....6b..g...R...g
~...9.>.. v,.%.A.. ...x.b...iy.=.g6...._\nP9........M...h...=.G....
......r.......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 429
Connection: keep-alive...........RMo.0...Wx.....vj%..xi....bq.CQ....F*Y.d7..S.....'=..||..b.
..QZ....qr.GR7.........I.`...jU_h.......2n.7s.........W.9.G~.<.....
o..&f....?-.#.1Z.......h......$Z.......}.......,g.z..J..=.F. ...%..4iV
.E6.........t*.x....RI....~H..:Q..B..p).....;!{P&..L%..b ..p?<;i.N.
...2k?X.i9..>.S^.$...9`.2.....rR...OO...].Z....6..p".....&.=.#.\bZ.
..].-V...fd....O............o.1..aU.(..2.%X...-4.pC.....6..A.2...z=.p.
..._......Tu3.........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1a8.............R]o.0.}..`H.mq.*...M.)R.U.l.U...!.jc.&K..L.&...=..>
..{.n:?.W.@..=.lwzc[..=.....\}..y.!.Zl. ..i........b.....r?4..gH)a[z.4
.Ae../u.....V.~. ...m..4ayy......].O.......y..y.,...,'@jn......[...K..
.f.z~.D~...8N..a?.B.....Ddw..{....-.B..8.t......%....pG@..8.*"z......Z
....L....a..q.~..p.!..$M.{M.y..//y.~wv/e/.28:.2.{.......3]......$.....
8.j.t.U..l....w.M]Uk......4.y.5...q.P.........<}0Q.a....f....ke....
].......f..).?...d........V89......0......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 392
Connection: keep-alive.............N.0.E.|E..;b.(I .UT@BB.h..B.8.....l...........}g.....5/..
..[..ap.{(.V.r..w..Q...../..N.mdnP......jD....z...j.b..=;2.lgr..zV....
.c.A.R.7.tm,6..g..........%,.n/......e...S..t..~..e%[.c].<;.WQ.&i&l
t;..<....E.D....P.C.sD..o..dU.l.Q.,A... ....7..A....f&.5.........p.
.$K NE.!p..d..,.Y...<=1J~..i..?L..j..0|..Z.%....>({...z...E.4.Mt
...vK...]...C..,5T.....Jk..|....|[A..t.m).........w.dU.......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 397
Connection: keep-alive...........R.N.0.}...F....KIZ9......E4e......Z..l'.._..R./}.....9>.
.W....:.U...y.q.i&......Y......,.#,..B.rS_.[...!o..v.....9g..O....:..g
.\..7,"...c..e.7..$..7Z,.0z/.I...fy.C....e.6..:....P...MuJ..Y...|.eyY.
......@.fy...8....L=..5H. ..`..N`..6.w...F..C.b..|o.P|...4......KV@...
i1.U.........F.%\Y..7%.|.M..,...Dh.i.,..N..r..S.G.H.ou..F....RD..r.b..
..|..B@.....%.....h..........q.............XK.m.......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 437
Connection: keep-alive...........RMk.0........F.Gb'..j.@`.-...J1.5I....d....C.t.=.t......0x.
.<;=(]."s...u@T-..!sw..G...7|G.....0.(..d..1r..Q.... GU. .....6.t:s
.....%.r..{...5....@C.c....`..<.R....vC........D'.2......**.2.P5...
...$N.Y...t..=..p..`.p..,g.r/\2~..lp.=k.m-.......TY..;;..&e..1........
..L..L.p:}|$....Z.V}.....C..y..ik.J_.l.. ...v..N.....|..VP.l.."..k.>
;_.-..^..m..........l^.........M#...T..K...=.KH.O.Of..b..{j.=..-.. ..F
.F....wrZ5. @.....*m`.........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 439
Connection: keep-alive...........R]..0.|..p..[.Xvb'..j....G.\.....&g..B.C..W....P....fwf.!.s
{tN.t........Qw.......O..L?.G.-.0<.l...../...BFA......]....c..0....
..........PLJPC.}......:...A...)..;...)....hA..t.)#..._......K..$..k.D
a...p..s..y..)L....H&...).......5.....,M..F....*.ZEa.. .!.Y.....8.U...
..9%.O.k.:.......a..............,.....Of....pjj(.!....c2.j/........`..
.....C/.\.2[?..u.g^...c.....y ..!0(% ......../.]f..b.O.........~...~..
n..i..... .....m.v........
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 380
Connection: keep-alive............]O.0.....s..I..l....h.F..zA.....Y.....oA.?n...y.y.....jcm.
Te.#.iwl....%_E.Kvw..1...I.]d.Af.....^k-..h..Z......(%lK....Q..4....`B
-..$...C...f....V.. 8..M..........p.d..d'........y.kLcY.(.,..........}
.,...].u...-....b....q.9.D..IJ.Z.Y@......^@}.`.<...0tI....b. ..9...
.h....J......X.....(..o.*.g...a2n....}r.TB2u.. 8...r......9..e&q.n..o.
....W.\....pN.$s..}..........7.......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 395
Connection: keep-alive............]o. .... <K..B.G.D.e5..i......*.C..5F....~$..}\....x..s
...O.C.W`.^....a.t..V..p]_}...} ...>....'j;s4.9gf.9P]..A...C..0p3..
.,..}.T...J....n...n.l..X}..V.%A..G.J..n.c.....yUW7';..i.4...Y7....V.b
.m.$O.d*.mQL9..$.3..).22t#;.q..V.h.9.g"O..'.L9.B%8....E.....-#.o.K....
.;...zr...M..8.\i.O6...GjOq..<...*....~.3.......0zO.G....3..a....P.
.{e.!#_}7.W...{....J;.....:...O....9...~......1..9e.......
GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 06 Dec 2016 10:20:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 350
Connection: keep-alive..........dQ.n. ...St..n..\...F]b.l.Z..1..T...`...h.t.;......|..N...R.
...]..JR....,...;.7h.....t0K.zlR.`L3..(VKu8.^%k.u.:f..1'..O..l.b.Q..7E
......j.j\.\'._...{...d.|]`t...."[..**.?...W@HB=.n...... %.?%I.WKy...u
.h..!{N.U...p..ZU^.57R.q...8...c....,....0(a....:.... .-?).....w4.....
.Oi...hQ7...\..T1.......G....B..h?g.2a.E........pi.6{n...........S....
HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date:
Tue, 06 Dec 2016 10:20:01 GMT..P3P: CP='This is not a P3P policy. See
hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1.
.Vary: Accept-Encoding..Content-Length: 350..Connection: keep-alive...
.........dQ.n. ...St..n..\...F]b.l.Z..1..T...`...h.t.;......|..N...R..
..]..JR....,...;.7h.....t0K.zlR.`L3..(VKu8.^%k.u.:f..1'..O..l.b.Q..7E.
.....j.j\.\'._...{...d.|]`t...."[..**.?...W@HB=.n...... %.?%I.WKy...u.
h..!{N.U...p..ZU^.57R.q...8...c....,....0(a....:.... .-?).....w4......
Oi...hQ7...\..T1.......G....B..h?g.2a.E........pi.6{n...........S.....
.
GET /draw/?w=colored&n=1299&c=000000ffffff&p= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/amg.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Cookie: uid=CgH9IlhGkMEWB2LNHawlAg==
Connection: Keep-Alive
Host: widgets.amung.us
HTTP/1.1 200 OK
Server: nginx/1.9.6
Date: Tue, 06 Dec 2016 10:19:46 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Content-Disposition: filename=wau-widget.png
Expires: Thu, 05 Jan 2017 10:19:46 GMT
Cache-Control: max-age=2592000609...PNG........IHDR...Q...........p.....PLTE...EEEYYY......???...AAA>>
.........;<=~~~......abdWXZ..................GGG......'((.........2
22.........uvyEFGzzz,,,<<<...kln...NNN>>>...........
.WWW.........~~.vwx...hhi.........OPQooo.........iii.........uvv...opp
......UVV...RRR..................bcc...ijj}~~......dee................
..QQQ...]^^PPP.........TTTaaa......{{{III.........___......HHHrss.....
....kllJJJ|||BBBOOO......DDD......CCC.....................LLLNOO......
...@@@tttkkkvvv:::...........................;;;.........FFF.........?
@@888666ppprrr.........MMM............111............000...lll......XY
Z(((&&&hhhfff cdeZ[\788...dddccc.........nnn.........ZZZXXXVVV[[[mmm
^^^\\\]]]```gggxxxjjj...M....tRNS.@..f...)IDATH....W.@......."......uO
.s/.. *..U.j-**...... .E......Q...ZF....PC...=..p.].......EQ.......^..
.....".. ......A..Nz]u.A....]..g....S?...U.* .U}o._ *(........'.._..AY
)O9KK..GU.GB..<..r....m..5..o..D^....R....S..\..y.....!...V.Y6.OY9O
..G....,...u..]xGn,...S.....uS..s]..3.i.R.^...I......d7.....v.zNf.s...
c..r:.p.k8}R...f..cG..#f9.......4../.[..l..}....{0..]4M.$.g'MH.A....?.
....Vbg....4..).J..)..q.z..m...C......5..Z...!~.<(3..xxj9....ab.,.b
.q...-.$..8%...ur\...='...2..j.S4..f......6.t...S..0.&a.lS2i..25-.?n,.
#.....G........td1.Hd...N.H...Z..b...BQ..4.....8,....C.'(..-.hZ.:_2RY,
......|....D...@..J*.u.pAu@QtA8@....Z.*..\.4R|..t#.....:tK...>b.w/.
V._."...\q.>...q..g.D.!.lR.......g....S.......[.....n........X.p|v.
...#._...v!E.Q.U!......:.)H.g."P.I..}.:..i.Nm,..p$.:$4**&:<..C#
GET /10114910/0/757d7213/1/ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:45 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Set-Cookie: __cfduid=d3893f81265d3726db45aef407f62888a1481019585; expires=Wed, 06-Dec-17 10:19:45 GMT; path=/; domain=.statcounter.com; HttpOnly
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1481019585.0; expires=Sun, 05-Dec-2021 10:19:45 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1481019585243773184; expires=Thu, 06-Dec-2018 10:19:45 GMT; path=/; domain=.statcounter.com
Server: cloudflare-nginx
CF-RAY: 30cf00587798403e-SOFGIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Tue, 06 Dec 2016 10:19:45 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=d3893f81265d3726d
b45aef407f62888a1481019585; expires=Wed, 06-Dec-17 10:19:45 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.148
1019585.0; expires=Sun, 05-Dec-2021 10:19:45 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1481019585243773184; expire
s=Thu, 06-Dec-2018 10:19:45 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 30cf00587798403e-SOF..GIF89a............
.......!.......,...........T..;....
GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=B72868160DD54F24488A158617CC8C84&sc_random=0.8780735333600617&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.govids.net/page-4.html?lid=937115&u=http://VVV.govids.net/page-4.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
Cookie: __cfduid=d3893f81265d3726db45aef407f62888a1481019585; is_unique=sc10114910.1481019585.0; is_visitor_unique=1481019585243773184
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:47 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1481019585.0-10675947.1481019587.0; expires=Sun, 05-Dec-2021 10:19:47 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1481019585243773184; expires=Thu, 06-Dec-2018 10:19:47 GMT; path=/; domain=.statcounter.com
Server: cloudflare-nginx
CF-RAY: 30cf0066227f403e-SOFGIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Tue, 06 Dec 2016 10:19:47 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..P3P: policyref="hXXp://VVV.statcounter
.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon
, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.148101958
5.0-10675947.1481019587.0; expires=Sun, 05-Dec-2021 10:19:47 GMT; path
=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=14810195852
43773184; expires=Thu, 06-Dec-2018 10:19:47 GMT; path=/; domain=.statc
ounter.com..Server: cloudflare-nginx..CF-RAY: 30cf0066227f403e-SOF..GI
F89a...................!.......,...........T..;..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: thm.vidvib.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:20:02 GMT
Content-Type: application/xml
Content-Length: 82
Connection: keep-alive
Last-Modified: Fri, 20 Jun 2014 22:54:54 GMT
ETag: "1000000015848-52-4fc4c61b7eb80"
Server: NetDNA-cache/2.2
Expires: Fri, 01 Dec 2017 10:20:02 GMT
Cache-Control: max-age=31104000
X-Cache: HIT
Accept-Ranges: bytes<cross-domain-policy>.. <allow-access-from domain="*"/>
..</cross-domain-policy>....
GET /abcd.mp4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: thm.vidvib.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:20:02 GMT
Content-Type: video/mp4
Content-Length: 5784
Connection: keep-alive
Last-Modified: Sun, 04 May 2014 13:45:24 GMT
ETag: "10000000157fb-1698-4f8933a030500"
Server: NetDNA-cache/2.2
Expires: Fri, 01 Dec 2017 10:20:02 GMT
Cache-Control: max-age=31104000
X-Cache: HIT
Accept-Ranges: bytes....ftypmp42....mp41isom....mdat.................3../..aP.pAr.2H..*=4M>>
icrosoft H.264 Encoder V1.5.3..............sC....B.5l.src:3 h:480 w:85
4 fps:29.970 pf:66 lvl:9 b:0 bqp:3 gop:60 idr:60 slc:1 cmp:0 rc:1 qp:2
4 rate:5500000 peak:0 buff:2062500 ref:1 srch:32 asrch:1 subp:1 par:6
3 3 rnd:0 cabac:0 lp:2 ctnt:0 aud:1 lat:0 wrk:4 vui:1 lyr:1 <<..
....e..K....P..#...}..}..}..}..}..}..}..}..}..}..}..}..}..".."........
......................................................................
...;...c..[.o.......?....{m....?....{e........Y.}z~...?}..}....[...}..
..[......?..5.....M<4....=4.}..}.._...:.../.._......Z.Sd..t...ET...
..3...1..........u...t..u.M......\.<....B.u....:......`.5.U..\..U/.
.D.y..Dj..).(=......:.Q.o.?...o...8 ...6....C..]..?..DJ.U. y.e. .v.M..
..D&No..W.....Y...Q*RU... ._...n....x(.....eU*.........Z.j..........B.
...kU..H..&U..x.'..~.>....!yI..^^U..Iv..''!-p.?Dd.....7..P..d`.j.Z.
......d.....x&..'V.WW..say]....R..u....JXd~........u.}k_p...Z.U.jl..F.
.K...GY?:.:d)-........!^U......B.O.?......'....!.G.......>.w."..".N
.k*.....\NN..........U........R....~R..Cz...%...\.Z.W.j.r..R*..UV...;.
..*.W.._NJo.H....LG.........l.....W...u'....?...!2..'' ....,.//'OZ.W..
"......{.R.W..y........)4H......._^..,.;XS../...O.^.....j....O...EUU..
E..y.g.Uw_Y........B....!:.(..../.... F.....W..w\.NN^]JMjG....G.....O.
.....`.....BuiI.e$..Il../....}k.~_...yTu...i.{..RC.b....]._.,.....kA..
.a.Z.[{e.{X.m....._{s.Z.. .].'...^..Z..ZHZ..S........DK.tL'.9./}D.....
......'.xF....2.......?.p..a......p.X....X..y?..`.%y..k.>......
GET /a.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154&rnd=1481019585000 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ww.commonsensicalmoderated.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:46 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 325
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html......<meta http-equiv="cache-control" content="max-age=0" />..&
lt;meta http-equiv="cache-control" content="no-cache" />..<meta
http-equiv="expires" content="0" />..<meta http-equiv="expires"
content="Tue, 01 Jan 1980 1:00:00 GMT" />..<meta http-equiv="pra
gma" content="no-cache" /><meta http-equiv="refresh" content="60
">760868HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:19:46 GMT..Serve
r: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content
-Length: 325..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..
Content-Type: text/html........<meta http-equiv="cache-control" con
tent="max-age=0" />..<meta http-equiv="cache-control" content="n
o-cache" />..<meta http-equiv="expires" content="0" />..<m
eta http-equiv="expires" content="Tue, 01 Jan 1980 1:00:00 GMT" />.
.<meta http-equiv="pragma" content="no-cache" /><meta http-eq
uiv="refresh" content="60">760868..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Tue, 06 Dec 2016 10:19:50 GMT
ETag: W/"144-1446501138000"
Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Home videos, Funny Videos - 4&mediaId=2&mediaUrl=hXXp://VVV.govids.net/4.html&srcPageUrl=hXXp://VVV.govids.net/4.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Tue, 06 Dec 2016 10:19:50 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorhub.com; Expires=Wed, 06-Dec-2017 16:08:10 GMT; Path=/
Set-Cookie: tvrg_60409="1,1481019590"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 06-Dec-2016 10:20:50 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
Content-Length: 532
Connection: keep-alive...........R.n.0... \..-.%..@R.&i. m.ZI.A....LX".>l...T...K..g.....>>
......P..d.D.I0B.........Y.\.'.C...h..Q.4.6.6.v.ah5.Jo\5f......=7..3Y.
..sq..i.Gy.]C.....7....rG..]..^.../...v..../...x<.u..$C..t{...~....
j.!..,^..I.....|..-.E..&.......8r4...%8...h.p.M.\@.vC.t.~V.k.>.Q..,
..~..U...0.%.V0_.CW>...w....\c.SB................g.v...JHo...f/,.&.
b[.?.6^.,..... .%.j.....w.mG.)....,._....a...T.f..OEi.:u..*.W.Y2.... .
...lU%I\%.x.8.R..j.OOy..9.k...gp/]......l3...........7......F..3..KM=.
;4o0Oo..@.R...b_.......?..9..D........'?..........4...HTTP/1.1 200 OK.
.Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding:
gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Tue, 06 Dec 20
16 10:19:50 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorv
ideo.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1
.1..Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorh
ub.com; Expires=Wed, 06-Dec-2017 16:08:10 GMT; Path=/..Set-Cookie: tvr
g_60409="1,1481019590"; Version=1; Domain=.tremorhub.com; Max-Age=60;
Expires=Tue, 06-Dec-2016 10:20:50 GMT; Path=/..Vary: Accept-Encoding..
x-tremorvideo-status: NO_AD..Content-Length: 532..Connection: keep-ali
ve.............R.n.0... \..-.%..@R.&i. m.ZI.A....LX".>l...T...K..g.
..........P..d.D.I0B.........Y.\.'.C...h..Q.4.6.6.v.ah5.Jo\5f......=7.
.3Y...sq..i.Gy.]C.....7....rG..]..^.../...v..../...x<.u..$C..t{...~
....j.!..,^..I.....|..-.E..&.......8r4...%8...h.p.M.\@.vC.t.~V.k.>.
Q..,..~..U...0.%.V0_.CW>...w....\c.SB................g.v...JHo.
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:23:24 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 11 Nov 2014 03:08:25 GMT
ETag: "a1b01-52-5078c97abfc40"
Accept-Ranges: bytes
Content-Length: 82
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/xml<cross-domain-policy>.. <allow-access-from domain="*"/>
..</cross-domain-policy>....
GET /v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hXXp://VVV.govids.net/4.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Home videos, Funny Videos - 4&LR_FORMAT=application/x-shockwave-flash HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:23:24 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Set-Cookie: PHPSESSID=hv4tkgfmkr75hvaa1krqgqjeh7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private
Pragma: no-cache
Content-Length: 513
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/xml<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0"&g>>
t;..<Ad id="1"><Wrapper><AdSystem>1</AdSystem>
<VASTAdTagURI><![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/a
d/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPositi
on=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Watch Home vid
eos, Funny Videos - 4&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl
=hXXp://VVV.govids.net/4.html&contentLength=[CONTENT_LENGTH]]]><
/VASTAdTagURI><Impression/><Creatives></Creatives>
;</Wrapper></Ad>..</VAST>HTTP/1.1 200 OK..Date: Tue,
06 Dec 2016 10:23:24 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-B
y: PHP/5.3.3..Set-Cookie: PHPSESSID=hv4tkgfmkr75hvaa1krqgqjeh7; path=/
..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: private..Prag
ma: no-cache..Content-Length: 513..Keep-Alive: timeout=5..Connection:
Keep-Alive..Content-Type: text/xml..<?xml version="1.0" encoding="U
TF-8"?>..<VAST version="2.0">..<Ad id="1"><Wrapper&g
t;<AdSystem>1</AdSystem><VASTAdTagURI><![CDATA[ht
tp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWid
th=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny
Videos - 4&mediaDesc=Watch Home videos, Funny Videos - 4&mediaId=&med
iaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.govids.net/4.html&cont
entLength=[CONTENT_LENGTH]]]></VASTAdTagURI><Impression/&g
t;<Creatives></Creatives></Wrapper></Ad>..
GET /wp-content/themes/howcast/images/icons/love.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.howcast.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:46 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT
ETag: "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"
Accept-Ranges: bytes
Content-Length: 127
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png.PNG........IHDR................s....gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx.b...L.`..`.>....jg.....IEND.B`.HTTP/1.
1 200 OK..Date: Tue, 06 Dec 2016 10:19:46 GMT..Server: Apache/2.2.22 (
Win64) PHP/5.3.13..Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT..ETag:
"5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"..Accept-Ranges: byte
s..Content-Length: 127..Keep-Alive: timeout=5, max=100..Connection: Ke
ep-Alive..Content-Type: image/png...PNG........IHDR................s..
..gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...L.
`..`.>....jg.....IEND.B`...
GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/amg.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: whos.amung.us
Connection: Keep-Alive
HTTP/1.1 303 See Other
Date: Tue, 06 Dec 2016 10:19:45 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Location: hXXp://widgets.amung.us/draw/?w=colored&n=1299&c=000000ffffff&p=
Set-Cookie: uid=CgH9IlhGkMEWB2LNHawlAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/0..
GET /report3.php HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:23:13 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:13 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......
GET /report3.php HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:23:14 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:14 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..
GET /home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.commonsensicalmoderated.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 858
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Encoding: gzip
Date: Tue, 06 Dec 2016 10:10:59 GMT
Vary: Accept-Encoding
Age: 526
X-Cache: Hit from cloudfront
Via: 1.1 05e6fd312b38836c9def63a422bd7429.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Xf1BJDmf86jQw1-ozuKrmcHkGLkKL2jNCXkLWAVNTyTPbYJL7PKMcA==...........U.o.6.......0..,JkZ....].&;..f.. ..z..Q.BR......%.I...l..|.
?.....Mh.f...6...Hd#...I.v...Q...-..W{N.X..v..m;..V.I.5.....r.j.d.l..|
.....o.x=.Y.h.T..i.q....M...:$.v...V...$.v.N..h...L....3.Nh. .y.d..S]H
.0u/j..W...G!b.:.Dwv...vt.a.x.d/\.Mx.....3.....y......c:.....2u:...{..
zP..C....Y.{.N6h2...;.....7$K(..o....D..-...".. .0...........|p.....9t
O......f..#..2.wM.........r:.....Q....$.....v..ZW....9.Zc.81.....6....
..6..Z..~.K.2.......1...).N....I..z#c.S...fu.2.../..~......}.J.O.k..^q
.R.......7..../J..>-...W...}.b..........|v.K .}....TC4L.,..-*j.G..w
...G......J.....%.bR.U...M?..re<...v.A...._g..a.]y2:...Q.b7.c..q..X
....G.Z.i...H...b...X..|u.<)./.@.......SEq..s.`.Uk6Q.|."..c....#.j.
......A.|G1..[.....i......iz.P...{....sH[Qq..Eh..'^......T..(b.Q..."H.
..n$Q.ey..,X../.....9 .I..xI.....3^$g.....p..A.8.2......@z?..4..?F ...
....!o..%.|.I,.....2.VWE.......
GET /jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.commonsensicalmoderated.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 878
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT
ETag: "b0000003c0a95-1d65-5418029ba830a"
Accept-Ranges: bytes
Content-Encoding: gzip
Date: Thu, 01 Dec 2016 16:57:21 GMT
Vary: Accept-Encoding
Age: 2097
X-Cache: Hit from cloudfront
Via: 1.1 05e6fd312b38836c9def63a422bd7429.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3aNUxS2O89gIPMONeFdr9SSKrMWoQO55QJjh1SljdxfuSntUCHCSxQ==............Qo.6.....;.z....$.....6`...o} .@.'..D..e.h..w...B.u..:.0dK>>
...........A...H.$...<.)v...2.......v.Q.[>l.q..X.,J.............
....I...nG:% G..|.H.C.....p`.. A.<~...;....0.D...W.<.S.....v....
...fIK}.VS^.S..;C93......2%k.{..x.....].z...j.....8..@...nM3.l......f.
d.,)/.......8..=.Rr..#..8I..1..b(.{.F.a... [..Z3....%q..._S..p.%..L...
#..&.|.Qf.:{..;.,...D.YmF..P._....;.?vD}^...6]...<.....19M.2.EBSmd.
j..V..L_%(.....l<...F[L..V"M'[(..4.........K..{HW..0).}2.Z.u.6.8.l.
..I.../.~Y..>.*v.....0[..Jk.....u..............b......a.....^..e.e.
......T..F...VPZ.<,...q^....\.]4.....nn.yi........>I...k&....n.W
....r..%.......;..q2..^..`1l.Ra.D....yT..v.d.^..z.\/2..p.....c1R....*.
o.<.""....T....7............6....C..n!..........._J<.v...h...L.Q
..!...D!.=!.B..y............?...........(`..Yp......<.0.<3=3=3=3
=3=3=3Gf._0..8.L=7=7=7=7=7=7=7Gn......3.3.3.3.3.?d...7G....*._.9......
...e...HTTP/1.1 200 OK..Content-Type: application/javascript..Content-
Length: 878..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT..ETag: "b0000003
c0a95-1d65-5418029ba830a"..Accept-Ranges: bytes..Content-Encoding: gzi
p..Date: Thu, 01 Dec 2016 16:57:21 GMT..Vary: Accept-Encoding..Age: 20
97..X-Cache: Hit from cloudfront..Via: 1.1 05e6fd312b38836c9def63a422b
d7429.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 3aNUxS2O89gIPMONeFdr9S
SKrMWoQO55QJjh1SljdxfuSntUCHCSxQ==..............Qo.6.....;.z....$.....
6`...o} .@.'..D..e.h..w...B.u..:.0dK...........A...H.$...<.)v..
GET /5/10/logo.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: l.longtailvideo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: image/png
Date: Tue, 06 Dec 2016 10:19:48 GMT
Etag: "3015243340"
Expires: Tue, 13 Dec 2016 10:19:48 GMT
Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT
Server: ECAcc (arn/46B0)
X-Cache: HIT
Content-Length: 1845.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP...>>
.0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......c
v..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*].
...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !..
...Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{
.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9k
L....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j
.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.
]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...
........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0
.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...
S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j
.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O
.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{..
....>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'.
...x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`.
..8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..
t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.
q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'
.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......
j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.b
i..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
GET /itd.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: aoaomo.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:46 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 1325
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html<html>..<head>..<title>a</title>..</head>>>
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {.. var nameEQ = name "
=";.. var ca = document.cookie.split(';');.. for(var i=0;i < ca.l
ength;i ) {.. var c = ca[i];.. while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);.. if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);.. }.. return null;..}..function uapcc()
{..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime() (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 50);.
.setInterval(function() {..uapcc();..}, 90);..//-->..setInterval( "
onl()", 60000);function onl(){if(document.images){document.images['onl
v'].src = 'o.php?' Date.parse(new Date().toString());}}..</script
><div style="visibility:hidden"><img name="onlv" src="o.ph
p"></div>..<meta http-equiv="refresh" content="300"><
;/html>....
GET /o.php HTTP/1.1
Accept: */*
Referer: hXXp://aoaomo.tremorhub.com/itd.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: aoaomo.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:46 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 3
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html...HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:19:46 GMT..Server: Apach
e/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length:
3..Keep-Alive: timeout=5, max=99..Connection: Keep-Alive..Content-Typ
e: text/html.......
GET /img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1481019587.B72868160DD54F24488A158617CC8C84.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1153493406.1481019588; _gat=1
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:19:47 GMT
Content-Type: image/png
Content-Length: 3856
Connection: keep-alive
Last-Modified: Tue, 10 Jun 2014 14:29:28 GMT
ETag: "a1bf2-f10-4fb7c27bc2200"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adob>>
e ImageReadyq.e<....IDATx..].O....V^.....rI........c..F..M.y0..-H..
..P.KH\.-.%-....J.[...5..S.... R...c....K/O.w...........93svY..i..e..w
...}..}gvy..E?.Q..%....J...(Q.V.DaZ....JN........(.fL...cM.....Z...'..
...A.....k.x....8....E..O..;.W...f.q.X..l..=.....k................%...
fd)........,..J..G...!...m.Q...J.../..................Y,0.......%...S6
R..=..t.0..%...|(..?T.V.DaZ...i%.b>..6:.~.=..7.-*.g....y<.,4>
....W..jv.(...}...8..YdF.l. .,,~5s..X<..h~.p...'......b...[6.0.D.Ci
........ Bo.C]....g..........y.i.........]N....p$.-~}8..... .....n.z..
.$~.9.).........P.....g....!.':.J..O...X.U.?:..#.g.{ .^......L..0..I..
"H<.5.u0...n^.3.ER.<......ZI......*f..... .fN.......q.n.........
.........Z.0.A.m|@.v. .uI......u........Y...u.t..........db...L.......
T.=21...8.(......i.$......y4...t:....(.`sG.H..Q...&...u.<..2L..Wl..
5...9...<. I....d...P.._h..n....MA7Y.....'..FsZ?....kH.l.s.<.QD.
...$q>lK...`1....x.Ha ^....L..W.#.C....._1...."^..6..WRz...4..z`.Ch
|R..H....:1..C..o. ........8..8.$...;..,..N.....S..O......W":.).}...IR
!.F8`=..lc..9n...O~a.....k7^-~........r........YO.C..0@I.v....7Dt.....
.............2..NmX...&.h.......f) ....;?...b8.~.>L..../.....C.l.Pf
g..............0..4k>.f.k-....X.9!a>.0.i.b.....$h.;.b.....`.32.T
r...bx.".:5K00..9..h...a........l....U..M..Z3..v..:....<:E........
#./...4p.y.....b....u.f.#[*e%.%p....|RO.dP\b...~.f...C......@..s......
....X.{.m0.k..T.O.?<&.M....C...6o.9..C..Pd.,.......O..`5.L.xP,.
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 18:27:38 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Tue, 06 Dec 2016 18:27:38 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: cdn.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 130
Connection: keep-alive
Date: Thu, 22 Sep 2016 17:57:27 GMT
Last-Modified: Thu, 04 Dec 2014 23:41:04 GMT
ETag: "2cf4c5e3d4c1206209355ac1065b0efc"
Accept-Ranges: bytes
Server: AmazonS3
Age: 56409
X-Cache: Hit from cloudfront
Via: 1.1 14484a063800eaed878a3068abf4dfac.cloudfront.net (CloudFront)
X-Amz-Cf-Id: apAVHTGe69p5mmPdUWZmRAnJN0RHurvYrUMDSDHWHlaUKDZOfdQwHg==<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" />.</cro
ss-domain-policy>....
GET /static/noad.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: cdn.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=b15b7484a37d4a1abe3149b882b87266
HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 73
Connection: keep-alive
Date: Thu, 22 Sep 2016 17:57:27 GMT
Last-Modified: Thu, 04 Dec 2014 23:38:15 GMT
ETag: "074455bdeaf186ffa7b220bc14965cd5"
Accept-Ranges: bytes
Server: AmazonS3
Age: 56415
X-Cache: Hit from cloudfront
Via: 1.1 14484a063800eaed878a3068abf4dfac.cloudfront.net (CloudFront)
X-Amz-Cf-Id: sU6PDenyQb3D1t-PHG0tCGRZsTLBfAn55bPMcW0uuakqUF80AqTqqA==<VAST version="2.0" t:status="NO_AD" xmlns:t="hXXp://tremorhub.com/
ssp"/>HTTP/1.1 200 OK..Content-Type: text/xml..Content-Length: 73..
Connection: keep-alive..Date: Thu, 22 Sep 2016 17:57:27 GMT..Last-Modi
fied: Thu, 04 Dec 2014 23:38:15 GMT..ETag: "074455bdeaf186ffa7b220bc14
965cd5"..Accept-Ranges: bytes..Server: AmazonS3..Age: 56415..X-Cache:
Hit from cloudfront..Via: 1.1 14484a063800eaed878a3068abf4dfac.cloudfr
ont.net (CloudFront)..X-Amz-Cf-Id: sU6PDenyQb3D1t-PHG0tCGRZsTLBfAn55bP
McW0uuakqUF80AqTqqA==..<VAST version="2.0" t:status="NO_AD" xmlns:t
="hXXp://tremorhub.com/ssp"/>..
GET /bck.php?1481019586000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:23:14 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:14 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......
GET /bck.php?1481019586000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 10:23:14 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:14 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..
The Trojan connects to the servers at the folowing location(s):
Map
Strings from Dumps
undiscounted.exe_1204:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
ers\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll
ers\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll
"%Program Files%\Kirton\lte.exe"
"%Program Files%\Kirton\lte.exe"
ed.exe"
ed.exe"
p\ExecCmd.dll
p\ExecCmd.dll
.reloc
.reloc
EnumWindows
EnumWindows
ExecCmd.dll
ExecCmd.dll
Kernel32.DLL
Kernel32.DLL
$$\wininit.ini
$$\wininit.ini
e%uy%u
e%uy%u
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp
lte.exe
lte.exe
rogram Files\Kirton\lte.exe"
rogram Files\Kirton\lte.exe"
ecCmd.dll
ecCmd.dll
.exe" | %SystemRoot%\System32\find /I "lte.exe"
.exe" | %SystemRoot%\System32\find /I "lte.exe"
\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp
\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp
"%Program Files%\asked\undiscounted.exe"
"%Program Files%\asked\undiscounted.exe"
%Program Files%\asked
%Program Files%\asked
undiscounted.exe
undiscounted.exe
ers\"%CurrentUserName%"\AppData\Local\Temp\nsiC052.tmp
ers\"%CurrentUserName%"\AppData\Local\Temp\nsiC052.tmp
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\
%Program Files%\asked\undiscounted.exe
%Program Files%\asked\undiscounted.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Windows\
Windows\
%Program Files%
%Program Files%
Nullsoft Install System v2.46
Nullsoft Install System v2.46
d\undiscounted.exe"
d\undiscounted.exe"
Kirton\lte.exe"
Kirton\lte.exe"
lte.exe_3632_rwx_00332000_00009000:
.NippNi
.NippNi
lte.exe_3632_rwx_6B2F2000_00002000:
BkVJBk.JBk>
BkVJBk.JBk>