Trojan.NSIS.Androm.3_dc7fd4f3cf

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

lte.exe:3632

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1053 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 519
87af60575e95350381303447cd2e0d96
c9c0ecad3c7691c9fb77d3e12dca89ba
eb908e35f01c51fd6c3145626da78202
739e7f76fb545c28ae4ce1d85e176484
d00d8a9daa2e2b19d952b1b10037467c
6e2c047259d3bc583dc140202340af7e
75182bfb4dd3d1ad7e0ef5e40b70550f
2a4240cfb6b249da0c5dcff5abf3a292
a746426f5bd2a7f239e0e1bc7529897d
0f2fa5e5c2ce26f0b744d19eff724c25
723325cfdc20c18e1ca96e88c9cca948
5cc9fd6672be1ca9538237031c1382c0
f1b56fd3f82b6a0668d00b9f0d6e991f
7f4ee0d326b67cc3e4a3fec3a25dfe3c
293bbf92195165383b202fa6cd4a2ba6
b33ccbf60d223d0df5c7b0c8b376386a
5c7aaa94fa1bbced13b76e9523bde956
da7eaa6230f54eb9da8f6986b5e53c89
0f5b04d97f3e3dc672c37106fbff0b45
9b0f84c736f2651c17fa4592c98ca6f0
10cdbd65f189a3a3a25eec73396c07d1
3642ef122aa6382d10aaf85824e1d78b
ca68f7598e334d1805d20eb245bebded
4684fab20680d9d8b202a59b822e633a
57f41da1ea05d30f6707060f00876d07

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 18:27:40 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Tue, 07 Nov 2017 18:27:40 GMT

Connection: close

Content-Type: application/x-shockwave-flash

CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....

<<< skipped >>>

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Timing-Allow-Origin: *

Date: Tue, 06 Dec 2016 08:42:39 GMT

Expires: Tue, 06 Dec 2016 10:42:39 GMT

Last-Modified: Wed, 28 Sep 2016 20:19:01 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11590

Age: 5826

Cache-Control: public, max-age=7200

...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W].b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..~.............>..........GB..N....?...?.I2.....U...o<.....W.;...x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo.....]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]............*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z......Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...zZ...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2

<<< skipped >>>

GET /r/collect?v=1&_v=j47&a=1859802888&t=pageview&_s=1&dl=http://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154&ul=en-us&de=utf-8&dt=home&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1076447804&cid=931079109.1481019585&tid=UA-74694740-5&_r=1&z=1545378189 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 06 Dec 2016 10:19:45 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Tue, 06 Dec 2016 10:19:45 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;....

GET /r/collect?v=1&_v=j47&a=926932721&t=pageview&_s=1&dl=http://VVV.govids.net/page-4.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1133922811&cid=1153493406.1481019588&tid=UA-74694740-2&_r=1&z=2010394032 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 06 Dec 2016 10:19:47 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35

GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Tue, 06 Dec 2016 10:19:47 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;..

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: we1sb-wwcgk.ads.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Tue, 06 Dec 2016 10:19:56 GMT

ETag: W/"144-1446501138000"

Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive

<?xml version="1.0" ?>.<cross-domain-policy>. <!-- Very Liberal -->. <allow-access-from domain="*" secure="false"/>.</cross-domain-policy>....

GET /ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Watch Home videos, Funny Videos - 4&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.govids.net/4.html&contentLength=[CONTENT_LENGTH] HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: we1sb-wwcgk.ads.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store, must-revalidate

Content-Encoding: gzip

Content-Type: text/xml;charset=ISO-8859-1

Date: Tue, 06 Dec 2016 10:19:56 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Pragma: no-cache

Server: Apache-Coyote/1.1

Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorhub.com; Expires=Wed, 06-Dec-2017 16:08:17 GMT; Path=/

Set-Cookie: tvrg_60409="1,1481019597"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 06-Dec-2016 10:20:57 GMT; Path=/

Vary: Accept-Encoding

x-tremorvideo-status: NO_AD

Content-Length: 529

Connection: keep-alive

...........R.n.0... \..-V$ ..H2T'-..a.Jz..`%.e..I.a[.....}\z 8....3.L..f.Em.........J2...{*>^..4.H..Eq......sgSoe...}...z..a%........`.I.....{/Kr6.....B.E..Xl...;X,...J.MsV@...1K.....".9.S.........JH`S.Y._/.p4...I.-.x.......o.I...J...h..7.....{G..g...JSP....%....P-e.......V...*.......\.>[#..v .5.". ....nURt.....'..T.F.7..7.t.E..n............A..].....K..j`...).r...E....Y...Z....... ...........epS..8...E.@.. ..q...8.......j...Y......R.c.V..q.Ak......].....^.....Q.M7.~..4Y..h.0K>..@.BC...~..L......L.. ....F...............z9...HTTP/1.1 200 OK..Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding: gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Tue, 06 Dec 2016 10:19:56 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorhub.com; Expires=Wed, 06-Dec-2017 16:08:17 GMT; Path=/..Set-Cookie: tvrg_60409="1,1481019597"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 06-Dec-2016 10:20:57 GMT; Path=/..Vary: Accept-Encoding..x-tremorvideo-status: NO_AD..Content-Length: 529..Connection: keep-alive.............R.n.0... \..-V$ ..H2T'-..a.Jz..`%.e..I.a[.....}\z 8....3.L..f.Em.........J2...{*>^..4.H..Eq......sgSoe...}...z..a%........`.I.....{/Kr6.....B.E..Xl...;X,...J.MsV@...1K.....".9.S.........JH`S.Y._/.p4...I.-.x.......o.I...J...h..7.....{G..g...JSP....%....P-e.......V...*.......\.>[#..v .5.". ....nURt.....'..T.F.7..7.t.E..n...........

<<< skipped >>>

GET /jwplayer1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 18:27:38 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT

ETag: "4403af-25d37-53444eccf91c0"

Accept-Ranges: bytes

Content-Length: 154935

Cache-Control: max-age=2592000, public

Expires: Tue, 07 Nov 2017 18:27:38 GMT

Connection: close

Content-Type: text/javascript
var dtn = Date.parse(new Date().toString());..document.write(unescape(
'
>>

GET /page-4.html?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:45 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
101e.............\kS.H..L...z........l.L. .js......).-.-.nH-.'........
...a....l..z....<}........#!.Z,...vx.R-).....aW.g..Q..w....#4f.....
..v.9.[......(m....FW...j..]..C......P.~(....4..CS.]..1..6..lSZ*....BZ
.UFFh...q .....v..<I... .t5..>..^..PG-..Uv8.!..0....km.6..[.m...
....}/..h4*."..Q.N$..[....Bj.........!I.^.g..l..^...M.....@....-.*5~..
.r..2..6..T....../]....?o..H... .Xn.cO..m...o..0P.........^...k.....-.
Sg.ez.^.............&....|s.z..w|@.....Psx.u5.Tc........3......:..g...
...$X....IP.~.,.b...Z..ua.S...,.u ..o.X......~........y....4...Z:wI...
...Q......l.97.q..o.xX.RI.......$AkD......^4..mYH...*.Suu.o..v........
,..i........oFp......o.........7v...t3p.............J......P".M....~..
H.{..nl.U}\u.7....i.~.v..f.RZn..rh.....x.P...=Sb....W...._n{"\..b.....
./...Z........tb...Q_.z.B.. ...........V].B....I.JJ.a,.....I.*..lJ.n..
..k..BGDHB....{....\.M.2.Ed...J_#.N..rS.Lf.G.7.b&...T..#y.."..@.k.u...
...T.a.A^|..C..C....V......Z......u.5<t.5..h).W....I...I.L...}...D.
..i........)..jT2...814e&..l.4$....0?P...`.UYT.01.....N..%...h.a.3V..-
).|...03. ....Q.Y...#..H....@.M...(I...5(.C...1. ......(K ...IN.d..u.-
Y.....>..ta.5d.....).#.G...`.._.Z..We..l.......l....t... ..;...#.oa
91...G[.M.yc....*l;.x"".L.3..HJ|...|PnW..9.`.....a...{.TX.YO.u23}n;X.!
.V.4.S.=...).|.._...Lc2A..x.(9..xW...&sz-f.s..d..oL..i.....O.._^.;....
...I..n7._!......G]...Q...6)......wG..................~.....r,.X...Q..
....g.g.?t..v~.........L.....w.......T&..j.<...3...Rx........T.....
.*.^s..:...>..."..o....F....T..[.........K.U/.wG[P...|....w....
>>

GET /page-4.htm?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.govids.net/page-4.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:46 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com
e5c..<meta charset="utf-8"><meta http-equiv="X-UA-Compatible"
 content="IE=edge,chrome=1"><img src="hXXp://vi.govids.net/repor
t3.php" border="0" alt="" width="0" height="0"><script type="tex
t/javascript" src="hXXp://govids.net/jwplayer1.js"></script>&
lt;script>var thecc ="ok";</script><script type="text/java
script" src="hXXp://govids.net/1.js"></script><form action
="hXXp://VVV.govids.net/page-4.php" method="get" name="redirect">&l
t;input type="hidden" name="lid" value="937115"></form>..<
script type="text/javascript"> if (top.location!= self.location) { 
setTimeout(function () { document.forms['redirect'].submit();}, 60 * 1
000); document.write('<head></head><body bgcolor="#ffff
ff" class="body" topmargin="0" leftmargin="0">');}</script>..
<script type="text/javascript"> if (top.location!= self.location
) { var rc = document.referrer.split('/')[2];if (rc == window.location
.hostname) {document.write('<div id="ova-jwplayer-container" style=
"position:absolute; top:0px; left:0px;width:300px;height:250px;">&l
t;/div>');}}</script>..<script type='text/javascript'>.
.var cb = Math.round(new Date().getTime() / 1000);..var items = Array(
'mp4:lqbyul0x.mp4','mp4:hc6lawyi.mp4','mp4:iblsdh2f.mp4','mp4:nbsyph4t
.mp4','mp4:peyjpa0x.mp4','mp4:9mzecklt.mp4','mp4:vnt9ciyd.mp4','mp4:q5
fufgnb.mp4','mp4:lzcpj8vr.mp4','mp4:pfdxi3pj.mp4','mp4:romfc7uu.mp4','
mp4:qgmcib5y.mp4','mp4:ifgfn0gh.mp4');..var item = items[Math.floo
>>

GET /css1.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1481019587.B72868160DD54F24488A158617CC8C84.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1153493406.1481019588; _gat=1

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:47 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
293.............U[O.0.~.R..G5.IM.B/.>.(..P..i......cG.{a...s..]7..0
..G....s..w<.........6 ...!..f.o3.||6...&...(...^{..F....t.>X.]L
of...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...M~...9..........#H...W.oi(y.
.....B;.@.....j.y.ke.9M.|.J..N...<8n.2...P.......>_.N...{U.....R
jb.<......oEF.I)..Bm.7...I..`.q28........Y......-P..y..V..rk.....$.
p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<.......Z.D.8 TY`..9P..H3m,..
...A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X#.B...F/...50.3j..da...H..2.
.....f..s\..q.....k.I..4.2..6..4....;(. .Rb(.........Z.,/..S....lur.*.
. ..B.....X....Jc3.P.x...I.$...)..`..F..iZ..E.pK...{F...&.....i..ja1&g
t;..s.&X..Q..~....v...*m...3.Dq".|oo%.MpTn..qU..~..-.q......0..
....


GET /img/lbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1481019587.B72868160DD54F24488A158617CC8C84.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1153493406.1481019588; _gat=1

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:47 GMT

Content-Type: image/png

Content-Length: 200

Connection: keep-alive

Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT

ETag: "a1bf1-c8-4ebb56fac1880"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Tue, 06 Dec 2016 10:19:47 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21 
Nov 2013 20:06:42 GMT..ETag: "a1bf1-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-001.ams002.int
ernap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......
gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b ..
...tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.!
[.....O...........IEND.B`...

GET /counter/counter.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d3893f81265d3726db45aef407f62888a1481019585; is_unique=sc10114910.1481019585.0; is_visitor_unique=1481019585243773184

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:47 GMT

Server: PWS/8.1.41.3

X-Px: ht h0-s1210.p11-fra.cdngp.net

ETag: W/"576924c5-654e"

Cache-Control: max-age=43200

Expires: Tue, 06 Dec 2016 14:13:53 GMT

Age: 29154

Content-Length: 9529

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT

Connection: keep-alive
...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5.  G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
>>

GET /amg.php HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.commonsensicalmoderated.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 359

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Date: Tue, 06 Dec 2016 10:10:59 GMT

Age: 526

X-Cache: Hit from cloudfront

Via: 1.1 e3666efb6956ba7f03c75c3401b8c79e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: kevomxyhv99NrDoJfjRXvU81_SR-R5lNRo3Y9oVcZirJw7tIgMI60w==
...<script type="text/javascript">setInterval( "vwu()", 200000);
function vwu(){if(document.images){document.images['viewers'].src = 'h
ttp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png?'   Date.parse
(new Date().toString());}}</script><div style="visibility:hid
den"><img name="viewers" src="hXXp://whos.amung.us/cwidget/iebro
wser1/000000ffffff.png"></div>HTTP/1.1 200 OK..Content-Type: 
text/html..Content-Length: 359..Connection: keep-alive..Server: Apache
/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Date: Tue, 06 De
c 2016 10:10:59 GMT..Age: 526..X-Cache: Hit from cloudfront..Via: 1.1 
e3666efb6956ba7f03c75c3401b8c79e.cloudfront.net (CloudFront)..X-Amz-Cf
-Id: kevomxyhv99NrDoJfjRXvU81_SR-R5lNRo3Y9oVcZirJw7tIgMI60w==.....<
script type="text/javascript">setInterval( "vwu()", 200000);functio
n vwu(){if(document.images){document.images['viewers'].src = 'hXXp://w
hos.amung.us/cwidget/iebrowser1/000000ffffff.png?'   Date.parse(new Da
te().toString());}}</script><div style="visibility:hidden"&gt
;<img name="viewers" src="hXXp://whos.amung.us/cwidget/iebrowser1/0
00000ffffff.png"></div>..

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 18:27:40 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Tue, 07 Nov 2017 18:27:40 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... 
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
>>

GET /ova-jw.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 18:27:42 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT

ETag: "4403b3-39741-4fbe0551c3280"

Accept-Ranges: bytes

Content-Length: 235329

Cache-Control: max-age=2592000, public

Expires: Tue, 07 Nov 2017 18:27:42 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
>>

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 18:27:40 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Tue, 06 Dec 2016 18:27:40 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; tvrg_60409="1,1481019590"

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Tue, 06 Dec 2016 10:19:50 GMT

ETag: W/"144-1446501138000"

Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,audiencescience,mediamath,TubeMogul-GP,tremornet,Videology,dynadmic,adapTV,eyeview,Pulsepoint,SundaySky,TapAd,1,_dmp_turbine,Bidswitch,rocketfuel,dataxu,BidTheatre,google,videoamp,conversant,appnexus,adgear,beeswax,centro&uid=b15b7484a37d4a1abe3149b882b87266&init=true HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:51 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 516

Connection: keep-alive
...........RM..0...W.H.mC .H.D4..V..Qa..j..x.V.m.&.....n.q....y3o.g...
9..(..,.....! 9.......Mh..w.6.. ..i&.....Zk..m-...n.I..[)a..Ri......v.
..D).%...B....S..$.rGY.....A4%9T........6........ih..n.J...$%q....`V..
..:...f.?...<\...X.....?......0m..-..............o. ....."..O.R....
...QK HP.M...)...B0<...-...Q....#......u.....ZF...}Y.1 .-.l.Ph@./..
F0...@T'8.t...F.f@.dpP!H.6.A..t..#...V....5.V8~.x....x.@.3.[.a..a.....
Id.9.;)..wB......lV...X.E.8.?....R..........h-.czDu.I.`..a........yRe.
....J.. a.-.Y.......................


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=google,conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:51 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 534

Connection: keep-alive
...........R...0.}.W.H.m.....A)..V...d..j.&.(X$.e;\...@...>D93...3.
..U....B.....^.%S\.b..d.."o.....*...M.%J{.f..9}...`....{LU.....{...v.}
..I..$Ny'.....Mc.N.a.dmng.Z....6My.....$~..xH....N.q.....{.L*.s#..MG..
d..i8...t4..F..8.G......S........:./.....K2.......888....$6.k.Q..85.-:
..9...x...CSBk...6....E...y.Jg......plKxUK....).O.x%..........m....9.=
....!..n....v....X..E.D;..Wz.j........Q>.FC.L....q...y..y4.....$...
..1....V...Wu^" ...H*_.#..B.....vg.7-.......].e...a.......ms.~./..#.ho
0..i\.......?.I.K........V...-..E......... u%.>.......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=conversant,TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:51 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1e9.............R...0.}.W.H.7........V m[.d..j.&..X.... ..I.K//}.|f|&l
t;gn..\.zG..K.9.`..P..q.....S?p...p......4.(..FNi.Z...XI].....k.rzva,.
.D..o............P.V...U.u.{i...7g'...v........>......m.%4.K.......
...O<......x....l4.L..`.....NEY...............T.!....&p..h.o8Cy....
.h50dh.db.G..6.R...ia.8u.M.].)PX-.|....-J.i-.4..............ly.g%.Ï.
hNp&tl..J..@%..`......A%.h3..Jmm.s.......$...1.fl...8...<..<....
.k.....Ak.....?}..(.LZY.n......k ..U..R.M.pn..4...hn0.... f.....>..
.......Fv....m m........d.......7.........0......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=TubeMogul-GP,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:51 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 533

Connection: keep-alive
...........R...0.}.W.H...\ .%AY...zA.@.V .... .e;@......HU.|f|<s|f.
..:.N ..yd.....^...}d...O.1.?..$..4...C..:2J........e.......FOO.&.Q...
.6Y.q..^.~.D..]..JC.g...4]..{..4......q..e.H....N..9..........IF.b2..|
.p&.7....wG..7...$...".MgN(....%.\..o59h..F.>......%.@A.0..N..].!8\
....2..Tq=0S...F...:3]....S....,m9.. .V@......Y...`...3. :u.H%.fD$...=
..`......N..Vb...3......Q.{.G\.z.&9..7........__.....G)k...R..nr4i....
7.Y.Qk..`..v3....?.e:.n\...^f_Lwa:..?.....ra......*.&sY...[R ....c'Pw.
......L...K.x..(d[?o.;.........7.............?.......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:51 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 485

Connection: keep-alive
...........R]..0.|.....[1...J.R.*.T..&G.N'..W..8......p...K.2.....6^..
.....F%.?.{.T..R......1.V..x......4z...%^..^2......r...Y...[Z.......6.
..8..4.a@k4}.w.a.....<...[.b...vO........ ........4...S\5 VF../.&gt
;.|..E...`1.O..Y8.f.....:....|.....[..z........].. t....{*.....!ZF...=
l.......:..3..OR..t."..J@..{Y.)....k..jp. ...h.*JD{.3.c?...`.:....!...
...n..'..Zo]kJ.p.R..?-.a..d.B.......(..h..f//i..L......<....K..q...
........*.Pk..?(..kC..#..L./4;..0..t..G.......nd...{.0...Z.O.......k..
........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:51 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 504

Connection: keep-alive
...........R...0.}.W.H...\ .%AYX$..]5a..Z.I<"...l...w..........g..L
..T........{46.(..q...m......C.......4z(.\GF.u3.,-..e.....,..c..J.nUd|
..KVF.&l...%4..>J;......A.>..{..4a....6q..e.J.................-$
gQ1....[83....l........`....&b........@M..3......%j.............A..U=l
.'.P...2..-k....3.EI8m...=.eY'.U. X!.P....Y.@b(......N. ....4..{.=.$..
..65.......ne...[. .'.....>....]...A....L...qh.n..........0hF.t..r 
..?.a:..i...&.Lwe..$..W....U.M..j$.~..8\J...P.a.~./.13......D3P..~.Xw.
.K..}.i.nn.?..................


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:52 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 510

Connection: keep-alive
...........R]..0.|.....[.......@%.k.D.....9... .e;@.}7.=...>D.ufw..
.....w..y-"...V........f.?..<~.>&iv.y.......*..3.1..Z.Ma..r..V..
.!.....>O.V.&.......T...6P..%......vyi......u...Z,.,y...D....?.....
...,.S.....7.F........G.`.L.../..l....x...C.k...."...=.......J.pnt....
,..r...aT...g...-...`.M.]Y...*N.V.8..)_.Y...`P...9#:v.H%.fD&...v@.....
A.\t.sV..4.......p.b2.Fd8a#.....hZ..W..o<~~.C.w.WJ../..}.}j.A....Q0
-....k.e....M_5...{,..z.=.O/...G.....".*n]I..[B'.....:...... ....{..:.
H4...............Ws........|.n|........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:52 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 519

Connection: keep-alive
...........R...0.}.W.H.VBn.P...VB........9..X`;.......K/R.'.......h~..
^.J3)b......RR&.....?..<y.=.Y~....?.=3.U.S.l.(.RUM1,%......iCL.c...
]...(..$..H].......$...e.Sd.]^ES...v.N../.e../7..(#...o..Q.I.\1......x
.;u...N....c....i1.....Q.G.......(B..>`..h...a.....`C......xS.0J"x`
T..) .Y#(.d..-..B9 .r..pb.......cP...9#j.......Ni.I.@.......L..v..;...
..4.m.....}.M.O.R...."..".....k...z.RJ.?..fx.....8...p8Iu.K)..24yX.&gt
;....?u..:...Z.}.......}o.....j.[#Z..g...n..y.@w.j'.B....}.I..=#...)..
......m.x..d..........L...........E.......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:52 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1dd..............O..0.....)Rsk...D@D..j.U.*.=.V..G.J0.mH....t.?.......
y.x}n......H,g6.&(..q.O.m..}h..7..,/n2w..C.W&.jc......UuW.............
...e..Yi..I..W %....m.I...I.?.....4c..._....... .....e.54..w..h...gI..
.b..............2\.Q9.Oebj4..2..w....9...E..N..1N.....:.P...|.L...j...
...0..A.kxE. .........Z..D.'8...a..$,@fl.d{.E...5...C..5rg:Ur...&,....
..E.<p....Ee..e.....K....x.T...s.mf8.../A~BJ.W[.*..@..5...G.....x_.
...P..c..FQ..G}.4~.......@.w.S.......&......N.:.i........z$._......0..
....


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:52 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 477

Connection: keep-alive
...........R]o.0.}..`H...@H......*M[U..PU......X.!......>^..s.c.s.o
.9.g..cE.2?..|..k.P....>...M...^.....4....e~..^.....4]=e.$.j.sk...l
.... ..<-...?....X..u ..t. ....m.D.^....M....^.U.p...8............&
lt;c.".X.Y...,...j.X,.e...z6.......>.[......v\`.`.i.......'..A8. .;
..P>....(..!.....5/..............CK.FXQ].Q..............q.w.3.P0...
:X..(..|.#....A..q...*\.........1..'?4..)...f..=..eO...d...`...N..K...
tZd....=.9K.Hm...C.tk0.....<...QdV.........&.'.B&.=A......z.K......
2.U.........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:52 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 445

Connection: keep-alive
..........dRMo.0...Wd.......;..xi..(.bv.CQ..D$B Y.d'....,..I..#.H*[...
.GcE.r/....*.r.v..T...x..].... -.i.......9..}gP.f.5S.J.Z.M..:p.../_...
Wd%.....Z...j..eQ.r'U......i.k.=}./..........4..H.....b...6..,......i.
..0...8^D.d...lv.sR.......:.hv......r.%.Ip{....W..0T..a>(.R0.....n.
.^..H....=..P/8. 5..t...|.`.<vo.u .#c.....4B.MG.4A.,.$...G.@.. J.$.
.d...//E....;cZ......:..{.....3.Hs*sN...........4.G{.E.@....X...]O....
.G. .......t............=..........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:52 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 451

Connection: keep-alive
...........RMo.0...Wd.....q....^........P..e...Z.$9M.../k.....(=.OOL.C
.<..6....M...e.q!.....~.."..~/..B.O4*.fa3gg.Z....vz..I...1.....`{.9
..6....%.....J.>e..Xl.z..U.]....CK^.v}.............h I....G...x....
d.!F..O.`...<...a..a...t.2.....i..._6(...|.......W..p.....Q.oEC.E..
...E.w.$...h^.@h/8v.*.5..S..E....g....R.....^3!q..z..Y...."....g^..8.Y
..a.......]k.....l.\..`..-5/.w.X...wE....A.Y..U..i..<]j2L..\`....@.
ZC.D{x...1.v..........X.Dgo.........\..........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:53 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1c8.............RMo.0...Wx...,.%v....t@..-fw;.E KD,...IN..?&M.u...G.Q|
zd6.uO.........].$.........M.y.).UV....hX(...nk...b5t.n..c}G.Q.cg.R;..
..Y.K..J...oM..}..............%.MK^....U.}._,...?.ST[......%.=.s-x....
 .X8.c?...$..'.$.....G*g .....o..gaY...$...q...%..`.;..v../.....1h..3.
!...=.......I...Fp;<.P....5.......F.jm.q..iL...4..DA<m.4l.$.L...
..w.B.^.o.....ak..$Xr.Dq.....D.."?./...n.........X...Kn..e..X}.......s
X%Rd....-.3,. t."...=.*^lqL.........'..n.... ....d........F.<......
0......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:53 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 444

Connection: keep-alive
...........RM..0...W......|.$(e....."...Z!'...v,....;P..........<O6
?..s.mx's..O\.d.1.7..\......]......?..P......jF.. :...q..b.r.;3.......
uy..Y.."...R..Q5..../.NU=e.-y.-YM7..."{... ...*........;.Vv..5gy...@&l
t;m...&....4.. J.$m&...?qf........%.C....AR&x.P..TP{. ...EM...s.'D....
B!..*...m.j.O.........Pk...K...b..M.$...,..m`..i.$~..~..............~.
..p...z{1..~. te...;.......j.?.]..z.Bi0.. E..h.?..."{..(2kM........d._
7.F&.=A.6...:o.C.......&{.........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:53 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 425

Connection: keep-alive
...........R.n.0... \....%.iH2T'...mP).!........AR.....'....g....]...x
..Q.>.....7C....]....?f..zW....B..4.(...^o.Z.b5.A.#..A.c.7. c.....~
..W^U.lV.?5(...5..(...;k....].Dk.....MU...\.m}..S..t....N.........8@L.
]..."..8].q.%Y..t.....%..y.>..6I`.w..d.....O..=..q.E4.pph... ..-...
...A;p;>.T....[&....r....E...Q..2e..@q.D9...fi.$..UA.4...........gn
...hO..n...L..3......P..q..*6.y.{4.X._..p.VC.......5.M^_..L~ A....|.W.
. ......K.~.......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:54 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
191.............RMO.0.....F..u...rR....j......&.....e;....V......f.f.&
lt;..b'......,.`2.=.m.....S}w......Y..3-..\.4s[.[k....Qtz.7......{vn,.
......../i...>kP..>Z...(.C..Z=PrJ.D V......__.7U]....h .@..tG...
.BsV.y. ..6..h..y...8..,..f:.T..%0...p).q.`.._sVo.\o.4...v...a.B9X...;
.m......A.qi].fB.m.....w.4A..Q..,e....,..&..&K.$y}-).............%....
'......#.e..wT..J.....t..m>.9..~s6.1k.......Jk..|..3.....v..ztX....
d.. ......Sxu.....0......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:53 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 428

Connection: keep-alive
...........RMo.0...Wx..[....l.^.....X..P..e...J.$.M.}. k.q.I..#...b../
..J..(].....v`....cs{....S..^7.Zp..B...t;c............h-].,..3....}S_.
UQ3.*~)...1Z..A^5.Zg.~(...I.f.l...U....u..Og9...;....A.b..T= .<....
.. ..A..a.'Q.%YN...,9..8..K.....C..m@.. .-.z..pia..f...EP.<./....c.
..rcFE{....S?.i.E..,..(.~..,.h..I..\..o.7J..?..7j.c.a..d.........\...4
........L...}dG...S.q.P.o.T.J.U......{k.,.Q.....L(..l.;C.d.G..~....[..
........tD........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:53 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 436

Connection: keep-alive
...........R]..0.|..p..[....../.@.i...>......=.B.s.._9..~@..F......
..^.#HE{...ln[...P.evUn>..2..~ .....4S..Bg.Ak.@HK`.<.....RJ..^(.
..2....X.yZ. O.K,.....S.X^.k...!E...hAJ.U..<...Z.e.t..Xjn......[.c.
..dm.8........7."/.B?..8i.....()..M...j.. >.t..z...%..1'&.`i....@..
ks.....dC9L...8A..........x..4q.6q....s.....K.....Nf.........[2]..H..T
..2.g$.w3VN.M...&.z...vuUm.ZO.'....).LHP...<]I..=...<.l...YJ..0{
t....a...t#._Z..b.%..... ....)]..........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:54 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 394

Connection: keep-alive
............OO.0....)....q..o....HH @4...j.....X.S....]..^8y.~3.?=:..^
.-j.....`.{(.^.r].w.........Z.GY...Aif..7...!Vc........1....X..)...Uu.
3Z.....J..w.....z.....J>/G.J.....d...........m..P...N6..1..(."...i.
.Q<.."..I..i....LNU... ..D.m ..N...U.w.X#hW../.U.J..........O.g...g
q..4.1..q.......Y..OO...0.Z..?..l..@...x .....\....[h.....S..>:..B.
.....d..C...54....-Jk...y!G1.k.....v.d........?".U.......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:55 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
17f.............R.j.0.}....6o.b..  .....-..}(%H.HD..#.l..J.6{y..fFg...
.^.R..$.I..8M.q$.`...6..._...|....?...,4j..m...... ......(...#.t......
......xD.#Pk......B....m6w.}.........5._...].=..,...B.?.oz....H..M..Q-
....y.5E.(.2/..n.|>..$.0T.o.......|'(..n|u...}H.\....I-fc....Uy..E.
s.R&.i....X]ee..L0.[......(..}b...I..4h0.E.......O.!.}F.q......p.K..k.
..I.sH.. ..d.tx._.j....F.o......><.~.......d.......t.y.m.....0..
....


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:54 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 435

Connection: keep-alive
...........RMk.0........F...d.m.@`.-..=.bdK.fkYH.i...!i.......7.....^.
gg.Jw.(.p......:q,.C.... ....}u...f..^..}2F..0...z..E;.@k.:f..5....?j.
q1".....Rr5......W.^g..E.-y"%...............NRe......U.b.l.:V.E.r.E-,`
...H.(I.8...h...eE%a.\Sv.T..v|.\..0.S.^.fTM'.?..M.4Y..4.XLC..(..&.a.g0
M..1....QjP....S..@{y.=jk.J_.m....A`......?..W.u.......xpk...f.3..m..{
.E./.:YU.6/...Y..........T.Fk...&..!F..>.EV......L\.m..R.W0x7......
...o......Q.C.........


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:54 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 438

Connection: keep-alive
...........R]k.0.|..p...E...l._...h...=.bdkI.........C.....=h....a...?
.G...Xj:s.4.....>5w..Kd....9.V7..`....J.7...!%........GRr.P....ej&g
t;<.yafIN.,.!.. .j....Yu.5....]...9..~......U.W........4.....l t):.
.....n.c........... .......=.a...x....)].....E.1..zR..M.E.qC...4.:^.D.
n.....k..?............pB.z;:)FpB.Z....,VkVl.....p.Z.?!..2.C:.J..-...?.
Y.fWV.......k.....\.....b..C.6\./{.@N.AY..@..N..Y.M.K4.......>.SR..
.....o#.5A:-..._..................


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:55 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
16f..............]O.0.....s......t%..!.!n..!...Xt].v...e".q.]O.{....p.
......jXb.V.4( ..b..\.w..9DW.%....9.. ....[....%h..mK......4.@*.Z..O.u
:6.LK..W.9..Xe..h..n...9....4-s.Y<O..^..i..Ov...4........r(.2)b..4t
.'v....~..~..Q......d..K.....g..k.V. ...V/ .OB/......1....$....N..V...
..!.....-\n..c$.mC...z>.'..=]e.|4.=L'...w.'.i....p..#A..vT^..>..
.V...o:...2%..|u.E......t2.k.....d........3..7.....0......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:55 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 394

Connection: keep-alive
............]O.0.....!.rG....lG.e........*;.h4.X.N..?.tt..M.......9..|
.........x...T..v......E.....U..$..2....R.k..!dA..lG1i....}....v4....T
s.......\k.....X......VK.....U[.....#........v..U.h...U5j.m.]K.".Rf.&*
.8.Q.d.$I.4O.B.a....... :%......,.c>...c.......H.Y.............(..H
Y.b.....".F.R;.$.3....8......*....~........[..O...#... .~...K..v;iN!#.
\7.S..... \........t..?.@..us<6... .....f*.e.......


GET /syncnoad?rid=c951ee73c29240129573556468689b00&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:55 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 353

Connection: keep-alive
..........d.]o.0.... ....B.*...u...-...1..F....#.._!N.q.....=}.g....s.
j........J..=.....C....M..W....l.T..Q.n.......^:.h.R.m...T...~|.g....Y
..J.u\...Si..b......Kq4.XA........" ....b....x..h.e.Yn.#...XJ).?%....q
..7.h..........b?D.% ..U..4....8@..c.P......D..(.Q4..*.=.c....\.&.Q.. 
B.JJ...;o.j:.... x..yH...H.C.rj.B..d>g..V C..........m.='B........X
T.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml.
.Date: Tue, 06 Dec 2016 10:19:55 GMT..P3P: CP='This is not a P3P polic
y. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyot
e/1.1..Vary: Accept-Encoding..Content-Length: 353..Connection: keep-al
ive............d.]o.0.... ....B.*...u...-...1..F....#.._!N.q.....=}.g.
...s.j........J..=.....C....M..W....l.T..Q.n.......^:.h.R.m...T...~|.g
....Y..J.u\...Si..b......Kq4.XA........" ....b....x..h.e.Yn.#...XJ).?%
....q..7.h..........b?D.% ..U..4....8@..c.P......D..(.Q4..*.=.c....\.&
.Q.. B.JJ...;o.j:.... x..yH...H.C.rj.B..d>g..V C..........m.='B....
....XT.........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=rocketfuel,dataxu,BidTheatre,TapAd,beeswax,google,Bidswitch,adapTV,Pulsepoint,adgear,dynadmic,mediamath,conversant,audiencescience,_dmp_turbine,appnexus,ignitionone,tremornet,centro,thetradedesk,videoamp,Videology,1,eyeview,TubeMogul-GP&uid=b15b7484a37d4a1abe3149b882b87266&init=true HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; tvrg_60409="1,1481019597"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:56 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 516

Connection: keep-alive
...........R.n.0... \..-Vd..lH2T'-..a..{..c%.%".I........}\z.8K...p7..
.mo..p)R/.\{=..d\...P|...Y..Y...B.:.%.3...X...o5.R7]9.d.........3....:
...$g.,..A)..Z...6 N...r..o...9 .~.q.%....y.?..).V..._}.....Ls....j8..
h4).M.O ..Q8..8....UZKYo..p^I......]._e.m.>/(.....K...}.@. ..,.:./2
....g(..>........3.x.... ...Cg....WGS........G.....q...X. .-2.-...R
4.$......@h.D@...P9;...4.E.5.$?.].V.m.K..........8.Q.B...Q.N.8..q4..yz
......i-..3.....L...H....4..q..&tju.~.*..m..%sM.....f..r..,4T...w;zFCl
....!.....V...l..%@.......I3........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:57 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
209.............RM..0...W.H..d..%.....j.m.J..V 4..`.......;...q.!.....
.........X....z.^.%S\.b..d.n"o....."....2j.v.&..9=.}g.RfS.=.*.Z.u..:p.
.x_..../.S.I....F.D..uX%Y..Y,...I..)..x....._g.i....4.'IP./..dR....'..
....p8...:.F... ...]0.8...S.......eu._TQ.7....B.G. .......-.ppp....%6.
K.Q..86..:..9.-.x...}s.....m`......?.0..(....{....:J..`. ..*p.SI.A ...
.v..B.F.T...t.[...!0.K.Z.v......&...5...w.0.B..y...8..Q.E.<........
..M..Q...aU..qU.%.R.m....8`9-.*J\I.;9.j..x^u.g..,... ...J.*m.6[.'...=b
............-m...<.T..:....oW.....=;.....d.. .......y@.....0..
t>....


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:56 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 503

Connection: keep-alive
...........R.n.@.}.W.H..M.8..`Q'."..U..!.....*fw.............g..{.\...
..v..."v....CQH.E.;...~.....*]f......0S.;..j..Vc-u...B..1.....`..;.O..
.I........P...h,.I...-...}Ov.)..|.~.D._..i.....h .../..(..6.........`&
lt;...&.'.m.0.G8.&.cW*..........>.s^.n.F).".>`...........@Kx....
,.m.B..!C.F!.q.q.>...CcZ.0N.ESt.e..VK..93{n...:.`5/...8.`..%.....9.
.....5.."..JY..D.......\.n..Vk.....j.A.7..A..p... ...L.0..p.....&.....
....i.z.'.E5`...w.8...._#.......h..s.h..p.Cs.I.@..13........i.....^..o
O..;H.v.1.)@......r.>........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:57 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 534

Connection: keep-alive
...........R...0.}.W.H..dsa.P...VB..-.>.V..'.Z.X....;........3.c...
.g..88.T...a...........M.?..,....Mz.9../r5..q.ZL-KK.jyh.Q^W.R.....D7*2
.~.'.#..:........6..P.i.w...C.=..MhJ...*.?>..I.<_.."5GA.?..<.
5.3.h........N2.......z......t("Vr..S5......%".!.D.K......x.(...l....$
.(.W.....s.......`C...*.7......<0..L...V...X....HE.........2.u&.D.N
.........K ...9*.5...=..^72c...:........>..M2pmo......s......../...
_.KMG.....9..7.Y.Qk..`...L.Gd..v.N.5.t.......L.3...f.._-L.1..6...2W...
.1..p..;v.u.q... .L%._q..'l.B......._.....g.jS.C......L;..A....
...


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:57 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 483

Connection: keep-alive
...........R]o.@.|.........`.m..T...Qq.C.....O....3......./}..zngv...(
w.=. j.z.....b5.j.z......g..U.,.....Ceg..*.....AY..).........u...z_...
;/Kr>.....F.U..:.Y...,.O....Es^....C.||Y..E.r..`."C..t[.T.|n.O....G
.h2...&...l.(..8....W:.>.............L...Jp.w.....:..9.7*....C7Bk..
.v..."D...u.*gj......X.i......D.@..N..B .T....GB...HM.........xjv.u-T.
v..^...B.UC.....Dq.... ..GA4-.8,.Ix{...%..I..S...?e...e...nH.H..Sg....
{..........,Y..Y..^`.<..@...{....S.....?....6...0...z.O......i0.B..
......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:57 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 477

Connection: keep-alive
...........RMo.@...WPK.V......\.J..6*.=D..{...^.v.|.........7....<M
<?.......J<.0.z.....&.c..c...w.*[.WZ.....3.x.sz&.3T7.j.A...Z....
:p.M................t..d..i~~.[..b..<.f.....}...Z.fy.t..`.......T..
....D.M..&.d4-.M.M...(..4..>b_'.....`....2x.S...$R.k..._.3..d_....%
...2....`...#[.?.)I9.0.$... .....kY2..%...WJ^...\.D..GF.n..5..t...n...
.vgI7Ru....k..B*.......I..0.`.>.4..i.EA.M.....4...|gLc...p........k
V......lr....!...H...]............(_......e...G\..7..vU|A.............
.........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:58 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 496

Connection: keep-alive
...........R.n.@.}.WPK..8.$6.6r HHU...>D..{...^.v....cBC/R..=3{v...
...z?.Pi...rG7..E.0.v....."k.~...U~.y=...=1.U.#'.c.....bT6.....f...V'.
...ln.q..i.]....hu...4?...V....<7.X....e..|...<{..... A.?..D).`S
.Y..lK.......6...n..x.x..]..2a`.......@C..3l..... 4..2.....;..B4..c.{.
2N.....eJ.F5..9..n..0;.`5/...8.`.7J^!....D}.#.....$...X.......v.Q6\.j7
.........4v...a....,.....`\D.WD.ww.......>(...<.....92.9....'...
.[.L._..Yn.s;.'Qv8......].,k.P. ...L.E.C}.i..F.b...WZ...|..v~.8W..K..}
.i..n.?.......)0.........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:57 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 502

Connection: keep-alive
...........R]..0.|.....[.K.G@IP.TB..N...N....b.q,.!............=...n4=
V..........qz Y.....&..1t....1]gW...0Q.....Z5!.j.j]6..........Kmcb..}.
..$Jy/..i....Z...*......!"o...)..n.Z&....<...K9E..(....I2YS>....
....Q0...`..c.m. ..0....}..fK......P.....-.j...y..Np.."B.....`......7&
lt;a ...|......1?I. ..V....-_)Y...`P......:..R.3.R...;...C.7.j!;.9.Tn.
].....[x.b.....x@=Z....E..E8.oo.......B.Z.e.p....h.Q8.9.f......q.Z|._.
u....[1.,.......t....i.Y.E..R.L7x$.f...w..&..:@..i.^P...m0.&?o..L~y..M
"N...........3c..........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:58 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 512

Connection: keep-alive
...........R]..0.|..........P...CB:.'.....r..X`;.........Vj..Yg....pr.
.N.J3)"...Y....L."k.-...$..>'iv..-./.=6.U.S.m.(.R.u./$......kCL.#..
.M2..0..8..HU.j.....8.....Sh..^D....z..../.Y.%/W..(#.P.7..(.$t.....m.z
C...r...#.l.....8#..^.=3.. w..;5%.E(P.{,....#". .T....a@....O..FI....#
3E........9PF81.OJV.A.X...HN........T.mu...B.T.4T......jcj.3...;..A&gt
;...xC.....9.(..7......k....8WJ.?....q..h...V..G..v!..A...K.'.e...n.V.
......vV]o.>..f...:..6KD.........%...v=.8.*..5.o0..13..L.b..=opp...
...F.?<a.. ..5..........K\.9.......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:58 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 470

Connection: keep-alive
............Oo.@......R}....l..u.*R.D5n.Qd....b.....o..q.....ov..f.&..
...#mD#...]9..e.Bn.g....9..].=[.......43.8..j..VS...-FeS..(g`g..mM.|}X
g7N.g8H....".W...T....`.|.....i.9lW.......&......mt...(K.....$....8.
....6Q4.o.......z.C.....$$..._..:A{&nQ..5=.(8.2...'%I...O..^..b....E.X
....V...".6.(....L.@j.V.9..{...h..vgH5BZ..X..mu!$.[...&E.D..C.....^0-.
./....~~Nc...n.n.?..Y..@.......DE.2......0G....d.?....nw..d..q.x.9....
`...H..\C...w.q......."v.....B...i........d@.I........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:59 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 468

Connection: keep-alive
...........R.n.0... T...b.p$....I..E..J{..."...."HJ... ......Yr...n.:.
go.cE..?..|....Pm.?...g..|...6...M4.....~..^.....tC..^.k....u....?..V7
~.W. ...j.f.6G.@.........u.$Z...._..............)4...{TL.....Ev.cQ.&i.
h.].-h..q..a..B.g..#.....5zRp.....0........L....v/......\..P..TR..P..(
.....{z@4..=..aMu.'...5...g....a..Ro.`..`6`.M8o.$Kh......8L.M.EM.F..OO
eN..........d]@.5..z...Q..0.#-`.....[../....iQ.....d.,}'..;..)...<.
.......G.YO&p.nG.."..:!.2....:@8,............J8........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=eyeview,appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:58 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1a7............dR.n.0.}.Wx...E.%.........[...CQ.....*Y.d'...i....C..&l
t;$.-.....X....&......P....>.L.E...^...-.i.....~...3.....}=i:......
...m.....o." .Wd?.h.f.V..P..1.[..2vv........}...^..U.|j..8E.&..=.Fu..F
.<..4a..I4..M.. ..(..8.f..W:'%.........fG....4....|....kZ....K.....
Hp...j.H..5..... 8v 5..t..>|.`.<...u'.#c..^...B.UO..`Z'q.C.....1
..Y..a.&....K...WtgLg...3.......;...'.Hs,sJ.....o..lih.1...".B....X...
.@ ..f.#.Bf..`....O.._...d...........~.....0......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=appnexus,audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:58 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 442

Connection: keep-alive
...........R.n.0... \...f.p$.z@uR.@.......X.k.hD.$.......}............
}...X....'W..U...v...>.O."..~-W....hT...e^...3....iz>...Y....[..
..w.yS.xyZ.Q.~3.5.S.:Z.m^.....>e/...RT.[.Y.....MY...q..S$h.....U..0
Rd.....8.....I2.. .(.....B.u....`........3...R.g....8*.....($......A .
.pD...B{)..V..@.."...!p.?Y..T...h....K....s...(. .E.>p..h..$.I.\_?&
gt;.)...[c:..=.O@...L.........ey.....x;(=k[...=.....!.......'2..Y.....
....,....v!..Z..e..9{... ....e../........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=audiencescience,centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:59 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 461

Connection: keep-alive
...........RQo.0.~..`H..0.RH.D,..L.Z5t{....N.V.e....]..Y..>...g.w.]
:.........\....e.1!..{W~.....C..X.gZp..Ci.6s.k....y......k.1.u..X.....
..b..i..<..A)...jo,o....Y.nR..<.-X....e.~../...?.S..DA.?u.......
,K.M..q...*.$.....Q0.c:...TVsiu.)....<.[7..^.kE...L@..y....,.A..y..
.A0.A......'.-.....4\uBZ...Uk..JH>.Q_E.U.%..1..B.C.M.$..$........u.
R.N.o......`j.In.7.mR...$$....l.}}u=..........%..s.w(........e.47..!y:
.....9.<.BW.....7.....1.&/7.L&.}A^..w.dX.G.......c..........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=centro,Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:19:59 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 437

Connection: keep-alive
...........RMo.0...Wd.....#.....4..tk....(..b...,Hr>...,m......'=..
.d/7.-. Z.y.....jZ..*......o..H..eu..G.=Tv.2o...3......z...Y....[.....
.~Q.xyZ.^..4.5.cT..C.W....|H.[.$Z..V...<..4.)...,..8E....=.F..'F.,.
Z6A.Gq8..e..._.0..8.G>.}.}....k...)?(.R4.%r...1M.j.@:...v.{B[.....V
..N'...!..m,.V(G..K.p....~Ge.....$.0...Pc.G.:I.:......<e.6?3.5.z ..
.X..6m.N....|INL..]k^.j>.v?...)'.......q.,O..L.[....w....2........%
6{.a.2{..{...............l..........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Bidswitch,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:00 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 418

Connection: keep-alive
...........RMo.0...Wx.....#.........[....(..bba.,Hr...)Y....'=J.||...V
>..4V.....,.P.=.j].w...E8....z..h.......*...SB.A..n`Q.Kb...7...`...
.e}.....-.....>Z..CI.Cn.X..... Z...w.W...0.....(..8.......V..gF..8[
.I.gy:a..(&..x.%c........N......%r..\..7.......C....h#8. ..........xp3
<Y..P..K............1..".4....0... ...yr~..HK....1....6b..g...R...g
~...9.>.. v,.%.A.. ...x.b...iy.=.g6...._\nP9........M...h...=.G....
......r.......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:00 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 429

Connection: keep-alive
...........RMo.0...Wx.....vj%..xi....bq.CQ....F*Y.d7..S.....'=..||..b.
..QZ....qr.GR7.........I.`...jU_h.......2n.7s.........W.9.G~.<.....
o..&f....?-.#.1Z.......h......$Z.......}.......,g.z..J..=.F. ...%..4iV
.E6.........t*.x....RI....~H..:Q..B..p).....;!{P&..L%..b ..p?<;i.N.
...2k?X.i9..>.S^.$...9`.2.....rR...OO...].Z....6..p".....&.=.#.\bZ.
..].-V...fd....O............o.1..aU.(..2.%X...-4.pC.....6..A.2...z=.p.
..._......Tu3.........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:00 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1a8.............R]o.0.}..`H.mq.*...M.)R.U.l.U...!.jc.&K..L.&...=..>
..{.n:?.W.@..=.lwzc[..=.....\}..y.!.Zl. ..i........b.....r?4..gH)a[z.4
.Ae../u.....V.~. ...m..4ayy......].O.......y..y.,...,'@jn......[...K..
.f.z~.D~...8N..a?.B.....Ddw..{....-.B..8.t......%....pG@..8.*"z......Z
....L....a..q.~..p.!..$M.{M.y..//y.~wv/e/.28:.2.{.......3]......$.....
8.j.t.U..l....w.M]Uk......4.y.5...q.P.........<}0Q.a....f....ke....
].......f..).?...d........V89......0......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=BidTheatre,beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:00 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 392

Connection: keep-alive
.............N.0.E.|E..;b.(I .UT@BB.h..B.8.....l...........}g.....5/..
..[..ap.{(.V.r..w..Q...../..N.mdnP......jD....z...j.b..=;2.lgr..zV....
.c.A.R.7.tm,6..g..........%,.n/......e...S..t..~..e%[.c].<;.WQ.&i&l
t;..<....E.D....P.C.sD..o..dU.l.Q.,A... ....7..A....f&.5.........p.
.$K NE.!p..d..,.Y...<=1J~..i..?L..j..0|..Z.%....>({...z...E.4.Mt
...vK...]...C..,5T.....Jk..|....|[A..t.m).........w.dU.......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=beeswax,videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:00 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 397

Connection: keep-alive
...........R.N.0.}...F....KIZ9......E4e......Z..l'.._..R./}.....9>.
.W....:.U...y.q.i&......Y......,.#,..B.rS_.[...!o..v.....9g..O....:..g
.\..7,"...c..e.7..$..7Z,.0z/.I...fy.C....e.6..:....P...MuJ..Y...|.eyY.
......@.fy...8....L=..5H. ..`..N`..6.w...F..C.b..|o.P|...4......KV@...
i1.U.........F.%\Y..7%.|.M..,...Dh.i.,..N..r..S.G.H.ou..F....RD..r.b..
..|..B@.....%.....h..........q.............XK.m.......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=videoamp,TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:00 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 437

Connection: keep-alive
...........RMk.0........F.Gb'..j.@`.-...J1.5I....d....C.t.=.t......0x.
.<;=(]."s...u@T-..!sw..G...7|G.....0.(..d..1r..Q.... GU. .....6.t:s
.....%.r..{...5....@C.c....`..<.R....vC........D'.2......**.2.P5...
...$N.Y...t..=..p..`.p..,g.r/\2~..lp.=k.m-.......TY..;;..&e..1........
..L..L.p:}|$....Z.V}.....C..y..ik.J_.l.. ...v..N.....|..VP.l.."..k.&gt
;_.-..^..m..........l^.........M#...T..K...=.KH.O.Of..b..{j.=..-.. ..F
.F....wrZ5. @.....*m`.........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=TapAd,adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:01 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 439

Connection: keep-alive
...........R]..0.|..p..[.Xvb'..j....G.\.....&g..B.C..W....P....fwf.!.s
{tN.t........Qw.......O..L?.G.-.0<.l...../...BFA......]....c..0....
..........PLJPC.}......:...A...)..;...)....hA..t.)#..._......K..$..k.D
a...p..s..y..)L....H&...).......5.....,M..F....*.ZEa.. .!.Y.....8.U...
..9%.O.k.:.......a..............,.....Of....pjj(.!....c2.j/........`..
.....C/.\.2[?..u.g^...c.....y ..!0(% ......../.]f..b.O.........~...~..
n..i..... .....m.v........


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=adgear,Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:01 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 380

Connection: keep-alive
............]O.0.....s..I..l....h.F..zA.....Y.....oA.?n...y.y.....jcm.
Te.#.iwl....%_E.Kvw..1...I.]d.Af.....^k-..h..Z......(%lK....Q..4....`B
-..$...C...f....V.. 8..M..........p.d..d'........y.kLcY.(.,..........}
.,...].u...-....b....q.9.D..IJ.Z.Y@......^@}.`.<...0tI....b. ..9...
.h....J......X.....(..o.*.g...a2n....}r.TB2u.. 8...r......9..e&q.n..o.
....W.\....pN.$s..}..........7.......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=Pulsepoint,_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:01 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 395

Connection: keep-alive
............]o. .... <K..B.G.D.e5..i......*.C..5F....~$..}\....x..s
...O.C.W`.^....a.t..V..p]_}...} ...>....'j;s4.9gf.9P]..A...C..0p3..
.,..}.T...J....n...n.l..X}..V.%A..G.J..n.c.....yUW7';..i.4...Y7....V.b
.m.$O.d*.mQL9..$.3..).22t#;.q..V.h.9.g"O..'.L9.B%8....E.....-#.o.K....
.;...zr...M..8.\i.O6...GjOq..<...*....~.3.......0zO.G....3..a....P.
.{e.!#_}7.W...{....J;.....:...O....9...~......1..9e.......


GET /syncnoad?rid=80fc2374739b4f889a1fd3425e5191dd&p=_dmp_turbine&uid=b15b7484a37d4a1abe3149b882b87266 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 06 Dec 2016 10:20:01 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 350

Connection: keep-alive
..........dQ.n. ...St..n..\...F]b.l.Z..1..T...`...h.t.;......|..N...R.
...]..JR....,...;.7h.....t0K.zlR.`L3..(VKu8.^%k.u.:f..1'..O..l.b.Q..7E
......j.j\.\'._...{...d.|]`t...."[..**.?...W@HB=.n...... %.?%I.WKy...u
.h..!{N.U...p..ZU^.57R.q...8...c....,....0(a....:.... .-?).....w4.....
.Oi...hQ7...\..T1.......G....B..h?g.2a.E........pi.6{n...........S....
HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date:
 Tue, 06 Dec 2016 10:20:01 GMT..P3P: CP='This is not a P3P policy. See
 hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1.
.Vary: Accept-Encoding..Content-Length: 350..Connection: keep-alive...
.........dQ.n. ...St..n..\...F]b.l.Z..1..T...`...h.t.;......|..N...R..
..]..JR....,...;.7h.....t0K.zlR.`L3..(VKu8.^%k.u.:f..1'..O..l.b.Q..7E.
.....j.j\.\'._...{...d.|]`t...."[..**.?...W@HB=.n...... %.?%I.WKy...u.
h..!{N.U...p..ZU^.57R.q...8...c....,....0(a....:.... .-?).....w4......
Oi...hQ7...\..T1.......G....B..h?g.2a.E........pi.6{n...........S.....
.

GET /draw/?w=colored&n=1299&c=000000ffffff&p= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/amg.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Cookie: uid=CgH9IlhGkMEWB2LNHawlAg==

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.9.6

Date: Tue, 06 Dec 2016 10:19:46 GMT

Content-Type: image/png

Transfer-Encoding: chunked

Connection: keep-alive

Content-Disposition: filename=wau-widget.png

Expires: Thu, 05 Jan 2017 10:19:46 GMT

Cache-Control: max-age=2592000
609...PNG........IHDR...Q...........p.....PLTE...EEEYYY......???...AAA
.........;<=~~~......abdWXZ..................GGG......'((.........2
22.........uvyEFGzzz,,,<<<...kln...NNN>>>...........
.WWW.........~~.vwx...hhi.........OPQooo.........iii.........uvv...opp
......UVV...RRR..................bcc...ijj}~~......dee................
..QQQ...]^^PPP.........TTTaaa......{{{III.........___......HHHrss.....
....kllJJJ|||BBBOOO......DDD......CCC.....................LLLNOO......
...@@@tttkkkvvv:::...........................;;;.........FFF.........?
@@888666ppprrr.........MMM............111............000...lll......XY
Z(((&&&hhhfff   cdeZ[\788...dddccc.........nnn.........ZZZXXXVVV[[[mmm
^^^\\\]]]```gggxxxjjj...M....tRNS.@..f...)IDATH....W.@......."......uO
.s/.. *..U.j-**...... .E......Q...ZF....PC...=..p.].......EQ.......^..
.....".. ......A..Nz]u.A....]..g....S?...U.* .U}o._ *(........'.._..AY
)O9KK..GU.GB..<..r....m..5..o..D^....R....S..\..y.....!...V.Y6.OY9O
..G....,...u..]xGn,...S.....uS..s]..3.i.R.^...I......d7.....v.zNf.s...
c..r:.p.k8}R...f..cG..#f9.......4../.[..l..}....{0..]4M.$.g'MH.A....?.
....Vbg....4..).J..)..q.z..m...C......5..Z...!~.<(3..xxj9....ab.,.b
.q...-.$..8%...ur\...='...2..j.S4..f......6.t...S..0.&a.lS2i..25-.?n,.
#.....G........td1.Hd...N.H...Z..b...BQ..4.....8,....C.'(..-.hZ.:_2RY,
......|....D...@..J*.u.pAu@QtA8@....Z.*..\.4R|..t#.....:tK...>b.w/.
V._."...\q.>...q..g.D.!.lR.......g....S.......[.....n........X.p|v.
...#._...v!E.Q.U!......:.)H.g."P.I..}.:..i.Nm,..p$.:$4**&:<..C#
>>

GET /10114910/0/757d7213/1/ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:45 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Set-Cookie: __cfduid=d3893f81265d3726db45aef407f62888a1481019585; expires=Wed, 06-Dec-17 10:19:45 GMT; path=/; domain=.statcounter.com; HttpOnly

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1481019585.0; expires=Sun, 05-Dec-2021 10:19:45 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1481019585243773184; expires=Thu, 06-Dec-2018 10:19:45 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 30cf00587798403e-SOF
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Tue, 06 Dec 2016 10:19:45 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=d3893f81265d3726d
b45aef407f62888a1481019585; expires=Wed, 06-Dec-17 10:19:45 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.148
1019585.0; expires=Sun, 05-Dec-2021 10:19:45 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1481019585243773184; expire
s=Thu, 06-Dec-2018 10:19:45 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 30cf00587798403e-SOF..GIF89a............
.......!.......,...........T..;....


GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=B72868160DD54F24488A158617CC8C84&sc_random=0.8780735333600617&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.govids.net/page-4.html?lid=937115&u=http://VVV.govids.net/page-4.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d3893f81265d3726db45aef407f62888a1481019585; is_unique=sc10114910.1481019585.0; is_visitor_unique=1481019585243773184

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:47 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1481019585.0-10675947.1481019587.0; expires=Sun, 05-Dec-2021 10:19:47 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1481019585243773184; expires=Thu, 06-Dec-2018 10:19:47 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 30cf0066227f403e-SOF
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Tue, 06 Dec 2016 10:19:47 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..P3P: policyref="hXXp://VVV.statcounter
.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon
, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.148101958
5.0-10675947.1481019587.0; expires=Sun, 05-Dec-2021 10:19:47 GMT; path
=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=14810195852
43773184; expires=Thu, 06-Dec-2018 10:19:47 GMT; path=/; domain=.statc
ounter.com..Server: cloudflare-nginx..CF-RAY: 30cf0066227f403e-SOF..GI
F89a...................!.......,...........T..;..

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: thm.vidvib.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:20:02 GMT

Content-Type: application/xml

Content-Length: 82

Connection: keep-alive

Last-Modified: Fri, 20 Jun 2014 22:54:54 GMT

ETag: "1000000015848-52-4fc4c61b7eb80"

Server: NetDNA-cache/2.2

Expires: Fri, 01 Dec 2017 10:20:02 GMT

Cache-Control: max-age=31104000

X-Cache: HIT

Accept-Ranges: bytes
<cross-domain-policy>..    <allow-access-from domain="*"/>
..</cross-domain-policy>....


GET /abcd.mp4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: thm.vidvib.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:20:02 GMT

Content-Type: video/mp4

Content-Length: 5784

Connection: keep-alive

Last-Modified: Sun, 04 May 2014 13:45:24 GMT

ETag: "10000000157fb-1698-4f8933a030500"

Server: NetDNA-cache/2.2

Expires: Fri, 01 Dec 2017 10:20:02 GMT

Cache-Control: max-age=31104000

X-Cache: HIT

Accept-Ranges: bytes
....ftypmp42....mp41isom....mdat.................3../..aP.pAr.2H..*=4M
icrosoft H.264 Encoder V1.5.3..............sC....B.5l.src:3 h:480 w:85
4 fps:29.970 pf:66 lvl:9 b:0 bqp:3 gop:60 idr:60 slc:1 cmp:0 rc:1 qp:2
4 rate:5500000 peak:0 buff:2062500 ref:1 srch:32 asrch:1 subp:1 par:6 
3 3 rnd:0 cabac:0 lp:2 ctnt:0 aud:1 lat:0 wrk:4 vui:1 lyr:1 <<..
....e..K....P..#...}..}..}..}..}..}..}..}..}..}..}..}..}..".."........
......................................................................
...;...c..[.o.......?....{m....?....{e........Y.}z~...?}..}....[...}..
..[......?..5.....M<4....=4.}..}.._...:.../.._......Z.Sd..t...ET...
..3...1..........u...t..u.M......\.<....B.u....:......`.5.U..\..U/.
.D.y..Dj..).(=......:.Q.o.?...o...8 ...6....C..]..?..DJ.U. y.e. .v.M..
..D&No..W.....Y...Q*RU... ._...n....x(.....eU*.........Z.j..........B.
...kU..H..&U..x.'..~.>....!yI..^^U..Iv..''!-p.?Dd.....7..P..d`.j.Z.
......d.....x&..'V.WW..say]....R..u....JXd~........u.}k_p...Z.U.jl..F.
.K...GY?:.:d)-........!^U......B.O.?......'....!.G.......>.w."..".N
.k*.....\NN..........U........R....~R..Cz...%...\.Z.W.j.r..R*..UV...;.
..*.W.._NJo.H....LG.........l.....W...u'....?...!2..'' ....,.//'OZ.W..
"......{.R.W..y........)4H......._^..,.;XS../...O.^.....j....O...EUU..
E..y.g.Uw_Y........B....!:.(..../.... F.....W..w\.NN^]JMjG....G.....O.
.....`.....BuiI.e$..Il../....}k.~_...yTu...i.{..RC.b....]._.,.....kA..
.a.Z.[{e.{X.m....._{s.Z.. .].'...^..Z..ZHZ..S........DK.tL'.9./}D.....
......'.xF....2.......?.p..a......p.X....X..y?..`.%y..k.>......
>>

GET /a.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154&rnd=1481019585000 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ww.commonsensicalmoderated.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:46 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 325

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
......<meta http-equiv="cache-control" content="max-age=0" />..&
lt;meta http-equiv="cache-control" content="no-cache" />..<meta 
http-equiv="expires" content="0" />..<meta http-equiv="expires" 
content="Tue, 01 Jan 1980 1:00:00 GMT" />..<meta http-equiv="pra
gma" content="no-cache" /><meta http-equiv="refresh" content="60
">760868HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:19:46 GMT..Serve
r: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content
-Length: 325..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..
Content-Type: text/html........<meta http-equiv="cache-control" con
tent="max-age=0" />..<meta http-equiv="cache-control" content="n
o-cache" />..<meta http-equiv="expires" content="0" />..<m
eta http-equiv="expires" content="Tue, 01 Jan 1980 1:00:00 GMT" />.
.<meta http-equiv="pragma" content="no-cache" /><meta http-eq
uiv="refresh" content="60">760868..

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Tue, 06 Dec 2016 10:19:50 GMT

ETag: W/"144-1446501138000"

Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....


GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Home videos, Funny Videos - 4&mediaId=2&mediaUrl=hXXp://VVV.govids.net/4.html&srcPageUrl=hXXp://VVV.govids.net/4.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store, must-revalidate

Content-Encoding: gzip

Content-Type: text/xml;charset=ISO-8859-1

Date: Tue, 06 Dec 2016 10:19:50 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Pragma: no-cache

Server: Apache-Coyote/1.1

Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorhub.com; Expires=Wed, 06-Dec-2017 16:08:10 GMT; Path=/

Set-Cookie: tvrg_60409="1,1481019590"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 06-Dec-2016 10:20:50 GMT; Path=/

Vary: Accept-Encoding

x-tremorvideo-status: NO_AD

Content-Length: 532

Connection: keep-alive
...........R.n.0... \..-.%..@R.&i. m.ZI.A....LX".>l...T...K..g.....
......P..d.D.I0B.........Y.\.'.C...h..Q.4.6.6.v.ah5.Jo\5f......=7..3Y.
..sq..i.Gy.]C.....7....rG..]..^.../...v..../...x<.u..$C..t{...~....
j.!..,^..I.....|..-.E..&.......8r4...%8...h.p.M.\@.vC.t.~V.k.>.Q..,
..~..U...0.%.V0_.CW>...w....\c.SB................g.v...JHo...f/,.&.
b[.?.6^.,..... .%.j.....w.mG.)....,._....a...T.f..OEi.:u..*.W.Y2.... .
...lU%I\%.x.8.R..j.OOy..9.k...gp/]......l3...........7......F..3..KM=.
;4o0Oo..@.R...b_.......?..9..D........'?..........4...HTTP/1.1 200 OK.
.Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding:
 gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Tue, 06 Dec 20
16 10:19:50 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorv
ideo.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1
.1..Set-Cookie: tvid=b15b7484a37d4a1abe3149b882b87266; Domain=.tremorh
ub.com; Expires=Wed, 06-Dec-2017 16:08:10 GMT; Path=/..Set-Cookie: tvr
g_60409="1,1481019590"; Version=1; Domain=.tremorhub.com; Max-Age=60; 
Expires=Tue, 06-Dec-2016 10:20:50 GMT; Path=/..Vary: Accept-Encoding..
x-tremorvideo-status: NO_AD..Content-Length: 532..Connection: keep-ali
ve.............R.n.0... \..-.%..@R.&i. m.ZI.A....LX".>l...T...K..g.
..........P..d.D.I0B.........Y.\.'.C...h..Q.4.6.6.v.ah5.Jo\5f......=7.
.3Y...sq..i.Gy.]C.....7....rG..]..^.../...v..../...x<.u..$C..t{...~
....j.!..,^..I.....|..-.E..&.......8r4...%8...h.p.M.\@.vC.t.~V.k.>.
Q..,..~..U...0.%.V0_.CW>...w....\c.SB................g.v...JHo.
>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:23:24 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Tue, 11 Nov 2014 03:08:25 GMT

ETag: "a1b01-52-5078c97abfc40"

Accept-Ranges: bytes

Content-Length: 82

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/xml
<cross-domain-policy>..    <allow-access-from domain="*"/>
..</cross-domain-policy>....


GET /v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hXXp://VVV.govids.net/4.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Home videos, Funny Videos - 4&LR_FORMAT=application/x-shockwave-flash HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1153493406.1481019588; _gat=1

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:23:24 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Set-Cookie: PHPSESSID=hv4tkgfmkr75hvaa1krqgqjeh7; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: private

Pragma: no-cache

Content-Length: 513

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/xml
<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0"&g
t;..<Ad id="1"><Wrapper><AdSystem>1</AdSystem>
<VASTAdTagURI><![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/a
d/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPositi
on=1&mediaTitle=Home videos, Funny Videos - 4&mediaDesc=Watch Home vid
eos, Funny Videos - 4&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl
=hXXp://VVV.govids.net/4.html&contentLength=[CONTENT_LENGTH]]]><
/VASTAdTagURI><Impression/><Creatives></Creatives&gt
;</Wrapper></Ad>..</VAST>HTTP/1.1 200 OK..Date: Tue,
 06 Dec 2016 10:23:24 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-B
y: PHP/5.3.3..Set-Cookie: PHPSESSID=hv4tkgfmkr75hvaa1krqgqjeh7; path=/
..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: private..Prag
ma: no-cache..Content-Length: 513..Keep-Alive: timeout=5..Connection: 
Keep-Alive..Content-Type: text/xml..<?xml version="1.0" encoding="U
TF-8"?>..<VAST version="2.0">..<Ad id="1"><Wrapper&g
t;<AdSystem>1</AdSystem><VASTAdTagURI><![CDATA[ht
tp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWid
th=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny
 Videos - 4&mediaDesc=Watch Home videos, Funny Videos - 4&mediaId=&med
iaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.govids.net/4.html&cont
entLength=[CONTENT_LENGTH]]]></VASTAdTagURI><Impression/&g
t;<Creatives></Creatives></Wrapper></Ad>..
>>

GET /wp-content/themes/howcast/images/icons/love.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.howcast.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:46 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT

ETag: "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"

Accept-Ranges: bytes

Content-Length: 127

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR................s....gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx.b...L.`..`.>....jg.....IEND.B`.HTTP/1.
1 200 OK..Date: Tue, 06 Dec 2016 10:19:46 GMT..Server: Apache/2.2.22 (
Win64) PHP/5.3.13..Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT..ETag:
 "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"..Accept-Ranges: byte
s..Content-Length: 127..Keep-Alive: timeout=5, max=100..Connection: Ke
ep-Alive..Content-Type: image/png...PNG........IHDR................s..
..gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...L.
`..`.>....jg.....IEND.B`...

GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/amg.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Tue, 06 Dec 2016 10:19:45 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/draw/?w=colored&n=1299&c=000000ffffff&p=

Set-Cookie: uid=CgH9IlhGkMEWB2LNHawlAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/
0..

GET /report3.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:23:13 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:13 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /report3.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:23:14 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:14 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..

GET /home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.commonsensicalmoderated.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 858

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Encoding: gzip

Date: Tue, 06 Dec 2016 10:10:59 GMT

Vary: Accept-Encoding

Age: 526

X-Cache: Hit from cloudfront

Via: 1.1 05e6fd312b38836c9def63a422bd7429.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Xf1BJDmf86jQw1-ozuKrmcHkGLkKL2jNCXkLWAVNTyTPbYJL7PKMcA==
...........U.o.6.......0..,JkZ....].&;..f.. ..z..Q.BR......%.I...l..|.
?.....Mh.f...6...Hd#...I.v...Q...-..W{N.X..v..m;..V.I.5.....r.j.d.l..|
.....o.x=.Y.h.T..i.q....M...:$.v...V...$.v.N..h...L....3.Nh. .y.d..S]H
.0u/j..W...G!b.:.Dwv...vt.a.x.d/\.Mx.....3.....y......c:.....2u:...{..
zP..C....Y.{.N6h2...;.....7$K(..o....D..-...".. .0...........|p.....9t
O......f..#..2.wM.........r:.....Q....$.....v..ZW....9.Zc.81.....6....
..6..Z..~.K.2.......1...).N....I..z#c.S...fu.2.../..~......}.J.O.k..^q
.R.......7..../J..>-...W...}.b..........|v.K .}....TC4L.,..-*j.G..w
...G......J.....%.bR.U...M?..re<...v.A...._g..a.]y2:...Q.b7.c..q..X
....G.Z.i...H...b...X..|u.<)./.@.......SEq..s.`.Uk6Q.|."..c....#.j.
......A.|G1..[.....i......iz.P...{....sH[Qq..Eh..'^......T..(b.Q..."H.
..n$Q.ey..,X../.....9 .I..xI.....3^$g.....p..A.8.2......@z?..4..?F ...
....!o..%.|.I,.....2.VWE.......


GET /jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.commonsensicalmoderated.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 878

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT

ETag: "b0000003c0a95-1d65-5418029ba830a"

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Thu, 01 Dec 2016 16:57:21 GMT

Vary: Accept-Encoding

Age: 2097

X-Cache: Hit from cloudfront

Via: 1.1 05e6fd312b38836c9def63a422bd7429.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3aNUxS2O89gIPMONeFdr9SSKrMWoQO55QJjh1SljdxfuSntUCHCSxQ==
............Qo.6.....;.z....$.....6`...o} .@.'..D..e.h..w...B.u..:.0dK
...........A...H.$...<.)v...2.......v.Q.[>l.q..X.,J.............
....I...nG:% G..|.H.C.....p`.. A.<~...;....0.D...W.<.S.....v....
...fIK}.VS^.S..;C93......2%k.{..x.....].z...j.....8..@...nM3.l......f.
d.,)/.......8..=.Rr..#..8I..1..b(.{.F.a... [..Z3....%q..._S..p.%..L...
#..&.|.Qf.:{..;.,...D.YmF..P._....;.?vD}^...6]...<.....19M.2.EBSmd.
j..V..L_%(.....l<...F[L..V"M'[(..4.........K..{HW..0).}2.Z.u.6.8.l.
..I.../.~Y..>.*v.....0[..Jk.....u..............b......a.....^..e.e.
......T..F...VPZ.<,...q^....\.]4.....nn.yi........>I...k&....n.W
....r..%.......;..q2..^..`1l.Ra.D....yT..v.d.^..z.\/2..p.....c1R....*.
o.<.""....T....7............6....C..n!..........._J<.v...h...L.Q
..!...D!.=!.B..y............?...........(`..Yp......<.0.<3=3=3=3
=3=3=3Gf._0..8.L=7=7=7=7=7=7=7Gn......3.3.3.3.3.?d...7G....*._.9......
...e...HTTP/1.1 200 OK..Content-Type: application/javascript..Content-
Length: 878..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT..ETag: "b0000003
c0a95-1d65-5418029ba830a"..Accept-Ranges: bytes..Content-Encoding: gzi
p..Date: Thu, 01 Dec 2016 16:57:21 GMT..Vary: Accept-Encoding..Age: 20
97..X-Cache: Hit from cloudfront..Via: 1.1 05e6fd312b38836c9def63a422b
d7429.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 3aNUxS2O89gIPMONeFdr9S
SKrMWoQO55QJjh1SljdxfuSntUCHCSxQ==..............Qo.6.....;.z....$.....
6`...o} .@.'..D..e.h..w...B.u..:.0dK...........A...H.$...<.)v..
>>

GET /5/10/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: l.longtailvideo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 06 Dec 2016 10:19:48 GMT

Etag: "3015243340"

Expires: Tue, 13 Dec 2016 10:19:48 GMT

Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT

Server: ECAcc (arn/46B0)

X-Cache: HIT

Content-Length: 1845
.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP...
.0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......c
v..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. 
...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !..
...Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{
.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9k
L....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j
.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.
]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...
........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0
.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...
S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j
.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O
.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{..
....>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'.
...x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`.
..8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..
t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.
q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'
.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......
j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.b
i..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
>>

GET /itd.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.commonsensicalmoderated.pw/home.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: aoaomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:46 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 1325

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
<html>..<head>..<title>a</title>..</head&gt
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {..  var nameEQ = name   "
=";..  var ca = document.cookie.split(';');..  for(var i=0;i < ca.l
ength;i  ) {..    var c = ca[i];..    while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);..    if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);..  }..  return null;..}..function uapcc()
 {..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime()   (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 50);.
.setInterval(function() {..uapcc();..}, 90);..//-->..setInterval( "
onl()", 60000);function onl(){if(document.images){document.images['onl
v'].src = 'o.php?'   Date.parse(new Date().toString());}}..</script
><div style="visibility:hidden"><img name="onlv" src="o.ph
p"></div>..<meta http-equiv="refresh" content="300">&lt
;/html>....
>>

GET /o.php HTTP/1.1

Accept: */*

Referer: hXXp://aoaomo.tremorhub.com/itd.php?id=02AMcKSTyy4dwvAf9I0S&date=2016-11-21&p=none&t=&ca=74784154

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: aoaomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:46 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 3

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: text/html
...HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:19:46 GMT..Server: Apach
e/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length:
 3..Keep-Alive: timeout=5, max=99..Connection: Keep-Alive..Content-Typ
e: text/html.......

GET /img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1481019587.B72868160DD54F24488A158617CC8C84.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1153493406.1481019588; _gat=1

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:19:47 GMT

Content-Type: image/png

Content-Length: 3856

Connection: keep-alive

Last-Modified: Tue, 10 Jun 2014 14:29:28 GMT

ETag: "a1bf2-f10-4fb7c27bc2200"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx..].O....V^.....rI........c..F..M.y0..-H..
..P.KH\.-.%-....J.[...5..S.... R...c....K/O.w...........93svY..i..e..w
...}..}gvy..E?.Q..%....J...(Q.V.DaZ....JN........(.fL...cM.....Z...'..
...A.....k.x....8....E..O..;.W...f.q.X..l..=.....k................%...
fd)........,..J..G...!...m.Q...J.../..................Y,0.......%...S6
R..=..t.0..%...|(..?T.V.DaZ...i%.b>..6:.~.=..7.-*.g....y<.,4>
....W..jv.(...}...8..YdF.l. .,,~5s..X<..h~.p...'......b...[6.0.D.Ci
........ Bo.C]....g..........y.i.........]N....p$.-~}8..... .....n.z..
.$~.9.).........P.....g....!.':.J..O...X.U.?:..#.g.{ .^......L..0..I..
"H<.5.u0...n^.3.ER.<......ZI......*f..... .fN.......q.n.........
.........Z.0.A.m|@.v. .uI......u........Y...u.t..........db...L.......
T.=21...8.(......i.$......y4...t:....(.`sG.H..Q...&...u.<..2L..Wl..
5...9...<. I....d...P.._h..n....MA7Y.....'..FsZ?....kH.l.s.<.QD.
...$q>lK...`1....x.Ha ^....L..W.#.C....._1...."^..6..WRz...4..z`.Ch
|R..H....:1..C..o. ........8..8.$...;..,..N.....S..O......W":.).}...IR
!.F8`=..lc..9n...O~a.....k7^-~........r........YO.C..0@I.v....7Dt.....
.............2..NmX...&.h.......f) ....;?...b8.~.>L..../.....C.l.Pf
g..............0..4k>.f.k-....X.9!a>.0.i.b.....$h.;.b.....`.32.T
r...bx.".:5K00..9..h...a........l....U..M..Z3..v..:....<:E........ 
#./...4p.y.....b....u.f.#[*e%.%p....|RO.dP\b...~.f...C......@..s......
....X.{.m0.k..T.O.?<&.M....C...6o.9..C..Pd.,.......O..`5.L.xP,.
>>

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 18:27:38 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Tue, 06 Dec 2016 18:27:38 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: cdn.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Type: text/xml

Content-Length: 130

Connection: keep-alive

Date: Thu, 22 Sep 2016 17:57:27 GMT

Last-Modified: Thu, 04 Dec 2014 23:41:04 GMT

ETag: "2cf4c5e3d4c1206209355ac1065b0efc"

Accept-Ranges: bytes

Server: AmazonS3

Age: 56409

X-Cache: Hit from cloudfront

Via: 1.1 14484a063800eaed878a3068abf4dfac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: apAVHTGe69p5mmPdUWZmRAnJN0RHurvYrUMDSDHWHlaUKDZOfdQwHg==
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" />.</cro
ss-domain-policy>....


GET /static/noad.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: cdn.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=b15b7484a37d4a1abe3149b882b87266

HTTP/1.1 200 OK

Content-Type: text/xml

Content-Length: 73

Connection: keep-alive

Date: Thu, 22 Sep 2016 17:57:27 GMT

Last-Modified: Thu, 04 Dec 2014 23:38:15 GMT

ETag: "074455bdeaf186ffa7b220bc14965cd5"

Accept-Ranges: bytes

Server: AmazonS3

Age: 56415

X-Cache: Hit from cloudfront

Via: 1.1 14484a063800eaed878a3068abf4dfac.cloudfront.net (CloudFront)

X-Amz-Cf-Id: sU6PDenyQb3D1t-PHG0tCGRZsTLBfAn55bPMcW0uuakqUF80AqTqqA==
<VAST version="2.0" t:status="NO_AD" xmlns:t="hXXp://tremorhub.com/
ssp"/>HTTP/1.1 200 OK..Content-Type: text/xml..Content-Length: 73..
Connection: keep-alive..Date: Thu, 22 Sep 2016 17:57:27 GMT..Last-Modi
fied: Thu, 04 Dec 2014 23:38:15 GMT..ETag: "074455bdeaf186ffa7b220bc14
965cd5"..Accept-Ranges: bytes..Server: AmazonS3..Age: 56415..X-Cache: 
Hit from cloudfront..Via: 1.1 14484a063800eaed878a3068abf4dfac.cloudfr
ont.net (CloudFront)..X-Amz-Cf-Id: sU6PDenyQb3D1t-PHG0tCGRZsTLBfAn55bP
McW0uuakqUF80AqTqqA==..<VAST version="2.0" t:status="NO_AD" xmlns:t
="hXXp://tremorhub.com/ssp"/>..

GET /bck.php?1481019586000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:23:14 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:14 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /bck.php?1481019586000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-4.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 06 Dec 2016 10:23:14 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 06 Dec 2016 10:23:14 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..

The Trojan connects to the servers at the folowing location(s):

Map

Strings from Dumps

undiscounted.exe_1204:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

ers\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll

ers\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp\ExecCmd.dll

"%Program Files%\Kirton\lte.exe"

"%Program Files%\Kirton\lte.exe"

ed.exe"

ed.exe"

p\ExecCmd.dll

p\ExecCmd.dll

.reloc

.reloc

EnumWindows

EnumWindows

ExecCmd.dll

ExecCmd.dll

Kernel32.DLL

Kernel32.DLL

$$\wininit.ini

$$\wininit.ini

e%uy%u

e%uy%u

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp

lte.exe

lte.exe

rogram Files\Kirton\lte.exe"

rogram Files\Kirton\lte.exe"

ecCmd.dll

ecCmd.dll

.exe" | %SystemRoot%\System32\find /I "lte.exe"

.exe" | %SystemRoot%\System32\find /I "lte.exe"

\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp

\Users\"%CurrentUserName%"\AppData\Local\Temp\nscD44F.tmp

"%Program Files%\asked\undiscounted.exe"

"%Program Files%\asked\undiscounted.exe"

%Program Files%\asked

%Program Files%\asked

undiscounted.exe

undiscounted.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsiC052.tmp

ers\"%CurrentUserName%"\AppData\Local\Temp\nsiC052.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

%Program Files%\asked\undiscounted.exe

%Program Files%\asked\undiscounted.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows\

Windows\

%Program Files%

%Program Files%

Nullsoft Install System v2.46

Nullsoft Install System v2.46

d\undiscounted.exe"

d\undiscounted.exe"

Kirton\lte.exe"

Kirton\lte.exe"

lte.exe_3632_rwx_00332000_00009000:

.NippNi

.NippNi

lte.exe_3632_rwx_6B2F2000_00002000:

BkVJBk.JBk>

BkVJBk.JBk>