Dropped.Trojan.Agent.37016_bd2c880c27

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):No processes have been created.The Dropped injects its code into the following process(es):

natural.exe:260
natural.exe:3100

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

HOSTS file anomalies

The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 987 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Dropped file.
   
3. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 477
87af60575e95350381303447cd2e0d96
39f1a43ddb6a47ab9ed5c5790fe0053c
851f652e88b118cedb92395bf9cb1abe
9fbf0e78e968d4999b9daacfaa4c43d5
55a7db10fd9eb579f55d531f8b54beaa
cade489e0f1690f6b13773d75f220663
61a4e4369f9a8b18839635607456c842
4c3e238bd437b649bc04bbdf1af32944
fffe24bc33eca54cf03d824195d52754
066f39836f411ea32528fcfb6190732d
60c9244eaf0ab4a4b27f7b20ad37d60f
f943df62e5ec6f5254a1517a3e739baa
3b59c9c06351fe2dc7ab07fbec5cf3f4
c1efdf1d2f9d814dbdd620eadccd7ec2
e20c2ee024fb4a3ea1b3416c7e39b340
a9efe494b8b83d12f5e17908c7efb634
786b1a641feab64bdb3604994a1555a7
e60a88037b13ef389b0883e46f245a1c
3f51c8788642751530132a9f3d027551
36f36ac1d61e3d88c9e20b1124209453
0dfa63e653b8e42ef88dfe0b87e0e998
4c59bb5c4cbbe5c13b67a5824b8d866e
17632b5c3594c6040fb5b2223b5c3c28
28a81e67c867325cea1f0383247d88aa
bd9726e2c29e002d07c80b3eb1dc880f

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /bck.php?1478557142000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:22:29 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 22:22:29 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8..

GET /img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1478557144.E5493D25C24B4F4A54DA27D7611DD4BD.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1900959323.1478557144; _gat=1

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:02 GMT

Content-Type: image/png

Content-Length: 2536

Connection: keep-alive

Last-Modified: Thu, 10 Jul 2014 23:39:15 GMT

ETag: "a1c81-9e8-4fddf55270ec0"

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes

.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...zIDATx..]]S.W..N.......7.NE.........(...H.8S..V.....H;j.v..%.3...^.`...3...3....7.6......>..r..n...$....a`M.ys.9.y..,..U.[..a.a9M..8M .....4.`..8..4...i...:M2MXd.&J..{..K....=.?........m.....!sX...M!.5.}...){.....].r..l.U..Vv9.afH.......Wr.i[FEX..v...;.... Y.=."d.bjy..L,.......Ph..$..I.B...]W...}.3*.B.....-..&....!..gT..{.q.`...hv.........i..8M ....#~z.|]......}a.......5y..!..&...NzV........>1....wb..A.E.|g..j....J7m./.w].Df.v.N.FN.}.%...#........g.7...G.wW..8"............SGe...x...M..%kV.%.B...7........gz.....K.....d.Da......../........=).....G?. ..<...Q...k0...v.B.....fn4.:._a...|...J7.g.(:...&..k.1.i......&.;........@....y.z..|[....w-....}.......c5....I=..J...j...5...."MV..[..8.Qw....w..........Ec}..~J.9m...A..v.?...m...FvU.; ....~...r...g..x=....... .....>V....9...~.....!.u.J.FZ.iB.L.T..S./L..*.q1..|..8.2.z1..5{....kdg....h.S..k...8.K.v.....Y..-.o.E@S..F.oo|. o.2.6.B...6..)m.T..Y........).O..........Q.'`.M.*J..p.tGW.....FO.C.=......b...*O..@....p*].h..Z.}.~....*G.....n$...D.....Q..4Y..8L..;...K...Z..H1...ai.t.*yL...`-)2E..ip..C.d.&$*....p..[{.......4Ez..Gf.V..T.D[....g....Rm......u(Y.o@HT.*>?;}..D2ks...6>-\.)}Rb..ky......Pc......-.\..?..s......319....^..D.i.C.....s.z.[..\...GJ...'8...Hi.s......-.S.#...1...)..._S.V.ocE.\..cB.*Y.Z..B..%..r..73.8..p....P.U..\......2.2u....S.....iQ.............P.y...{ 7i......v.s..N..-....K]\v.%..Vo$.P..<....}....Wb..9..7.p..$4=N Mj..0..4gj..Hie..5;-......6...8..m.(.

<<< skipped >>>

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 08 Nov 2016 06:26:11 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Tue, 08 Nov 2016 06:26:11 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 08 Nov 2016 06:26:10 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Tue, 08 Nov 2016 06:26:10 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: thm.vidvib.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:34 GMT

Content-Type: application/xml

Content-Length: 82

Connection: keep-alive

Last-Modified: Fri, 20 Jun 2014 22:54:54 GMT

ETag: "1000000015848-52-4fc4c61b7eb80"

Server: NetDNA-cache/2.2

Expires: Thu, 02 Nov 2017 22:19:34 GMT

Cache-Control: max-age=31104000

X-Cache: HIT

Accept-Ranges: bytes

<cross-domain-policy>.. <allow-access-from domain="*"/>..</cross-domain-policy>....

GET /abcd.mp4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: thm.vidvib.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:34 GMT

Content-Type: video/mp4

Content-Length: 5784

Connection: keep-alive

Last-Modified: Sun, 04 May 2014 13:45:24 GMT

ETag: "10000000157fb-1698-4f8933a030500"

Server: NetDNA-cache/2.2

Expires: Thu, 02 Nov 2017 22:19:34 GMT

Cache-Control: max-age=31104000

X-Cache: HIT

Accept-Ranges: bytes

....ftypmp42....mp41isom....mdat.................3../..aP.pAr.2H..*=4Microsoft H.264 Encoder V1.5.3..............sC....B.5l.src:3 h:480 w:854 fps:29.970 pf:66 lvl:9 b:0 bqp:3 gop:60 idr:60 slc:1 cmp:0 rc:1 qp:24 rate:5500000 peak:0 buff:2062500 ref:1 srch:32 asrch:1 subp:1 par:6 3 3 rnd:0 cabac:0 lp:2 ctnt:0 aud:1 lat:0 wrk:4 vui:1 lyr:1 <<......e..K....P..#...}..}..}..}..}..}..}..}..}..}..}..}..}.."..".................................................................................;...c..[.o.......?....{m....?....{e........Y.}z~...?}..}....[...}....[......?..5.....M<4....=4.}..}.._...:.../.._......Z.Sd..t...ET.....3...1..........u...t..u.M......\.<....B.u....:......`.5.U..\..U/..D.y..Dj..).(=......:.Q.o.?...o...8 ...6....C..]..?..DJ.U. y.e. .v.M....D&No..W.....Y...Q*RU... ._...n....x(.....eU*.........Z.j..........B....kU..H..&U..x.'..~.>....!yI..^^U..Iv..''!-p.?Dd.....7..P..d`.j.Z.......d.....x&..'V.WW..say]....R..u....JXd~........u.}k_p...Z.U.jl..F..K...GY?:.:d)-........!^U......B.O.?......'....!.G.......>.w."..".N.k*.....\NN..........U........R....~R..Cz...%...\.Z.W.j.r..R*..UV...;...*.W.._NJo.H....LG.........l.....W...u'....?...!2..'' ....,.//'OZ.W.."......{.R.W..y........)4H......._^..,.;XS../...O.^.....j....O...EUU..E..y.g.Uw_Y........B....!:.(..../.... F.....W..w\.NN^]JMjG....G.....O......`.....BuiI.e$..Il../....}k.~_...yTu...i.{..RC.b....]._.,.....kA...a.Z.[{e.{X.m....._{s.Z.. .].'...^..Z..ZHZ..S........DK.tL'.9./}D...........'.xF....2.......?.p..a......p.X....X..y?..`.%y..k.>......

<<< skipped >>>

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 08 Nov 2016 06:26:12 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Tue, 10 Oct 2017 06:26:12 GMT

Connection: close

Content-Type: application/x-shockwave-flash

CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....

<<< skipped >>>

GET /10114910/0/757d7213/1/ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:18:55 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Set-Cookie: __cfduid=d329072cef8e35c782d4df421c85c8f271478557134; expires=Tue, 07-Nov-17 22:18:54 GMT; path=/; domain=.statcounter.com; HttpOnly

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1478557135.0; expires=Sat, 06-Nov-2021 22:18:55 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1478557135348244617; expires=Wed, 07-Nov-2018 22:18:55 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 2fe429eda0f74ecc-DME

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 22:18:55 GMT..Content-Type: image/gif..Content-Length: 49..Connection: keep-alive..Set-Cookie: __cfduid=d329072cef8e35c782d4df421c85c8f271478557134; expires=Tue, 07-Nov-17 22:18:54 GMT; path=/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.1478557135.0; expires=Sat, 06-Nov-2021 22:18:55 GMT; path=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=1478557135348244617; expires=Wed, 07-Nov-2018 22:18:55 GMT; path=/; domain=.statcounter.com..Server: cloudflare-nginx..CF-RAY: 2fe429eda0f74ecc-DME..GIF89a...................!.......,...........T..;....

GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=E5493D25C24B4F4A54DA27D7611DD4BD&sc_random=0.6212423037842605&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.ivids.net/page-5.html?lid=937115&u=http://VVV.ivids.net/page-5.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d329072cef8e35c782d4df421c85c8f271478557134; is_unique=sc10114910.1478557135.0; is_visitor_unique=1478557135348244617

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:02 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1478557135.0-10675947.1478557142.0; expires=Sat, 06-Nov-2021 22:19:02 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1478557135348244617; expires=Wed, 07-Nov-2018 22:19:02 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 2fe42a1be41c4ecc-DME

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 22:19:02 GMT..Content-Type: image/gif..Content-Length: 49..Connection: keep-alive..P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.1478557135.0-10675947.1478557142.0; expires=Sat, 06-Nov-2021 22:19:02 GMT; path=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=1478557135348244617; expires=Wed, 07-Nov-2018 22:19:02 GMT; path=/; domain=.statcounter.com..Server: cloudflare-nginx..CF-RAY: 2fe42a1be41c4ecc-DME..GIF89a...................!.......,...........T..;..

GET /draw/?w=colored&n=1558&c=000000ffffff&p= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Cookie: uid=CgH9IFgg/c24DxxpE2TuAg==

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.9.6

Date: Mon, 07 Nov 2016 22:18:55 GMT

Content-Type: image/png

Transfer-Encoding: chunked

Connection: keep-alive

Content-Disposition: filename=wau-widget.png

Expires: Wed, 07 Dec 2016 22:18:55 GMT

Cache-Control: max-age=2592000

60a...PNG........IHDR...Q...........p.....PLTE...EEE...???...AAA.....................;<=CCC......***$$$...abdWXZ............444......GGG......'((.........""".........uvyEFG...,,,......kln...NNN>>>.........~~.vwx...hhi.........OPQ............iii......uvv...opp......UVV...RRR...WWW............bcc...ijj}~~......dee............~~~............QQQ...]^^PPP.........TTTaaa......zzz......___......HHHrss.........kllJJJDDD|||......YYY...eee............LLLNOO.........@@@tttkkkvvv:::qqq.................................FFF.........?@@666ppprrrSSS............BBB.........888......111............000...lll......XYZ(((&&&hhhfff cdeZ[\788...dddccc.........nnn.........ZZZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjj...h....tRNS.@..f...0IDATH....W.A.....N....@-$...Pk..J;..c3.....0 ;.4..& S)..F..<..b6D..ifYh....|?.|{...,<X..(...n[W_.v......Y~........g..I...W..W..j...g|.....N........>....2.[.[0M..y..Z.@s.G.....C....wo.........6....:.373..<}..v.P.Q...z}.......2=..;(...=......j5nV~..T[R|.\/*..[.,....s.....Y...W....b......\..x.<..sx..L..3..&..S..9.M8q.Xv..l1.....V.QWF..\<d,.<..9@..iz...}4!s/Mg...TAU..]...Z.....Q%G!....R0.[. .99....$%"1.....Ql..fA..U.rWN.G.#.~].&6f.)v.i5....@....qU........X..2|.6#...X.D.T.f.0.".....@9....a<9>Ol=eIsU..%.D.....E.!2......R ...<Q..[b.,."T......#....a@&.....CSg.-d:.Z.%.s..9.rWrZ.b}. h.V..[.T.Q.\(NA.H..B...U.z.-.:.5..B..i'M.`.6a.P,G@x...T..6.,..p..[..e.c.m.Z=}.(h.Bq$..~..ix.'..H]E? ?....?-.aC......!.....Y.D.2..K@ ....{..4..."........\.@.@&QH....k..k....k.".....E......#.......R...

<<< skipped >>>

GET /default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t= HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.chevallemma.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 915

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Encoding: gzip

Date: Mon, 07 Nov 2016 22:00:25 GMT

Vary: Accept-Encoding

Age: 1107

X-Cache: Hit from cloudfront

Via: 1.1 6fd049110ebc3ac6deddab8b0bf5d686.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 4934D_E2Qd9ohKLYVZetiUJYqpECxhizeaD2Ek4xOVdsfrnjdkKezg==

...........U[o.6.~/....a.fY.6...r.K.d..C3l...Z:..I.JR..$.}....E.t.. ...s...jQ..Y.j..r......6`s....W....vS...mN....f.N...b..%...$.\].PV...V-....5l4.....Wi..V...5:..q.H.......6....2.)%VuOvJ.h...d.....d...s.|.la.-:K....W.......B...P...[..........-.D....=..w..@...A.[..j!. ...u.....,..7.@....p].h2...k..^@@.iD.;....o.pb.[@..........8...JU.....-0S......."..'gI.&...%......s6..&.g.9g.|O..\J[.4...Q../}...%h..DN5.B.S....x....)T.Z.[...u..q..[>......lk(..S.7E.!.....9...TTE:.Q......T.........}}..e7...........?....4.......M.w..........W6y...Os.........a...ElQQ..K...5.>bM._.7s.s..E....Z.[GV4..J..4..[.(.. ..|...e..=....".$.Q..}......w..- .au. ..1{.T..bv.....$..:........Y:q.C..0x.".SX...;.....N...& t;.A.....'...A..Nl.G....3..W..s).6.........pHb....{..H@.C"`....f.?3..'.du........c....cw.V..F.E#....e... ....wZ.$.br.s.n$.Hw..._Lal,..B.....Yv.:K.4.......e.%......?..__.)....py..}..8.I%.s..c;..e.U.....f"..u~....9......(.m....HTTP/1.1 200 OK..Content-Type: text/html..Content-Length: 915..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Encoding: gzip..Date: Mon, 07 Nov 2016 22:00:25 GMT..Vary: Accept-Encoding..Age: 1107..X-Cache: Hit from cloudfront..Via: 1.1 6fd049110ebc3ac6deddab8b0bf5d686.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 4934D_E2Qd9ohKLYVZetiUJYqpECxhizeaD2Ek4xOVdsfrnjdkKezg==.............U[o.6.~/....a.fY.6...r.K.d..C3l...Z:..I.JR..$.}....E.t.. ...s...jQ..Y.j..r......6`s....W....vS...mN....f.N...b..%...$.\].PV...V-....5l4.....Wi..V...5:..q.H.......6....2.)%VuOvJ.h...d

<<< skipped >>>

GET /func.js?r=5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.chevallemma.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 597

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT

ETag: "90000001e1520-f7a-537ea953f7333"

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Thu, 13 Oct 2016 00:18:15 GMT

Vary: Accept-Encoding

Age: 1108

X-Cache: Hit from cloudfront

Via: 1.1 6fd049110ebc3ac6deddab8b0bf5d686.cloudfront.net (CloudFront)

X-Amz-Cf-Id: pbEK__N-MxdjjNLf3A9d6NQwCZq5K70zm8z7zWz4BnM7slUptQapgQ==

............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L.. *.V2..p...rv.....F..x?W..*............3_.q.q....S.~....7_e.G..P..7w..h..R ..$.w....H.41.W.n...D....wZ..x.ZG....6..:a.5!....t:O..:.5MvM...(...f.@..S.\.......SuY....:.........>...P..{|:.<.<...I...=........}..=...|.8.......{1z...HTTP/1.1 200 OK..Content-Type: application/javascript..Content-Length: 597..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT..ETag: "90000001e1520-f7a-537ea953f7333"..Accept-Ranges: bytes..Content-Encoding: gzip..Date: Thu, 13 Oct 2016 00:18:15 GMT..Vary: Accept-Encoding..Age: 1108..X-Cache: Hit from cloudfront..Via: 1.1 6fd049110ebc3ac6deddab8b0bf5d686.cloudfront.net (CloudFront)..X-Amz-Cf-Id: pbEK__N-MxdjjNLf3A9d6NQwCZq5K70zm8z7zWz4BnM7slUptQapgQ==..............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L..

<<< skipped >>>

GET /jwplayer1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 08 Nov 2016 06:26:10 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT

ETag: "4403af-25d37-53444eccf91c0"

Accept-Ranges: bytes

Content-Length: 154935

Cache-Control: max-age=2592000, public

Expires: Tue, 10 Oct 2017 06:26:10 GMT

Connection: close

Content-Type: text/javascript
var dtn = Date.parse(new Date().toString());..document.write(unescape(
'
>>

GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Mon, 07 Nov 2016 22:18:53 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/draw/?w=colored&n=1558&c=000000ffffff&p=

Set-Cookie: uid=CgH9IFgg/c24DxxpE2TuAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/
0..

GET /itd.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t= HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: cocomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:18:54 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 1118

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
<html>..<head>..<title>a</title>..</head&gt
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {..  var nameEQ = name   "
=";..  var ca = document.cookie.split(';');..  for(var i=0;i < ca.l
ength;i  ) {..    var c = ca[i];..    while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);..    if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);..  }..  return null;..}..function uapcc()
 {..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime()   (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 90);.
.setInterval(function() {..uapcc();..}, 90);..//-->..</script&gt
;..<meta http-equiv="refresh" content="300">..</html>HTTP/
1.1 200 OK..Date: Mon, 07 Nov 2016 22:18:54 GMT..Server: Apache/2.2.22
 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 1118..K
eep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: t
ext/html..<html>..<head>..<title>a</title>..&l
t;/head>..<body>..<script language="JavaScript" type="
>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Mon, 07 Nov 2016 22:19:09 GMT

ETag: W/"144-1446501138000"

Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....


GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net - 5&mediaDesc=Entertainment videos ivids.net - 5&mediaId=2&mediaUrl=hXXp://VVV.ivids.net/5.html&srcPageUrl=hXXp://VVV.ivids.net/5.html&contentLength=300 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store, must-revalidate

Content-Encoding: gzip

Content-Type: text/xml;charset=ISO-8859-1

Date: Mon, 07 Nov 2016 22:19:09 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Pragma: no-cache

Server: Apache-Coyote/1.1

Set-Cookie: tvid=55d3e6ef50a445de8e106c9313ff0239; Domain=.tremorhub.com; Expires=Wed, 08-Nov-2017 04:07:30 GMT; Path=/

Set-Cookie: tvrg_60409="1,1478557150"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Mon, 07-Nov-2016 22:20:10 GMT; Path=/

Vary: Accept-Encoding

x-tremorvideo-status: NO_AD

Content-Length: 524

Connection: keep-alive
...........S.n.@.}.W.H.[...."..NZYJ..`.!..aw. .].....;.7..!}@.........
.}....%......J...y......g.^..(N.e.........Z[.\.j,..Vi...5.t:vf,......M
t..~.;..CCY.n..6..0i{;q...o.vi...W.....yq.%..y]..J"..ko-.T..Z. .&..8.)
...Y:.N....L.....q........8X...P....'..QX.%...dM.k<.<.z.)..^7..*
o....H ...KaI/%.i.......Q.....*.S...k....`.h.pj...Z5.*...4.}Qf..rc ..v
|.\@.v.J>.".I..*..*..._.(....m...7{....V$.h..x...Or.8N.......fY.0.v
.}P`u.//...i...J...H{......hi..}...e..>....ez..,J....n./4)$.h.0..HL
..D.../p. ..U..N.K......N..=k.^.. ......|.^...HTTP/1.1 200 OK..Cache-C
ontrol: no-cache, no-store, must-revalidate..Content-Encoding: gzip..C
ontent-Type: text/xml;charset=ISO-8859-1..Date: Mon, 07 Nov 2016 22:19
:09 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com
/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-
Cookie: tvid=55d3e6ef50a445de8e106c9313ff0239; Domain=.tremorhub.com; 
Expires=Wed, 08-Nov-2017 04:07:30 GMT; Path=/..Set-Cookie: tvrg_60409=
"1,1478557150"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=
Mon, 07-Nov-2016 22:20:10 GMT; Path=/..Vary: Accept-Encoding..x-tremor
video-status: NO_AD..Content-Length: 524..Connection: keep-alive......
.......S.n.@.}.W.H.[...."..NZYJ..`.!..aw. .].....;.7..!}@..........}..
..%......J...y......g.^..(N.e.........Z[.\.j,..Vi...5.t:vf,......Mt..~
.;..CCY.n..6..0i{;q...o.vi...W.....yq.%..y]..J"..ko-.T..Z. .&..8.)...Y
:.N....L.....q........8X...P....'..QX.%...dM.k<.<.z.)..^7..*o...
.H ...KaI/%.i.......Q.....*.S...k....`.h.pj...Z5.*...4.}Qf..rc ..v
>>

GET /ova-jw.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1900959323.1478557144; _gat=1

HTTP/1.1 200 OK

Date: Tue, 08 Nov 2016 06:26:14 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT

ETag: "4403b3-39741-4fbe0551c3280"

Accept-Ranges: bytes

Content-Length: 235329

Cache-Control: max-age=2592000, public

Expires: Tue, 10 Oct 2017 06:26:14 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
>>

GET /report1.php?url=/ivids/page-5.html?lid=937115 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:22:24 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 22:22:24 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /bck.php?1478557142000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:22:29 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 22:22:29 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /report1.php?url=/ivids/page-5.htm?lid=937115 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:22:29 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Mon, 07 Nov 2016 22:22:29 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 20:49:50 GMT

Expires: Mon, 07 Nov 2016 22:49:50 GMT

Last-Modified: Wed, 28 Sep 2016 20:19:01 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11590

Age: 5344

Cache-Control: public, max-age=7200
...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'
V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W]
.b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..
~.............>..........GB..N....?...?.I2.....U...o<.....W.;...
x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/
..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<
.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo..
...]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..
~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.
E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)
....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]..........
..*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.
........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9
..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....
q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z...
...Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....
C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.
X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'
....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P
..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...z
Z...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@
........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
>>

GET /r/collect?v=1&_v=j47&a=2138643529&t=pageview&_s=1&dl=http://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=&ul=en-us&de=utf-8&dt=home&sd=24-bit&sr=1276x846&vp=695x408&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=66857684&cid=212621649.1478557136&tid=UA-74694740-5&_r=1&z=1180830552 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Mon, 07 Nov 2016 22:18:54 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Mon, 07 Nov 2016 22:18:54 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;....


GET /r/collect?v=1&_v=j47&a=935247025&t=pageview&_s=1&dl=http://VVV.ivids.net/page-5.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x497&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1162591881&cid=1900959323.1478557144&tid=UA-74694740-2&_r=1&z=989024687 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Mon, 07 Nov 2016 22:19:02 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Mon, 07 Nov 2016 22:19:02 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..

GET /counter/counter.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d329072cef8e35c782d4df421c85c8f271478557134; is_unique=sc10114910.1478557135.0; is_visitor_unique=1478557135348244617

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:02 GMT

Server: PWS/8.1.41.3

X-Px: ht h0-s1210.p11-fra.cdngp.net

ETag: W/"576924c5-654e"

Cache-Control: max-age=43200

Expires: Tue, 08 Nov 2016 00:52:54 GMT

Age: 33968

Content-Length: 9529

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT

Connection: keep-alive
...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5.  G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1900959323.1478557144; _gat=1

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:22:51 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Tue, 11 Nov 2014 03:08:25 GMT

ETag: "a1b01-52-5078c97abfc40"

Accept-Ranges: bytes

Content-Length: 82

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/xml
<cross-domain-policy>..    <allow-access-from domain="*"/>
..</cross-domain-policy>....


GET /v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hXXp://VVV.ivids.net/5.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Entertainment videos ivids.net&LR_FORMAT=application/x-shockwave-flash HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1900959323.1478557144; _gat=1

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:22:51 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Set-Cookie: PHPSESSID=n99dlc3ib64bmbi07m87ujk872; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: private

Pragma: no-cache

Content-Length: 654

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/xml
<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0"&g
t;..<Ad id="1"><Wrapper><AdSystem>1</AdSystem>
<VASTAdTagURI><![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/a
d/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPositi
on=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Enterta
inment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageU
rl=hXXp://VVV.ivids.net/5.html&contentLength=[CONTENT_LENGTH]]]>&lt
;/VASTAdTagURI><Impression><![CDATA[hXXp://z.frightenedomn
iscient.info/chki.php?ww=tremor&aa=hXXp://VVV.ivids.net/5.html&lrp=937
115&TIMESTAMP=2052523090]]></Impression><Creatives><
/Creatives></Wrapper></Ad>..</VAST>HTTP/1.1 200 O
K..Date: Mon, 07 Nov 2016 22:22:51 GMT..Server: Apache/2.2.15 (CentOS)
..X-Powered-By: PHP/5.3.3..Set-Cookie: PHPSESSID=n99dlc3ib64bmbi07m87u
jk872; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: 
private..Pragma: no-cache..Content-Length: 654..Keep-Alive: timeout=5.
.Connection: Keep-Alive..Content-Type: text/xml..<?xml version="1.0
" encoding="UTF-8"?>..<VAST version="2.0">..<Ad id="1">
<Wrapper><AdSystem>1</AdSystem><VASTAdTagURI>&
lt;![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fs
pan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Enter
tainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.n
et&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.ivi
>>

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1900959323.1478557144; _gat=1

HTTP/1.1 200 OK

Date: Tue, 08 Nov 2016 06:26:12 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Tue, 10 Oct 2017 06:26:12 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... 
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
>>

GET /page-5.html?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:18:55 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
f59.............\.O.J.....?........I <..Rz.....^...M..cplc...]..=g.
...&.....B<...3.......Z#.......{........" ...j.}..>Wdo...}.[."K.
..5.v[........^sWQ...6.J..[:.v..D..2....z...[.'<.XW.l...4.I.T.B4";.
r.=...W.....'...z....2M#]....f3<...F.....q.ur...cy*...........w%.q.
8t....n.L. ..xa.......2..$.Q;.......v....J... 5.z..j....K.f...&.AtW.G.
....8.m..........c205.v....C...f. .J.V"......j.1..........\..^....&..R
o...{T.aw....`*... ..,^ .......7`(....t.'......^s....0(.2..o.......hl.
$E`.F..:.}..6F^k...........%....M..UH..v..U........x!.c..GKu...3......
..Y.^(x.6B.t..$...]w"......jz..$....n...n..f..q!.2L.i.C.T...B...P.a.._
K4J....6.)^.6sL>.....0,.A.l.....KYd.d....@... {...6..ngO...pj9.....
.C....K".0Q.."%......t.........r@F!.<."....v..i..h...S.c".C..!=YL1.
....^..X..;.$....\...v..F........,....!.$...07&.d.z.TS.e.O ..l ...JH.&
lt;......R.w....,.../W..Fn.....u.<`.....cV.H7.e./,AP6_.f&lq.. ..u..
F%....w....M.{"yn`...I..r..$,.(O.....L......@G.Q....Z..4.ll"....E`n*..
AO.A....hC...H_.r......>x>..N..8/.........pc...{V.....o.........
...P...P..Z.'q./2.Ml..e...q..a..?....P...Yw..`.}c.,.u2.....N..>.H..
f..&\...U^.`..}...{.p.......|gn@.A"....~...r.S..&...E....i............
.>....l$s;.!.Z6...u.|.Ai...33..........L.....ZqP.....?..<7......
nF..U02.7./.....x........n..i.^C....'...`Esu;...c..........\.......Y?y
......./..W..J%..-."y.8.|.?=?.60.....vr.9..1....xr.4.kh....dQ.>..o3
.*e)<...m....T$.l...S....[...H2(.....gX..lz...m........ ...7./mT.._
w....-.67.5....3{n*.l...(L>........V#.4........T.[...<H;xG.#
>>

GET /page-5.htm?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.ivids.net/page-5.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:01 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
116b.............\.O.L.....?..O.$..'....P..w...T.V..B.=q..m.qBh...9.K.
...........r..3g.<s&/...... #!.^....j...Z.......^ 4.../......m.5_..
V[...K.6........;..(lj.b.W...q..!..........3..../E.L..q.. .lCu9rL}G..@
S.BTQ.s.u.M....7..W.sew9..5......L7....z...:.O..A.Q....g...........i..
...v.(...6M....?.Mt'B.D..(.....f..1{....U.3t...>..3.. .;3=#.sW.....
\z1...&.?.....ex.............}..*.-..........b..W..^gz...iX...\...y..@
.}...R.T....K...}@.5.i.ou......X..iO.@.x.} .....B.]...b.`0|/.I.=}.zN$.
.).W./w...'..^.N.1.{.6=.Z..T...)-M....:o..........f..S.F..UT.......1.^
.Wv."..q.R.A.......9..Y../U<..2idl;.tf........0.....?j.\..gg..PWw|.
.s'.k...a..\...0.Z. ..\..Yg.....yi7..\R....N......a...\.=..n..........
.R.C...r.Q.H.. ...U....U.%j..m..lj..h...M..jx..>0d..dO.S...R...\D~.
...L.bB.bc....s.$.s.t.T.=UH.d....1EB..v.u...=.@...J.A.. .c.Rb.....>
Q... D.dy......0..0r..........?.. .ZVG.)i)3.#..(,...(.p.P....-.....^..
...A..,...........O..j.3.cV.%k.MF...e3{@66.ZJ.t...F.1.Ke..c....7).)d#.
...A.I.g..@.....X.......`7S.....{...F..s]]..$..@.C..A..k....L.!..G...7
#...q......R...o.......A=<..2J.(......m1H.z.. P.....1.aH.Q..Z(K`],.
..^...t.m..C..a.FQ2...2.......S....s.e{....E.<.[...m..hv.I.Qb....1V
g...........Z'..;.B....b.8.....3...F\.36Nk.)wP.s......-.........5'."..
.v0;..1.....>.........nd..3.(.3.5..j3.....A].....4`...:.s....w.N.&g
t;.zwx.......~..i..#.......}..Eck...I...O>....7...^..pr..$~........
?...[..3.-."~8.x|xr..C.NiG..N>.|:N|.J:9<ywp.4.64...ol.....mI_.Yr
.Y.dYcXw.....".>...8X2..G.ZBw...oh[U,z.8....#x...>5t.y...F..
>>

GET /css1.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1478557144.E5493D25C24B4F4A54DA27D7611DD4BD.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1900959323.1478557144; _gat=1

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:02 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Mon, 10 Nov 2014 09:13:53 GMT

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
293.............U[O.0.~.R..G5.IM.B/.>.(..P..i......cG.{a...s..]7..0
..G....s..w<.........6 ...!..f.o3.||6...&...(...^{..F....t.>X.]L
of...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...M~...9..........#H...W.oi(y.
.....B;.@.....j.y.ke.9M.|.J..N...<8n.2...P.......>_.N...{U.....R
jb.<......oEF.I)..Bm.7...I..`.q28........Y......-P..y..V..rk.....$.
p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<.......Z.D.8 TY`..9P..H3m,..
...A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X#.B...F/...50.3j..da...H..2.
.....f..s\..q.....k.I..4.2..6..4....;(. .Rb(.........Z.,/..S....lur.*.
. ..B.....X....Jc3.P.x...I.$...)..`..F..iZ..E.pK...{F...&.....i..ja1&g
t;..s.&X..Q..~....v...*m...3.Dq".|oo%.MpTn..qU..~..-.q......0..HTTP/1.
1 200 OK..Date: Mon, 07 Nov 2016 22:19:02 GMT..Content-Type: text/css.
.Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Enco
ding..Last-Modified: Mon, 10 Nov 2014 09:13:53 GMT..Server: CDCE..X-IN
AP-Cache-Status: HIT..X-INAP-Server: cdce-ams002-001.ams002.internap.c
om..Content-Encoding: gzip..293.............U[O.0.~.R..G5.IM.B/.>.(
..P..i......cG.{a...s..]7..0..G....s..w<.........6 ...!..f.o3.||6..
.&...(...^{..F....t.>X.]Lof...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...
M~...9..........#H...W.oi(y......B;.@.....j.y.ke.9M.|.J..N...<8n.2.
..P.......>_.N...{U.....Rjb.<......oEF.I)..Bm.7...I..`.q28......
..Y......-P..y..V..rk.....$.p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<
.......Z.D.8 TY`..9P..H3m,.....A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X
#.B...F/...50.3j..da...H..2......f..s\..q.....k.I..4.2..6..4....;(
>>

GET /img/lbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-5.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1478557144.E5493D25C24B4F4A54DA27D7611DD4BD.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1900959323.1478557144; _gat=1

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:19:02 GMT

Content-Type: image/png

Content-Length: 200

Connection: keep-alive

Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT

ETag: "a1c85-c8-4ebb56fac1880"

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Mon, 07 Nov 2016 22:19:02 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21 
Nov 2013 20:06:42 GMT..ETag: "a1c85-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: HIT..X-INAP-Server: cdce-ams002-001.ams002.interna
p.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......gAMA
....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b .....t
V.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.![...
..O...........IEND.B`...

GET /5/10/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: l.longtailvideo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Mon, 07 Nov 2016 22:19:04 GMT

Etag: "3015243340"

Expires: Mon, 14 Nov 2016 22:19:04 GMT

Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT

Server: ECAcc (arn/46B0)

X-Cache: HIT

Content-Length: 1845
.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP...
.0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......c
v..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. 
...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !..
...Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{
.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9k
L....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j
.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.
]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...
........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0
.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...
S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j
.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O
.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{..
....>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'.
...x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`.
..8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..
t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.
q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'
.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......
j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.b
i..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
>>

GET /count.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=&rnd=1478557134000 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.chevallemma.pw/default1.php?id=14ASuOantM5EdWhenu8i&date=2016-10-28&p=none&t=

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ww.chevallemma.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Mon, 07 Nov 2016 22:18:55 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 47

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
......<meta http-equiv="refresh" content="300">HTTP/1.1 200 OK..
Date: Mon, 07 Nov 2016 22:18:55 GMT..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 47..Keep-Alive: tim
eout=5, max=100..Connection: Keep-Alive..Content-Type: text/html......
..<meta http-equiv="refresh" content="300">..

The Dropped connects to the servers at the folowing location(s):

Map

Strings from Dumps

natural.exe_260_rwx_00332000_00009000:

.hP9)h

.hP9)h

expensively.exe_3740:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

ers\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp\ExecCmd.dll

ers\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp\ExecCmd.dll

"%Program Files%\sluttish\natural.exe"

"%Program Files%\sluttish\natural.exe"

mp\ExecCmd.dll

mp\ExecCmd.dll

.reloc

.reloc

EnumWindows

EnumWindows

ExecCmd.dll

ExecCmd.dll

Kernel32.DLL

Kernel32.DLL

e%uy%u

e%uy%u

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp

nsy5A8F.tmp

nsy5A8F.tmp

rogram Files\sluttish\natural.exe"

rogram Files\sluttish\natural.exe"

ecCmd.dll

ecCmd.dll

ural.exe" | %SystemRoot%\System32\find /I "natural.exe"

ural.exe" | %SystemRoot%\System32\find /I "natural.exe"

\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp

\Users\"%CurrentUserName%"\AppData\Local\Temp\nsy5A8F.tmp

"%Program Files%\jesse\expensively.exe"

"%Program Files%\jesse\expensively.exe"

%Program Files%\jesse

%Program Files%\jesse

expensively.exe

expensively.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsn46CF.tmp

ers\"%CurrentUserName%"\AppData\Local\Temp\nsn46CF.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

%Program Files%\jesse\expensively.exe

%Program Files%\jesse\expensively.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows\

Windows\

Nullsoft Install System v2.46

Nullsoft Install System v2.46

se\expensively.exe"

se\expensively.exe"

ttish\natural.exe"

ttish\natural.exe"

taskeng.exe_644:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

USER32.dll

USER32.dll

msvcrt.dll

msvcrt.dll

ntdll.dll

ntdll.dll

API-MS-Win-Core-Debug-L1-1-0.dll

API-MS-Win-Core-Debug-L1-1-0.dll

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

API-MS-Win-Core-File-L1-1-0.dll

API-MS-Win-Core-File-L1-1-0.dll

API-MS-Win-Core-Handle-L1-1-0.dll

API-MS-Win-Core-Handle-L1-1-0.dll

API-MS-Win-Core-Heap-L1-1-0.dll

API-MS-Win-Core-Heap-L1-1-0.dll

API-MS-Win-Core-Interlocked-L1-1-0.dll

API-MS-Win-Core-Interlocked-L1-1-0.dll

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

API-MS-Win-Core-Misc-L1-1-0.dll

API-MS-Win-Core-Misc-L1-1-0.dll

API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll

API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-Profile-L1-1-0.dll

API-MS-Win-Core-Profile-L1-1-0.dll

API-MS-Win-Core-Synch-L1-1-0.dll

API-MS-Win-Core-Synch-L1-1-0.dll

API-MS-Win-Core-SysInfo-L1-1-0.dll

API-MS-Win-Core-SysInfo-L1-1-0.dll

API-MS-Win-Core-ThreadPool-L1-1-0.dll

API-MS-Win-Core-ThreadPool-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

RPCRT4.dll

RPCRT4.dll

KERNEL32.dll

KERNEL32.dll

d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp

Session::ChannelMsgReceived

Session::ChannelMsgReceived

d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp

StopJobMsg

StopJobMsg

StartJobMsg

StartJobMsg

ClientPipeName

ClientPipeName

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp

d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp

TaskScheduler.log

TaskScheduler.log

j%Xf;

j%Xf;

d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

SspiCli.dll

SspiCli.dll

XmlLite.dll

XmlLite.dll

MPR.dll

MPR.dll

RegOpenKeyTransactedW

RegOpenKeyTransactedW

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegCreateKeyExW

RegCreateKeyExW

FindExecutableW

FindExecutableW

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

EnumThreadWindows

EnumThreadWindows

EnumWindows

EnumWindows

GetProcessWindowStation

GetProcessWindowStation

_wcmdln

_wcmdln

_amsg_exit

_amsg_exit

GetProcessHeap

GetProcessHeap

SetProcessShutdownParameters

SetProcessShutdownParameters

TaskEng.pdb

TaskEng.pdb

version="5.1.0.0"

version="5.1.0.0"

name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"

name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"

8 8$8(878

8 8$8(878

3=4Z4w4

3=4Z4w4

=!=(=0=4=?=>>

=!=(=0=4=?=>>

5 5U5_5

5 5U5_5

5b6u6

5b6u6

-131J1X1o1}1

-131J1X1o1}1

=$=

=$=

Password

Password

hXXp://schemas.microsoft.com/windows/2004/02/mit/task

hXXp://schemas.microsoft.com/windows/2004/02/mit/task

ieframe.dll

ieframe.dll

%SystemRoot%\SYSTEM32\cmd.exe

%SystemRoot%\SYSTEM32\cmd.exe

%SystemRoot%\System32\Tasks

%SystemRoot%\System32\Tasks

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake

WindowSeconds

WindowSeconds

InitializeCmdlineProcessing()

InitializeCmdlineProcessing()

pCrimson provider registration failed for taskeng, hr=0x%x

pCrimson provider registration failed for taskeng, hr=0x%x

CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]

CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]

InteractiveTokenOrPassword

InteractiveTokenOrPassword

%d.%d

%d.%d

%s, (%d)

%s, (%d)

hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout

hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

201ef99a-7fa0-444c-9399-19ba84f12a1a

201ef99a-7fa0-444c-9399-19ba84f12a1a

C:\Windows\SYSTEM32\cmd.exe

C:\Windows\SYSTEM32\cmd.exe

6.1.7601.17514 (win7sp1_rtm.101119-1850)

6.1.7601.17514 (win7sp1_rtm.101119-1850)

taskeng.exe

taskeng.exe

Windows

Windows

Operating System

Operating System

6.1.7601.17514

6.1.7601.17514

natural.exe_3100_rwx_00402000_00009000:

.hP9)h

.hP9)h