Dropped:Trojan.Generic.17338822 (B) (Emsisoft), Dropped:Trojan.Generic.17338822 (AdAware), Trojan.NSIS.StartPage.FD (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 3bb658d8842811f2bb1727abfc9e8886
SHA1: 22902bb69eb6862f74eb6c7ebc5675651087baec
SHA256: 31fc55592b77e2dc9d2802a14fab06e3be818e0489d0458e6109352329dfca35
SSDeep: 24576:N1sVXU77dr367nlH7k 3m3rYlgdgWO6ACa4mCeB:zsVXGJr365bB3 HOWOCGZB
Size: 790490 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Dropped creates the following process(es):
taskkill.exe:1912
taskkill.exe:360
%original file name%.exe:1832
login.exe:236
tasklist.exe:216
tasklist.exe:800
tasklist.exe:224
tasklist.exe:1640
tasklist.exe:1204
tasklist.exe:1940
tasklist.exe:1668
tasklist.exe:1752
tasklist.exe:936
tasklist.exe:1492
tasklist.exe:828
tasklist.exe:1888
tasklist.exe:436
tasklist.exe:1756
tasklist.exe:188
tasklist.exe:1912
tasklist.exe:452
tasklist.exe:1368
tasklist.exe:1936
41612.exe:1364
11984526.exe:1752
find.exe:1144
find.exe:884
find.exe:552
find.exe:1372
find.exe:1928
find.exe:492
find.exe:468
find.exe:624
find.exe:1960
find.exe:1856
find.exe:320
find.exe:404
find.exe:476
find.exe:500
find.exe:1312
find.exe:564
find.exe:1796
find.exe:240
find.exe:1912
find.exe:1552
find.exe:1808
find.exe:1748
The Dropped injects its code into the following process(es):
abounds.exe:1884
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1832 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Program Files%\shrewdness\login.exe (1050 bytes)
%Program Files%\officials\settings.dll (10101 bytes)
%WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\11984526.exe (3071 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\41612.exe (1082 bytes)
%System%\drivers\etc\hosts (123 bytes)
%WinDir%\settings.dll (10101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\AccessControl.dll (13 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\carli.lnk (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\ShellLink.dll (4 bytes)
%Program Files%\officials\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Program Files%\officials\abounds.exe (4853 bytes)
%WinDir%\abounds.exe (4853 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\ShellLink.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp (0 bytes)
The process login.exe:236 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsp7.tmp\ExecCmd.dll (4 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsp7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh6.tmp (0 bytes)
The process 41612.exe:1364 makes changes in the file system.
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp (0 bytes)
The process 11984526.exe:1752 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\SimpleFC.dll (5289 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsr4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\SimpleFC.dll (0 bytes)
The process abounds.exe:1884 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\player1[1].swf (12969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[4].xml (679 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[2].xml (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\player1[2].swf (17293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[7].xml (640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CATGC715.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[6].xml (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\jwplayer1[1].js (77663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[3].xml (587 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CA49Y30D.xml (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\CACPKV0P.xml (803 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (611 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[2].txt (320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\counter[2].js (1353 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CAEBSPYJ.xml (705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[1].xml (757 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[6].xml (711 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\logo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CAXSMC0W.xml (863 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (183 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\CAGP0ZA5.xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CAFB10O8.xml (799 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (297 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\page-1[1].html (710 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[7].xml (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[1].xml (684 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CAXB7F94.xml (702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[4].xml (591 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\collect[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\crossdomain[1].xml (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[2].xml (625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CALVA7OH.xml (802 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[5].xml (683 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[3].xml (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[5].xml (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[5].xml (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\analytics[1].js (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\v[1].xml (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[2].xml (699 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CADRRFV2.xml (717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CAKA8220.xml (714 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CAIFQDWT.xml (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[1].xml (795 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\css1[1].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[1].xml (686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CAP5NCCB.xml (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CAOPGPQZ.xml (763 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\crossdomain[2].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\page-1[2].htm (174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CA89I7GL.xml (748 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\page-1[1].htm (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\lbg[1].png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CACP2NOX.xml (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[6].xml (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[5].xml (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\logo[1].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[3].xml (567 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[2].xml (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\ova-jw[1].swf (37825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[3].xml (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[4].xml (620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\CAE74LMB.xml (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\page-1[1].htm (833 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\crossdomain[1].xml (82 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\counter[1].js (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\player1[1].swf (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\page-1[1].html (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\css1[1].css (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\collect[1].gif (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sol (0 bytes)
Registry activity
The process taskkill.exe:1912 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 B9 2B EA 05 5F 2C 82 F8 62 DD C2 A6 23 47 3F"
The process taskkill.exe:360 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F1 7A 26 97 5E 31 AD F5 D5 4C B4 B5 F5 0B 4D 6C"
The process %original file name%.exe:1832 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "38 1A 34 16 7E 11 32 80 93 4C A2 67 F4 BA 81 F5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"atrial" = "%Program Files%\officials\abounds.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"suborbital" = "%Program Files%\officials\abounds.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"perrot" = "%Program Files%\officials\abounds.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"lynde" = "%Program Files%\officials\abounds.exe"
The process login.exe:236 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 FA A7 EE 1C 59 5A F2 B0 E8 1E 4F 21 6C 7E 9B"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Login" = "%Program Files%\shrewdness\login.exe"
"slimness" = "%Program Files%\officials\abounds.exe"
The process tasklist.exe:216 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 73 E4 C8 21 DC 4F 5E 25 82 48 92 26 BC 50 A9"
The process tasklist.exe:800 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E3 96 59 03 B6 EE 05 CA 65 0F 9F 31 3E B0 40 2F"
The process tasklist.exe:224 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E C5 52 8F DC 75 0D 45 E7 CA 8B E7 2F 18 D5 D1"
The process tasklist.exe:1640 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 CF 93 B3 80 10 D2 96 EA 71 46 51 30 F7 A9 8C"
The process tasklist.exe:1204 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "80 08 F9 BB CA 9F DF D5 5A 6B E9 81 72 71 DC CB"
The process tasklist.exe:1940 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 DA 8D E6 15 56 44 17 FF DD 60 8B BC E6 B8 80"
The process tasklist.exe:1668 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 E4 2D 02 8B 28 0B BB A4 54 E0 C7 2A 4A FF AD"
The process tasklist.exe:1752 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "B1 DE B5 6A 1A 68 E2 F6 AD BE 28 B4 24 04 74 E0"
The process tasklist.exe:936 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "ED 3C 49 FC C5 81 ED 1F F6 9A CD C4 C9 01 82 D0"
The process tasklist.exe:1492 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2A 0E 8B 26 41 C2 90 A1 FA B0 D4 C9 AD 96 ED D7"
The process tasklist.exe:828 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 00 78 66 E3 D7 23 96 6A CC C0 65 7B AA 0A 51"
The process tasklist.exe:1888 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AE 87 D6 E8 45 11 10 C6 D5 59 CE C6 DD A6 39 4F"
The process tasklist.exe:436 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 2F 8E 7E 0D FF 6E 96 FF 67 87 06 35 F0 E6 50"
The process tasklist.exe:1756 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9B BD F6 46 FA DC 30 62 AE 12 5A E5 55 33 37 79"
The process tasklist.exe:188 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "53 48 66 BF C8 56 6E 93 0D E0 3B 9C 75 14 D9 2D"
The process tasklist.exe:1912 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 93 94 FA 72 94 C0 88 3B A4 57 F2 E4 C8 6F B9"
The process tasklist.exe:452 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "07 FA 43 D7 1B B0 1A 86 E9 8C 66 20 84 E0 2E 88"
The process tasklist.exe:1368 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "66 91 37 A3 C3 28 1A 22 21 B5 DE 01 4D 67 91 6E"
The process tasklist.exe:1936 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "30 4B B8 25 1D 4B AE AC AD 6C 52 E9 63 6A 80 29"
The process 41612.exe:1364 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "2C FE 48 0B 31 28 68 56 B8 23 98 CA A9 88 52 9D"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process 11984526.exe:1752 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5E 52 A9 1E 98 8F DF D9 D3 25 0B D0 71 84 49 41"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process abounds.exe:1884 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090820160909]
"CachePrefix" = ":2016090820160909:"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090820160909]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016090820160909\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090820160909]
"CacheOptions" = "11"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090820160909]
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1B 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4D 10 C9 9A F3 32 C4 36 9A 56 DF 39 41 8C FF E9"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016090820160909]
"CacheRepair" = "0"
The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Dropped deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
The Dropped deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process find.exe:1144 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "55 72 47 71 E4 31 6A 82 BE 9B 69 BA EC A9 F2 96"
The process find.exe:884 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "99 F2 97 09 F0 E5 7D 18 46 49 78 4B 21 AC E0 D1"
The process find.exe:552 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DE F9 CC EA 15 C2 63 09 C7 B0 20 E2 BF D6 B7 54"
The process find.exe:1372 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "47 80 36 AD E2 65 36 39 08 0C B5 19 5A 6C 11 49"
The process find.exe:1928 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "AF A2 1B F4 C1 D1 5C 3F B0 D4 F7 16 A9 EE 8F E5"
The process find.exe:492 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "16 5E B4 D2 45 7E E7 2C 32 D8 79 A4 F4 06 AB 90"
The process find.exe:468 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DB 81 D5 33 E0 BD B9 74 A4 9F FF 97 AA 67 A4 45"
The process find.exe:624 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D5 F4 10 FD E8 4F 90 BA D7 AB 9E E1 4E 4B 2F A2"
The process find.exe:1960 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 AE EF 26 9A 5F E0 7B E8 92 F7 4A 3F 86 A6 1C"
The process find.exe:1856 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "63 67 2B 08 89 BB DD D8 17 C9 A1 B3 BB E1 37 4B"
The process find.exe:320 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 F9 56 2B 92 9B 35 13 BA 11 6B B3 AD A0 29 16"
The process find.exe:404 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7F 4A 6A 90 3F 23 57 9F AD 45 32 B6 D7 3E 29 20"
The process find.exe:476 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C FB 35 AE 98 89 E4 02 FC 51 CE 59 E9 69 5F FF"
The process find.exe:500 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 4C 03 68 CC 64 29 05 72 D6 B7 FD 00 2E B5 3E"
The process find.exe:1312 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 67 31 EA F6 94 A2 5E EE F7 FD AE BA AA 3E 16"
The process find.exe:564 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 51 94 5F F3 65 10 7B 1E AD E5 DB 1C 5D 35 83"
The process find.exe:1796 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1B 7B 4C F0 95 51 12 5C A5 CE AD DE 39 4D AE CB"
The process find.exe:240 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 6B 80 D1 23 7C F8 8F 55 30 91 89 87 2E 66 81"
The process find.exe:1912 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "25 6A B8 B9 5C 4F C6 55 C5 86 2E CB 0C B2 EC 2F"
The process find.exe:1552 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "06 61 3A 52 4D 2A 31 B9 68 3F 32 AB 6F CA B5 DD"
The process find.exe:1808 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "35 0D 38 4D 2C 8F E0 19 ED 2A 2D C8 00 11 B4 C8"
The process find.exe:1748 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 F8 64 55 28 B3 58 BE F4 99 33 BB E4 22 A5 BB"
Dropped PE files
MD5 | File path |
---|---|
c1fa44cb71aeba23165ecbe218a49f65 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\11984526.exe |
6351426f5922b23dd580621eee7b681c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\41612.exe |
b9380b0bea8854fd9f93cc1fda0dfeac | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsp7.tmp\ExecCmd.dll |
c8ff52bfddc6898c202c08c4a61a3d22 | c:\Program Files\officials\Microsoft.Win32.TaskScheduler.dll |
f8af57b674487c0a2c1aae91468b11bf | c:\Program Files\officials\abounds.exe |
c105af61f7c6249f5fc323045d1e6c34 | c:\Program Files\officials\settings.dll |
6af231fb806a738d7dca1467407c6420 | c:\Program Files\shrewdness\login.exe |
c8ff52bfddc6898c202c08c4a61a3d22 | c:\WINDOWS\Microsoft.Win32.TaskScheduler.dll |
c105af61f7c6249f5fc323045d1e6c34 | c:\WINDOWS\settings.dll |
f8af57b674487c0a2c1aae91468b11bf | c:\WINDOWS\terns.exe |
HOSTS file anomalies
The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 857 bytes in size. The following strings are added to the hosts file listed below:
162.222.194.13 | cocomo.tremorhub.com |
162.222.194.13 | www.virustotal.com |
162.222.194.13 | virustotal.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:1912
taskkill.exe:360
%original file name%.exe:1832
login.exe:236
tasklist.exe:216
tasklist.exe:800
tasklist.exe:224
tasklist.exe:1640
tasklist.exe:1204
tasklist.exe:1940
tasklist.exe:1668
tasklist.exe:1752
tasklist.exe:936
tasklist.exe:1492
tasklist.exe:828
tasklist.exe:1888
tasklist.exe:436
tasklist.exe:1756
tasklist.exe:188
tasklist.exe:1912
tasklist.exe:452
tasklist.exe:1368
tasklist.exe:1936
41612.exe:1364
11984526.exe:1752
find.exe:1144
find.exe:884
find.exe:552
find.exe:1372
find.exe:1928
find.exe:492
find.exe:468
find.exe:624
find.exe:1960
find.exe:1856
find.exe:320
find.exe:404
find.exe:476
find.exe:500
find.exe:1312
find.exe:564
find.exe:1796
find.exe:240
find.exe:1912
find.exe:1552
find.exe:1808
find.exe:1748 - Delete the original Dropped file.
- Delete or disinfect the following files created/modified by the Dropped:
%Program Files%\shrewdness\login.exe (1050 bytes)
%Program Files%\officials\settings.dll (10101 bytes)
%WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\11984526.exe (3071 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\41612.exe (1082 bytes)
%System%\drivers\etc\hosts (123 bytes)
%WinDir%\settings.dll (10101 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\AccessControl.dll (13 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\carli.lnk (485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi2.tmp\ShellLink.dll (4 bytes)
%Program Files%\officials\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Program Files%\officials\abounds.exe (4853 bytes)
%WinDir%\abounds.exe (4853 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp7.tmp\ExecCmd.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsh5.tmp\SimpleFC.dll (5289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\player1[1].swf (12969 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[4].xml (679 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[2].xml (696 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\player1[2].swf (17293 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[7].xml (640 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CATGC715.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[6].xml (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\jwplayer1[1].js (77663 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[3].xml (587 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CA49Y30D.xml (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\CACPKV0P.xml (803 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (611 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[2].txt (320 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\counter[2].js (1353 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CAEBSPYJ.xml (705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[1].xml (757 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[6].xml (711 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\logo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CAXSMC0W.xml (863 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (183 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\CAGP0ZA5.xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CAFB10O8.xml (799 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (297 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\page-1[1].html (710 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (173 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[7].xml (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[1].xml (684 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CAXB7F94.xml (702 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[4].xml (591 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (548 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\collect[1].gif (35 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\crossdomain[1].xml (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[2].xml (625 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\CALVA7OH.xml (802 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[5].xml (683 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[3].xml (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[5].xml (792 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[5].xml (754 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\analytics[1].js (227 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\v[1].xml (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[2].xml (699 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CADRRFV2.xml (717 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CAKA8220.xml (714 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CAIFQDWT.xml (748 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\syncnoad[1].xml (795 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\css1[1].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[1].xml (686 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CAP5NCCB.xml (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\CAOPGPQZ.xml (763 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\crossdomain[2].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\page-1[2].htm (174 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CA89I7GL.xml (748 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\page-1[1].htm (18 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\lbg[1].png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\CACP2NOX.xml (751 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[6].xml (637 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[5].xml (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\logo[1].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[3].xml (567 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\syncnoad[2].xml (608 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\ova-jw[1].swf (37825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\W1YHYF09\syncnoad[3].xml (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\AVSTIBOT\syncnoad[4].xml (620 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\MRYNK3CL\CAE74LMB.xml (817 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\O7QLUV4N\crossdomain[1].xml (82 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"atrial" = "%Program Files%\officials\abounds.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"suborbital" = "%Program Files%\officials\abounds.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"perrot" = "%Program Files%\officials\abounds.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"lynde" = "%Program Files%\officials\abounds.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Login" = "%Program Files%\shrewdness\login.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"slimness" = "%Program Files%\officials\abounds.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 86016 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 278528 | 2536 | 2560 | 3.13622 | b9f20defc9dd650d8dcc7fc5d4708ad4 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 87
7bcde813c50a0b0e20e5f9f233bc3040
b1a5b5b97ab40559c62f27923a7322c1
830674c88d54f6aa3c6f1bcf72147f75
fb9b2e8e0616dc9aecab4078c571a0f8
f3636d03e448990429c0cd25a2f93345
9ff200ddc12202840ae4f1479dc80093
9ee71cc1c041d515cf6606b5a62b0fb4
637bb93dc73a24cf09b23978655b53c2
461ec31a2d9f4cb4629e19d90afcd885
d39b2060fb5d686cd00740d95d66da28
8c5c729b23092d8327ee3d3e3c6f9555
d50e432a8fdaf70f58f6827e9e9a127a
39eda76caa561e614ad56c9fd3a56795
920b0a615f533fe5b5a303884784b337
687103e1b99753a9b29adb563dda87e2
a03424bc22092f0c5dd55690515bdaec
c4739131eb465158fc0fe9a507243ae5
a330a483c6310b89bfb063478eaebb6d
db5758991e0deed7870c5e00ac1784f9
6fbb8fb46337e3f62482246f42d9b043
54f561eda86f1e84fc86247e6f2c8430
49839380f2b5206da8310e3e7a06a5ae
b341a56684c065e107316fd0df7f6581
c09676623f77c5767f18b933aaba2b62
acaa641b943db17b0caaf35156d8830d
Network Activity
URLs
URL | IP |
---|---|
hxxp://d3cpqb3ouewn5u.cloudfront.net/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t= | |
hxxp://d3cpqb3ouewn5u.cloudfront.net/func.js?r=5 | |
hxxp://www-google-analytics.l.google.com/analytics.js | |
hxxp://www.clangburkitt.info/count.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=&rand= | 162.222.194.132 |
hxxp://cocomo.tremorhub.com/itd.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=&rand= | |
hxxp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png | 67.202.94.93 |
hxxp://c.statcounter.com/10114910/0/757d7213/1/ | 216.59.38.124 |
hxxp://widgets.amung.us/draw/?w=colored&n=1381&c=000000ffffff&p= | 50.23.131.235 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j46&a=1209679827&t=pageview&_s=1&dl=http://www.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=935957912&cid=868745746.1473282938&tid=UA-74694740-5&_r=1&z=21672047 | |
hxxp://8c715ae47b.site.internapcdn.net/page-1.html?lid=937115 | |
hxxp://109.201.148.40/report1.php?url=/govids/page-1.html?lid=937115 | |
hxxp://govids.net/jwplayer1.js | 162.222.194.11 |
hxxp://109.201.148.40/bck.php?1473282939000 | |
hxxp://govids.net/1.js | 162.222.194.11 |
hxxp://8c715ae47b.site.internapcdn.net/page-1.htm?lid=937115 | |
hxxp://109.201.148.40/report1.php?url=/govids/page-1.htm?lid=937115 | |
hxxp://109.201.148.40/bck.php?1473282940000 | |
hxxp://g1.panthercdn.com/counter/counter.js | |
hxxp://govids.net/player1.swf | 162.222.194.11 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j46&a=1189258277&t=pageview&_s=1&dl=http://www.govids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1722919336&cid=336549416.1473282941&tid=UA-74694740-2&_r=1&z=307528681 | |
hxxp://8c715ae47b.site.internapcdn.net/css1.css | |
hxxp://8c715ae47b.site.internapcdn.net/img/logo.png | |
hxxp://8c715ae47b.site.internapcdn.net/img/lbg.png | |
hxxp://c.statcounter.com/t.php?sc_project=10675947&java=1&security=299981d6&u1=19C6AC8E74C24FC4F8CBC53BEB7EB6BB&sc_random=0.6606831011682974&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://www.govids.net/page-1.html?lid=937115&u=http://www.govids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 | 216.59.38.124 |
hxxp://cs28.wpc.thetacdn.net/5/10/logo.png | |
hxxp://govids.net/ova-jw.swf | 162.222.194.11 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 1&mediaDesc=Home videos, Funny Videos - 1&mediaId=2&mediaUrl=hxxp://www.govids.net/1.html&srcPageUrl=hxxp://www.govids.net/1.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dataxu,thetradedesk,eyeview,_dmp_turbine,adapTV,centro,SundaySky,1,tremornet,dynadmic,ignitionone,videoamp,BidTheatre,appnexus,conversant,Bidswitch,Videology,audiencescience,google,beeswax,rocketfuel,TubeMogul-GP&uid=649ea7c690dc4437b3247d781b53384b&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | |
hxxp://dyhd7e8p4cqed.cloudfront.net/crossdomain.xml | |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://www.govids.net/page-1.htm?lid=937115 | 69.88.149.137 |
hxxp://www.google-analytics.com/analytics.js | 216.58.214.206 |
hxxp://www.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t= | 54.230.45.95 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/crossdomain.xml | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://cdn.tremorhub.com/crossdomain.xml | 52.85.173.85 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://www.govids.net/img/logo.png | 69.88.149.137 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dataxu,thetradedesk,eyeview,_dmp_turbine,adapTV,centro,SundaySky,1,tremornet,dynadmic,ignitionone,videoamp,BidTheatre,appnexus,conversant,Bidswitch,Videology,audiencescience,google,beeswax,rocketfuel,TubeMogul-GP&uid=649ea7c690dc4437b3247d781b53384b&init=true | 107.21.30.191 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j46&a=1189258277&t=pageview&_s=1&dl=http://www.govids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1722919336&cid=336549416.1473282941&tid=UA-74694740-2&_r=1&z=307528681 | 216.58.214.206 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://www.govids.net/page-1.html?lid=937115 | 69.88.149.137 |
hxxp://xlf5t.ads.tremorhub.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 1&mediaDesc=Home videos, Funny Videos - 1&mediaId=2&mediaUrl=hxxp://www.govids.net/1.html&srcPageUrl=hxxp://www.govids.net/1.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | 52.87.42.156 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j46&a=1209679827&t=pageview&_s=1&dl=http://www.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=935957912&cid=868745746.1473282938&tid=UA-74694740-5&_r=1&z=21672047 | 216.58.214.206 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://www.govids.net/img/lbg.png | 69.88.149.137 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://xlf5t.ads.tremorhub.com/crossdomain.xml | 52.87.42.156 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://www.bruindorsett.pw/func.js?r=5 | 54.230.45.95 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://www.statcounter.com/counter/counter.js | 151.249.89.202 |
hxxp://l.longtailvideo.com/5/10/logo.png | 93.184.221.48 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://www.govids.net/css1.css | 69.88.149.137 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b | 107.21.30.191 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Date: Wed, 07 Sep 2016 19:25:48 GMT
Expires: Wed, 07 Sep 2016 21:25:48 GMT
Last-Modified: Mon, 15 Aug 2016 04:25:11 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11590
Cache-Control: public, max-age=7200
Age: 6606
...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W].b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..~.............>..........GB..N....?...?.I2.....U...o<.....W.;...x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo.....]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]............*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z......Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...zZ...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
<<< skipped >>>
GET /r/collect?v=1&_v=j46&a=1209679827&t=pageview&_s=1&dl=http://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=935957912&cid=868745746.1473282938&tid=UA-74694740-5&_r=1&z=21672047 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 07 Sep 2016 21:15:54 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Wed, 07 Sep 2016 21:15:54 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;....
GET /r/collect?v=1&_v=j46&a=1189258277&t=pageview&_s=1&dl=http://VVV.govids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1722919336&cid=336549416.1473282941&tid=UA-74694740-2&_r=1&z=307528681 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 07 Sep 2016 21:15:57 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-Allow-Origin: *..Date: Wed, 07 Sep 2016 21:15:57 GMT..Pragma: no-cache..Expires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-store, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-Content-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2..Content-Length: 35..GIF89a.............,...........D..;..
GET /ova-jw.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.336549416.1473282941; _gat=1
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2016 05:21:35 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT
ETag: "4403b3-39741-4fbe0551c3280"
Accept-Ranges: bytes
Content-Length: 235329
Cache-Control: max-age=2592000, public
Expires: Thu, 10 Aug 2017 05:21:35 GMT
Connection: close
Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b...k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K......tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&........Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.HW....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E..............&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T..O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=..........).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
<<< skipped >>>
GET /img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1473282941.19C6AC8E74C24FC4F8CBC53BEB7EB6BB.1.1.1.1.1.1.1.1.1; _ga=GA1.2.336549416.1473282941; _gat=1
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:57 GMT
Content-Type: image/png
Content-Length: 3856
Connection: keep-alive
Last-Modified: Tue, 10 Jun 2014 14:29:28 GMT
ETag: "a1bf2-f10-4fb7c27bc2200"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Accept-Ranges: bytes
.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..].O....V^.....rI........c..F..M.y0..-H....P.KH\.-.%-....J.[...5..S.... R...c....K/O.w...........93svY..i..e..w...}..}gvy..E?.Q..%....J...(Q.V.DaZ....JN........(.fL...cM.....Z...'.....A.....k.x....8....E..O..;.W...f.q.X..l..=.....k................%...fd)........,..J..G...!...m.Q...J.../..................Y,0.......%...S6R..=..t.0..%...|(..?T.V.DaZ...i%.b>..6:.~.=..7.-*.g....y<.,4>....W..jv.(...}...8..YdF.l. .,,~5s..X<..h~.p...'......b...[6.0.D.Ci........ Bo.C]....g..........y.i.........]N....p$.-~}8..... .....n.z...$~.9.).........P.....g....!.':.J..O...X.U.?:..#.g.{ .^......L..0..I.."H<.5.u0...n^.3.ER.<......ZI......*f..... .fN.......q.n..................Z.0.A.m|@.v. .uI......u........Y...u.t..........db...L.......T.=21...8.(......i.$......y4...t:....(.`sG.H..Q...&...u.<..2L..Wl..5...9...<. I....d...P.._h..n....MA7Y.....'..FsZ?....kH.l.s.<.QD....$q>lK...`1....x.Ha ^....L..W.#.C....._1...."^..6..WRz...4..z`.Ch|R..H....:1..C..o. ........8..8.$...;..,..N.....S..O......W":.).}...IR!.F8`=..lc..9n...O~a.....k7^-~........r........YO.C..0@I.v....7Dt..................2..NmX...&.h.......f) ....;?...b8.~.>L..../.....C.l.Pfg..............0..4k>.f.k-....X.9!a>.0.i.b.....$h.;.b.....`.32.Tr...bx.".:5K00..9..h...a........l....U..M..Z3..v..:....<:E........ #./...4p.y.....b....u.f.#[*e%.%p....|RO.dP\b...~.f...C......@..s..........X.{.m0.k..T.O.?<&.M....C...6o.9..C..Pd.,.......O..`5.L.xP,.
<<< skipped >>>
GET /index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t= HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.bruindorsett.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 906
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Encoding: gzip
Date: Wed, 07 Sep 2016 21:15:53 GMT
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 d2fa707728d9947a31db9f8dc3e9e56c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 1xVu9YC2kTGFwI8a1xPDcAq8ea1o2bgFgH_K5Pank0HYdNVjwpB-Sg==
...........UMo.6../....!.ZY..$......l.........hi,1 .Zrd.H..KRq.oOE}...r8o......Y.k..b..rR.\.@F{\M>....5b7...X3........v....J.%...su... .j.Z`9]......S....(..I......<...t.k...i`.-....f...........d...^K.....]..7. .[ F...dN.t...h.....&..!W*-T/1...T.,.x._..g...}. ^.}.R.....g..$;.d.{..J...=.e.(.D.5.9%5..F.../..A..M.U..Y1*.......u..o..o.H../.u..Q..dL.5.b.P....U.V%..U...........-....$:..5..k(....Fg.....zY.P2...U\.:.q.=....RU.g.7.........;.g.V.1....r?z...5........(.zS..Gz..h...;...$a .,.0.qf.B..\4...*.]..:*.g.9..........n..n6.`.]..V.6...kU..%...a.4............R.>.8.........>.[.......' .D3WbB*..c.AL......... ..:..Q...I..t..W..0<....T=SFp...NN.=_..J.v*\Y..5oBB.C.F4&...D.-!.;..*..LDk.4......%...w....` .Z.........U.e"...j.u.S.f......i@~..:.....'..@m..F.....k).....H....h.nNjQ. m .."....>I.;<.k.N...Q............)..<?8..4K...r...H..Zm.qB..W.n...//.>_...0".......{/2$n....,x.4...~`:....P.p........v......!..:...HTTP/1.1 200 OK..Content-Type: text/html..Content-Length: 906..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Encoding: gzip..Date: Wed, 07 Sep 2016 21:15:53 GMT..Vary: Accept-Encoding..X-Cache: Miss from cloudfront..Via: 1.1 d2fa707728d9947a31db9f8dc3e9e56c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 1xVu9YC2kTGFwI8a1xPDcAq8ea1o2bgFgH_K5Pank0HYdNVjwpB-Sg==.............UMo.6../....!.ZY..$......l.........hi,1 .Zrd.H..KRq.oOE}...r8o......Y.k..b..rR.\.@F{\M>....5b7...X3........v....J.%...su... .j.Z`9]......S....(..I......<...t.k...i`.-....f...
<<< skipped >>>
GET /func.js?r=5 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.bruindorsett.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 597
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT
ETag: "90000001e1520-f7a-537ea953f7333"
Accept-Ranges: bytes
Content-Encoding: gzip
Date: Fri, 19 Aug 2016 01:35:05 GMT
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 d2fa707728d9947a31db9f8dc3e9e56c.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 2VmMbbqmWtZ79Tb7G3-gwP4Frpab9l6HFzEK8ejM5Q4jSXKdzueBpg==
............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L.. *.V2..p...rv.....F..x?W..*............3_.q.q....S.~....7_e.G..P..7w..h..R ..$.w....H.41.W.n...D....wZ..x.ZG....6..:a.5!....t:O..:.5MvM...(...f.@..S.\.......SuY....:.........>...P..{|:.<.<...I...=........}..=...|.8.......{1z...HTTP/1.1 200 OK..Content-Type: application/javascript..Content-Length: 597..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT..ETag: "90000001e1520-f7a-537ea953f7333"..Accept-Ranges: bytes..Content-Encoding: gzip..Date: Fri, 19 Aug 2016 01:35:05 GMT..Vary: Accept-Encoding..X-Cache: RefreshHit from cloudfront..Via: 1.1 d2fa707728d9947a31db9f8dc3e9e56c.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 2VmMbbqmWtZ79Tb7G3-gwP4Frpab9l6HFzEK8ejM5Q4jSXKdzueBpg==..............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L.. *.V
<<< skipped >>>
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.336549416.1473282941; _gat=1
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2016 05:21:33 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Thu, 10 Aug 2017 05:21:33 GMT
Connection: close
Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
<<< skipped >>>
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 130
Connection: keep-alive
Date: Sun, 24 Jul 2016 04:41:02 GMT
Last-Modified: Thu, 04 Dec 2014 23:41:04 GMT
ETag: "2cf4c5e3d4c1206209355ac1065b0efc"
Accept-Ranges: bytes
Server: AmazonS3
Age: 8739
X-Cache: Hit from cloudfront
Via: 1.1 c3e32c3c6fc2de06cadacd3ef5ca2730.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xPG5FtHshCC5a8reRxfPyO09-mVykmAtJDFQHyK96r9gWKqvDvp01g==
<?xml version="1.0" ?>.<cross-domain-policy>. <!-- Very Liberal -->. <allow-access-from domain="*" />.</cross-domain-policy>..
GET /report1.php?url=/govids/page-1.html?lid=937115 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:19:25 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Wed, 07 Sep 2016 21:19:25 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8......
GET /bck.php?1473282939000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:19:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Wed, 07 Sep 2016 21:19:26 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8......
GET /report1.php?url=/govids/page-1.htm?lid=937115 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:19:26 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
....
GET /bck.php?1473282940000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:19:27 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Wed, 07 Sep 2016 21:19:27 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8..
GET /10114910/0/757d7213/1/ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:54 GMT
Server: Apache/2.2.3 (CentOS)
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1473282954.0; expires=Mon, 06-Sep-2021 21:15:54 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1473282954122714614; expires=Fri, 07-Sep-2018 21:15:54 GMT; path=/; domain=.statcounter.com
Content-Length: 49
Connection: close
Content-Type: image/gif
GIF89a...................!.......,...........T..;..
GET /draw/?w=colored&n=1381&c=000000ffffff&p= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uid=CgH9IFfQg4pxhRQQObx0Ag==
Connection: Keep-Alive
Host: widgets.amung.us
HTTP/1.1 200 OK
Server: nginx/1.9.6
Date: Wed, 07 Sep 2016 21:15:54 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Content-Disposition: filename=wau-widget.png
Expires: Fri, 07 Oct 2016 21:15:54 GMT
Cache-Control: max-age=2592000
606...PNG........IHDR...Q...........p.....PLTE...EEE...???AAA......"""...............;<=CCC...***.........abdWXZ..................GGG...'((.....................uvyEFG...,,,......kln...NNN>>>.........~~.vwx...hhi.........OPQ...............VVV......uvv...opp......UVV...RRR..................bcc...ijj}~~......dee..................QQQ...]^^PPP.........TTTaaa...............___......HHHrss.........kllJJJDDD|||......YYY........................LLLNOO.........@@@tttkkkvvv:::qqq....................................FFF.........?@@888666ppprrrSSS............BBB.........uuu......111............000...lll......XYZ(((&&&hhhfff cdeZ[\788...dddccc.........nnn.........ZZZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjjy.......tRNS.@..f...,IDATH....W.A........)../$..K;.....K.6S.2..R(...H..& .....*MJm *c6...ifYMX.......ww...fvy.R.E....hw..g./.M....g.p.=.....'V..m...^.7.........>...Z[..[Z?....>P6[..&Lc.;....^..-G....Z..._.^....Vk'....[....c..G8Z..>......(w.=......ms...V.=T.....;..&..:...]5V....x...9..E.a...9......O...%e...'.,..`1...8.....k....=B8...=..#........}j_..^<.Q.\k..i.1.f.....E..iz...;hB.v..o.}(.[...]...-.=T.Q..y........Z......df .r.....t0..V..{.\..G.!.rE*fy.2v.Rv...).@f-..b]r............v.Q4...)....]Z.....Y.@9S .......i..3..'.....;..i.. .....rr0..d..1.h..q....'.x.....h....2.TO..qJa$.<.$.L..5..:...e.......f..P>...X)2N@.H..B...............w..4v.....q"c%..............C.l.G.F.#i.J5iD.d..8....WY...."%...0'?.-...m...g........j..1.'F.~...Fd.S..E..... >..l.G.@&QH.=.......HH.....a..F.*.S,...C#..GB...FE.G..-.E.LH..e
<<< skipped >>>
GET /count.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=&rand= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.clangburkitt.info
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:55 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 47
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
......<meta http-equiv="refresh" content="300">HTTP/1.1 200 OK..Date: Wed, 07 Sep 2016 21:15:55 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 47..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html........<meta http-equiv="refresh" content="300">..
GET /jwplayer1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2016 05:21:31 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT
ETag: "4403af-25d37-53444eccf91c0"
Accept-Ranges: bytes
Content-Length: 154935
Cache-Control: max-age=2592000, public
Expires: Thu, 10 Aug 2017 05:21:31 GMT
Connection: close
Content-Type: text/javascriptvar dtn = Date.parse(new Date().toString());..document.write(unescape(>>
'
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 07 Sep 2016 21:16:00 GMT
ETag: W/"144-1446501138000"
Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 1&mediaDesc=Home videos, Funny Videos - 1&mediaId=2&mediaUrl=hXXp://VVV.govids.net/1.html&srcPageUrl=hXXp://VVV.govids.net/1.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Wed, 07 Sep 2016 21:16:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=649ea7c690dc4437b3247d781b53384b; Domain=.tremorhub.com; Expires=Fri, 08-Sep-2017 03:04:21 GMT; Path=/
Set-Cookie: tvrg_60409="1,1473282961"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 07-Sep-2016 21:17:01 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
transfer-encoding: chunked
Connection: keep-alive214.............S...0.}.....m..,7%A,,.RiWM......C. vd;\..cJ....S..g...>>
q.......4."t...SC.I.E.:.d..wF.C.......4j.zhBgkL9t]...j[..L....S3Cm.T:t
>.Y..N..Y-..)(KT....`.%..Z......":f.....(..6.....U..e.-..C.,2!...ga
...ha/.n6~.3......&.{....e.....w&f.F.C.zG%....Hh..rm*.r.T..2Y..P.%...`
p.wg.m;...@C.....g.y..!..e..3.P...9K...f....S.....q...I.....W.w/s ....
......\.|oA...p".d.C..pOER...y.......K....u.-....K.......'...i....Q...
G..{*/JI.W86.f.fk ...."..f.'.}.4.2....Y..lg..-..E........r9'4m.O....[.
.R..o....".....F.'....(.v....(eMl...{'...po.........f...{.....rL<._
.....0..HTTP/1.1 200 OK..Cache-Control: no-cache, no-store, must-reval
idate..Content-Encoding: gzip..Content-Type: text/xml;charset=ISO-8859
-1..Date: Wed, 07 Sep 2016 21:16:00 GMT..P3P: CP='This is not a P3P po
licy. See hXXp://tremorvideo.com/en/privacy-policy'..Pragma: no-cache.
.Server: Apache-Coyote/1.1..Set-Cookie: tvid=649ea7c690dc4437b3247d781
b53384b; Domain=.tremorhub.com; Expires=Fri, 08-Sep-2017 03:04:21 GMT;
Path=/..Set-Cookie: tvrg_60409="1,1473282961"; Version=1; Domain=.tre
morhub.com; Max-Age=60; Expires=Wed, 07-Sep-2016 21:17:01 GMT; Path=/.
.Vary: Accept-Encoding..x-tremorvideo-status: NO_AD..transfer-encoding
: chunked..Connection: keep-alive..214.............S...0.}.....m..,7%A
,,.RiWM......C. vd;\..cJ....S..g...q.......4."t...SC.I.E.:.d..wF.C....
...4j.zhBgkL9t]...j[..L....S3Cm.T:t>.Y..N..Y-..)(KT....`.%..Z......
":f.....(..6.....U..e.-..C.,2!...ga...ha/.n6~.3......&.{....e.....w&f.
F.C.zG%....Hh..rm*.r.T..2Y..P.%...`p.wg.m;...@C.....g.y..!..e..3.P
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 07 Sep 2016 21:16:01 GMT
ETag: W/"144-1446501138000"
Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dataxu,thetradedesk,eyeview,_dmp_turbine,adapTV,centro,SundaySky,1,tremornet,dynadmic,ignitionone,videoamp,BidTheatre,appnexus,conversant,Bidswitch,Videology,audiencescience,google,beeswax,rocketfuel,TubeMogul-GP&uid=649ea7c690dc4437b3247d781b53384b&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 497
Connection: keep-alive...........R[o.0.}..`..[....J.2.M.v...=T.r..`Al..J..>SZvy.C.s.....t
ql...h....h0.z .d\4Y.P}.....].*..".y...3.Y..V...jh...z@e.......K.3Y...
.....`.<...R.= ;c...Sl.,.....T.`.i.~......MQ...r.h ..._u;A.$l.9.&S.
.!$.d..i....G#6..q......F.f..FK*......r5|..._}.G...-N..WF..FT.B..%G...
..>|....l:.......f..:8px.)..pt.C.8.........%....gn..q..#]..iY'.k9}.
T[ .....<.#..o......jm........3 .......8..#t$.F..x<....<....V
k..}....W.i.."....Y.E...y.S.s..Vi0~..<]j....\`.~...* M..w...F.T....
.8.-E..t.`..._......J...........
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 516
Connection: keep-alive...........R...0.}.W.H..B.47...n..zY.6}X...'....m....'i..K........&Z..>>
...m...7..^.....*....w3o....i..h#G.Ba.6....E.X.......l.c....c.mM.}.V..
^....D?4Q.....Xh..T....(.&OCS.....c..}Y..y.r................,..`N.0-'.
MHCF.d0......l...*.R.g.a..Vy[..Y....'.y%...K....#..|...K.-..t..|...ZV.
.o.j....a...9.\....[.`.8......P.VK..83.n..q..F.l...N..pz..[ (.........
. .BX.F...%..o......N..F.p<-.#4b:.....YX..&Q....ZK..... ........|4
P.........8..MqRT..._........t.uQ..(...a.D ...=..L...\..\...=~........
.F.~k.\.....D.S......e.M%"...HTTP/1.1 200 OK..Content-Encoding: gzip..
Content-Type: text/xml..Date: Wed, 07 Sep 2016 21:16:01 GMT..P3P: CP='
This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy
'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 5
16..Connection: keep-alive.............R...0.}.W.H..B.47...n..zY.6}X..
.'....m....'i..K........&Z.....m...7..^.....*....w3o....i..h#G.Ba.6...
.E.X.......l.c....c.mM.}.V..^....D?4Q.....Xh..T....(.&OCS.....c..}Y..y
.r................,..`N.0-'.MHCF.d0......l...*.R.g.a..Vy[..Y....'.y%..
.K....#..|...K.-..t..|...ZV..o.j....a...9.\....[.`.8......P.VK..83.n..
q..F.l...N..pz..[ (.......... .BX.F...%..o......N..F.p<-.#4b:.....Y
X..&Q....ZK..... ........|4 P.........8..MqRT..._........t.uQ..(...a.D
...=..L...\..\...=~.........F.~k.\.....D.S......e.M%".......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 484
Connection: keep-alive...........R.n.0... \..-..._.d.NZ..#.......\..-. )....d7.........3.h~*>>
...Z'...~..tPq-....S..v...7.2.. m....r3..[...1o..v[.].K...:~.<.....
o...H.Tt....c.6UV;.e..w;Y....f ...6O...................K.V\i.s E<..
.z8.F.u.C.C...b..........U._....~z|7X....<j.T....&_....T.8.*...R...
M....-...vTb......c..*..JH...o..pT.j...pG...pV).u.k....QJ~..[........D
.....!...Y...R.M.D.N..|4.....q1....._...'a...D...........oK...B{].6.s.
.....U.h<...k..%...5y@w.I....1s.|GKy.......?.Jf.=.^..6..1.)@.....z.
.X....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml.
.Date: Wed, 07 Sep 2016 21:16:01 GMT..P3P: CP='This is not a P3P polic
y. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyot
e/1.1..Vary: Accept-Encoding..Content-Length: 484..Connection: keep-al
ive.............R.n.0... \..-..._.d.NZ..#.......\..-. )....d7.........
3.h~*...Z'...~..tPq-....S..v...7.2.. m....r3..[...1o..v[.].K...:~.<
.....o...H.Tt....c.6UV;.e..w;Y....f ...6O...................K.V\i.s E&
lt;...z8.F.u.C.C...b..........U._....~z|7X....<j.T....&_....T.8.*..
.R...M....-...vTb......c..*..JH...o..pT.j...pG...pV).u.k....QJ~..[....
....D.....!...Y...R.M.D.N..|4.....q1....._...'a...D...........oK...B{]
.6.s......U.h<...k..%...5y@w.I....1s.|GKy.......?.Jf.=.^..6..1.)@..
...z..X........
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:02 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 515
Connection: keep-alive...........R...0.}.W.H....,.(.......j...j..x....l...w........3.....pv.>>
..#(.k.Y.....(j..6.V........u.f7......S.Y;c..........E]....3Sm.itd}..I
.V.&.......Tg..6P...o/M.B...$MXF...e.~|./.,y...T........B....g.8......
.. <F]:t.6)s.gA..e....l..`;.........5.. x. . ^s........FQ....Mh....
..R....l.GAA...=...j.....7..q..F.t..e......%............."h%.nX%7.Q9..
o....P..O...<..]....Q~.......!.]...j......irl}....6....yrDp...L..*.
.@l..Fb...e..v......*}x.,........E_.\VR......\.:......3jA..)Z.q...(.F6
..Bnd.K......W..........k..#...HTTP/1.1 200 OK..Content-Encoding: gzip
..Content-Type: text/xml..Date: Wed, 07 Sep 2016 21:16:02 GMT..P3P: CP
='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-poli
cy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length:
515..Connection: keep-alive.............R...0.}.W.H....,.(.......j...
j..x....l...w........3.....pv...#(.k.Y.....(j..6.V........u.f7......S.
Y;c..........E]....3Sm.itd}..I.V.&.......Tg..6P...o/M.B...$MXF...e.~|.
/.,y...T........B....g.8........ <F]:t.6)s.gA..e....l..`;.........5
.. x. . ^s........FQ....Mh......R....l.GAA...=...j.....7..q..F.t..e...
...%............."h%.nX%7.Q9..o....P..O...<..]....Q~.......!.]...j.
.....irl}....6....yrDp...L..*..@l..Fb...e..v......*}x.,........E_.\VR.
.....\.:......3jA..)Z.q...(.F6..Bnd.K......W..........k..#.....
..
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:03 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1c3.............RMo.@...WPK.-,../.F.I.HQ[..=D......].v...}.@B?.=.....y>>
O...j...u..I.....j^...I.\|.....C....J.[.=.n..`...2.-..n... ..3A.O.._.$
..}...i..N...`......Q...m'.....y......O.i..e~....e...5-..kn...@....p..
.....V.......b.*........?.s.`......5...FOx!.V.j....z....-...^...0F..v-
........:...../R...|C8...&..... ..gJ.A...(............Pf.k[J.7u.2. ..p
..<...r....._~...Q......,....?..]..h.....R.J.O.r.. ......2.]{2,...\
.=. L.G...,,.-.....r.fo....~.`.7D.r......d.. ..............0..HTTP/1.1
200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 07
Sep 2016 21:16:03 GMT..P3P: CP='This is not a P3P policy. See hXXp://
tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: A
ccept-Encoding..transfer-encoding: chunked..Connection: keep-alive..1c
3.............RMo.@...WPK.-,../.F.I.HQ[..=D......].v...}.@B?.=.....yO.
..j...u..I.....j^...I.\|.....C....J.[.=.n..`...2.-..n... ..3A.O.._.$..
}...i..N...`......Q...m'.....y......O.i..e~....e...5-..kn...@....p....
...V.......b.*........?.s.`......5...FOx!.V.j....z....-...^...0F..v-..
......:...../R...|C8...&..... ..gJ.A...(............Pf.k[J.7u.2. ..p..
<...r....._~...Q......,....?..]..h.....R.J.O.r.. ......2.]{2,...\.=
. L.G...,,.-.....r.fo....~.`.7D.r......d.. ..............0.....
.
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:03 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1bd.............R]o.@.|.....[9...d..$."UmU;.!...v....tw....&4...O.]...>>
.6^......S.N...0...5*.M.....i.H...,/..QG....}...7s!.................o\
.|...n.4....?,.C....y........b..<........4~.......2.......5..R....0
.Li.C...f...a....g.2.p...&..S......N...=M..J!......;......Kj......h:5.
..*...<..#I{[3......;.y...|..b.. %_(......$rG81:tK@e...2k..Ri.7..pF
...l.2..Q9...hzS~...a...........?q..XW.3.B..a.p.....C.......3.i...F..]
a..........3.;pD.....q%..$.....\l.?...d.................0..HTTP/1.1 20
0 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 07 Se
p 2016 21:16:03 GMT..P3P: CP='This is not a P3P policy. See hXXp://tre
morvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Acce
pt-Encoding..transfer-encoding: chunked..Connection: keep-alive..1bd..
...........R]o.@.|.....[9...d..$."UmU;.!...v....tw....&4...O.]....6^..
....S.N...0...5*.M.....i.H...,/..QG....}...7s!.................o\.|...
n.4....?,.C....y........b..<........4~.......2.......5..R....0.Li.C
...f...a....g.2.p...&..S......N...=M..J!......;......Kj......h:5...*..
.<..#I{[3......;.y...|..b.. %_(......$rG81:tK@e...2k..Ri.7..pF...l.
2..Q9...hzS~...a...........?q..XW.3.B..a.p.....C.......3.i...F..]a....
......3.;pD.....q%..$.....\l.?...d.................0......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:04 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 477
Connection: keep-alive...........R]o.@.|.....[1.]..6r HHU..&}."..[..>[wg..}...~HU.nvovwv.>>
..\.{.*-J.Yw...C.J..............$.n4..Q..S.Y{c.....E..u>`e.h]Y=3..L
.#...M...0..8....PuQ.j.E.]j{i..:.....g.[?.....|.d..u\..H.4.cn .,.....h
...b...[...<....ls?....."........H4.....X....G..#G}..[l.........`..
...]..0.F.....'a..pZK.mz...V./.{.d{..@A..Op&.t"...nxQmL.r!._w......&C.
|..r.....]....~.......=(U..\.....j`.K0Sku......;..-..$......(;X.......
.UQ)..Q9q8Wd.hP.`.~......v..|h.YMl...s#;..p......F.C........<.....H
TTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date:
Wed, 07 Sep 2016 21:16:04 GMT..P3P: CP='This is not a P3P policy. See
hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..
Vary: Accept-Encoding..Content-Length: 477..Connection: keep-alive....
.........R]o.@.|.....[1.]..6r HHU..&}."..[..>[wg..}...~HU.nvovwv...
\.{.*-J.Yw...C.J..............$.n4..Q..S.Y{c.....E..u>`e.h]Y=3..L.#
...M...0..8....PuQ.j.E.]j{i..:.....g.[?.....|.d..u\..H.4.cn .,.....h..
.b...[...<....ls?....."........H4.....X....G..#G}..[l.........`....
.]..0.F.....'a..pZK.mz...V./.{.d{..@A..Op&.t"...nxQmL.r!._w......&C.|.
.r.....]....~.......=(U..\.....j`.K0Sku......;..-..$......(;X........U
Q)..Q9q8Wd.hP.`.~......v..|h.YMl...s#;..p......F.C........<.........
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:05 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 482
Connection: keep-alive...........R...0.}.W.H.[q.....&.......VZ.....J0.6!.}.lv..C..|.>3s.0>>
^x....(-J.[w....d%.r.[..........(Nn4..a..s.[{c.9!FAQ.}...,....3sm...o}
.O...x....wE..T...6P..%.....y..4.xBw..:..?-.Q.=].UT....?......P....0..
.d.<w............i.. .%[...,....X.Z.f.FQ....Ch.$.A..%.k....4.4..x.@
.U".$.n.a{.q-9m.CW....B..J....0..tC..N..ZT.S^T..U&$..n.w.t....g.;.dC..
.L...p8u....#...R.T..'.f4b6.M*..iAQ...y...lV_.7}U...o...z..O.\...X....
/R...E.@w.E.o.....o0...........W'4Z#.......R................1.......HT
TP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: W
ed, 07 Sep 2016 21:16:05 GMT..P3P: CP='This is not a P3P policy. See h
ttp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..V
ary: Accept-Encoding..Content-Length: 482..Connection: keep-alive.....
........R...0.}.W.H.[q.....&.......VZ.....J0.6!.}.lv..C..|.>3s.0^x.
...(-J.[w....d%.r.[..........(Nn4..a..s.[{c.9!FAQ.}...,....3sm...o}.O.
..x....wE..T...6P..%.....y..4.xBw..:..?-.Q.=].UT....?......P....0...d.
<w............i.. .%[...,....X.Z.f.FQ....Ch.$.A..%.k....4.4..x.@.U"
.$.n.a{.q-9m.CW....B..J....0..tC..N..ZT.S^T..U&$..n.w.t....g.;.dC...L.
..p8u....#...R.T..'.f4b6.M*..iAQ...y...lV_.7}U...o...z..O.\...X..../R.
..E.@w.E.o.....o0...........W'4Z#.......R................1.......
t>....
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:05 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 492
Connection: keep-alive...........R...0.}.W.H.V.&YnJ..\$...H.>.V...bA..v...N(]z..>..}&l>>
t;g....Kq....P2t......)..!t......E...8I.4...Gi.6trk.)!VC.t^e}..bL.t..X
j .:.>.....1.D.WM..t.%..PD..o'I.....*......u..../.4~...T[.....m$...
..<..aB.0.....|N=:p]>.g....~.....uR....m.VS....Ch..pF..J.T....h.
.v=....Z!x....e9....6..M..Iy!.wJ....1....^..m..(..xQ.l.3!.W.=...#6..8.
}o.y..?.?d..7....( .:..Z.?.....i..5.h.i.g...)u...u.....:..S.W.S..Yt.U;
...j.v.E..i.,7.5.E...tm....(5.v.I..5.(j0w....3..TSv..^.8..l.........m#
q.nvF........0.t....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-T
ype: text/xml..Date: Wed, 07 Sep 2016 21:16:05 GMT..P3P: CP='This is n
ot a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server
: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 492..Conne
ction: keep-alive.............R...0.}.W.H.V.&YnJ..\$...H.>.V...bA..
v...N(]z..>..}<g....Kq....P2t......)..!t......E...8I.4...Gi.6trk
.)!VC.t^e}..bL.t..Xj .:.>.....1.D.WM..t.%..PD..o'I.....*......u....
/.4~...T[.....m$.....<..aB.0.....|N=:p]>.g....~.....uR....m.VS..
..Ch..pF..J.T....h..v=....Z!x....e9....6..M..Iy!.wJ....1....^..m..(..x
Q.l.3!.W.=...#6..8.}o.y..?.?d..7....( .:..Z.?.....i..5.h.i.g...)u...u.
....:..S.W.S..Yt.U;...j.v.E..i.,7.5.E...tm....(5.v.I..5.(j0w....3..TSv
..^.8..l.........m#q.nvF........0.t........
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:05 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 451
Connection: keep-alive...........R]..0.|...H.[.........:.j.B...)2...r..6$...4....O..g=..M6..
..A....../\.$k..O.. ....M.*.......4l.fmS..V.....V.]5gmC.Q.c..R.....y..
.Y.s'K.k....*.c.....)./.y..Ds^.....,y.......".........$.-..-x.. ......
...S..<...*.yt.f*.5XM9p0.7........E.......C....o.H.[...7'aY...$.Cq.
..AR....R.@.&...9.3.^phi...y......0.F.A.4d.x.Y..a.{h8.n...GA...%..t..n
.?!.i......S<..3.lg@...5.y..j.....2../j...`.. Y..8...\a.|..(2KM..w.
........r%... /K..q.6.!@.....v.......HTTP/1.1 200 OK..Content-Encoding
: gzip..Content-Type: text/xml..Date: Wed, 07 Sep 2016 21:16:05 GMT..P
3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privac
y-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-L
ength: 451..Connection: keep-alive.............R]..0.|...H.[.........:
.j.B...)2...r..6$...4....O..g=..M6....A....../\.$k..O.. ....M.*.......
4l.fmS..V.....V.]5gmC.Q.c..R.....y...Y.s'K.k....*.c.....)./.y..Ds^....
.,y.......".........$.-..-x.. .........S..<...*.yt.f*.5XM9p0.7.....
...E.......C....o.H.[...7'aY...$.Cq...AR....R.@.&...9.3.^phi...y......
0.F.A.4d.x.Y..a.{h8.n...GA...%..t..n.?!.i......S<..3.lg@...5.y..j..
...2../j...`.. Y..8...\a.|..(2KM..w.........r%... /K..q.6.!@.....v....
.......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:06 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 449
Connection: keep-alive...........RM..0...WP..V...$."..J UmU...ZE.~$.........l....'....y..mN.
.7...S.......u\.}........x.} ..J.'.^Tv.r...^.......&`.$.j.sk...m.... o
." .Wd.....TU.u ..|.../.y.<.......wE..a{S...ENS........S...#x.LaE..
4...Y.iD.a.Wm.'<m...a.A..M.EO.N..`........a.........c..U.8....1...R
.gJ}....h.......CG.F..R.\o..`.OF....-Ws..8J.(D.I.h.EQ.7..EF..........h
-.........P.D.l..0..6...F...fS......I.l."}'..;M.)..........#.G.YO&p.n.
.."..:!W2....2"8............%......HTTP/1.1 200 OK..Content-Encoding:
gzip..Content-Type: text/xml..Date: Wed, 07 Sep 2016 21:16:06 GMT..P3P
: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-
policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Len
gth: 449..Connection: keep-alive.............RM..0...WP..V...$."..J Um
U...ZE.~$.........l....'....y..mN..7...S.......u\.}........x.} ..J.'.^
Tv.r...^.......&`.$.j.sk...m.... o." .Wd.....TU.u ..|.../.y.<......
.wE..a{S...ENS........S...#x.LaE..4...Y.iD.a.Wm.'<m...a.A..M.EO.N..
`........a.........c..U.8....1...R.gJ}....h.......CG.F..R.\o..`.OF....
-Ws..8J.(D.I.h.EQ.7..EF..........h-.........P.D.l..0..6...F...fS......
I.l."}'..;M.)..........#.G.YO&p.n..."..:!W2....2"8............%....../font>....
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:07 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 418
Connection: keep-alive..........dR.n.0... <..mQj{.........[1...(.Yb...,H.....4K...'..|z.]
......d...r2.....R?..]..s........3-.iX......{. .[P..v....8g../.g.sy...
....Z.......v.U.....P.T.-%..ah)j.|......WWe]>...f.FA..........".e0g
SH..f..D..M.H.7M..l.\...h.w.S.b...vp.p`....E.U....o.W..l.^..b.L(._)...
..K..vl....Z....Pf.;.H...(/..K.l>.<I...#..f...8.............?/.e
.e....vL....Q...Xx...7n..teQ....aA..:..z.....G......9......V\.Qx.G....
..O..Q`...HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/
xml..Date: Wed, 07 Sep 2016 21:16:07 GMT..P3P: CP='This is not a P3P p
olicy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-C
oyote/1.1..Vary: Accept-Encoding..Content-Length: 418..Connection: kee
p-alive............dR.n.0... <..mQj{.........[1...(.Yb...,H.....4K.
..'..|z.]......d...r2.....R?..]..s........3-.iX......{. .[P..v....8g..
/.g.sy.......Z.......v.U.....P.T.-%..ah)j.|......WWe]>...f.FA......
....".e0gSH..f..D..M.H.7M..l.\...h.w.S.b...vp.p`....E.U....o.W..l.^..b
.L(._).....K..vl....Z....Pf.;.H...(/..K.l>.<I...#..f...8........
.....?/.e.e....vL....Q...Xx...7n..teQ....aA..:..z.....G......9......V\
.Qx.G......O..Q`.......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:07 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 424
Connection: keep-alive...........R.n.0... T....#..lP.T'...I...!...l..(......V..I...Crvwv0.84
....N.:./..0...B.m...o... ........H.B..>.w..9B.......y. .L.....w...
o..eHp)...Zj...[.;/.R..AU.b..8.-EM...%.....e]....j..A.7s{.uKEa.......L
.t.Ix"hL'Q$f...".$#..N(XX:>.........W%...|.....}.......Q..R.$..paR.
'z..WB..1...1k.Y...uGM.L..Og...$NY...4.`_.8K.......W.......S..nX{ =4/.
..X-..wE....A.I..1V.c:.......tgH.w0.....?B......6....d.W.........[....
...^.1....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/
xml..Date: Wed, 07 Sep 2016 21:16:07 GMT..P3P: CP='This is not a P3P p
olicy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-C
oyote/1.1..Vary: Accept-Encoding..Content-Length: 424..Connection: kee
p-alive.............R.n.0... T....#..lP.T'...I...!...l..(......V..I...
Crvwv0.84....N.:./..0...B.m...o... ........H.B..>.w..9B.......y. .L
.....w...o..eHp)...Zj...[.;/.R..AU.b..8.-EM...%.....e]....j..A.7s{.uKE
a.......L.t.Ix"hL'Q$f...".$#..N(XX:>.........W%...|.....}.......Q..
R.$..paR.'z..WB..1...1k.Y...uGM.L..Og...$NY...4.`_.8K.......W.......S.
.nX{ =4/...X-..wE....A.I..1V.c:.......tgH.w0.....?B......6....d.W.....
....[.......^.1........
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:08 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 441
Connection: keep-alive...........R]O.0.}..."-o...5i...Z&ub.H.........c.Nh.=n)........9......
..\...............o.._s..?..eU.h.........Z.f.X..No.&.]..Q.gg.......\.K
...y...D)..U5..[\.z...B... Z....\.0.|.X.uy{.SD[...............|J".5...
R.HJ.$a.M.3.o`.......d.]0.(,.:\....z..f.$....Ro9q..h87.d.. ..H..\.V.m.
.!y....)'..L#F!L.&M.t....4.asw..x?......\..`..`..%..g..$.$..HA..Q2_.Z.
_..w.rH%h..l..........x..4.j..f. ...v9........B....>..;.\......8...
'.....8.................HTTP/1.1 200 OK..Content-Encoding: gzip..Conte
nt-Type: text/xml..Date: Wed, 07 Sep 2016 21:16:08 GMT..P3P: CP='This
is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Se
rver: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 441..C
onnection: keep-alive.............R]O.0.}..."-o...5i...Z&ub.H.........
c.Nh.=n)........9........\...............o.._s..?..eU.h.........Z.f.X.
.No.&.]..Q.gg.......\.K...y...D)..U5..[\.z...B... Z....\.0.|.X.uy{.SD[
...............|J".5...R.HJ.$a.M.3.o`.......d.]0.(,.:\....z..f.$....Ro
9q..h87.d.. ..H..\.V.m..!y....)'..L#F!L.&M.t....4.asw..x?......\..`..`
..%..g..$.$..HA..Q2_.Z._..w.rH%h..l..........x..4.j..f. ...v9........B
....>..;.\......8...'.....8.....................
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=centro,Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:08 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive193.............._o.0....).H.m.&...1.(.*ukE.....c_.E.X......h.....{}..
>...C....:..<......h...y.P}...3..~/..b..6..n..p.....-4..t.P..q..
..:.}.........-d......{...yhXu.........Z..??,o.}.8......3.z........-.3
.d>.`.G....:...1.E....$..:.....n...|..e.%..m.Z...F..h.6...E.....j.$
..1(W.1 ..Zi.tGp2....d$E..i.GHL...S.gI...(.3......R..e...'..."".W...3.
~..m^-._.....}..y7....k%..-.T;p...-....,.[....h..M^O..L~.....wz..~...d
...........q.....0..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-T
ype: text/xml..Date: Wed, 07 Sep 2016 21:16:08 GMT..P3P: CP='This is n
ot a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server
: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chunked
..Connection: keep-alive..193.............._o.0....).H.m.&...1.(.*ukE.
....c_.E.X......h.....{}..>...C....:..<......h...y.P}...3..~/..b
..6..n..p.....-4..t.P..q....:.}.........-d......{...yhXu.........Z..??
,o.}.8......3.z........-.3.d>.`.G....:...1.E....$..:.....n...|..e.%
..m.Z...F..h.6...E.....j.$..1(W.1 ..Zi.tGp2....d$E..i.GHL...S.gI...(.3
......R..e...'..."".W...3.~..m^-._.....}..y7....k%..-.T;p...-....,.[..
..h..M^O..L~.....wz..~...d...........q.....0......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=Bidswitch,SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:09 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive180.............._o.0....).H.m1M2..c...*U....CU!.....c...o_C...K......
?.<.5.... [U...0.@.VH.T....oy8%_......x/...N\.........5..E.m..:...:
.:[..?..<$...........z..!.a6.._...........5._.f.....v......w.....bj
.(F9...26Z.R....a.......W.@.U......"..^Q.H.. ).5P..7..n..W.).....R4z.:
...A.7K.@3>...O.$cI.]...}O.<e.....H.cZ..l.1).V:........g.J:.....
......>9D..x*..{...... kC..O~....W..7.,F..@.(}lG<."..e..@.......
.QT.....0..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text
/xml..Date: Wed, 07 Sep 2016 21:16:09 GMT..P3P: CP='This is not a P3P
policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-
Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chunked..Connect
ion: keep-alive..180.............._o.0....).H.m1M2..c...*U....CU!.....
c...o_C...K......?.<.5.... [U...0.@.VH.T....oy8%_......x/...N\.....
....5..E.m..:...:.:[..?..<$...........z..!.a6.._...........5._.f...
..v......w.....bj.(F9...26Z.R....a.......W.@.U......"..^Q.H.. ).5P..7.
.n..W.).....R4z.:...A.7K.@3>...O.$cI.]...}O.<e.....H.cZ..l.1).V:
........g.J:...........>9D..x*..{...... kC..O~....W..7.,F..@.(}lG&l
t;."..e..@........QT.....0......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=SundaySky,dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:09 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive173.............._O.0.....s....6. ]..LH....@..[.,..i..... ....{.s.....
...U3...Gv.....YIs...yr...!....,......r5....Z.......V....RJ...(..R....
..6.1..~. ...n.(....g........4..l./S....q........y....../..eN.^...aA.[
.....A.ui......~KD..@.<.qGw9M...>.........) ...\.B.t%...Vu0.....
...... .\.9......~.\..~bL.,.......8.F..3..O.@.._@G.......C`...4`y...$.
.`.Q&....|R3..Q...t..o .9A....|...d........a_.K.....0..HTTP/1.1 200 OK
..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 07 Sep 20
16 21:16:09 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorv
ideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-E
ncoding..transfer-encoding: chunked..Connection: keep-alive..173......
........_O.0.....s....6. ]..LH....@..[.,..i..... ....{.s........U3...G
v.....YIs...yr...!....,......r5....Z.......V....RJ...(..R......6.1..~.
...n.(....g........4..l./S....q........y....../..eN.^...aA.[.....A.ui
......~KD..@.<.qGw9M...>.........) ...\.B.t%...Vu0........... .\
.9......~.\..~bL.,.......8.F..3..O.@.._@G.......C`...4`y...$..`.Q&....
|R3..Q...t..o .9A....|...d........a_.K.....0......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=dynadmic,BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:10 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive181.............RMo.0...Wt..m...-(...IH.6....Bi..bM#'.../E..q.f...=...
].a..T^...8m.." Y...=K.nC{@..[<M.0...F..:.7Z.>B.xQ..J..,.R..t_i.
..O..xd..3..w.Rrh..^i^...kM./.....1K.z.:!.z>..I<?.I.Z.C.....DI.
.r.uC..m......|F=.v].[.~......}...........O.3Q.3^.B.p..........a.{..Y.
.f..{A.....;....~.X..~{....o...T.a{.a{0O....U...90.m..Sx`.xaK.........
.jRH...,"x.f.y..9$...N.2..m....\he.....`....Nm.z......d.. ......K.t...
..0..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..
Date: Wed, 07 Sep 2016 21:16:10 GMT..P3P: CP='This is not a P3P policy
. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote
/1.1..Vary: Accept-Encoding..transfer-encoding: chunked..Connection: k
eep-alive..181.............RMo.0...Wt..m...-(...IH.6....Bi..bM#'.../E.
.q.f...=...].a..T^...8m.." Y...=K.nC{@..[<M.0...F..:.7Z.>B.xQ..J
..,.R..t_i. ..O..xd..3..w.Rrh..^i^...kM./.....1K.z.:!.z>..I<?.I.
Z.C.....DI..r.uC..m......|F=.v].[.~......}...........O.3Q.3^.B.p......
....a.{..Y..f..{A.....;....~.X..~{....o...T.a{.a{0O....U...90.m..Sx`.x
aK..........jRH...,"x.f.y..9$...N.2..m....\he.....`....Nm.z......d.. .
.....K.t.....0......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=BidTheatre,beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:10 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 371
Connection: keep-alive...........Q]o.0.}..`$.mT...RC.%&......1--B6J.V..~.9....n{.=.9p.......
jxl...m1.7....^d...=F..9I.3.ma......Rk1.@KV7...'oj...-=R.......u2..L..
...B0......FYwk..#...N4...,...^.'.$K.G9......K..s.`:....!.p..dX.~.S...
... ~@.....0.......*..\.3.i-.z I.Yo.....A>..4.}/ .k..p@n</..j. .
iw&e#.....K.SE......6.;..9:...w.G.y-$Sm9...4...........2.8.5..v.ke..k.
.`.....2..S........ys..7...HTTP/1.1 200 OK..Content-Encoding: gzip..Co
ntent-Type: text/xml..Date: Wed, 07 Sep 2016 21:16:10 GMT..P3P: CP='Th
is is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'.
.Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 371
..Connection: keep-alive.............Q]o.0.}..`$.mT...RC.%&......1--B6
J.V..~.9....n{.=.9p.......jxl...m1.7....^d...=F..9I.3.ma......Rk1.@KV7
...'oj...-=R.......u2..L.....B0......FYwk..#...N4...,...^.'.$K.G9.....
.K..s.`:....!.p..dX.~.S...... ~@.....0.......*..\.3.i-.z I.Yo.....A>
;..4.}/ .k..p@n</..j. .iw&e#.....K.SE......6.;..9:...w.G.y-$Sm9...4
...........2.8.5..v.ke..k..`.....2..S........ys..7.......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=beeswax,videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:11 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 371
Connection: keep-alive............[k.0....)..|....U.HQ.........I..r!.e~...t...r9'.....O..U.X
.d.w...1I..r.......Ct...Yq....6J;p..uN..p..e..2 J.k....u..m.?=....`N=.
.....f7;X..*.^o6{..|x..i.7..)....8/..)Nc.d....=H"..C.i.KY.wXR......G..
............S...w.hE.^..).d.}c...'...P..QRFa.K.ny.Ei\.......c...*.#.@.
E..S.p..R;....pb..k.[..u.:qL.6.6...G.a. f/K...aq.,.&...I.....|.....x..
[..;.... .....ar.O...HTTP/1.1 200 OK..Content-Encoding: gzip..Content-
Type: text/xml..Date: Wed, 07 Sep 2016 21:16:11 GMT..P3P: CP='This is
not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Serve
r: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 371..Conn
ection: keep-alive..............[k.0....)..|....U.HQ.........I..r!.e~.
..t...r9'.....O..U.X.d.w...1I..r.......Ct...Yq....6J;p..uN..p..e..2 J.
k....u..m.?=....`N=......f7;X..*.^o6{..|x..i.7..)....8/..)Nc.d....=H".
.C.i.KY.wXR......G..............S...w.hE.^..).d.}c...'...P..QRFa.K.ny.
Ei\.......c...*.#.@.E..S.p..R;....pb..k.[..u.:qL.6.6...G.a. f/K...aq.,
.&...I.....|.....x..[..;.... .....ar.O.......
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=videoamp,_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:11 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 412
Connection: keep-alive............]O.0.....H.w.....t.}$K....bYH....4m!..-....0.E{.{.>....
[.juL....=.x..x...?%.:[\D.....t..d~/3.\.ub?k-..h..F>...lj...-=V..V%
..m..l.Rja.(..L..........Z......MS.........t.f..`'.....~....7.NdE.Q.b.
....v......}.....h.].....neQq..}.....Q.... ,....hX\.A....#..l.e#......
.!..........<7^....0v..^......V..:... u..9...$z_'X.........3TG7'...
....C..ZH..e..M%#...:]1.6.$F.IR..e.w.ke....'1.........Q...........P...
.HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date
: Wed, 07 Sep 2016 21:16:11 GMT..P3P: CP='This is not a P3P policy. Se
e hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1
..Vary: Accept-Encoding..Content-Length: 412..Connection: keep-alive..
............]O.0.....H.w.....t.}$K....bYH....4m!..-....0.E{.{.>....
[.juL....=.x..x...?%.:[\D.....t..d~/3.\.ub?k-..h..F>...lj...-=V..V%
..m..l.Rja.(..L..........Z......MS.........t.f..`'.....~....7.NdE.Q.b.
....v......}.....h.].....neQq..}.....Q.... ,....hX\.A....#..l.e#......
.!..........<7^....0v..^......V..:... u..9...$z_'X.........3TG7'...
....C..ZH..e..M%#...:]1.6.$F.IR..e.w.ke....'1.........Q...........P...
.....
GET /syncnoad?rid=68e9a0e7b6ff4c4da3a022d9fb47d8f4&p=_dmp_turbine&uid=649ea7c690dc4437b3247d781b53384b HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=649ea7c690dc4437b3247d781b53384b; tvrg_60409="1,1473282961"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 07 Sep 2016 21:16:12 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 352
Connection: keep-alive..........d._o.0....)X.|.E.....u...-...1..E....#.._%N.....w..=........
.l.0t=...I^5.......L..^.Y~...f..=1.8..N 4J.R......j...L...]'..i....)w.
~U.m.:..OmDM.~...g./..4.9..^...nf.4O7g;........l$..]n.%...X(%.?%..[Ky.
...1..... ......Q4...]. #.-.Q,h.....BAX.>.y...Q.D...P$b.....%b...z.
....lT.~..F..UB.............~..A-. ...s..h..4... ..H.K.6.s".K.........
.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..
Date: Wed, 07 Sep 2016 21:16:12 GMT..P3P: CP='This is not a P3P policy
. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote
/1.1..Vary: Accept-Encoding..Content-Length: 352..Connection: keep-ali
ve............d._o.0....)X.|.E.....u...-...1..E....#.._%N.....w..=....
.....l.0t=...I^5.......L..^.Y~...f..=1.8..N 4J.R......j...L...]'..i...
.)w.~U.m.:..OmDM.~...g./..4.9..^...nf.4O7g;........l$..]n.%...X(%.?%..
[Ky....1..... ......Q4...]. #.-.Q,h.....BAX.>.y...Q.D...P$b.....%b.
..z.....lT.~..F..UB.............~..A-. ...s..h..4... ..H.K.6.s".K.....
...........
GET /itd.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=&rand= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cocomo.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:55 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 1118
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html<html>..<head>..<title>a</title>..</head>>>
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {.. var nameEQ = name "
=";.. var ca = document.cookie.split(';');.. for(var i=0;i < ca.l
ength;i ) {.. var c = ca[i];.. while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);.. if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);.. }.. return null;..}..function uapcc()
{..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime() (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 90);.
.setInterval(function() {..uapcc();..}, 90);..//-->..</script>
;..<meta http-equiv="refresh" content="300">..</html>HTTP/
1.1 200 OK..Date: Wed, 07 Sep 2016 21:15:55 GMT..Server: Apache/2.2.22
(Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 1118..K
eep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: t
ext/html..<html>..<head>..<title>a</title>..&l
t;/head>..<body>..<script language="JavaScript" type="
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2016 05:21:33 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Thu, 10 Aug 2017 05:21:33 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....>>
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T.....
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=19C6AC8E74C24FC4F8CBC53BEB7EB6BB&sc_random=0.6606831011682974&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.govids.net/page-1.html?lid=937115&u=http://VVV.govids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
Cookie: is_unique=sc10114910.1473282954.0; is_visitor_unique=1473282954122714614
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:57 GMT
Server: Apache/2.2.3 (CentOS)
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1473282954.0-10675947.1473282957.0; expires=Mon, 06-Sep-2021 21:15:57 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1473282954122714614; expires=Fri, 07-Sep-2018 21:15:57 GMT; path=/; domain=.statcounter.com
Content-Length: 49
Connection: close
Content-Type: image/gifGIF89a...................!.......,...........T..;..
GET /5/10/logo.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: l.longtailvideo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: image/png
Date: Wed, 07 Sep 2016 21:15:59 GMT
Etag: "3015243340"
Expires: Wed, 14 Sep 2016 21:15:59 GMT
Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT
Server: ECAcc (arn/46B0)
X-Cache: HIT
Content-Length: 1845.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP...>>
.0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......c
v..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*].
...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !..
...Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{
.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9k
L....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j
.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.
]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...
........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0
.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...
S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j
.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O
.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{..
....>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'.
...x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`.
..8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..
t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.
q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'
.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......
j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.b
i..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
GET /page-1.html?lid=937115 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:54 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Content-Encoding: gzipfdc.............\kO....L.....:..........0........h...e.._tW..\..].....>>
.0...D.wu=v.ZU...]...........w.e..*U zI.7K.J9...H.....Q`..=o`.a..=....
..?...n..u..1n.....e.~[.h./.^.i.m./4...L.|......k>.q.6!E.J...2.m>
;..^..QG9..V.?...}a...y7..t.'.6.J.....iyn...pX...TQ'.i.....m.'..\....0
.@...[.....[.).4.T....#.HT..R....-..>..lMz~...N...f.....:..L......0
..X[...n...O.3G..3<.....u......a[...C...z...a.EW...W.w.2......*Nah.
...j.E.F...XMGS_...F...k.].htu....M...am...~).".\s...q..z.....|be.W*..
...F..Q. ..hm...;.mg......V7TR....pd.......j7..v.....\./F.>........
.....eX#3W.....=..K.....9.rI~...j.u.).....E....cX..(.du{]...........?.
.....k.F.kz...?...-..........l...r'.N........)...:.!{....z...>m.. .
..`u.....k?..cZ.s...T.NV}~.HV.p..6...H..T...1M-.T...h.H...B..I.2..RU".
3NS..u...M.~.nE..L..I.p.i.{.9O....V4....Dh..s%....,....2S=....S.......
..@.)..j\........J.f.EV|....x.....\.....f ..rm5.....X....l.........@.d
.oR#.h..... .%.3..B..[$a...s4*..O... e...l94..*..0>......y...,J0...
.X.....D.....}aF.`.....?..S.....n..< ..zD0.I.5.....~..%.w.......A.a
..}C-..CY..d9Mrz.v...6d..*I....%..,#.Gn.z.h...v6ozu..@sA.. .c..H.?.fG.
YI....j.........h....0...n._#.......dI.#..E....j\.w.I.A..L.`o..~z4...S
.T-a.Z%....t.ecf..[...O..x@..|....r#:5......Q..`..mi...............19_
.V...|<..:............v....? ...../.m....9..eR.....................
......W./N.c....h......~;.<.z..P..........K.........J...V....y..O.N
ir"K.!..lr..P\.f.ND.PN........u.....|.Z..l....&..G..Fs...6...%..?..@[.
.re.y.\.|..<..'.`...Ge.....t.....x......7..Z..Q...w..>0tD.;.
GET /page-1.htm?lid=937115 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:56 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Content-Encoding: gzip116d.............\.O.J...J...z.M....$.@CE.{...E-..UU!..8..6.8!......#.>>
....^i.j...8s.7g.c....fQhv....N..5:...T..V..z..?.....7q.v..?r....6....
..q..........Wt....K..JCa.....5.....:.`b...".....##)Uf.H.Q=.*..5&<.
...}...Yg{##db.M.u..B...........!3L..^...x.....h...6.b.[]..Ba.1.<Cn
9!7.hw. ..?p,.{Y%.Pa#... e%.J...|..o{........M....."....u..Y....'.q..^
...p......oMX.6}.......Ga.kDQW.....C#....buy_L..*..79...b.l..NI.y..!..
(p.Q.. ._.o.4}....<....V.~$H.`...-g..[......6L......h.......!.....w
c.w..;..jW.@~.h..lPi....E..W.$.S....*sk..........!.j...U...........:C|
cu.5.......;..j?..I.2..;.eo... ....,..[.1.8."..F.@....^4..MQ(...<0f
.....y..k.<.1..Uhx...}.....k38o..BQ.......P.........K{h:...P.......
.....B...dc.....p..V........=[....l.....m...`.B....j....3...T..S.,.Re]
......./.....$.M.../j.T.E..R{.B!BPS..g...6j.n5....X..F(.P.1G.,.q.e.q.O
*l.....5...."...5...'..j..=.....,..s.O$u(...Pm*..L.H..\.Y$qK.\'...*.Lu
..5..j...3.....y..9...?.j....yE.AV ..v.......rMA.7.Z..w.....!.......q.
...F....}.g../.....E..B.C.Z&.S.7.B.x......R*.....\.i,...(.H. ......N.t
$..~...p .....K^|/>..".....J........JSBH..._.t.K...;....&?...(....^
..F[..l;E.."....o...R..>...........|.w.\.z..v.._.Z......j...w.u..n.
.'...j.....SG`.x..9...~Tc...7a..Ol....yd..wlu.../....R.U. Xe'....G...~
/UX..P.....q.2B.-.I.3...dN......ItN.....d....f.-../a...L07.....1.^FN.b
..y...........}:;>.n....W(.|.......r.o.....t................G.N....
..}<....j,.YR..Q..........?t.Tv.........3AE.....V/ .O3.L.'.y..o..89
S....K79.](.H.x/&=T...b.uiea....1...c...F....T..5Fk..4\...K....qC[
GET /css1.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1473282941.19C6AC8E74C24FC4F8CBC53BEB7EB6BB.1.1.1.1.1.1.1.1.1; _ga=GA1.2.336549416.1473282941; _gat=1
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:57 GMT
Content-Type: text/css
Content-Length: 1963
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT
ETag: "a1af0-7ab-5077d27777580"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Accept-Ranges: bytesA..{..COLOR: #000000; ..TEXT-DECORATION: none;..}..A:link ..{..COLOR:>>
#000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DE
CORATION: none;..FONT-SIZE: 13px;..}..A:visited ..{..COLOR: #000000;..
FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION:
none;..FONT-SIZE: 13px;..}..A:hover ..{..COLOR: #000000;..FONT-FAMILY:
Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-
SIZE: 13px;..}..table ..{..FONT-SIZE: 10px;..FONT-FAMILY: verdana, Ari
al, Helvetica, sans-serif;..}..td {font-family:Verdana;font-size:8.5pt
}...body {..BACKGROUND-COLOR: #ffffff;..margin-left: 10%;..margin-righ
t: 10%; ..border: 0px solid #979696;..}...topmenu {..BACKGROUND-COLOR:
#eeeeee;..border-bottom: 1px solid #B5B5B5;..height: 35px;..}...topme
nufont..{..COLOR: #B5B5B5; ..TEXT-DECORATION: none;..}...topmenufont:l
ink ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans
-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smooth
ing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.00
4);..}...topmenufont:visited ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdan
a, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 1
2px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1p
x 1px 1px rgba(0,0,0,0.004);..}...topmenufont:hover ..{..COLOR: #B5B5B
5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATI
ON: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !impo
rtant;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...logo {..b
GET /img/lbg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1473282941.19C6AC8E74C24FC4F8CBC53BEB7EB6BB.1.1.1.1.1.1.1.1.1; _ga=GA1.2.336549416.1473282941; _gat=1
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:57 GMT
Content-Type: image/png
Content-Length: 200
Connection: keep-alive
Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT
ETag: "a1bf1-c8-4ebb56fac1880"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Wed, 07 Sep 2016 21:15:57 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21
Nov 2013 20:06:42 GMT..ETag: "a1bf1-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-003.ams002.int
ernap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......
gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b ..
...tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.!
[.....O...........IEND.B`...
GET /counter/counter.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.statcounter.com
Connection: Keep-Alive
Cookie: is_unique=sc10114910.1473282954.0; is_visitor_unique=1473282954122714614
HTTP/1.1 200 OK
Date: Wed, 07 Sep 2016 21:15:57 GMT
Server: PWS/8.1.38
X-Px: ht h0-s1157.p11-fra.cdngp.net
ETag: W/"576924c5-654e"
Cache-Control: max-age=43200
Expires: Thu, 08 Sep 2016 04:10:46 GMT
Age: 18311
Content-Length: 9529
Content-Type: application/x-javascript
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT
Connection: keep-alive...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u>>
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5. G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18A1NmP0nMB2rKtNAUOc&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: whos.amung.us
Connection: Keep-Alive
HTTP/1.1 303 See Other
Date: Wed, 07 Sep 2016 21:15:54 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Location: hXXp://widgets.amung.us/draw/?w=colored&n=1381&c=000000ffffff&p=
Set-Cookie: uid=CgH9IFfQg4pxhRQQObx0Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/0..
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2016 05:21:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Thu, 08 Sep 2016 05:21:32 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Thu, 08 Sep 2016 05:21:32 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Thu, 08 Sep 2016 05:21:32 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
The Dropped connects to the servers at the folowing location(s):
Map
Strings from Dumps
login.exe_236:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp\ExecCmd.dll
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp\ExecCmd.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp\ExecCmd.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp\ExecCmd.dll
"%Program Files%\officials\abounds.exe"
"%Program Files%\officials\abounds.exe"
ecCmd.dll
ecCmd.dll
.reloc
.reloc
EnumWindows
EnumWindows
ExecCmd.dll
ExecCmd.dll
Kernel32.DLL
Kernel32.DLL
e%uy%u
e%uy%u
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp
nsp7.tmp
nsp7.tmp
rogram Files\officials\abounds.exe"
rogram Files\officials\abounds.exe"
q abounds.exe" | %SystemRoot%\System32\find /I "abounds.exe"
q abounds.exe" | %SystemRoot%\System32\find /I "abounds.exe"
login Setup
login Setup
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsp7.tmp
"%Program Files%\shrewdness\login.exe"
"%Program Files%\shrewdness\login.exe"
%Program Files%\shrewdness
%Program Files%\shrewdness
login.exe
login.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh6.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsh6.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
%Program Files%\shrewdness\login.exe
%Program Files%\shrewdness\login.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Nullsoft Install System v2.46
Nullsoft Install System v2.46
ewdness\login.exe"
ewdness\login.exe"
icials\abounds.exe"
icials\abounds.exe"