Dropped.Trojan.GenericKD.3853499_1944119093

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):No processes have been created.The Dropped injects its code into the following process(es):No processes have been created.

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

HOSTS file anomalies

The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1053 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Delete the original Dropped file.
   
2. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
3. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
4. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 525
87af60575e95350381303447cd2e0d96
3ed467c0bcda41c45704150aabac1780
3c29aa8e13fdffa69ada7e6932cc65db
62508b7bf1899a015b0f61fb7486a7e6
6a719482c6246092ff759896a8a952e6
4f11bdb380dafa2518053c6d20147a05
c9c0ecad3c7691c9fb77d3e12dca89ba
eb908e35f01c51fd6c3145626da78202
dc7fd4f3cfe333cb005ce5639899f0bf
739e7f76fb545c28ae4ce1d85e176484
d00d8a9daa2e2b19d952b1b10037467c
6e2c047259d3bc583dc140202340af7e
75182bfb4dd3d1ad7e0ef5e40b70550f
2a4240cfb6b249da0c5dcff5abf3a292
a746426f5bd2a7f239e0e1bc7529897d
0f2fa5e5c2ce26f0b744d19eff724c25
723325cfdc20c18e1ca96e88c9cca948
5cc9fd6672be1ca9538237031c1382c0
f1b56fd3f82b6a0668d00b9f0d6e991f
7f4ee0d326b67cc3e4a3fec3a25dfe3c
293bbf92195165383b202fa6cd4a2ba6
b33ccbf60d223d0df5c7b0c8b376386a
5c7aaa94fa1bbced13b76e9523bde956
da7eaa6230f54eb9da8f6986b5e53c89
0f5b04d97f3e3dc672c37106fbff0b45

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /wp-content/themes/howcast/images/icons/love.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.howcast.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:13 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT

ETag: "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"

Accept-Ranges: bytes

Content-Length: 127

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: image/png

.PNG........IHDR................s....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...L.`..`.>....jg.....IEND.B`.HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:37:13 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT..ETag: "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"..Accept-Ranges: bytes..Content-Length: 127..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: image/png...PNG........IHDR................s....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...L.`..`.>....jg.....IEND.B`...

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 16 Dec 2016 00:32:21 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Fri, 16 Dec 2016 00:32:21 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /o.php HTTP/1.1

Accept: */*

Referer: hXXp://aoaomo.tremorhub.com/itd.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: aoaomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:29 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 3

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

...HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:37:29 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 3..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html.......

GET /itd.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: aoaomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:13 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 1325

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

<html>..<head>..<title>a</title>..</head>..<body>..<script language="JavaScript" type="text/javascript">..<!--..function reeadCookie(name) {.. var nameEQ = name "=";.. var ca = document.cookie.split(';');.. for(var i=0;i < ca.length;i ) {.. var c = ca[i];.. while (c.charAt(0)==' ') c = c.substring(1,c.length);.. if (c.indexOf(nameEQ) == 0) return c.substring(nameEQ.length,c.length);.. }.. return null;..}..function uapcc() {..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.substring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new Date();..date.setTime(date.getTime() (60 * 1000));..var times = Math.floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times ";domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..document.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 50);..setInterval(function() {..uapcc();..}, 90);..//-->..setInterval( "onl()", 60000);function onl(){if(document.images){document.images['onlv'].src = 'o.php?' Date.parse(new Date().toString());}}..</script><div style="visibility:hidden"><img name="onlv" src="o.php"></div>..<meta http-equiv="refresh" content="300"></html>..

<<< skipped >>>

GET /10114910/0/757d7213/1/ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:13 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Set-Cookie: __cfduid=d0680ba799d1c74f85eef7f5d754fbeb41481819833; expires=Fri, 15-Dec-17 16:37:13 GMT; path=/; domain=.statcounter.com; HttpOnly

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1481819833.0; expires=Tue, 14-Dec-2021 16:37:13 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1481819833273510971; expires=Sat, 15-Dec-2018 16:37:13 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 311b51a80598404a-SOF

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:37:13 GMT..Content-Type: image/gif..Content-Length: 49..Connection: keep-alive..Set-Cookie: __cfduid=d0680ba799d1c74f85eef7f5d754fbeb41481819833; expires=Fri, 15-Dec-17 16:37:13 GMT; path=/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.1481819833.0; expires=Tue, 14-Dec-2021 16:37:13 GMT; path=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=1481819833273510971; expires=Sat, 15-Dec-2018 16:37:13 GMT; path=/; domain=.statcounter.com..Server: cloudflare-nginx..CF-RAY: 311b51a80598404a-SOF..GIF89a...................!.......,...........T..;....

GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=761A21DFE1814F1FCA8A43388FCBAC36&sc_random=0.024991977743598625&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1916&h=902&camefrom=http://VVV.govids.net/page-2.html?lid=937115&u=http://VVV.govids.net/page-2.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d0680ba799d1c74f85eef7f5d754fbeb41481819833; is_unique=sc10114910.1481819833.0; is_visitor_unique=1481819833273510971

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:53 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1481819833.0-10675947.1481819873.0; expires=Tue, 14-Dec-2021 16:37:53 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1481819833273510971; expires=Sat, 15-Dec-2018 16:37:53 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 311b52a352b4404a-SOF

GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:37:53 GMT..Content-Type: image/gif..Content-Length: 49..Connection: keep-alive..P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.1481819833.0-10675947.1481819873.0; expires=Tue, 14-Dec-2021 16:37:53 GMT; path=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=1481819833273510971; expires=Sat, 15-Dec-2018 16:37:53 GMT; path=/; domain=.statcounter.com..Server: cloudflare-nginx..CF-RAY: 311b52a352b4404a-SOF..GIF89a...................!.......,...........T..;..

GET /report3.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:40:57 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:40:57 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8..

GET /a.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053&rnd=1481819854000 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ww.worriedlyflacks.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:13 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 325

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html

......<meta http-equiv="cache-control" content="max-age=0" />..<meta http-equiv="cache-control" content="no-cache" />..<meta http-equiv="expires" content="0" />..<meta http-equiv="expires" content="Tue, 01 Jan 1980 1:00:00 GMT" />..<meta http-equiv="pragma" content="no-cache" /><meta http-equiv="refresh" content="60">249161HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:37:13 GMT..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 325..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: text/html........<meta http-equiv="cache-control" content="max-age=0" />..<meta http-equiv="cache-control" content="no-cache" />..<meta http-equiv="expires" content="0" />..<meta http-equiv="expires" content="Tue, 01 Jan 1980 1:00:00 GMT" />..<meta http-equiv="pragma" content="no-cache" /><meta http-equiv="refresh" content="60">249161..

GET /report3.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:41:06 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:41:06 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8..

GET /5/10/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: l.longtailvideo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Thu, 15 Dec 2016 16:38:02 GMT

Etag: "3015243340"

Expires: Thu, 22 Dec 2016 16:38:02 GMT

Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT

Server: ECAcc (arn/46B0)

X-Cache: HIT

Content-Length: 1845

.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP....0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......cv..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. ...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !.....Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9kL....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{......>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'....x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`...8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.bi..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se

<<< skipped >>>

GET /bck.php?1481819882000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:41:08 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:41:08 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8..

GET /img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1481819895.761A21DFE1814F1FCA8A43388FCBAC36.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1892378973.1481819896; _gat=1

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:56 GMT

Content-Type: image/png

Content-Length: 3856

Connection: keep-alive

Last-Modified: Tue, 10 Jun 2014 14:29:28 GMT

ETag: "a1bf2-f10-4fb7c27bc2200"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-fra004-005.fra004.internap.com

Accept-Ranges: bytes

.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx..].O....V^.....rI........c..F..M.y0..-H....P.KH\.-.%-....J.[...5..S.... R...c....K/O.w...........93svY..i..e..w...}..}gvy..E?.Q..%....J...(Q.V.DaZ....JN........(.fL...cM.....Z...'.....A.....k.x....8....E..O..;.W...f.q.X..l..=.....k................%...fd)........,..J..G...!...m.Q...J.../..................Y,0.......%...S6R..=..t.0..%...|(..?T.V.DaZ...i%.b>..6:.~.=..7.-*.g....y<.,4>....W..jv.(...}...8..YdF.l. .,,~5s..X<..h~.p...'......b...[6.0.D.Ci........ Bo.C]....g..........y.i.........]N....p$.-~}8..... .....n.z...$~.9.).........P.....g....!.':.J..O...X.U.?:..#.g.{ .^......L..0..I.."H<.5.u0...n^.3.ER.<......ZI......*f..... .fN.......q.n..................Z.0.A.m|@.v. .uI......u........Y...u.t..........db...L.......T.=21...8.(......i.$......y4...t:....(.`sG.H..Q...&...u.<..2L..Wl..5...9...<. I....d...P.._h..n....MA7Y.....'..FsZ?....kH.l.s.<.QD....$q>lK...`1....x.Ha ^....L..W.#.C....._1...."^..6..WRz...4..z`.Ch|R..H....:1..C..o. ........8..8.$...;..,..N.....S..O......W":.).}...IR!.F8`=..lc..9n...O~a.....k7^-~........r........YO.C..0@I.v....7Dt..................2..NmX...&.h.......f) ....;?...b8.~.>L..../.....C.l.Pfg..............0..4k>.f.k-....X.9!a>.0.i.b.....$h.;.b.....`.32.Tr...bx.".:5K00..9..h...a........l....U..M..Z3..v..:....<:E........ #./...4p.y.....b....u.f.#[*e%.%p....|RO.dP\b...~.f...C......@..s..........X.{.m0.k..T.O.?<&.M....C...6o.9..C..Pd.,.......O..`5.L.xP,.

<<< skipped >>>

GET /counter/counter.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.statcounter.com

Connection: Keep-Alive

Cookie: __cfduid=d0680ba799d1c74f85eef7f5d754fbeb41481819833; is_unique=sc10114910.1481819833.0; is_visitor_unique=1481819833273510971

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:52 GMT

Server: PWS/8.2.0.5

X-Px: ht h0-s1211.p11-fra.cdngp.net

ETag: W/"576924c5-654e"

Cache-Control: max-age=43200

Expires: Thu, 15 Dec 2016 19:39:15 GMT

Age: 32317

Content-Length: 9529

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT

Connection: keep-alive

...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C........l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&....d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q......$|...._.;...Em..itPa......P..Gj.. .5. G..1m.....Ee...F70..ZUU&.&.?.>..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4.................#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*..EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t.........J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D...y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\....'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....

<<< skipped >>>

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 16 Dec 2016 00:32:30 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Fri, 17 Nov 2017 00:32:30 GMT

Connection: close

Content-Type: application/x-shockwave-flash

CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....

<<< skipped >>>

GET /home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.worriedlyflacks.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 858

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Encoding: gzip

Date: Thu, 15 Dec 2016 16:37:00 GMT

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 44d7d28132a47c2b5760c4ec3dd7aa89.cloudfront.net (CloudFront)

X-Amz-Cf-Id: Y217Ll24bTakBc-DHnZAoWAX7iY89itCQvMZ0rqzTicjnk00l6O_9Q==

...........U.o.6.......0..,JkZ....].&;..f.. ..z..Q.BR......%.I...l..|.?.....Mh.f...6...Hd#...I.v...Q...-..W{N.X..v..m;..V.I.5.....r.j.d.l..|.....o.x=.Y.h.T..i.q....M...:$.v...V...$.v.N..h...L....3.Nh. .y.d..S]H.0u/j..W...G!b.:.Dwv...vt.a.x.d/\.Mx.....3.....y......c:.....2u:...{..zP..C....Y.{.N6h2...;.....7$K(..o....D..-...".. .0...........|p.....9tO......f..#..2.wM.........r:.....Q....$.....v..ZW....9.Zc.81.....6......6..Z..~.K.2.......1...).N....I..z#c.S...fu.2.../..~......}.J.O.k..^q.R.......7..../J..>-...W...}.b..........|v.K .}....TC4L.,..-*j.G..w...G......J.....%.bR.U...M?..re<...v.A...._g..a.]y2:...Q.b7.c..q..X....G.Z.i...H...b...X..|u.<)./.@.......SEq..s.`.Uk6Q.|."..c....#.j.......A.|G1..[.....i......iz.P...{....sH[Qq..Eh..'^......T..(b.Q..."H...n$Q.ey..,X../.....9 .I..xI.....3^$g.....p..A.8.2......@z?..4..?F .......!o..%.|.I,.....2.VWE.......

GET /jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.worriedlyflacks.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 878

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT

ETag: "b0000003c0a95-1d65-5418029ba830a"

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Wed, 23 Nov 2016 16:10:01 GMT

Vary: Accept-Encoding

Age: 2326

X-Cache: Hit from cloudfront

Via: 1.1 44d7d28132a47c2b5760c4ec3dd7aa89.cloudfront.net (CloudFront)

X-Amz-Cf-Id: aZUxsc8K7fJReYeBfR2Z5vUz3ADZHcYnKzzp8iyfigF686Orh48ELg==

............Qo.6.....;.z....$.....6`...o} .@.'..D..e.h..w...B.u..:.0dK...........A...H.$...<.)v...2.......v.Q.[>l.q..X.,J.................I...nG:% G..|.H.C.....p`.. A.<~...;....0.D...W.<.S.....v.......fIK}.VS^.S..;C93......2%k.{..x.....].z...j.....8..@...nM3.l......f.d.,)/.......8..=.Rr..#..8I..1..b(.{.F.a... [..Z3....%q..._S..p.%..L...#..&.|.Qf.:{..;.,...D.YmF..P._....;.?vD}^...6]...<.....19M.2.EBSmd.j..V..L_%(.....l<...F[L..V"M'[(..4.........K..{HW..0).}2.Z.u.6.8.l...I.../.~Y..>.*v.....0[..Jk.....u..............b......a.....^..e.e.......T..F...VPZ.<,...q^....\.]4.....nn.yi........>I...k&....n.W....r..%.......;..q2..^..`1l.Ra.D....yT..v.d.^..z.\/2..p.....c1R....*.o.<.""....T....7............6....C..n!..........._J<.v...h...L.Q..!...D!.=!.B..y............?...........(`..Yp......<.0.<3=3=3=3=3=3=3Gf._0..8.L=7=7=7=7=7=7=7Gn......3.3.3.3.3.?d...7G....*._.9.........e...HTTP/1.1 200 OK..Content-Type: application/javascript..Content-Length: 878..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT..ETag: "b0000003c0a95-1d65-5418029ba830a"..Accept-Ranges: bytes..Content-Encoding: gzip..Date: Wed, 23 Nov 2016 16:10:01 GMT..Vary: Accept-Encoding..Age: 2326..X-Cache: Hit from cloudfront..Via: 1.1 44d7d28132a47c2b5760c4ec3dd7aa89.cloudfront.net (CloudFront)..X-Amz-Cf-Id: aZUxsc8K7fJReYeBfR2Z5vUz3ADZHcYnKzzp8iyfigF686Orh48ELg==..............Qo.6.....;.z....$.....6`...o} .@.'..D..e.h..w...B.u..:.0dK...........A...H.$...<.)v..

<<< skipped >>>

GET /amg.php HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.worriedlyflacks.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 359

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Date: Thu, 15 Dec 2016 15:58:28 GMT

Age: 2328

X-Cache: Hit from cloudfront

Via: 1.1 44d7d28132a47c2b5760c4ec3dd7aa89.cloudfront.net (CloudFront)

X-Amz-Cf-Id: soEuP4wgkXHW-709juhnqliiKhWX7ctRmMwdpzy3aCuhR5HPFzb-Mw==

...<script type="text/javascript">setInterval( "vwu()", 200000);function vwu(){if(document.images){document.images['viewers'].src = 'http://whos.amung.us/cwidget/iebrowser1/000000ffffff.png?' Date.parse(new Date().toString());}}</script><div style="visibility:hidden"><img name="viewers" src="hXXp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png"></div>HTTP/1.1 200 OK..Content-Type: text/html..Content-Length: 359..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Date: Thu, 15 Dec 2016 15:58:28 GMT..Age: 2328..X-Cache: Hit from cloudfront..Via: 1.1 44d7d28132a47c2b5760c4ec3dd7aa89.cloudfront.net (CloudFront)..X-Amz-Cf-Id: soEuP4wgkXHW-709juhnqliiKhWX7ctRmMwdpzy3aCuhR5HPFzb-Mw==.....<script type="text/javascript">setInterval( "vwu()", 200000);function vwu(){if(document.images){document.images['viewers'].src = 'hXXp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png?' Date.parse(new Date().toString());}}</script><div style="visibility:hidden"><img name="viewers" src="hXXp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png"></div>..

GET /jwplayer1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 16 Dec 2016 00:32:12 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT

ETag: "4403af-25d37-53444eccf91c0"

Accept-Ranges: bytes

Content-Length: 154935

Cache-Control: max-age=2592000, public

Expires: Fri, 17 Nov 2017 00:32:12 GMT

Connection: close

Content-Type: text/javascript
var dtn = Date.parse(new Date().toString());..document.write(unescape(
'
>>

GET /draw/?w=colored&n=1633&c=000000ffffff&p= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.worriedlyflacks.pw/amg.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Cookie: uid=CgH9IFhSxsm4DxxpqDAGAg==

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.9.6

Date: Thu, 15 Dec 2016 16:37:30 GMT

Content-Type: image/png

Transfer-Encoding: chunked

Connection: keep-alive

Content-Disposition: filename=wau-widget.png

Expires: Sat, 14 Jan 2017 16:37:30 GMT

Cache-Control: max-age=2592000
5e8...PNG........IHDR...Q...........p....yPLTE...EEEYYY......???,,,...
AAA..................;<=......abdWXZ........................GGG...'
((.....................uvyEFG..."""...............kln...NNN...{{{.....
.......~~.vwx...hhi.........OPQ.........VVV.....................uvv...
opp......UVV...RRR...............bcc...ijj}~~......dee............QQQ.
..]^^PPP.........TTTaaa......yyy......___......HHHrss.........kllJJJDD
D|||BBB...............CCC............LLLNOO.........@@@tttkkkvvv:::...
..............................?@@888666ppprrr.........uuu>>>F
FF......111............000...lll......XYZ(((&&&hhhfff   cdeZ[\788...dd
dccc.........nnn.........ZZZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjjQ.."....t
RNS.@..f....IDATH....;.Q...{.".......V.........M."]....BJ.-$N.R..,..\.
(..]..Q........<...{..y...sf.... .......t1..3...B............RZ....
...oS../..7..?..<=.]].=...Gg'..w.w .Z....uL......4.t...o....4......
aD7..:T>.~D.~.M...a...j.*.a.j..PY.....a.....1T-....^.R.....3.......
3...'...a)z.....FHA~..ks.2.S.=..b.*'.s.0.s.M....[Y7.........9.^.K*d...
._IC...I.L.1-..._"I*..p..Zs!.`.........MB$.9M....Xjh....-.'J'....Q. .U
f.H........C.....8...x...lI.1.Q...no...A".i. i..[.P.R...;.;...F.M.CmU.
.....rj.x......~....Q....8I....<.C.-!........{#,.&d,.A.k....8...5..
.U.s.~u..0!....q.....76s{.V.Z.U..^..kB..4.".(.J|.(.vF#. ..|.7.^.^.x{R&
n.DB.z..7..`......1...X$.........^K....D.......J|Qq......%...gR....ZHE
.........NM$.8..%...........I...;y...8...D$..r..........sY#.{.........
.YS4..p..bW.... ...]..N;.....h.zu....p..)..3.A..... .SD.-......IEN
>>

GET /bck.php?1481819872000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:40:58 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Thu, 15 Dec 2016 16:40:58 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..

GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.worriedlyflacks.pw/amg.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Thu, 15 Dec 2016 16:37:29 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/draw/?w=colored&n=1633&c=000000ffffff&p=

Set-Cookie: uid=CgH9IFhSxsm4DxxpqDAGAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/
0..

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Fri, 16 Dec 2016 00:32:12 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Fri, 16 Dec 2016 00:32:12 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /ova-jw.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1892378973.1481819896; _gat=1

HTTP/1.1 200 OK

Date: Fri, 16 Dec 2016 00:32:46 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT

ETag: "4403b3-39741-4fbe0551c3280"

Accept-Ranges: bytes

Content-Length: 235329

Cache-Control: max-age=2592000, public

Expires: Fri, 17 Nov 2017 00:32:46 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
>>

GET /page-2.html?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:16 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-fra004-005.fra004.internap.com

Content-Encoding: gzip
f92.............\.S..........N..`[..6`..B..y0..m...F.V.@..iecR..~g....
 ..N.......o....Y.....a.a.EG....R..d.-D........s.....?.t..\.0....P....
.>.1.............(T.A.:t*}...Q.......E.....z~h........Ma#...L.....V
C...:.`b..."...^.C=IU.. .t=.\}.C.r...j.=..x..L..0XG.o.....lm.....L7..{
.$F.QQ......D..........<..TBn:!7.....l..c...2.......(....j..J...|.Z
n...........X....".Z..6....u......{r<l..0}#....j,.u3...o.(.....}x..
.j./L..j..."...|k......&.z.9f....> .'K..j..E...U.z;......3.....x...
....._v...-..[1......u..2Q.S...}.......d......... ..{...G...y....4...j
:wI... B..0..[...q.~..c.v[....L..=W...B..Fd..UH.z.8.......u.O....q..-.
.z.m8c.P.k..... $.wFp......2o.zp]H.....8.$}..........oy..-...'..(.H~.b
.\............"......{....e9.G.LC.{P...:.....z...S.=Sb[..P...vI.......
.Vh.l}{..)....h=. ....3...,e....:...CxfL......5e..z,.H...D....2.......
...F.._..P..:"B.:......5O.2m".I.#.._H}..{...MI3.....T..P..R....9.....1
n@.m.b.0.RI...y.......b5PE.*.(L.(......t.[.......eK...76.I.,.Mbd..x..=
=Ld......C..IP.B...J&.S.7...d......R......zy.l.2...&F.q......D=..%2ln.
.`.&../...fF..|..t%x6....p..a d..p..1.JR..o........E..%jq.>.....)B.
/....VST0......8].f.....S....W...M....h-...i..5........ji.E:_.......u.
.;.`91...G;.m.yc....v..d|.#.L.s..............&......KM..R.u..d]'3c....
..lyH.?5..............4&..o..Z.............M.......1.^.-....?_]|y.....
....7.z.Uo.B......'...B....cR.......'................o.>]}..~5.Q,..
........y....N...N>w?.}..$f2%u....V/ .O3.L.&.y..O..Hr*K.!..nr..PR.b
.^Lz. {......R,]....^....... lrP=..0Z.W.."oV_...._.....y....lz.N{.
>>

GET /page-2.htm?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.govids.net/page-2.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:38 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-fra004-005.fra004.internap.com

Content-Encoding: gzip
1205.............\.O.I...H..jz..=c..>.61.!..Q..........vC_.ac....^.
...1.eG.....u.z...w._.".L.q?.aO..A.......0.*.22.=._.......xh.-.0.uB...
.aO.CQ.G.k.....=d......[..Mu..M#P..V}..~.P.........)5.q..)lb..H...9...
....7...SO..P\..s>.q.27Xn...g...5.<@...z.....,..]g=..Pv. .s..Q..
o3....d..L&yVx|(*...`..5z.P..s8X...0}...R.....L..NZ.2......A...i-.*...
..z..1s.......ca].....5..K....S..n....#.....p....T.,.RH.-|U..o.a..{Sf.
5. .j.Ziw.d...(.^..7@n....S...........@..A.S...@.......3.........V.qfO
 ............x..X..J_._w..T...;.;.x... ....2...7.13....WR.Vhoq..>..
N-,...&.O.....B.K.....]...I..n.F.....[.@..@.=y.,p.......M_.c..y8R}7r..
#&.....T....8T.%..`q....}.O...kv...4.jW*..eY4..->..."......."..L.Q3
..ybz....:.../.|...vtsj..^...`..sE......~....Wf.;..A....(..].m....."s0
.8..H..vg.. $K.H6.,...1G9.b.K....%.a8*}M....%.6....V!G.f_.]........)x.
..P*.Tl.. ~{..).l.Q,..n.}Nt..3.....g..... <3.H.Q.v...Q...@.~H......
B.kV&.....f...?.R...$@...b..|.h.v...2...y-..XG....jS.Be.G.7.b.".[j`.Ax
....T.l..H,&l.1.JI...............juQ.`!...H.. .....2I.F.nm..7Y........
k......Y&?P.9....P..}.gE..).S....CJ%0`} .o...VV..aa.\.QB81...2.Q.}$.H.
.K..~.-..0....L.......#.1....B..>*....%.w.......F.A..{.^Lg.....vJ..
E:. k..ULH.i..Q.lL.....q...7.Z..\..........:.v..<..5.F....'........
S3.1.......nPf.G.3e..O...q.7".7.wd....}....uu....hr..S...h............
..v.O..>...B..da.g/......../..=..7\.F...._.9.....).Y1....e....z....
..wG'o.?....5..F..JO......A......M.J.?.~<~..o..<.|.pz..4~......g
.?.[.e4.kb0.#~8.xrtz..C.Fe...N?.~:...4.....;\...<M.2.....3>}
>>

GET /css1.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1481819895.761A21DFE1814F1FCA8A43388FCBAC36.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1892378973.1481819896; _gat=1

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:37:56 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-fra004-005.fra004.internap.com

Content-Encoding: gzip
293.............U[O.0.~.R..G5.IM.B/.>.(..P..i......cG.{a...s..]7..0
..G....s..w<.........6 ...!..f.o3.||6...&...(...^{..F....t.>X.]L
of...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...M~...9..........#H...W.oi(y.
.....B;.@.....j.y.ke.9M.|.J..N...<8n.2...P.......>_.N...{U.....R
jb.<......oEF.I)..Bm.7...I..`.q28........Y......-P..y..V..rk.....$.
p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<.......Z.D.8 TY`..9P..H3m,..
...A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X#.B...F/...50.3j..da...H..2.
.....f..s\..q.....k.I..4.2..6..4....;(. .Rb(.........Z.,/..S....lur.*.
. ..B.....X....Jc3.P.x...I.$...)..`..F..iZ..E.pK...{F...&.....i..ja1&g
t;..s.&X..Q..~....v...*m...3.Dq".|oo%.MpTn..qU..~..-.q......0..HTTP/1.
1 200 OK..Date: Thu, 15 Dec 2016 16:37:56 GMT..Content-Type: text/css.
.Transfer-Encoding: chunked..Connection: keep-alive..Vary: Accept-Enco
ding..Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT..Server: CDCE..X-IN
AP-Cache-Status: HIT..X-INAP-Server: cdce-fra004-005.fra004.internap.c
om..Content-Encoding: gzip..293.............U[O.0.~.R..G5.IM.B/.>.(
..P..i......cG.{a...s..]7..0..G....s..w<.........6 ...!..f.o3.||6..
.&...(...^{..F....t.>X.]Lof...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...
M~...9..........#H...W.oi(y......B;.@.....j.y.ke.9M.|.J..N...<8n.2.
..P.......>_.N...{U.....Rjb.<......oEF.I)..Bm.7...I..`.q28......
..Y......-P..y..V..rk.....$.p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<
.......Z.D.8 TY`..9P..H3m,.....A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X
#.B...F/...50.3j..da...H..2......f..s\..q.....k.I..4.2..6..4....;(
>>

GET /img/lbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1481819895.761A21DFE1814F1FCA8A43388FCBAC36.1.1.1.1.1.1.1.1.1; _ga=GA1.2.1892378973.1481819896; _gat=1

HTTP/1.1 200 OK

Date: Thu, 15 Dec 2016 16:38:03 GMT

Content-Type: image/png

Content-Length: 200

Connection: keep-alive

Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT

ETag: "a1bf1-c8-4ebb56fac1880"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-fra004-005.fra004.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Thu, 15 Dec 2016 16:38:03 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21 
Nov 2013 20:06:42 GMT..ETag: "a1bf1-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-fra004-005.fra004.int
ernap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......
gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b ..
...tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.!
[.....O...........IEND.B`...

GET /ova-jw.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.1892378973.1481819896; _gat=1

HTTP/1.1 200 OK

Date: Fri, 16 Dec 2016 00:32:44 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT

ETag: "4403b3-39741-4fbe0551c3280"

Accept-Ranges: bytes

Content-Length: 235329

Cache-Control: max-age=2592000, public

Expires: Fri, 17 Nov 2017 00:32:44 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
>>

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Strict-Transport-Security: max-age=10886400; includeSubDomains; preload

Timing-Allow-Origin: *

Date: Thu, 15 Dec 2016 15:28:01 GMT

Expires: Thu, 15 Dec 2016 17:28:01 GMT

Last-Modified: Wed, 28 Sep 2016 20:19:01 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11590

Age: 4152

Cache-Control: public, max-age=7200
...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'
V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W]
.b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..
~.............>..........GB..N....?...?.I2.....U...o<.....W.;...
x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/
..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<
.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo..
...]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..
~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.
E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)
....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]..........
..*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.
........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9
..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....
q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z...
...Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....
C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.
X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'
....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P
..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...z
Z...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@
........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
>>

GET /r/collect?v=1&_v=j47&a=628801802&t=pageview&_s=1&dl=http://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053&ul=en-us&de=utf-8&dt=home&sd=24-bit&sr=1916x902&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1501963183&cid=506006047.1481819860&tid=UA-74694740-5&_r=1&z=1432791642 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.worriedlyflacks.pw/home.php?id=21A4imXuW6oCrZRqKMR6&date=2016-11-21&p=none&t=&ca=84002053

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Thu, 15 Dec 2016 16:37:29 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 15 Dec 2016 16:37:29 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;....


GET /r/collect?v=1&_v=j47&a=2080254541&t=pageview&_s=1&dl=http://VVV.govids.net/page-2.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1916x902&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=876319079&cid=1892378973.1481819896&tid=UA-74694740-2&_r=1&z=2048592887 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Thu, 15 Dec 2016 16:37:56 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Thu, 15 Dec 2016 16:37:56 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..

The Dropped connects to the servers at the folowing location(s):

Map

Strings from Dumps

taskeng.exe_3996:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

USER32.dll

USER32.dll

msvcrt.dll

msvcrt.dll

ntdll.dll

ntdll.dll

API-MS-Win-Core-Debug-L1-1-0.dll

API-MS-Win-Core-Debug-L1-1-0.dll

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

API-MS-Win-Core-File-L1-1-0.dll

API-MS-Win-Core-File-L1-1-0.dll

API-MS-Win-Core-Handle-L1-1-0.dll

API-MS-Win-Core-Handle-L1-1-0.dll

API-MS-Win-Core-Heap-L1-1-0.dll

API-MS-Win-Core-Heap-L1-1-0.dll

API-MS-Win-Core-Interlocked-L1-1-0.dll

API-MS-Win-Core-Interlocked-L1-1-0.dll

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

API-MS-Win-Core-Misc-L1-1-0.dll

API-MS-Win-Core-Misc-L1-1-0.dll

API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll

API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-Profile-L1-1-0.dll

API-MS-Win-Core-Profile-L1-1-0.dll

API-MS-Win-Core-Synch-L1-1-0.dll

API-MS-Win-Core-Synch-L1-1-0.dll

API-MS-Win-Core-SysInfo-L1-1-0.dll

API-MS-Win-Core-SysInfo-L1-1-0.dll

API-MS-Win-Core-ThreadPool-L1-1-0.dll

API-MS-Win-Core-ThreadPool-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

RPCRT4.dll

RPCRT4.dll

KERNEL32.dll

KERNEL32.dll

d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp

Session::ChannelMsgReceived

Session::ChannelMsgReceived

d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp

StopJobMsg

StopJobMsg

StartJobMsg

StartJobMsg

ClientPipeName

ClientPipeName

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp

d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp

TaskScheduler.log

TaskScheduler.log

j%Xf;

j%Xf;

d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

SspiCli.dll

SspiCli.dll

XmlLite.dll

XmlLite.dll

MPR.dll

MPR.dll

RegOpenKeyTransactedW

RegOpenKeyTransactedW

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegCreateKeyExW

RegCreateKeyExW

FindExecutableW

FindExecutableW

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

EnumThreadWindows

EnumThreadWindows

EnumWindows

EnumWindows

GetProcessWindowStation

GetProcessWindowStation

_wcmdln

_wcmdln

_amsg_exit

_amsg_exit

GetProcessHeap

GetProcessHeap

SetProcessShutdownParameters

SetProcessShutdownParameters

TaskEng.pdb

TaskEng.pdb

version="5.1.0.0"

version="5.1.0.0"

name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"

name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"

8 8$8(878

8 8$8(878

3=4Z4w4

3=4Z4w4

=!=(=0=4=?=>>

=!=(=0=4=?=>>

5 5U5_5

5 5U5_5

5b6u6

5b6u6

-131J1X1o1}1

-131J1X1o1}1

=$=

=$=

Password

Password

hXXp://schemas.microsoft.com/windows/2004/02/mit/task

hXXp://schemas.microsoft.com/windows/2004/02/mit/task

ieframe.dll

ieframe.dll

%SystemRoot%\SYSTEM32\cmd.exe

%SystemRoot%\SYSTEM32\cmd.exe

%SystemRoot%\System32\Tasks

%SystemRoot%\System32\Tasks

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake

WindowSeconds

WindowSeconds

InitializeCmdlineProcessing()

InitializeCmdlineProcessing()

pCrimson provider registration failed for taskeng, hr=0x%x

pCrimson provider registration failed for taskeng, hr=0x%x

CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]

CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]

InteractiveTokenOrPassword

InteractiveTokenOrPassword

%d.%d

%d.%d

%s, (%d)

%s, (%d)

hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout

hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

201ef99a-7fa0-444c-9399-19ba84f12a1a

201ef99a-7fa0-444c-9399-19ba84f12a1a

C:\Windows\SYSTEM32\cmd.exe

C:\Windows\SYSTEM32\cmd.exe

6.1.7601.17514 (win7sp1_rtm.101119-1850)

6.1.7601.17514 (win7sp1_rtm.101119-1850)

taskeng.exe

taskeng.exe

Windows

Windows

Operating System

Operating System

6.1.7601.17514

6.1.7601.17514

thirsty.exe_4008:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

Gw2.Hw

Gw2.Hw

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

ers\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp\ExecCmd.dll

ers\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp\ExecCmd.dll

"%Program Files%\Jammed\brogue.exe"

"%Program Files%\Jammed\brogue.exe"

p\ExecCmd.dll

p\ExecCmd.dll

.reloc

.reloc

EnumWindows

EnumWindows

ExecCmd.dll

ExecCmd.dll

Kernel32.DLL

Kernel32.DLL

$$\wininit.ini

$$\wininit.ini

e%uy%u

e%uy%u

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp

brogue.exe

brogue.exe

rogram Files\Jammed\brogue.exe"

rogram Files\Jammed\brogue.exe"

ecCmd.dll

ecCmd.dll

gue.exe" | %SystemRoot%\System32\find /I "brogue.exe"

gue.exe" | %SystemRoot%\System32\find /I "brogue.exe"

\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp

\Users\"%CurrentUserName%"\AppData\Local\Temp\nsp5004.tmp

"%Program Files%\manchester\thirsty.exe"

"%Program Files%\manchester\thirsty.exe"

%Program Files%\manchester

%Program Files%\manchester

thirsty.exe

thirsty.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsz35BF.tmp

ers\"%CurrentUserName%"\AppData\Local\Temp\nsz35BF.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

%Program Files%\manchester\thirsty.exe

%Program Files%\manchester\thirsty.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows\

Windows\

%Program Files%

%Program Files%

Nullsoft Install System v2.46

Nullsoft Install System v2.46

hester\thirsty.exe"

hester\thirsty.exe"

ammed\brogue.exe"

ammed\brogue.exe"

svchost.exe_2416:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

msvcrt.dll

msvcrt.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

KERNEL32.dll

KERNEL32.dll

NTDLL.DLL

NTDLL.DLL

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-Core-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

RPCRT4.dll

RPCRT4.dll

ole32.dll

ole32.dll

ntdll.dll

ntdll.dll

_amsg_exit

_amsg_exit

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

GetProcessHeap

GetProcessHeap

svchost.pdb

svchost.pdb

version="5.1.0.0"

version="5.1.0.0"

name="Microsoft.Windows.Services.SvcHost"

name="Microsoft.Windows.Services.SvcHost"

Host Process for Windows Services

Host Process for Windows Services

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\Svchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

Software\Microsoft\Windows NT\CurrentVersion\MgdSvchost

\PIPE\

\PIPE\

Host Process for Windows Services

Host Process for Windows Services

6.1.7600.16385 (win7_rtm.090713-1255)

6.1.7600.16385 (win7_rtm.090713-1255)

svchost.exe

svchost.exe

Windows

Windows

Operating System

Operating System

6.1.7600.16385

6.1.7600.16385