Trojan.NSIS.Androm.3_18284f0f50

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):

allegro.exe:3288

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

No files have been created.

Registry activity

Dropped PE files

HOSTS file anomalies

The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1053 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
2. Delete the original Trojan file.
   
3. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
5. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 506
87af60575e95350381303447cd2e0d96
7f4ee0d326b67cc3e4a3fec3a25dfe3c
293bbf92195165383b202fa6cd4a2ba6
b33ccbf60d223d0df5c7b0c8b376386a
5c7aaa94fa1bbced13b76e9523bde956
da7eaa6230f54eb9da8f6986b5e53c89
0f5b04d97f3e3dc672c37106fbff0b45
9b0f84c736f2651c17fa4592c98ca6f0
10cdbd65f189a3a3a25eec73396c07d1
3642ef122aa6382d10aaf85824e1d78b
ca68f7598e334d1805d20eb245bebded
4684fab20680d9d8b202a59b822e633a
57f41da1ea05d30f6707060f00876d07
1b2bfbbbca773cdb33d6da3b213f8ce7
2530acdcdc7ecc5f66ce4c84f00c16dd
ddd76f91d11e7721e59ad2452476ba21
91d216dab486680090f9e408480f984f
0d20acfa48e8979c1469531204ca1968
99694dd84a6be2f345b9f6700efd6b44
e4172945272ff2f0c8e57d2ef3a90236
6d10dc27bb05455779a4020400cd6218
d48596e9c6655369a1702009153f2549
143736e701565a0d0b41822c321d767f
d08279dabcb13c2c97e36726ff0230eb
135789a839ca94c62aa0ff02a71ec03e

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.763910521.1480466603; _gat=1

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:47:03 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Tue, 11 Nov 2014 03:08:25 GMT

ETag: "a1b01-52-5078c97abfc40"

Accept-Ranges: bytes

Content-Length: 82

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/xml

<cross-domain-policy>.. <allow-access-from domain="*"/>..</cross-domain-policy>....

GET /v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hXXp://VVV.ivids.net/1.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Entertainment videos ivids.net&LR_FORMAT=application/x-shockwave-flash HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.763910521.1480466603; _gat=1

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:47:03 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Set-Cookie: PHPSESSID=6or4a519r4tp1eoeotmth65b26; path=/

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: private

Pragma: no-cache

Content-Length: 514

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/xml

<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0">..<Ad id="1"><Wrapper><AdSystem>1</AdSystem><VASTAdTagURI><![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=[CONTENT_LENGTH]]]></VASTAdTagURI><Impression/><Creatives></Creatives></Wrapper></Ad>..</VAST>HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:47:03 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Set-Cookie: PHPSESSID=6or4a519r4tp1eoeotmth65b26; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: private..Pragma: no-cache..Content-Length: 514..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/xml..<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0">..<Ad id="1"><Wrapper><AdSystem>1</AdSystem><VASTAdTagURI><![CDATA[http://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=[CONTENT_LENGTH]]]></VASTAdTagURI><Impression/><Creatives></Creatives></Wrapper></Ad>

<<< skipped >>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Wed, 30 Nov 2016 00:43:28 GMT

ETag: W/"144-1446243360000"

Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive

<?xml version="1.0" ?>.<cross-domain-policy>. <!-- Very Liberal -->. <allow-access-from domain="*" secure="false"/>.</cross-domain-policy>....

GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net - 1&mediaDesc=Entertainment videos ivids.net - 1&mediaId=2&mediaUrl=hXXp://VVV.ivids.net/1.html&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=300 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store, must-revalidate

Content-Encoding: gzip

Content-Type: text/xml;charset=ISO-8859-1

Date: Wed, 30 Nov 2016 00:43:29 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Pragma: no-cache

Server: Apache-Coyote/1.1

Set-Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com; Expires=Thu, 30-Nov-2017 06:31:49 GMT; Path=/

Set-Cookie: tvrg_60409="1,1480466609"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 30-Nov-2016 00:44:29 GMT; Path=/

Vary: Accept-Encoding

x-tremorvideo-status: NO_AD

Content-Length: 544

Connection: keep-alive

...........R]o.0.}..`..[....J.2.*...%......w....?(.......e...q.......P.:{4V(...^?..d..Y%.C...:....c..g...Q..7..6...0t.ke6..1U.....n...m.|._g.A.g.....h..a..:.......*..6[...P=|[.....mVdO';..I:P./..dR.....h:.l:...S..F.c..O.x...x...I.%.c.=....Jg..5...yS..DW~gQ !.....EU~wy."..t.....8.F.-...wD....:..9.-........p.h_....Z...F..Gbc.....-k...b.@""{.QA.....^.FPTR8.I..gJ6.A{.....\c.G..|!T)U...c.o...1888...g.OK...&.`8."6.F.1.1N.cd.u..&.x|~N......(.Oz..........*.ew...6y...X.(..........z....6h.a..xn........g..HY.`[......................n.^......d...H...HTTP/1.1 200 OK..Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding: gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Wed, 30 Nov 2016 00:43:29 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com; Expires=Thu, 30-Nov-2017 06:31:49 GMT; Path=/..Set-Cookie: tvrg_60409="1,1480466609"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 30-Nov-2016 00:44:29 GMT; Path=/..Vary: Accept-Encoding..x-tremorvideo-status: NO_AD..Content-Length: 544..Connection: keep-alive.............R]o.0.}..`..[....J.2.*...%......w....?(.......e...q.......P.:{4V(...^?..d..Y%.C...:....c..g...Q..7..6...0t.ke6..1U.....n...m.|._g.A.g.....h..a..:.......*..6[...P=|[.....mVdO';..I:P./..dR.....h:.l:...S..F.c..O.x...x...I.%.c.=....Jg..5...yS..DW~gQ !.....EU~wy."..t.....8.F.-...wD....:..9.-........p.h_....Z...F..Gbc.....-k...b.@""{.Q

<<< skipped >>>

GET /report3.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:46:49 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:46:49 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8......

GET /report3.php HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: vi.ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:46:50 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8

HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:46:50 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8..

GET /5/10/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: l.longtailvideo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Wed, 30 Nov 2016 00:43:25 GMT

Etag: "3015243340"

Expires: Wed, 07 Dec 2016 00:43:25 GMT

Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT

Server: ECAcc (arn/46B0)

X-Cache: HIT

Content-Length: 1845

.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP....0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......cv..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. ...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !.....Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9kL....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{......>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'....x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`...8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.bi..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se

<<< skipped >>>

GET /counter/counter.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:23 GMT

Server: PWS/8.1.41.3

X-Px: ht h0-s1150.p11-fra.cdngp.net

ETag: W/"576924c5-654e"

Cache-Control: max-age=43200

Expires: Wed, 30 Nov 2016 10:14:08 GMT

Age: 8955

Content-Length: 9529

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT

Connection: keep-alive

...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C........l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&....d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q......$|...._.;...Em..itPa......P..Gj.. .5. G..1m.....Ee...F70..ZUU&.&.?.>..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4.................#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*..EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t.........J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D...y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\....'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....

<<< skipped >>>

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 08:51:05 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Wed, 30 Nov 2016 08:51:05 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /page-1.html?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:21 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip

f45.............\.S.H..9.....[.`.l....3..L..I....[S).-.,aYR......}..zX~...l..T.j.....O..u...Brf.<...j..v....J...v....u....t.s...... 4f....D......m.......v.}..FW......SqF..U<!....P6*..h......ZMc.Ea..;..U.-.....J....$..@t5)nd...x....5..z..|"B.r...j.; .h.C&ma......`>..U6_...C....^...x\.C..b......}........F-....C.:. ..n;.).,.....q7.@....-.(.}...z..1.b...*.o`P}.....k..[.....3.~,7..S.a........_...?6..n|.Dqo.......l..~fz.V.:...CG...C[p..M..|s.z}.w}...,....<...}.1.v......0.....h...c..9._r...-..[3...w.....U..gT..|.......X......... ..{..'.....lU.A.q.r5..D.C6. u..|..1......$vk7.<ll.$..u.x...`."..[.$..M..).I..\.|.....0.n1........./- ..^...~5...(,$..y.4..B...e..q!.K.h8.....X}...m..u0..T.T..R...~..h.{.?...Y}]q......T...W@63...V`.GN.b..*...s..g.ks.....i../w<.nlU0=.`....L.0Q...i.y.Sk...hli./.k..dT..3c...$.n..m$.X.....D.......fJl.....g....DHB[.1..>`nO..Y.e4B.9_....H......4...QPM...?.(..N$..J.P.h..l.f...3(.l.}...Vf(.......U,D..qn.1f...z.....Av..-..g.}']f.I.L...}...D...i..9d...3(.?.H2Q...1.a...U.aO.S.Q..."...ER.P...(.M.Ax0.z.]..E.-.X...D...[.a..A(v.IW........D.i..y.l..% I........|.......R...Y....&9}.....Z...U$.{h...3....7O}St.B.z;.~.._&..w...6[....Gi.ki.E:Z]... 8.t. .g..B...d2.w.G,.$.....Dd..|nv.I%.B....jis_.....q[...{.,V.QK.v2B.w\...t,B....O.fn.._...7.s...T.=..K.j#.....A......4`...:...~y.........o.>\...6..F.%R?..9.....\.wF.wLJ=.t.....?1..t..........._.......Z.B*................5J.8.p.....n..R......[....Y.....<}...s...Rx...............).......<.,...M.......E.............]...K U...;.:EO..e...]s..`...D

<<< skipped >>>

GET /page-1.htm?lid=937115 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:22 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip

117f.............\kS.H...T.?.hkb{...m...)B....*!;..JQm.e.dIH.....{n...F..............=}.O.".... ...L"k...?...(..........>.l.zc.G....3<7..........1....5...C....P.....V..m.. .F |/...?..6..S...T.wP..f...d.H......14...X4...D.2j..).S......f..."....U4..i].S..h$....w..-g.......`.......a6.......j.b..G.. C.)...........8]...}d..p.L.m*l......;..M.....=.,.}f[..y..x.&.s..Y(. {...H.N...&Q...r8.J/L...1.*5.~....|V..`lG....:.6.oLk6.....,.#Q.<..n.....g..`hx..<...?....PW.....1..6D..8..........nFO........D..@.}.c.4*.O..{$J.......2..#/.hB!.Ld..M{.l..7.[)X.h]q...`...L...6......3....b.._.I..Or....../...6=. .......,-...C.7...k......f..3..c.j*.J.......E0.............u......T.P.....u.ln...VBs...I. ...NTH......u.._.q..sM..o.s.P.b..XCwPHr...Yo...|.....Y!.Z.2v&.B..pl...y!.......dRm/..D!E.I..r</....@..Z.M.V....Q.sR..lG.l.B..X.........>0...dO.S...R..b.O...G..baA.b...f..Z3....R...*..d...3c.....m7.:..$..y.Qb.L..Dz.CJ.........Bg.HB_.0.s.C....j..\..._.;....]VG.)i)3.#...,...(.p.0:.*.Z...=...&...A....EV.ja.b.M.|...X^...j%...R.PU(....*..c.I..o."SHG..3.A,I.g..@..e.yc.J..S|g...J>EU>.1tT.uL.4..Y.....[.....~........(.1..D..S\.~....4.?.[..#...~P......>.....$.d........l..1j.C(....v.(K`],.D.^...t..H.....=.M..g6..)7.=S.3.....a.......i.t;......i..I..D....1vz~bG..G...R...2.w..,.$.....Eh..|l................6.;X%.eKL.WRc..s.).z.......E@8X..|b..>.......Mg<Q..|.*9...Nd..N...L'...S.$.........w...:.......s....;...........{.....6).....w.........oN......:~~.....W.q.RqF.EU....~8>9~.FoR....'o....c;..N.O^.]....M.....r..O.........K.5.

<<< skipped >>>

GET /css1.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1480466603.4768EC11B3054F99C2BAA38B65E80AD8.1.1.1.1.1.1.1.1.1; _ga=GA1.2.763910521.1480466603; _gat=1

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:23 GMT

Content-Type: text/css

Content-Length: 1963

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Mon, 10 Nov 2014 09:13:53 GMT

ETag: "a1af7-7ab-5077d94d75640"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes

A..{..COLOR: #000000; ..TEXT-DECORATION: none;..}..A:link ..{..COLOR: #000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 13px;..}..A:visited ..{..COLOR: #000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 13px;..}..A:hover ..{..COLOR: #000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 13px;..}..table ..{..FONT-SIZE: 10px;..FONT-FAMILY: verdana, Arial, Helvetica, sans-serif;..}..td {font-family:Verdana;font-size:8.5pt}...body {..BACKGROUND-COLOR: #ffffff;..margin-left: 10%;..margin-right: 10%; ..border: 0px solid #979696;..}...topmenu {..BACKGROUND-COLOR: #eeeeee;..border-bottom: 1px solid #B5B5B5;..height: 35px;..}...topmenufont..{..COLOR: #B5B5B5; ..TEXT-DECORATION: none;..}...topmenufont:link ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...topmenufont:visited ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...topmenufont:hover ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...logo {..b

<<< skipped >>>

GET /img/lbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1480466603.4768EC11B3054F99C2BAA38B65E80AD8.1.1.1.1.1.1.1.1.1; _ga=GA1.2.763910521.1480466603; _gat=1

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:23 GMT

Content-Type: image/png

Content-Length: 200

Connection: keep-alive

Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT

ETag: "a1c85-c8-4ebb56fac1880"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes

.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:43:23 GMT..Content-Type: image/png..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT..ETag: "a1c85-c8-4ebb56fac1880"..Server: CDCE..X-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-001.ams002.internap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`...

GET /jwplayer1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 08:51:05 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT

ETag: "4403af-25d37-53444eccf91c0"

Accept-Ranges: bytes

Content-Length: 154935

Cache-Control: max-age=2592000, public

Expires: Wed, 01 Nov 2017 08:51:05 GMT

Connection: close

Content-Type: text/javascript
var dtn = Date.parse(new Date().toString());..document.write(unescape(
'
>>

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 08:51:06 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Wed, 30 Nov 2016 08:51:06 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /itd.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: aoaomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:22 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 1325

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
<html>..<head>..<title>a</title>..</head&gt
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {..  var nameEQ = name   "
=";..  var ca = document.cookie.split(';');..  for(var i=0;i < ca.l
ength;i  ) {..    var c = ca[i];..    while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);..    if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);..  }..  return null;..}..function uapcc()
 {..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime()   (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 50);.
.setInterval(function() {..uapcc();..}, 90);..//-->..setInterval( "
onl()", 60000);function onl(){if(document.images){document.images['onl
v'].src = 'o.php?'   Date.parse(new Date().toString());}}..</script
><div style="visibility:hidden"><img name="onlv" src="o.ph
p"></div>..<meta http-equiv="refresh" content="300">&lt
;/html>....
>>

GET /o.php HTTP/1.1

Accept: */*

Referer: hXXp://aoaomo.tremorhub.com/itd.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: aoaomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:22 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 3

Keep-Alive: timeout=5, max=99

Connection: Keep-Alive

Content-Type: text/html
...HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:43:22 GMT..Server: Apach
e/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length:
 3..Keep-Alive: timeout=5, max=99..Connection: Keep-Alive..Content-Typ
e: text/html.......

GET /bck.php?1480466602000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:46:50 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
....


GET /bck.php?1480466602000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:46:50 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:46:50 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Timing-Allow-Origin: *

Date: Tue, 29 Nov 2016 23:55:00 GMT

Expires: Wed, 30 Nov 2016 01:55:00 GMT

Last-Modified: Wed, 28 Sep 2016 20:19:01 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11590

Age: 2900

Cache-Control: public, max-age=7200
...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'
V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W]
.b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..
~.............>..........GB..N....?...?.I2.....U...o<.....W.;...
x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/
..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<
.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo..
...]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..
~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.
E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)
....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]..........
..*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.
........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9
..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....
q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z...
...Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....
C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.
X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'
....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P
..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...z
Z...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@
........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
>>

GET /r/collect?v=1&_v=j47&a=105673728&t=pageview&_s=1&dl=http://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323&ul=en-us&de=utf-8&dt=searchbox&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=495422830&cid=2093138924.1480466601&tid=UA-74694740-5&_r=1&z=1103281923 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Wed, 30 Nov 2016 00:43:21 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 30 Nov 2016 00:43:21 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;....


GET /r/collect?v=1&_v=j47&a=1085413297&t=pageview&_s=1&dl=http://VVV.ivids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1777473885&cid=763910521.1480466603&tid=UA-74694740-2&_r=1&z=1229294853 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Wed, 30 Nov 2016 00:43:23 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 30 Nov 2016 00:43:23 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..

GET /img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.ivids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1480466603.4768EC11B3054F99C2BAA38B65E80AD8.1.1.1.1.1.1.1.1.1; _ga=GA1.2.763910521.1480466603; _gat=1

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:23 GMT

Content-Type: image/png

Content-Length: 2536

Connection: keep-alive

Last-Modified: Thu, 10 Jul 2014 23:39:15 GMT

ETag: "a1c81-9e8-4fddf55270ec0"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...zIDATx..]]S.W..N.......7.NE.........(...H.8S..V.
....H;j.v..%.3...^.`...3...3....7.6......>..r..n...$....a`M.ys.9.y.
.,..U.[..a.a9M..8M .....4.`..8..4...i...:M2MXd.&J..{..K....=.?........
m.....!sX...M!.5.}...){.....].r..l.U..Vv9.afH.......Wr.i[FEX..v...;...
. Y.=."d.bjy..L,.......Ph..$..I.B...]W...}.3*.B.....-..&....!..gT..{.q
.`...hv.........i..8M ....#~z.|]......}a.......5y..!..&...NzV........&
gt;1....wb..A.E.|g..j....J7m./.w].Df.v.N.FN.}.%...#........g.7...G.wW.
.8"............SGe...x...M..%kV.%.B...7........gz.....K.....d.Da......
../........=).....G?. ..<...Q...k0...v.B.....fn4.:._a...|...J7.g.(:
...&..k.1.i......&.;........@....y.z..|[....w-....}.......c5....I=..J.
..j...5...."MV..[..8.Qw....w..........Ec}..~J.9m...A..v.?...m...FvU.; 
....~...r...g..x=....... .....>V....9...~.....!.u.J.FZ.iB.L.T..S./L
..*.q1..|..8.2.z1..5{....kdg....h.S..k...8.K.v.....Y..-.o.E@S..F.oo|. 
o.2.6.B...6..)m.T..Y........).O..........Q.'`.M.*J..p.tGW.....FO.C.=..
....b...*O..@....p*].h..Z.}.~....*G.....n$...D.....Q..4Y..8L..;...K...
Z..H1...ai.t.*yL...`-)2E..ip..C.d.&$*....p..[{.......4Ez..Gf.V..T.D[..
..g....Rm......u(Y.o@HT.*>?;}..D2ks...6>-\.)}Rb..ky......Pc.....
.-.\..?..s......319....^..D.i.C.....s.z.[..\...GJ...'8...Hi.s......-.S
.#...1...)..._S.V.ocE.\..cB.*Y.Z..B..%..r..73.8..p....P.U..\......2.2u
....S.....iQ.............P.y...{ 7i......v.s..N..-....K]\v.%..Vo$.P..&
lt;....}....Wb..9..7.p..$4=N Mj..0..4gj..Hie..5;-......6...8..m.(.
>>

GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=4768EC11B3054F99C2BAA38B65E80AD8&sc_random=0.6264624061063745&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.ivids.net/page-1.html?lid=937115&u=http://VVV.ivids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:23 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Set-Cookie: __cfduid=dc6b71b1b298a73db8b24e47946c18be61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=/; domain=.statcounter.com; HttpOnly

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10675947.1480466603.0; expires=Mon, 29-Nov-2021 00:43:23 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1480466603302962551; expires=Fri, 30-Nov-2018 00:43:23 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 309a43cf757e405c-SOF
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Wed, 30 Nov 2016 00:43:23 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=dc6b71b1b298a73db
8b24e47946c18be61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10675947.148
0466603.0; expires=Mon, 29-Nov-2021 00:43:23 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1480466603302962551; expire
s=Fri, 30-Nov-2018 00:43:23 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 309a43cf757e405c-SOF..GIF89a............
.......!.......,...........T..;..

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: cdn.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Type: text/xml

Content-Length: 130

Connection: keep-alive

Date: Thu, 22 Sep 2016 17:57:27 GMT

Last-Modified: Thu, 04 Dec 2014 23:41:04 GMT

ETag: "2cf4c5e3d4c1206209355ac1065b0efc"

Accept-Ranges: bytes

Server: AmazonS3

Age: 21840

X-Cache: Hit from cloudfront

Via: 1.1 3ef066dcf359ad5dbc339df978147194.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 3a4igCQjSMA394Ibj8YDGTKBHSZoRfhl9x9QD9GcnhPjWHIw5fJdyw==
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" />.</cro
ss-domain-policy>....


GET /static/noad.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: cdn.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Type: text/xml

Content-Length: 73

Connection: keep-alive

Date: Thu, 22 Sep 2016 17:57:27 GMT

Last-Modified: Thu, 04 Dec 2014 23:38:15 GMT

ETag: "074455bdeaf186ffa7b220bc14965cd5"

Accept-Ranges: bytes

Server: AmazonS3

Age: 21841

X-Cache: Hit from cloudfront

Via: 1.1 3ef066dcf359ad5dbc339df978147194.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qD1xw02Y4UGp6bidxqGvsPQ4E25jSXcay4A9OxJD3FmVU-gFyYkmOQ==
<VAST version="2.0" t:status="NO_AD" xmlns:t="hXXp://tremorhub.com/
ssp"/>HTTP/1.1 200 OK..Content-Type: text/xml..Content-Length: 73..
Connection: keep-alive..Date: Thu, 22 Sep 2016 17:57:27 GMT..Last-Modi
fied: Thu, 04 Dec 2014 23:38:15 GMT..ETag: "074455bdeaf186ffa7b220bc14
965cd5"..Accept-Ranges: bytes..Server: AmazonS3..Age: 21841..X-Cache: 
Hit from cloudfront..Via: 1.1 3ef066dcf359ad5dbc339df978147194.cloudfr
ont.net (CloudFront)..X-Amz-Cf-Id: qD1xw02Y4UGp6bidxqGvsPQ4E25jSXcay4A
9OxJD3FmVU-gFyYkmOQ==..<VAST version="2.0" t:status="NO_AD" xmlns:t
="hXXp://tremorhub.com/ssp"/>..

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: thm.vidvib.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:41 GMT

Content-Type: application/xml

Content-Length: 82

Connection: keep-alive

Last-Modified: Fri, 20 Jun 2014 22:54:54 GMT

ETag: "1000000015848-52-4fc4c61b7eb80"

Server: NetDNA-cache/2.2

Expires: Sat, 25 Nov 2017 00:43:41 GMT

Cache-Control: max-age=31104000

X-Cache: HIT

Accept-Ranges: bytes
<cross-domain-policy>..    <allow-access-from domain="*"/>
..</cross-domain-policy>....


GET /abcd.mp4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: thm.vidvib.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:41 GMT

Content-Type: video/mp4

Content-Length: 5784

Connection: keep-alive

Last-Modified: Sun, 04 May 2014 13:45:24 GMT

ETag: "10000000157fb-1698-4f8933a030500"

Server: NetDNA-cache/2.2

Expires: Sat, 25 Nov 2017 00:43:41 GMT

Cache-Control: max-age=31104000

X-Cache: HIT

Accept-Ranges: bytes
....ftypmp42....mp41isom....mdat.................3../..aP.pAr.2H..*=4M
icrosoft H.264 Encoder V1.5.3..............sC....B.5l.src:3 h:480 w:85
4 fps:29.970 pf:66 lvl:9 b:0 bqp:3 gop:60 idr:60 slc:1 cmp:0 rc:1 qp:2
4 rate:5500000 peak:0 buff:2062500 ref:1 srch:32 asrch:1 subp:1 par:6 
3 3 rnd:0 cabac:0 lp:2 ctnt:0 aud:1 lat:0 wrk:4 vui:1 lyr:1 <<..
....e..K....P..#...}..}..}..}..}..}..}..}..}..}..}..}..}..".."........
......................................................................
...;...c..[.o.......?....{m....?....{e........Y.}z~...?}..}....[...}..
..[......?..5.....M<4....=4.}..}.._...:.../.._......Z.Sd..t...ET...
..3...1..........u...t..u.M......\.<....B.u....:......`.5.U..\..U/.
.D.y..Dj..).(=......:.Q.o.?...o...8 ...6....C..]..?..DJ.U. y.e. .v.M..
..D&No..W.....Y...Q*RU... ._...n....x(.....eU*.........Z.j..........B.
...kU..H..&U..x.'..~.>....!yI..^^U..Iv..''!-p.?Dd.....7..P..d`.j.Z.
......d.....x&..'V.WW..say]....R..u....JXd~........u.}k_p...Z.U.jl..F.
.K...GY?:.:d)-........!^U......B.O.?......'....!.G.......>.w."..".N
.k*.....\NN..........U........R....~R..Cz...%...\.Z.W.j.r..R*..UV...;.
..*.W.._NJo.H....LG.........l.....W...u'....?...!2..'' ....,.//'OZ.W..
"......{.R.W..y........)4H......._^..,.;XS../...O.^.....j....O...EUU..
E..y.g.Uw_Y........B....!:.(..../.... F.....W..w\.NN^]JMjG....G.....O.
.....`.....BuiI.e$..Il../....}k.~_...yTu...i.{..RC.b....]._.,.....kA..
.a.Z.[{e.{X.m....._{s.Z.. .].'...^..Z..ZHZ..S........DK.tL'.9./}D.....
......'.xF....2.......?.p..a......p.X....X..y?..`.%y..k.>......
>>

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.763910521.1480466603; _gat=1

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 08:51:07 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Wed, 01 Nov 2017 08:51:07 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... 
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
>>

GET /homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323 HTTP/1.1

Accept: */*

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.hikeemissivity.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 860

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Encoding: gzip

Date: Wed, 30 Nov 2016 00:43:20 GMT

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 7419ebe6dc61a036c7f081375facfd52.cloudfront.net (CloudFront)

X-Amz-Cf-Id: qZgR5wslkOiXEwPAv9FbFWrcyNwzsYfihh0Gy_YkPi2Zr0nhepo-Tg==
...........UKs.6..g&.....*. .'j"A.<<.{H.q...... .....(F...w.....
.3.. ........wj.n...u..'....g..w._....._.. .,.s....;......4.F{..r~..n 
..5...1o.;..}...EY...^........k:..t".5.!Q......,-..........w..p...Nv\9
X...O.NX..Dq.........S."..GIp..(.l......'{n.m...h5......{(...L........
.R7.lv...B.Q....2.sgt1E.&....B...,}...!w..q... ....:Z...d.."....j#.L./
F .)Y..E..Y..P.W..y......._.9....1^F...I.<j...J..d........`cA0.F)L.
K........f..7.)....v...tT..!...KH.oA.....P.$.v..!...]n.&.9....yI>..
(x..:x).o.k..\1............K.....M.........f..1.n.5.J....{i.. ..<.*
.......CE..(uo.....1....Z..........f..FE....Bj............Y6uX~W..L/..
...MM.}....5.?];.lxLk@lxF&............I.x..|.&.N..t..=>...1..t....E
x..6...Gt.5.5]..5....Blc.8.*.=...G-...tT..Qe.8.t...2.fi......x....5vR.
...>FA..s/....H.*...eU..../....3Z.4...M.?.._..29;=.pv.......)..4^..
.$...L#..c....\..`.E'u(..[MBy.?.o-._jJ...HTTP/1.1 200 OK..Content-Type
: text/html..Content-Length: 860..Connection: keep-alive..Server: Apac
he/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Encodi
ng: gzip..Date: Wed, 30 Nov 2016 00:43:20 GMT..Vary: Accept-Encoding..
X-Cache: Miss from cloudfront..Via: 1.1 7419ebe6dc61a036c7f081375facfd
52.cloudfront.net (CloudFront)..X-Amz-Cf-Id: qZgR5wslkOiXEwPAv9FbFWrcy
NwzsYfihh0Gy_YkPi2Zr0nhepo-Tg==.............UKs.6..g&.....*. .'j"A.&lt
;<.{H.q...... .....(F...w......3.. ........wj.n...u..'....g..w._...
.._.. .,.s....;......4.F{..r~..n ..5...1o.;..}...EY...^........k:..t".
5.!Q......,-..........w..p...Nv\9X...O.NX..Dq.........S."..GIp..(.
>>

GET /jquery.min.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.hikeemissivity.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 878

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT

ETag: "b0000003c0a95-1d65-5418029ba830a"

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Sat, 26 Nov 2016 22:59:44 GMT

Vary: Accept-Encoding

Age: 1504

X-Cache: Hit from cloudfront

Via: 1.1 7419ebe6dc61a036c7f081375facfd52.cloudfront.net (CloudFront)

X-Amz-Cf-Id: 5djjYFnfujygNBhvGosrVESWBr1cBfKE9PWBQ_JbksUWlwYJAN0BCQ==
............Qo.6.....;.z....$.....6`...o} .@.'..D..e.h..w...B.u..:.0dK
...........A...H.$...<.)v...2.......v.Q.[>l.q..X.,J.............
....I...nG:% G..|.H.C.....p`.. A.<~...;....0.D...W.<.S.....v....
...fIK}.VS^.S..;C93......2%k.{..x.....].z...j.....8..@...nM3.l......f.
d.,)/.......8..=.Rr..#..8I..1..b(.{.F.a... [..Z3....%q..._S..p.%..L...
#..&.|.Qf.:{..;.,...D.YmF..P._....;.?vD}^...6]...<.....19M.2.EBSmd.
j..V..L_%(.....l<...F[L..V"M'[(..4.........K..{HW..0).}2.Z.u.6.8.l.
..I.../.~Y..>.*v.....0[..Jk.....u..............b......a.....^..e.e.
......T..F...VPZ.<,...q^....\.]4.....nn.yi........>I...k&....n.W
....r..%.......;..q2..^..`1l.Ra.D....yT..v.d.^..z.\/2..p.....c1R....*.
o.<.""....T....7............6....C..n!..........._J<.v...h...L.Q
..!...D!.=!.B..y............?...........(`..Yp......<.0.<3=3=3=3
=3=3=3Gf._0..8.L=7=7=7=7=7=7=7Gn......3.3.3.3.3.?d...7G....*._.9......
...e...HTTP/1.1 200 OK..Content-Type: application/javascript..Content-
Length: 878..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT..ETag: "b0000003
c0a95-1d65-5418029ba830a"..Accept-Ranges: bytes..Content-Encoding: gzi
p..Date: Sat, 26 Nov 2016 22:59:44 GMT..Vary: Accept-Encoding..Age: 15
04..X-Cache: Hit from cloudfront..Via: 1.1 7419ebe6dc61a036c7f081375fa
cfd52.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 5djjYFnfujygNBhvGosrVE
SWBr1cBfKE9PWBQ_JbksUWlwYJAN0BCQ==..............Qo.6.....;.z....$.....
6`...o} .@.'..D..e.h..w...B.u..:.0dK...........A...H.$...<.)v..
>>

GET /amg.php HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.hikeemissivity.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 359

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Date: Wed, 30 Nov 2016 00:18:15 GMT

Age: 1505

X-Cache: Hit from cloudfront

Via: 1.1 6e8dd39e00d9a5c1a31d69ffa2821a5e.cloudfront.net (CloudFront)

X-Amz-Cf-Id: MrPjTjl3ZL3_WXMUTnYEbmaFKi8cIK7uI4xgIQuSAraDjjc6MQ2V0A==
...<script type="text/javascript">setInterval( "vwu()", 200000);
function vwu(){if(document.images){document.images['viewers'].src = 'h
ttp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png?'   Date.parse
(new Date().toString());}}</script><div style="visibility:hid
den"><img name="viewers" src="hXXp://whos.amung.us/cwidget/iebro
wser1/000000ffffff.png"></div>HTTP/1.1 200 OK..Content-Type: 
text/html..Content-Length: 359..Connection: keep-alive..Server: Apache
/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Date: Wed, 30 No
v 2016 00:18:15 GMT..Age: 1505..X-Cache: Hit from cloudfront..Via: 1.1
 6e8dd39e00d9a5c1a31d69ffa2821a5e.cloudfront.net (CloudFront)..X-Amz-C
f-Id: MrPjTjl3ZL3_WXMUTnYEbmaFKi8cIK7uI4xgIQuSAraDjjc6MQ2V0A==.....&lt
;script type="text/javascript">setInterval( "vwu()", 200000);functi
on vwu(){if(document.images){document.images['viewers'].src = 'hXXp://
whos.amung.us/cwidget/iebrowser1/000000ffffff.png?'   Date.parse(new D
ate().toString());}}</script><div style="visibility:hidden"&g
t;<img name="viewers" src="hXXp://whos.amung.us/cwidget/iebrowser1/
000000ffffff.png"></div>..

GET /draw/?w=colored&n=2470&c=000000ffffff&p= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hikeemissivity.pw/amg.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Cookie: uid=CgH9I1g IKk63nhbx4f/Ag==

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.9.6

Date: Wed, 30 Nov 2016 00:43:21 GMT

Content-Type: image/png

Transfer-Encoding: chunked

Connection: keep-alive

Content-Disposition: filename=wau-widget.png

Expires: Fri, 30 Dec 2016 00:43:21 GMT

Cache-Control: max-age=2592000
68a...PNG........IHDR...Q...........p.....PLTE...EEEYYY...???AAA......
.........;<=...~~~...abdWXZ...""",,,...............GGG.............
..'((......222.........uvyEFGzzz...<<<...kln...NNN>>&gt
;......QQQ~~.vwx...hhi.........OPQ.....................iii......uvv...
opp......UVV......ooo............bbb......bcc...ijj}~~......dee.......
..qqq...SSS......]^^PPP.........TTTaaaVVV............{{{...HHHrss.....
....kllJJJDDDBBBLLL......RRR...III............FFF.........NOO.........
@@@tttkkkvvv:::............|||.........WWW..................;;;.......
..?@@888666ppprrr...............KKK.........CCC...111.................
.000...lll......XYZ(((&&&hhhfff   cdeZ[\788...dddccc.........nnn......
...ZZZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjj0..w....tRNS.@..f....IDATH....W
.W....Z)*.....&H..Z.(J.n....Z.Z.....-.....Q....kUR...(.$V!.8.j..F.....
!'(?p.......L>....$. ...7..-]........z_..._.66..WL..6..........!...
./..:...>}V..K<...<...J..G.s.=.....U....r....G..cq....T^V.w..
...X......r.s.FI.u.n.*...v:..]E.8..\ p".].?/_....\.|,y..s......-......
,U8}J...'8..c.....pD.K.g6..d.>.4..< ..w.n..4...l.Y.}.nd..z.N...a
c..~.e.l.....m).....f....M......=..~_.X'..Eq........[. Vo.M.B.>...Q
.. .M..%-T..].|.R.._.S.....B.S..'..V..?......O)|..BX@i..E...|..|...s.y
..Y....h.<7.....vEY._kC].t.0..m..(b-U....S.V.di.$M.NtL`.u..1=1_.&.V
I.W0N....K....c.1....dF...G.3.q.J8....._.eQ.U.t...b1 .....(.....b2..Z.
..A.{!...f. 0..C..b.....Q7.)1.....0.[.=4.rg.2.tj.08s.^KL..a.n.H.1.F...
.[3.......^..X..s..v....O2G.{I.6...P..3(..2..5".i/.....[.O.....W?.
>>

GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hikeemissivity.pw/amg.php

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Wed, 30 Nov 2016 00:43:21 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/draw/?w=colored&n=2470&c=000000ffffff&p=

Set-Cookie: uid=CgH9I1g IKk63nhbx4f/Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/
0..

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 08:51:06 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Wed, 01 Nov 2017 08:51:06 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... 
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: we1sb-wwcgk.ads.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Wed, 30 Nov 2016 00:43:35 GMT

ETag: W/"144-1446243360000"

Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....


GET /ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=[CONTENT_LENGTH] HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: we1sb-wwcgk.ads.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store, must-revalidate

Content-Encoding: gzip

Content-Type: text/xml;charset=ISO-8859-1

Date: Wed, 30 Nov 2016 00:43:35 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Pragma: no-cache

Server: Apache-Coyote/1.1

Set-Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com; Expires=Thu, 30-Nov-2017 06:31:56 GMT; Path=/

Set-Cookie: tvrg_60409="1,1480466616"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 30-Nov-2016 00:44:36 GMT; Path=/

Vary: Accept-Encoding

x-tremorvideo-status: NO_AD

Content-Length: 597

Connection: keep-alive
...........S.n.@.}.W.H.-........T..6....Eh....a.......r.^.*..3....9;..
....(..H..h..@P.....!.......x.m..0....B_.....^{.Q.H........u..Z.b.N.o.
.l..q..i.S....Y..6..y.v......./...T.?.i..q.....\.%..$4...IP!.. ...H...
..yv.L.e.....AD.3?..a......].A...$.......F........_..?....0b..".X..i.?
u.. .....3..i.n;X...P...<[..0;0.0`..hN....j@p.Y....u.@.%.4.8i..!.X.
.......X.Q;........Z...x%.A..8g./.........o....#..U...n.W%.g....~.P.*.
B6...!P...S'FYxzJc.O.VJI..|.......^7...yp..f........?......,..#.^.XU']
].N3....?....>.....]?p..< ...z.*.K7Z.?r..1.._7...-......bw......
G02W..q.V.T[c....{..~K..m.n.y.................HTTP/1.1 200 OK..Cache-C
ontrol: no-cache, no-store, must-revalidate..Content-Encoding: gzip..C
ontent-Type: text/xml;charset=ISO-8859-1..Date: Wed, 30 Nov 2016 00:43
:35 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com
/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com; 
Expires=Thu, 30-Nov-2017 06:31:56 GMT; Path=/..Set-Cookie: tvrg_60409=
"1,1480466616"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=
Wed, 30-Nov-2016 00:44:36 GMT; Path=/..Vary: Accept-Encoding..x-tremor
video-status: NO_AD..Content-Length: 597..Connection: keep-alive......
.......S.n.@.}.W.H.-........T..6....Eh....a.......r.^.*..3....9;......
(..H..h..@P.....!.......x.m..0....B_.....^{.Q.H........u..Z.b.N.o..l..
q..i.S....Y..6..y.v......./...T.?.i..q.....\.%..$4...IP!.. ...H.....yv
.L.e.....AD.3?..a......].A...$.......F........_..?....0b..".X..i.?
>>

GET /ova-jw.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/player1.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ivids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.763910521.1480466603; _gat=1

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 08:51:11 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT

ETag: "4403b3-39741-4fbe0551c3280"

Accept-Ranges: bytes

Content-Length: 235329

Cache-Control: max-age=2592000, public

Expires: Wed, 01 Nov 2017 08:51:11 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
>>

GET /10114910/0/757d7213/1/ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:24 GMT

Content-Type: image/gif

Content-Length: 49

Connection: keep-alive

Set-Cookie: __cfduid=d9d3a1e1db2f75a801067e6bf74f072b61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=/; domain=.statcounter.com; HttpOnly

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1480466604.0; expires=Mon, 29-Nov-2021 00:43:24 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1480466604145085836; expires=Fri, 30-Nov-2018 00:43:24 GMT; path=/; domain=.statcounter.com

Server: cloudflare-nginx

CF-RAY: 309a43d1a08d401a-SOF
GIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Wed, 30 Nov 2016 00:43:24 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=d9d3a1e1db2f75a80
1067e6bf74f072b61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.148
0466604.0; expires=Mon, 29-Nov-2021 00:43:24 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1480466604145085836; expire
s=Fri, 30-Nov-2018 00:43:24 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 309a43d1a08d401a-SOF..GIF89a............
.......!.......,...........T..;..

GET /wp-content/themes/howcast/images/icons/love.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: VVV.howcast.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:21 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT

ETag: "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"

Accept-Ranges: bytes

Content-Length: 127

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: image/png
.PNG........IHDR................s....gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx.b...L.`..`.>....jg.....IEND.B`.HTTP/1.
1 200 OK..Date: Wed, 30 Nov 2016 00:43:21 GMT..Server: Apache/2.2.22 (
Win64) PHP/5.3.13..Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT..ETag:
 "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"..Accept-Ranges: byte
s..Content-Length: 127..Keep-Alive: timeout=5, max=100..Connection: Ke
ep-Alive..Content-Type: image/png...PNG........IHDR................s..
..gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...L.
`..`.>....jg.....IEND.B`...

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Wed, 30 Nov 2016 00:43:29 GMT

ETag: W/"144-1446243360000"

Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,centro,_dmp_turbine,Pulsepoint,TubeMogul-GP,adapTV,TapAd,rocketfuel,1,thetradedesk,Bidswitch,beeswax,appnexus,tremornet,audiencescience,BidTheatre,videoamp,dynadmic,ignitionone,conversant,mediamath,eyeview,google,Videology,dataxu&uid=69be0537b12244c29476d5cd69b6ece4&init=true HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:29 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 516

Connection: keep-alive
...........R.n.0... \..-..H. .P.....A... 0F.T&l..Iy....'.r.A......L:;4
.....JfA.....Lq!.,x,?]..Y..]...B.x..J;uY.vNO...l.Y.U..&.V..7..\k....Uq
..i.;y....h..8Z.M^.b;..C..9OE.^B....O.?.o..x:..`...z..=J&....<.'.g.
d..&..$.!@.G....5.']..J.[.0.3%.>.............2E-.#.JzfD.p.........K
..}.RpT[U......G.vC&.q'p.Sh-..Z.[.h.h.....tF..(.........p\l|Z~.....6..
4../.r.@..Q!.=...|C.h/.t..}h....'. ...kM%$v[..pRa?..U.`..l0.GC.0N.!2..
..4.s?..(...z..x].kfBfQW.U6....?K:.:'.k.A..0...!.b........1K.lCG|..IZb
.....9.-E.v.t.gq./.......L\.........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:29 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 534

Connection: keep-alive
...........R.n.0... \..-...[ .P.....F... 0F..LX".............7.Y.<N
2..UgK.I.fA?...RB.T.,x.?]M.y..y...[....D.n.,X{on..[..]7E(t.9g...q.|.f.
.o...H..;i...1d[kyp..4?.v..E.].....P>}.H../.wY......^1.....%...[..x
:D1..{.).........&q..{.......@.....)........MY*.y`...>.@0.3........
.6.Y".J....&o...m...m%....(.7...J...8^......>Jt;.....Q....-...XK..&
.P._...5..a. r;.3....6.h`2.{.T....yWX..ol!.u..l4-.7..... ..`..G8......
__.$..[.......uX...."QI..Y...=U.R.....v'.VG. ,...M\......#.3...Xr..Fir
kY..%.........-../...ew...z.....JD...-= ... .....d..C.......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:30 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1e9.............R]o.0.}..`..7....J.2.M...-){.*tc_..b[.....&....=D>.
...~E.S....X.d...C...)..6...O...H.E.4......Ei.\....;.w. e...0U..j.....
W....m..{I..^..0.5.6....J..n/.V..Fv.).a...1...,..<}..i0NRB..|.....0
...|..|<......g...O....[>...8........y.!X....jT.)....t.&....&p6.
....G.W...Kt.8r.;.....c....O.ma....-..b.Jg......p.$...C...gy#.W.......
.gy^"P2.....'B.6!.4..t..\.{.Z..&.......B.MM=.....o..(.....p:.c... ...5
..?'.`.2.....>....WNU.....;....9^<. m..[.'..P..........R.......@
........b..'..5.........d.. ....V.........0......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:30 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 534

Connection: keep-alive
...........R...@.}..pI.mE...0..$&{1.....i.R;J..nT.~.....l.....t..S.L/.
.uB.y)B...Z-.y.\.Bk.>}.Y..C....Ns..].zbBko..8.QX.j_e..,....2.m..th}
....V.......I....Z.,..z..$..yO^......y..._f.8._n.$SF....}k....Tq......
.v{c...G..2..8.z}..m......U...Y.>.L.k....T..:.4....<......(.....
b.'....../.n`...E._...(.*.<p.gn.=.........Z0(xN.@..`f.FO..H....>
...S#...`.d.t...FYr...@!7.R.......8....f=.....{...9P~.9z..Q..n..R..k..
@.T.y...W. ....Y.b....T.~..sb..mff..V.......g..V...f1.....L.*.&sQH...T
'.f.,.'.w.....F.T..@..x..hb;?.8w..K..}uiMo6E?..........D.......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:30 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1d6.............RMo.0...Wd..[........v@.b f7;.E@KD,$..IN..?...}\v.#..H
>0^..~p@cE..o<.y.T..Bm....r;....x.....t4....%^..^..3(kS5.....V{.
...\c....Mv..q..i....h.,o.C....A.?..{.o..../.......> ..K;..).h.W.V1
U._...p.q6.....C.h6.(.4.Y8....F'.O..8.bM...SC.....^......].Bg.#G...[&l
t;.<v.Z <5....d!Z...0T...>.n....p.(.m..dy..K..J..$..L/*......
..D....R.,@g..s...k...7\..kL)..4d.d^.(.... .C.....G.S}.....4..4.......
....-....CrH.mo<...y.7..?Jm.v7.............v.b....n..@^Zb..^. ..M..
?2:..z.O...d.................0......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:30 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1cf.............RMo.0...Wd...........v@.a f7;.E@.D,$..IN..?:..}\v.#..H
>0^....@..F%.d4...D.Rm.....q...w.:.. -.i.Q..K..9..}g.nL..#........u
.Z.x_.m.;/.3.....Z........8....c....M3,`...!..?..eE.|i..8......)......
...."..'........Y@.pr..h..@...Cp....2x.S...%R.o.]_...@B.;N....##^F...=
lQ.}d.9pE.r.a.I.=J'*.y...|..b..k)....jp. ...x.NJ"{...C?...a.:C.....n..
..`.7.5.T4l.....qt3 'A.."X..)F..>%A..K....}oLc...p...l...]......|&g
t;7..>......O.[. ... L./<;0.0 v|.....2...._..o...a..].J....d....
.............0......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:31 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 496

Connection: keep-alive
...........R]..0.|.....[..@.©8$..=5..p:.M."...l'....G.~HU.<.....7
X^.S.A.y%Bk4.Z=.y..8....|.Y..C..'...v4z(...Va.\8.QXV...A^.......6`j.Z_
......1.E.w.R.......(...%.S..'.Mc..a.m..._V.8._n.$(#H......E.l.8......
.?..........].y.1.N.2d`.R.....@C..3.N..........#..b..L.f.x.u.k..5....L
......g..M^.Nj..M.]Y..`%....8.`.7zZ ...2D}.......$.....O.I......Y)..V.
...i..<..d.g#.....{..MrF.)....F.....JU./.;?..@.Ls..j.N.??.v7...ov.8
..k.. Q......\...lK.Pw[.D.J.3.A}.Q..F.b...#m.cC.kb;?o.;........r77....
.......E........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:30 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 502

Connection: keep-alive
...........R...0.}.W.H.[q.Bn."..R.mw..m....{6X...M...C6....> ......
O8?U.........;pz Y...F.&..q...w.c.fW....P.....Z5#.j.j]6..........Kmc".
.].,.8Lx/..i....J[c...sm/M.C..<.MxF...u...Z,.,y..ST[...?........&lt
;...g.`<.N..4..(-....?.......j....x...}.m......8.....A...J.pjL....,
0.|`....F.Ips.....Fr....-o%..`. ..V.......b0(......:A.R.3....}.7.j!;.9
.Tn.]..../<..0.n....|.yS.<.........9........_......E_..U.Q' ..x.
..e../w.}..}....o...Q~|...>....m.R/....`..#q..h..1W.....Ef.)....._.
 ...C.d.K.....x.s....................


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:31 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 511

Connection: keep-alive
...........R...0.}.W.H.V.!..$(...T. .....r.)..vd;..}'...Hm....x.g&\\..
S.6\.....N.$U..C.....Sg.....4..........).-..k5...*.S%\cJ.c...[....y...
8LX'..hR..[/m...g...4}.....h.2r.m7q..e.J...V.$.Jl..[.FR..[h."..0:.&...
|B.....M<.......2z...I......XM.00Gt....... .R..V..@`..`...Z!x......
....4..M..I....... ..N.. .>:9.9....m...aF...}.N.J..Eg.D......^.C.g9
...$.z..So.O.,...c.........k...CQf........~.D.Y..K.:rHQ.~a.b........).
....c.....M.......]o..D...l.:.m..(5..B.8\j...`.0.?.f...&.....qw......N
v.J...,..M............3<.......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:31 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1c8.............RM..0...WP.........hv[..jW....*2..b%..6$...4.......y..
y.xs..N...F&.|:s....!_.wW||.r7...[..W.?...4k....j.yVc...-...=c.......&
q?..g.n.g...w..B=dyo,.i1.u..1.^..h..{.}.O..O......r.i i.._....a.... ..
G.r6.0`,\-. a..*...,...Vh5..4.w..{..........`..LA..@.........$,.......
..0..A-8..A....'............:...Z.,....c{4..!-%{.......'--..J..7.r..A.
.(X. .@..r........;......]S ..m7....T.w.u>.....P..F...L../j...h....
x.is....4~...1.......#k..._..J.~..{.".........d........6K.......0......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:31 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 468

Connection: keep-alive
...........R.n.0... \.....H~A..:)..h.Ji.A`P..E$........q.>.=qv5...6
.....C.d..`6..#.....ip_~|..6...[^..Z8...vk....f.....[..D4.9g.._;.}....
.]~.dI..,.n.1h....G.......K.k.$.C..._o.....:/......k24.K..B7.6VB..b..x
1..0.<^.9.`..2.].4...{.$...[....... ).t.tPG...!.A.;H/j.E....SO.z.AI
AP!H..._.e..<RQ!..?..$`..!Xr...w..C.H....2;..Jj..4.|U.4.ZT.0.".....
b.......1K..y.X...b#_..pp.......q......HyJ...v.4_....72...'......2...2
,K..b......O4.'f9.....(gGl......oO....}9.... ................


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:32 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 436

Connection: keep-alive
..........dRMo.0...Wx.......8..xi..(.bv.CQ..D.B Y.d'..c.,..I..#.H*[..[
0.u..y8.L..5.../y.X........{Y..Zt.Q.v ....f....:....w.9g.......<..u
[..EV...~X0....F.Q..17..............]......u.tjg.zM.&...5....."..D.4YL
g)...r...E..xv-....I..}.>D........C......').Nz...z-`.^G.b. .......|
..^........`Oh..;P.`....>.o.M'.'c ....6R.UO..i...z...(.y....H. ..9.
..E........oY..........w^.E.=.9%.)c.....lci.9...".'u@..P....@[r.f.#.Bf
..`....O.........l...........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:31 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 443

Connection: keep-alive
...........RMo.0...Wx.......8.......]1;..(.Z"b..,Hr...1Y......H=.OOL.C
....X.....'...wB.].o....~..K..eu..G..*.t..8...9.mg.....e.j.sK...6...l.
k?K..e.w.Z.9F.`..Yu....>a....BT..|]g....uQ...q..S$h...Aq.....i.G...
|2.1...3.Z..\.. 1.F:.^Hz0Z~:>. .....')..t.!\.J.P>....@...lQHh.5?
.U.@r(..........ZM..].:..g....Q.......R..'....It5..A..<...LD\P~....
.,a.ZscLg.qH.c..`O...Q..m.....{S....=)=k[...=.....!.....f.-......'Z..=
}.%6.u..d.[...O.;go........~2..........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:32 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 462

Connection: keep-alive
...........R.n.0... 2..m...I......Rtk1...(.Y"j..,Hr....4k......G....r/
.F;0Vt*.B?.F.X..z........,>d?..>......]..k...B.....o|.Ib..Fna.u.
.....r..Y.GE..P....j..dQ.kGUu.....i.k.p.cSd..V....N.45N. ....b..|i...4
.,MfA.BLi2.R..Y..8.. ....r......n..c-..W........r).B.\PI].B.[......&gt
;.=....Q...T.........r.l..[..F(..(q.6.$.Y.FQ..(.gS.0..)0......5.......
...o`g...8r.N.($4$.......r.m{u...L.h......._r.w(............a.H....'v`
.........P...x...Xd.?7.L&.=A^W...dX.[.......EO.........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:32 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 436

Connection: keep-alive
...........RMo.0.....F*...&@P..RV..n .....9..X........e.~\..7.g.y3...r
...:.U....0..4..-...._&....}/..B..4|......{3%.[.......$..0.S..o].~{\..
a..<(.......U.. ...6....|$O.%.......>..o..|9..j......v.)M.....i.
Y.....bJ......#...k>Hz&.....g..h^.....t.y.(..!......)H..@Q........N
p.T..55%....:0Z(...K...m..^..........FQ..(..#.0...0.__.....a....A.`.w.
.c.......|...).{m7y.\<<.{.....Y.N...8wRds........=....-e......w.
&.n..L~..|,.....x. .....?..........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:32 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 418

Connection: keep-alive
...........RMo.0...Wx.......8..xi....bv.CQ..H.B Y..4..S....e'=RO||...^
>.;2V...g.4.H...z(.....e....?..9....?Tv...sN..s.do...x/..:...:p.-..
...eX...e....d.Q=ZG.l.o.....[.(Za...........j.......o(.KwT\..k#.H..y..
.....t9.hq..2.].4......X?......P...$. .u....t.^..-.}..G;.....6. ....dI
.B9.lQ...L .M...<ki.^,.Y.'...d1......Sr._..O.W........h...]...=....
.QL...Q.T.ZjC..ZV.......3,./..xfc.?..q.#..g...v&..J..]................
u.......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:32 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 408

Connection: keep-alive
...........RMo.0...Wx..[....8..xi.....q.CQ..H4B Y.d7..S.4..e'=R.||..r.
^........h.G.E.R?..C..r./...G....dO...-|.o.7...%..m..D..s&...y.. .o.7.
u\......`..}...'U...h.....<.VX....m.?>....z<...^..F...Z..pi%.
i.....x.S........... .g...A.*)>% E(A....Yb.%..C...7...K......Sa8..W
G....`..l|g......L.......$I..$OgS.......OO%g.........[3r.F...prz|.K...
/......2..~... ........k...Y[./.G.....l.~..d.[.vZqX..a.K........>.l
.......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:33 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 422

Connection: keep-alive
...........R.N.0...Wd"...M..M.........af.P..W$*v,....s[.:.. ...=.>.
r.^...k;].q4......~......y.d_..r].a.....[."l.7.B......#.).....p.......
..*d.....-7...[.......`....#x$-e....o.....*...Dg....E.......K..".3).l6
.sH9..S.k9K`...9.F.P [..o...e ..8.D..p.|...J..2hV.........Z...He6..u.a
.#.4.a.Mfu.$i*.<.Me&$..  }zb.........G.....^{.=v.......2.Ybb[x...E.
.......}f4G.'U7.Xp...FW.'....&...:Gde....\...C4y..3..Q.|....4..&@.....
\..e........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:33 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 430

Connection: keep-alive
...........RQo.0.~..."..a......P$..U%...*r..X...v(..s.....>....}w..
....w.mx#S.......a\.R..W....|...m~....%J3....V....D..m.....Q.gg.R.....
...>.......R.;o.b,...r.....K.D......5._...,...t.j ]C.7./...es.Y.%1.
.x2.&.Q.O..Vl..4... .....|.....E.`...Y....B93.*c..k....K....U.VW\B.uT.
..A<.T.0..:L....5s.1..=>.....V.F...../..[..L.....-.......q.~.D..
..`.*..M0Z...fS...Y..g.9.|.r-........N1~.s5.......kZ.q.s{.i.C...t...J.
.=...U"...................


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:33 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 385

Connection: keep-alive
............_O.0.....s........d.ML....@..ko`.uM..|{.D...O..=...r...z.6
.MY....].C.kQ.U.?.W.C..N.S6...p's...l...U#B.......x].c.....`....w.l.3.
...g.J...f[c.by;..f.....i&rX=>\3z:.L.<....h ..._.[.e.b.K.FI,x...
..#.x..(. .a............Y8...k.. sP.p.}.jP.......Z.F...N...........a..
0..}.s..}..-......Z...J........E)...A.8.p.._D.....R...1..D......d....S
....K.r....&_/.(&.V.C...=%.. ........L.......


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:33 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
183.............R.N.0....!....i.6..*jABB.h...*.^...!....q.By\8..;.3.5.
.......Ve<H.q..i........I<#'..Z.GX...F.......)B...v.6...9g..O...
ue|s...1....~.....h..<HR.{..........5.<._.|.<_Tu.|.3.z..%.x..
S........."....d........0..C..{....M.9K.55...]...h.|..\..om#...0sT4...
.f..Y.."..x.x...A.Z..~*..V.?.$.l...y..n.....E.....r.......t....J..n.ID
......w..|.....-e/.'\t...h.YAG0.6.}.6.....C......|I..d.....0...
...


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:33 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 428

Connection: keep-alive
...........RM..0...W..........&...vi..aY.,...kYH.....C...aA....y..S._.
gg...ATn..\...x'. .X.>-.5.P..C}.E3.6..2..d.\!d...z....z..t.....QW..
o....$....E..5G.Wm.....9.nK..<..^....=.?.o..&.g:I..V../.W..@.Zu.J..
."......t.Q..<.e..<H}Y.T..E...Y..:al..^6fTm'.....h!H....(IXT$y.S
.m>........ro...?....q.h/OjGm.X.....rEY..I._R3.y.._...0S.\^L.hg...d
.3.....;..[/.<YU.6/.............|!.....t....._.>.E......n&.F[4.T
...~...N...y.........%6.$........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:33 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 432

Connection: keep-alive
...........R.j.0.|.W.....c.v.l.7N.p....=.bdki.........!Mzwp.. .fwf.I..
no.@....=......Y._S{Wn.....$O......f..Z..~.Z,....^.....;...-.P..A....U
..$..E.....r|m......^k.}H..x".XI_w..In.WyVf.g:A..F../.w.....lY...5q...
.0..<..f..s<...LD.0.......V..D..Y..&....5....3....b..,h.....~y!.
.S.Z.^...=.~....$.e.P.G$......>.a...O>...m....\Z..OG^....m...Y..
..e....a'./.*_?..uU.N.O.......E'$.1'.$ .T....J.o.]j..../.....V..>~.
..>.@......'.......#.z.........


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:33 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 394

Connection: keep-alive
............MO.0.... ..6........E.V..nES..P..#.A.k........8.J>....}
.cZ>.....t.b~4.}.T;.N.3.]_~..%.Do.U}..{. Tff...V..........CO...gg..
;.......>...8..Bk..n.b,..>.z...........__/8.|{>....h..Z..&...
.V.B..I...l.4....!.i&D#...It&.4.l#{..#6..`t5Y.@...M..I..E.g2m..g.Brw.)
....q......R......5[...-..I.0...v,.p.G.....b.d_....o...-.......t.k...%
...A.n...rz.^C8e..}p_.b....&.'.$&.\A>f..x|(.*@.....p...e....
...


GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:34 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 351

Connection: keep-alive
..........dQ[o. .}......J[..PL..1Y.e....C.(q-..f......op...s8..G...\i!
...<.uxK%..>wW..].N..Z.eu..'.]l......n..Q....^{T6@..u.D.b.u.>
>....Q...^..:.N..S...j.u.....8...".......l^T..lGY....^..V...p.-F...
B)..)I..F.....c@.N.......L.Q:..z...He.8.....:.C.i..$f.e..9.pt".,b4..?.
8$$JcBj..<........h.t..S......!=..#F....2 E..~........'.J.?$..m....
.%@.......}.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type:
 text/xml..Date: Wed, 30 Nov 2016 00:43:34 GMT..P3P: CP='This is not a
 P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Ap
ache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 351..Connectio
n: keep-alive............dQ[o. .}......J[..PL..1Y.e....C.(q-..f......o
p...s8..G...\i!...<.uxK%..>wW..].N..Z.eu..'.]l......n..Q....^{T6
@..u.D.b.u.>>....Q...^..:.N..S...j.u.....8...".......l^T..lGY...
.^..V...p.-F...B)..)I..F.....c@.N.......L.Q:..z...He.8.....:.C.i..$f.e
..9.pt".,b4..?.8$$JcBj..<........h.t..S......!=..#F....2 E..~......
..'.J.?$..m.....%@.......}.........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,conversant,appnexus,TubeMogul-GP,adgear,dataxu,SundaySky,dynadmic,videoamp,Videology,rocketfuel,thetradedesk,1,google,BidTheatre,centro,mediamath,_dmp_turbine,audiencescience,Pulsepoint,ignitionone,Bidswitch,eyeview,adapTV,tremornet&uid=69be0537b12244c29476d5cd69b6ece4&init=true HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; tvrg_60409="1,1480466616"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:36 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 516

Connection: keep-alive
...........R.n.@.}.WPK.-.s....(I.Hi..C....w.{..]....w....K..=3>3s..
.N..s.m..Y...A.....*....7..Y..].W..6.4..fj...VM..jh..].....QA.N.%..,..
}3...t.:y.S..@{k...M^.c;..2.....sV....}...Z......."......n ....4gY.$I.
[.m...pX.q...?JH.<.#.UY%e........G.E.p%|....|Y.. .-v..gF..FT.F..%'.
.E.......^V...`5a.........>.R.N.x..........a.D..3s....WN0..v>-k.
a....`.4../....b.(....... ......F.t{.J.s.....u......nRB.<L.h0...`2J
b6...1P.=?.i........=....n.63....\.%Q4............. ..t..S~.s.y....d..
..^...Gi............Y..^..........<:. .......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:36 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 535

Connection: keep-alive
...........R...0.}.W.H..BB.h" ..m.R/Qa.....{.X...M.....I//}@..........
..A..E....3.A%........{g...6i........Y...Z...g54Ro......Q....%.5...[..
;I..A...D)......&...A..#.....,'....$z...O....N.m..r..{.TH....8....W:~.
...IY.AH..4$.....P.T.n,".;...%|.U[.}Z.. .-.,..5..0....F,9.....t...@..:
u.-XM.00;4..{....R....`.8....?.P.VK..83.n..q..FN.. .N...S..0N.b...|...
.Q...9".w.H.z....`........kTa[]r...Sl^.h6....O...O...(C....//I........
g=.q ........\..S............^..,X../o......&{^.&...`.K..h.Q...s.I...%
..kBwx..{..`......{......gzQ".)@.....YE..D.......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:36 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 504

Connection: keep-alive
...........R]o.0.}.........h" bi7U..h...."c...`[.I....d.>^..|......
hy....h.....h..@P..(c.).4.u...h.f.5.....0..;..j..VC-u..#*k......Xb..;.
.....D).$..M...EYk,.I...d.:r..^4e9)..?$....]....9E..hh..n ...-5gq.$...
t.:...iQ.AH.......&.F.yS.WY6.....o.K.-.(.`4..0....F,95....,..g ..l;...
...f.!.p.p..PJ..1.l.........a.D..3s..V..F0.f..Y...jN...8.....y...`P..#
9!:t.H.z.%..`...(.E.x.j........k....l.....}...0`3........D.....Z..&r..
...j...5.Gr...........Zi0...I..X0?...$......5.;\...v.`....{Mv.{.}.C..K
..O........7.........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:35 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
20a.............R...0.}.W.H...BH.....JH..M....r.!. .e;@......HU.".....
..pz)...(. .Y.^......"..M.........,I.4...E.'&..c..q...RE..hU:ZK.c&..S.
...m7[Xq8c.8......(i..2N.w;I.........$.<.....|1Kg/.v.(#PP......"l.8
.| A....~4...,....}/ ....hWF<....*..;..G.....#.\j.o....[..:Vy...0.0
`...B.'........na.8...^..P.FU..9.gnh.8..#Mrh..F.Vr....IIL.FO. (...@...
...DJyU..Q...Q...h..X)w.V....[W...G. ....Qw..>.Q.y.(x..q....R.J.5.e
X..............Y..a...S..P.?Gf..vh..i.J.....zv..I...........U.M....t..
N...z.O..0.?....."....<.P4.....;.........7......d.........d.E.....0
......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:36 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 484

Connection: keep-alive
...........R]o.@.|......`0`.d..$."UmT;.!...n.Op............>yv=7;;.
xy.......J..p..P....M.....Go....Y^\iAG....\.U....;..6US.Y-}k.7p...56..
~.dw^.g|..?.h.....:.i.....c..5.../`...!..?..."{...`."C.............Q4z
e...|:..e.F,.M#...p.nt2........8885........X..m.. t.8r.;*....c'...Sc;.
pA..e..:..35.O...p.".7.C..:Y.*.R0......:.....PQ".#...:C u.|.`.<6{..
..s..Ro\cJ....r..8.M.r...)...(.3..."...K....}oLm....Kp...[p.!E$..O.I..
B..]...6h....xehWq@{.i..v.b.......@aZb....W.....vetQ..........K.:,....
....


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1de.............R]o.@.|..p.....1..`Q'."EmT...E.r.1'..tw`...8n...>1.
....6^....CmD#.g:...J.p!w..X|...Y...M..W.?...4K.8..j..Vc...-'..]c.3.Kc
..&q.~.f7N.g|..?4(.z...X....v......<.f......4~.......b.@[I.M...%...
..<....{a..."...2.#.zA.....l............%..'.........C.B..#G...{...
..2.O..`......?.a(.n.|....e......|?..^...#X#.P..^.E.@.PQ".#..u.@P.....
4...`P5B..oy......8n...%z.YTN}?.........~.....4v.L.V.F..8....s..ef.H=.
......"{W .f8$7...v... L.{...Yh`{:...B4.v..q.d.7.......k.?.........w..
....0......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 498

Connection: keep-alive
...........R]..0.|.....[..!)(...!!..S.....r.=bA..v...]s...T.......x...
:.:...".......5.b.[.|....H>DOi..h...C..:.J....j.U-..ph].J5.@..&.U..
...]YI..A.}..i@.(...*./o.Y.....K...d...I....U....v..Z. ......&l!9.. a8
z......L.".B......^0..&fD.sk{..2.4.'..>....K..0`...B....".A..U....k
.......e...3u.....V0.g.S.....S..0N*..7z^.A1....D..:#.T....@$.......0.w
.jv....0l....F.IX.=...7...M).|.....$r.7.^.Z...1.!.4....Bn.1../...0..z.
Is{...;.e....|.E.U..j$(.vn.-%Z.;P7.D.82Af..=...w..B......._J..{.;wu#.!
@........>........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 502

Connection: keep-alive
...........R]..@.}...$...".....Mn.....6..!..(.e!........~<...3.....
....08.....5.G..$......d........1I....iX(..DViL3#.(.jU.....h.X.3...VG.
..<YZq..A.~S.i@.Q.i.U.]j.i.....eh.3........b.d..u\C..(..cn'..). .#.
h...l....dR...0...t.9......Z.y.,....P.:....(..z.!tp.pB..%.[....4.4..0.
@.U#.(.>..J.i 9..}..w..J0..pA j..zV.E1....D.... Z5.,....<...M-d.
8.U..V.B....xZ......q\.9S7...8.}`.>?.!....R...^a.<..h.i..r..J{'.
sm.l..r...V....c..[~...V...X>...\.^..U........B.....8...Pdf..=.^.q.
.....r#._Z..k....... ....V.x.........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 512

Connection: keep-alive
...........R]..0.|........$.©.$..=.p}8..c/...............).........8
uj.. .9.......qy..m....3....I..i^K....l....3.....E.....1...3c..L.|..K.
N.&..._5)K.m.6......N.>..[.*......u...Y,.,y...D[.....m$.....,....`O
...t<.........2.x......3P'uh....`5a...1..j.gD...KeZX1......f(H.....
..[Z N .H........N..`..b.......c...3. ....([-v...<U'....b.c...J.\B.
j...0...|.y.1....g..0.....k...z..Z.?,e..Uo..5.p.....G.*u........v.m...
..).....c.....-..-...m........Y.u..8kQj0...q...-...a.~B..23M..O|U.....
...;.....v.x.7;.o.......\..=.......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 471

Connection: keep-alive
...........RMo.0...Wd...b...........[1;..(.Ybc!.,H.....n.......G=....,
......L...s& i.............$?..........l......Z...u[.h#\c.3. c.mM.|...
o.,..$K~j...!*zcAd..;)...}M..9 .~...K.>ln.2...)....f.........,.....
D.O.2X,.*.b.yAL....t.R[.....sx.o.......(.......)`..`....A..3s.....V2..
..1.%a.S...'....^.@pd.*.s"gD.g....-......G....b.cB.l. .a...- ..E\.}?..
......a>....c....w.u...q.kf9#G...~.t....].5b...)......\../jwBi0...Y
...:..\a.|...2KM.....Co.....{%..}......e.........Ag~S........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 469

Connection: keep-alive
...........R]o.0.}..`H.....X" bi'U......."c....X.!......>^..s/..s.o
.9.g..cE.R.>...(.r..../.|..o.w...(/.`..Ee........g@....)k%.V..[[G]g
S...]~.gI..,.i..`.........^Q.&..y..yI....,y.......,..q..M....S-..#x...
......U.XTU..,..1.-.h.&:..z.....=)8vv.....Xv:..@9.".,.=....E.8....1...
R0........^6@.#...=.#.^ph.................q.w.3.P0..QV.......A..`..._2
.......YB..........c..rkz3mM..F..arOj.@..8.w.5_.....".O.'..........3$K
..s.=.....8.Ef9.....1h.l...\..._..%..9.... ......6k........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 438

Connection: keep-alive
..........dR.n.0... <..m..8.........[Q...(.Ybc..,H.....4K...G..|$..
.....X....N....Z..6...._....Sz_.....4LTv.2.qN/.q.dk....V.k....u.u6....
..~......C..3Z.`...:.zey...........^.....eQ...v...P.....b..|e..b.I.&lt
;...|..fu.....(..<...Bg.D..._.5..............w..N8. .;..P.....(..!.
....5o..............CK..{.-P...{..[.......u.....q.E..|...0."...$.s....
...)O..5].......e/........v..i.e...R....I...N!z.g..?Q.Ef5...r...,....9
.....tx<.Qx.G........,.........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1bc.............R.n.0... T....,.Rm...I..E.Tr{..."7..."H....k...8.'..gw
..M..|..`..T......b..j.......~..I..U}..'..*.r..:.W.8..3m.LY'......:.z.
.7_v....%.....Z.9E.`....k...M.Kr.Z...._7y..n}U...y...).4.k....(/..Y.4I
..6{X,...i.8aq.%4X...MtF{...`.x.....3.....g.X.....C.8 ...\..P..TR....-
P..A.`....Ap....)..5.n.'....a..R.\o..`..T/.......a..p.%1_0....D..yJ...
....c.h...............My......;*=k.Hm........Q......3.@.Y...q.........
....o-..B............qT*.......0......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:37 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 461

Connection: keep-alive
...........R]o.0.}..`H.m......K:)S.V.n.U...6X..e.....4k...o.^....{...?
:#(.zQ.......S&v.{.|...]....U..i..f/..0...#.....W.....Hk.:f..6....W.j.
.yE.2......U=i..l.w.....K.(Z...n~l....j]5..INbe.5...;."zL..."..e.=..g.
$..6M3..I..Y......aT.!Z}fT?1C:..AP<....t..rF,.@...t....l.m...'..hd.
z...... ...G..g..bK...A.L.7.<.[.fq..Q.$$.'YJg..~.....2G...P.W....A.
 .5a.....q....(@1..8...o...U.jd..<./.mh......{K.G.'........2_)...A.
a._.T.e6..........l.......'..N..9.V.. .....q..........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:38 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 437

Connection: keep-alive
...........RM..0...W....8......,.Vj. .m...r.Y..vd;@.}',..........7..Or
...X.U......b.........O.<...(..J.{..*;s..u.....Hm.m=dZ.k..s3..km...
[.7~.......6..>*;.@.... ....%......au.....7EU<^..j......v.)M....
.@.$xf...4...:....QB.I.....>.n.....pQ.....u.y.(..!........W[...A.`.
... 8h*...o......B..r...l..5.P0h...5..qR..0.X8...O..|.....<%...4F..
}.'...p`.n....{....\.;j.......j.?.../z..1`...<]..^..^a.~..(2 C...gy
..,.......o_..K.._.........x.-<........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:38 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
196.............RMo.0...Wx...,.q.%..xi..(..v.CQ....B Y..4..S....e.G...
.T....`...^..4......P.2.k.|......{U7gZr..Be...;....gP.......X...-..7.2
..mS]...x@....Fs...:..9..u}S...Q...l.n.h..~}Q5..IN.q.....;*.z. #x.!.y.
....E:..m..,....y.M.D...8....!Y.Q...y(....:.?..t.^..-.}..G;....=..E0..
...u/....K.q.i...p.g.b<...4I..%.4...q...a..@....Kcz...}..n_.c]...M.
..._.................k.....3........`O.o\.P9...............'{.....d...
....-..$v.....0......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:38 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
18b.............R.n.0... <.....8.........]....(.Zb...,H...}. K....#
...'..v.%..:..2...8B.[!...........@.V..LK.........{3'.[T..v....8g.....
..2.....bF .1...1h..jp......juG.)y..D....7.~|X^Uu.p.3`.......4.-......
."y....,.L.&...'Y..4.....b. .....B!A....E.z..f..At.a.P/...L. 6.6.....i
..!X.e.....x..W.5.L'E3N.,.., r1.".s..=>2J.........[3r..0...d.... v.
.,....7.Xt...F.6..=.3d.[...Y[...K\....l..B.d.f.9.8........d........4..
m.....0......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:38 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 421

Connection: keep-alive
...........R.n.0... T....6K.A.P.....A.$. 0(rb..).....K.n....,o..Y.b'_.
......$......P.*.o.......~.W....`.P.....9=G......6b.D..0ps...l...X..!.
5..~4Tk0.o...$i...ju..{.HZ..n..^...iyY7...NS.......WL../..U..,....Lgy.
.mQ........H.DW......K..&x........7...(8.TjoR..j.q7.Z..P.;k.......&..w
.B<..6I.<g.,/.>e...`.??.........7$...D|......|......N/|b[9...
x........|d7G.'U.R....#....H.`.&.7~t....l...j...G...t..?Z..g..?m... ..
..!.^.........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:39 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 430

Connection: keep-alive
...........R...0.}.W...[q...$(...T.UI...*r..`u.X.C....(."U};c..3sf....
8GP.."wgS.u@..2..n]m..w....K..n.`..D..&w....BF...ah...Hk.:f..6......r.
.YI."......h.....:.:..C...g..V..?o....j]V..ENbe.mh.... ..t.....i.?..s&
lt;...m.$%......dF&2.c.:..E.`.....d..Q.1..b..V.<./.d...AC.l..Z&`2.Z
...8L.Y.D...Q...P............ .....'.rl..w........NV*.O.P...Z...1..7.v
.......vM]o-ZO...s....\*...Q......A.`.}.V`...&.....A.m......./%.. ../.
.?.......Jh.........


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:39 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 386

Connection: keep-alive
............]O.0.....s....16!].....52.....#,..i;..o..~.xw..{..'/..W...
.)k... .=....\e.}qy~....~...Q..dnQ......j...P.z.....2F....Kmc2..f.O|.s
.....R.w.|k,T.hw.......5.EAW.w3.O..I^......J.....VrYS1.....i.>..s..
.z.%I..0Ni.........7.~..7...V..T..jW.6..T]J......6...:....A.....Eq..A.
&....'.!~z"....j].?,..|.Pa.6`..k......k..Bj=...Ji0....c....0... .B....
.......85.zAG1.v..2ty.)............M.......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:39 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 389

Connection: keep-alive
...........RMO.0.....F....4Mh....HHhA4..*T9..Z...N..{..P`/....y.y....K
..uB.*.'i..b.........<^...O.j..l..A....w..9B...v.....9g......sU..vS
_...<".......... I...V.;.>.{..7t.p.M.....n....P.U..|.}ULi..V...Z
....?Mg.d..EQ.".K.N.b.F....M...-)...!..^..-....K...m..Q7,...N'e;..<
g.,/.>e<..`.?>...J..V...H...1V....&B#........r..S.G.X..:.....
.N..^Z.^...!.7.,...R....e....F..t..O ..m....@.......^.H.e......
.


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:39 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1a0.............RMk.0...W....._.7AV.&...n.8.C)F...i-.I6.._9$.~..:hf..{
o..xo....n:...$p.........\.|q...?.....F.m.znr...9G.(h;......Hk.:f..5..
.o..b..\p....J.j...m.%....n.1.H.I.^..........(....... h...A0.Q.P..S.Y.
<..y:K....4ci.d4.Fi.|.S....hy..i.]#..*.....n...8iVC0..:..$a.,.R>
e..S`.<=....{.T....O..CG[y..kk.J^..T. J. Lf.95b.Oh...F.3...........
la....n.Px.....V....V.gVx4~..i..=.."x...f.}..|g.I-.T......@.m..\A.0.m.
...{..U._...d.................0......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:39 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
16e.............._O.0.....s.{s.clB..e.!.!n..!.k.,..i;......y.....{~7..
w...2....v..l.qR...b{.....}t._.,......r.....Z....U.\7.K..(%lK....Q..&l
t;^$....Z..I,...*. .*..g.,.@pn.M.....e...,.$y2;..,57@./.='.../K...G..$
.e....E..... .^..[.....(&....?].J,t#..3.9,.........A@.n...C.....`>G
....JY.?..r1]....0l .O.... ..wL...t<~.......On.JH.....S....L]..>
...Q...w..p..VF..~.E......L2.k.....d...........7.....0......


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:39 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
17d...............n.0.E...E@..).z..IA...@.........I,4..!.$._....E.p1..
.=.!-^.go.h.^1?....J.M.....>}...~A..eu..;. Tfj...VO...]......#.h..S
c.....|].3....8..Bk..n.f,t...z....SroZ6.xZ}.szy.= ...h..Z..F...).z...6
,........I2..u..2..\.i.E2.l.tzm..[............8Id<I..Ie...HH..8%...
 ...`.q@...}..[.!h..B;.4..(.`....|f...X....!N.......a.?......N#..(....
..[0...[...) .....7[P.85y?!g1...r.......O...d.......d.h.e.....0..
t>....


GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://ivids.net/ova-jw.swf

x-flash-version: 23,0,0,185

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=69be0537b12244c29476d5cd69b6ece4

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Wed, 30 Nov 2016 00:43:40 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
150............dQ[o. .}...x.m.....F]b.l.Z..1..j....f......op...s8..G..
t\.Z........d..g`Y.......U^.WZp..E..&..c.1.F.F..{.R.@.[...6....<&gt
;m...(g.F...-W.[...op..:E.....MsV...e...z:..|}..L..,.WM....6.f...-1WJ.
.J.)...Xs..1..&..k...m...p..u.Z.F*.'..{q.V~.D..FQ...2.'..h..8ISoG.]&lt
;.....$.........}.s.E.*.O.B.....t\_..=....,..G.9....-.~O....H.K...s#.K
..e.........U........0..HTTP/1.1 200 OK..Content-Encoding: gzip..Conte
nt-Type: text/xml..Date: Wed, 30 Nov 2016 00:43:40 GMT..P3P: CP='This 
is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Se
rver: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chu
nked..Connection: keep-alive..150............dQ[o. .}...x.m.....F]b.l.
Z..1..j....f......op...s8..G..t\.Z........d..g`Y.......U^.WZp..E..&..c
.1.F.F..{.R.@.[...6....<>m...(g.F...-W.[...op..:E.....MsV...e...
z:..|}..L..,.WM....6.f...-1WJ..J.)...Xs..1..&..k...m...p..u.Z.F*.'..{q
.V~.D..FQ...2.'..h..8ISoG.]<.....$.........}.s.E.*.O.B.....t\_..=..
..,..G.9....-.~O....H.K...s#.K..e.........U........0..

GET /a.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323&rnd=1480466600000 HTTP/1.1

Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*

Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323

Accept-Language: en-US

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)

Host: ww.hikeemissivity.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 30 Nov 2016 00:43:22 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 325

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
......<meta http-equiv="cache-control" content="max-age=0" />..&
lt;meta http-equiv="cache-control" content="no-cache" />..<meta 
http-equiv="expires" content="0" />..<meta http-equiv="expires" 
content="Tue, 01 Jan 1980 1:00:00 GMT" />..<meta http-equiv="pra
gma" content="no-cache" /><meta http-equiv="refresh" content="60
">806127HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:43:22 GMT..Serve
r: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content
-Length: 325..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..
Content-Type: text/html........<meta http-equiv="cache-control" con
tent="max-age=0" />..<meta http-equiv="cache-control" content="n
o-cache" />..<meta http-equiv="expires" content="0" />..<m
eta http-equiv="expires" content="Tue, 01 Jan 1980 1:00:00 GMT" />.
.<meta http-equiv="pragma" content="no-cache" /><meta http-eq
uiv="refresh" content="60">806127..

The Trojan connects to the servers at the folowing location(s):

Map

Strings from Dumps

inferno.exe_1596:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

ers\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll

ers\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll

"%Program Files%\Dendritic\allegro.exe"

"%Program Files%\Dendritic\allegro.exe"

p\ExecCmd.dll

p\ExecCmd.dll

.reloc

.reloc

EnumWindows

EnumWindows

ExecCmd.dll

ExecCmd.dll

Kernel32.DLL

Kernel32.DLL

%Program Files%

%Program Files%

\Dendritic\allegro.exe"

\Dendritic\allegro.exe"

\ExecCmd.dll

\ExecCmd.dll

%SystemRoot%\

%SystemRoot%\

eq allegro.exe" | %SystemRoot%\

eq allegro.exe" | %SystemRoot%\

\find /I "allegro.exe"

\find /I "allegro.exe"

\Dendritic\allegro.exe

\Dendritic\allegro.exe

\allegro.exe"

\allegro.exe"

$$\wininit.ini

$$\wininit.ini

e%uy%u

e%uy%u

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp

nss5457.tmp

nss5457.tmp

rogram Files\Dendritic\allegro.exe"

rogram Files\Dendritic\allegro.exe"

ecCmd.dll

ecCmd.dll

egro.exe" | %SystemRoot%\System32\find /I "allegro.exe"

egro.exe" | %SystemRoot%\System32\find /I "allegro.exe"

\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp

\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp

"%Program Files%\enormities\inferno.exe"

"%Program Files%\enormities\inferno.exe"

%Program Files%\enormities

%Program Files%\enormities

inferno.exe

inferno.exe

ers\"%CurrentUserName%"\AppData\Local\Temp\nsd402B.tmp

ers\"%CurrentUserName%"\AppData\Local\Temp\nsd402B.tmp

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\

%Program Files%\enormities\inferno.exe

%Program Files%\enormities\inferno.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Windows\

Windows\

Nullsoft Install System v2.46

Nullsoft Install System v2.46

mities\inferno.exe"

mities\inferno.exe"

dritic\allegro.exe"

dritic\allegro.exe"

taskeng.exe_2992:

.text

.text

`.data

`.data

.rsrc

.rsrc

@.reloc

@.reloc

USER32.dll

USER32.dll

msvcrt.dll

msvcrt.dll

ntdll.dll

ntdll.dll

API-MS-Win-Core-Debug-L1-1-0.dll

API-MS-Win-Core-Debug-L1-1-0.dll

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

API-MS-Win-Core-ErrorHandling-L1-1-0.dll

API-MS-Win-Core-File-L1-1-0.dll

API-MS-Win-Core-File-L1-1-0.dll

API-MS-Win-Core-Handle-L1-1-0.dll

API-MS-Win-Core-Handle-L1-1-0.dll

API-MS-Win-Core-Heap-L1-1-0.dll

API-MS-Win-Core-Heap-L1-1-0.dll

API-MS-Win-Core-Interlocked-L1-1-0.dll

API-MS-Win-Core-Interlocked-L1-1-0.dll

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

API-MS-Win-Core-LibraryLoader-L1-1-0.dll

API-MS-Win-Core-Misc-L1-1-0.dll

API-MS-Win-Core-Misc-L1-1-0.dll

API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll

API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-ProcessThreads-L1-1-0.dll

API-MS-Win-Core-Profile-L1-1-0.dll

API-MS-Win-Core-Profile-L1-1-0.dll

API-MS-Win-Core-Synch-L1-1-0.dll

API-MS-Win-Core-Synch-L1-1-0.dll

API-MS-Win-Core-SysInfo-L1-1-0.dll

API-MS-Win-Core-SysInfo-L1-1-0.dll

API-MS-Win-Core-ThreadPool-L1-1-0.dll

API-MS-Win-Core-ThreadPool-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

API-MS-Win-Security-Base-L1-1-0.dll

ole32.dll

ole32.dll

OLEAUT32.dll

OLEAUT32.dll

RPCRT4.dll

RPCRT4.dll

KERNEL32.dll

KERNEL32.dll

d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp

Session::ChannelMsgReceived

Session::ChannelMsgReceived

d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp

d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp

StopJobMsg

StopJobMsg

StartJobMsg

StartJobMsg

ClientPipeName

ClientPipeName

Invalid parameter passed to C runtime function.

Invalid parameter passed to C runtime function.

d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp

d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp

TaskScheduler.log

TaskScheduler.log

j%Xf;

j%Xf;

d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp

d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-Management-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

API-MS-WIN-Service-winsvc-L1-1-0.dll

ADVAPI32.dll

ADVAPI32.dll

SHELL32.dll

SHELL32.dll

SHLWAPI.dll

SHLWAPI.dll

SspiCli.dll

SspiCli.dll

XmlLite.dll

XmlLite.dll

MPR.dll

MPR.dll

RegOpenKeyTransactedW

RegOpenKeyTransactedW

RegCloseKey

RegCloseKey

RegOpenKeyExW

RegOpenKeyExW

RegNotifyChangeKeyValue

RegNotifyChangeKeyValue

RegCreateKeyExW

RegCreateKeyExW

FindExecutableW

FindExecutableW

MsgWaitForMultipleObjects

MsgWaitForMultipleObjects

EnumThreadWindows

EnumThreadWindows

EnumWindows

EnumWindows

GetProcessWindowStation

GetProcessWindowStation

_wcmdln

_wcmdln

_amsg_exit

_amsg_exit

GetProcessHeap

GetProcessHeap

SetProcessShutdownParameters

SetProcessShutdownParameters

TaskEng.pdb

TaskEng.pdb

version="5.1.0.0"

version="5.1.0.0"

name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"

name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"

8 8$8(878

8 8$8(878

3=4Z4w4

3=4Z4w4

=!=(=0=4=?=>>

=!=(=0=4=?=>>

5 5U5_5

5 5U5_5

5b6u6

5b6u6

-131J1X1o1}1

-131J1X1o1}1

=$=

=$=

Password

Password

hXXp://schemas.microsoft.com/windows/2004/02/mit/task

hXXp://schemas.microsoft.com/windows/2004/02/mit/task

-ieframe.dll

-ieframe.dll

%SystemRoot%\SYSTEM32\cmd.exe

%SystemRoot%\SYSTEM32\cmd.exe

%SystemRoot%\System32\Tasks

%SystemRoot%\System32\Tasks

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake

WindowSeconds

WindowSeconds

InitializeCmdlineProcessing()

InitializeCmdlineProcessing()

pCrimson provider registration failed for taskeng, hr=0x%x

pCrimson provider registration failed for taskeng, hr=0x%x

CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]

CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]

InteractiveTokenOrPassword

InteractiveTokenOrPassword

%d.%d

%d.%d

%s, (%d)

%s, (%d)

hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout

hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/sendusing

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

hXXp://schemas.microsoft.com/cdo/configuration/smtpserver

201ef99a-7fa0-444c-9399-19ba84f12a1a

201ef99a-7fa0-444c-9399-19ba84f12a1a

C:\Windows\SYSTEM32\cmd.exe

C:\Windows\SYSTEM32\cmd.exe

6.1.7601.17514 (win7sp1_rtm.101119-1850)

6.1.7601.17514 (win7sp1_rtm.101119-1850)

taskeng.exe

taskeng.exe

Windows

Windows

Operating System

Operating System

6.1.7601.17514

6.1.7601.17514

allegro.exe_3288_rwx_00232000_00009000:

.hP9)h

.hP9)h