Trojan-Dropper.Win32.Dapato.opco (Kaspersky), Trojan.NSIS.Androm.3 (AdAware), Trojan.NSIS.StartPage.FD (Lavasoft MAS)Behaviour: Trojan-Dropper, Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: 18284f0f5042cd7d5a7a5a3afe6c3e49
SHA1: f8faa087e2374743ccf20455d0e81040bc0952aa
SHA256: 6ed477a3d4ada9b9e745deb9f7bf02f7840fcefcb8e875991d77d05f8cb0c2c6
SSDeep: 12288:bM1rmjBwvxfNMgMbO4FaQ0FWUGXaZNBQlA 9aB6wrG2j viOHqHh4fNTuc6XCp:bQ7V goO4FP0F18aZ4lA 9OOHqHhc6cP
Size: 788112 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2009-12-06 00:50:52
Analyzed on: Windows7 SP1 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Trojan creates the following process(es):No processes have been created.The Trojan injects its code into the following process(es):
allegro.exe:3288
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
No files have been created.
Registry activity
Dropped PE files
MD5 | File path |
---|---|
8a3069cc809fd0f46bbc45cf8333bd73 | c:\Program Files\Dendritic\allegro.exe |
c8ff52bfddc6898c202c08c4a61a3d22 | c:\Program Files\Mausoleums\Microsoft.Win32.TaskScheduler.dll |
270fbf9c5065f195aeff4fb8a5bb5b60 | c:\Program Files\Mausoleums\allegro.exe |
d04c8544a6ffa7c516d06ddcde8895b8 | c:\Program Files\Mausoleums\settings.dll |
b55a422f81b798459f38d95346e2e6ef | c:\Program Files\Mozilla Firefox\firefox334.exe |
46206119b2c9bdd1fbc5a5d1e4cc49df | c:\Program Files\enormities\inferno.exe |
61d79c117b5049360e722d55728264b7 | c:\Users\"%CurrentUserName%"\AppData\Local\109052.exe |
8749f1c8fc54d4462dd3aca5d3df367a | c:\Users\"%CurrentUserName%"\AppData\Local\16550.exe |
6272891cb21b1f7fdfd0c0e6d0b28e28 | c:\Users\"%CurrentUserName%"\AppData\Local\35875.exe |
b63fdb3f8bb5dfd5e9cd40dca879c2b8 | c:\Users\"%CurrentUserName%"\AppData\Local\56270.exe |
9fbea86c1454a608a1131a73029337ae | c:\Users\"%CurrentUserName%"\AppData\Local\84976.exe |
b9380b0bea8854fd9f93cc1fda0dfeac | c:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll |
8a3069cc809fd0f46bbc45cf8333bd73 | c:\Windows\bisbee.exe |
HOSTS file anomalies
The Trojan modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 1053 bytes in size. The following strings are added to the hosts file listed below:
127.0.0.1 | validation.sls.microsoft.com |
162.222.193.86 | aoaomo.tremorhub.com |
162.222.193.86 | www.howcast.com |
162.222.193.86 | howcast.com |
192.192.3.8 | www.virustotal.com |
192.192.3.8 | virustotal.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):No processes have been created.
- Delete the original Trojan file.
- Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 61440 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 253952 | 2536 | 2560 | 3.13983 | 5b5a2d9d119a78aca9bef9d54b647674 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 506
87af60575e95350381303447cd2e0d96
7f4ee0d326b67cc3e4a3fec3a25dfe3c
293bbf92195165383b202fa6cd4a2ba6
b33ccbf60d223d0df5c7b0c8b376386a
5c7aaa94fa1bbced13b76e9523bde956
da7eaa6230f54eb9da8f6986b5e53c89
0f5b04d97f3e3dc672c37106fbff0b45
9b0f84c736f2651c17fa4592c98ca6f0
10cdbd65f189a3a3a25eec73396c07d1
3642ef122aa6382d10aaf85824e1d78b
ca68f7598e334d1805d20eb245bebded
4684fab20680d9d8b202a59b822e633a
57f41da1ea05d30f6707060f00876d07
1b2bfbbbca773cdb33d6da3b213f8ce7
2530acdcdc7ecc5f66ce4c84f00c16dd
ddd76f91d11e7721e59ad2452476ba21
91d216dab486680090f9e408480f984f
0d20acfa48e8979c1469531204ca1968
99694dd84a6be2f345b9f6700efd6b44
e4172945272ff2f0c8e57d2ef3a90236
6d10dc27bb05455779a4020400cd6218
d48596e9c6655369a1702009153f2549
143736e701565a0d0b41822c321d767f
d08279dabcb13c2c97e36726ff0230eb
135789a839ca94c62aa0ff02a71ec03e
Network Activity
URLs
URL | IP |
---|---|
hxxp://d232tmx7gh8bfo.cloudfront.net/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323 | |
hxxp://d232tmx7gh8bfo.cloudfront.net/jquery.min.js | |
hxxp://d232tmx7gh8bfo.cloudfront.net/amg.php | |
hxxp://www-google-analytics.l.google.com/analytics.js | |
hxxp://aoaomo.tremorhub.com/wp-content/themes/howcast/images/icons/love.png | |
hxxp://aoaomo.tremorhub.com/itd.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323 | |
hxxp://ww.hikeemissivity.pw/a.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323&rnd=1480466600000 | 162.222.193.17 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j47&a=105673728&t=pageview&_s=1&dl=http://www.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323&ul=en-us&de=utf-8&dt=searchbox&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=495422830&cid=2093138924.1480466601&tid=UA-74694740-5&_r=1&z=1103281923 | |
hxxp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png | 67.202.94.86 |
hxxp://a5f50dedef.site.internapcdn.net/page-1.html?lid=937115 | |
hxxp://aoaomo.tremorhub.com/o.php | |
hxxp://vi.ivids.net/report3.php | 109.201.148.40 |
hxxp://ivids.net/1.js | 162.222.194.11 |
hxxp://ivids.net/jwplayer1.js | 162.222.194.11 |
hxxp://widgets.amung.us/draw/?w=colored&n=2470&c=000000ffffff&p= | 50.23.131.235 |
hxxp://vi.ivids.net/bck.php?1480466602000 | 109.201.148.40 |
hxxp://a5f50dedef.site.internapcdn.net/page-1.htm?lid=937115 | |
hxxp://www.statcounter.com.cdnga.net/counter/counter.js | 151.249.90.5 |
hxxp://ivids.net/player1.swf | 162.222.194.11 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j47&a=1085413297&t=pageview&_s=1&dl=http://www.ivids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1777473885&cid=763910521.1480466603&tid=UA-74694740-2&_r=1&z=1229294853 | |
hxxp://a5f50dedef.site.internapcdn.net/css1.css | |
hxxp://c.statcounter.com/t.php?sc_project=10675947&java=1&security=299981d6&u1=4768EC11B3054F99C2BAA38B65E80AD8&sc_random=0.6264624061063745&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://www.ivids.net/page-1.html?lid=937115&u=http://www.ivids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 | 104.20.2.47 |
hxxp://a5f50dedef.site.internapcdn.net/img/logo.png | |
hxxp://a5f50dedef.site.internapcdn.net/img/lbg.png | |
hxxp://c.statcounter.com/10114910/0/757d7213/1/ | 104.20.2.47 |
hxxp://cs28.wpc.thetacdn.net/5/10/logo.png | |
hxxp://ivids.net/ova-jw.swf | 162.222.194.11 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net - 1&mediaDesc=Entertainment videos ivids.net - 1&mediaId=2&mediaUrl=hxxp://www.ivids.net/1.html&srcPageUrl=hxxp://www.ivids.net/1.html&contentLength=300 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,centro,_dmp_turbine,Pulsepoint,TubeMogul-GP,adapTV,TapAd,rocketfuel,1,thetradedesk,Bidswitch,beeswax,appnexus,tremornet,audiencescience,BidTheatre,videoamp,dynadmic,ignitionone,conversant,mediamath,eyeview,google,Videology,dataxu&uid=69be0537b12244c29476d5cd69b6ece4&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://dyhd7e8p4cqed.cloudfront.net/crossdomain.xml | |
hxxp://dyhd7e8p4cqed.cloudfront.net/static/noad.xml | |
hxxp://vi.ivids.net/crossdomain.xml | 109.201.148.40 |
hxxp://vi.ivids.net/v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hxxp://www.ivids.net/1.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Entertainment videos ivids.net&LR_FORMAT=application/x-shockwave-flash | 109.201.148.40 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hxxp://www.ivids.net/1.html&contentLength=[CONTENT_LENGTH] | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,conversant,appnexus,TubeMogul-GP,adgear,dataxu,SundaySky,dynadmic,videoamp,Videology,rocketfuel,thetradedesk,1,google,BidTheatre,centro,mediamath,_dmp_turbine,audiencescience,Pulsepoint,ignitionone,Bidswitch,eyeview,adapTV,tremornet&uid=69be0537b12244c29476d5cd69b6ece4&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | |
hxxp://thumb.none1366649718.netdna-cdn.com/crossdomain.xml | |
hxxp://thumb.none1366649718.netdna-cdn.com/abcd.mp4 | |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.ivids.net/page-1.html?lid=937115 | 69.88.149.139 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.ivids.net/img/logo.png | 69.88.149.139 |
hxxp://www.google-analytics.com/analytics.js | 173.194.113.192 |
hxxp://www.hikeemissivity.pw/amg.php | 52.222.174.193 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j47&a=1085413297&t=pageview&_s=1&dl=http://www.ivids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1777473885&cid=763910521.1480466603&tid=UA-74694740-2&_r=1&z=1229294853 | 173.194.113.192 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/crossdomain.xml | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j47&a=105673728&t=pageview&_s=1&dl=http://www.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323&ul=en-us&de=utf-8&dt=searchbox&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=495422830&cid=2093138924.1480466601&tid=UA-74694740-5&_r=1&z=1103281923 | 173.194.113.192 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.hikeemissivity.pw/jquery.min.js | 52.222.174.193 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://l.longtailvideo.com/5/10/logo.png | 93.184.221.48 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.howcast.com/wp-content/themes/howcast/images/icons/love.png | |
hxxp://xlf5t.ads.tremorhub.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net - 1&mediaDesc=Entertainment videos ivids.net - 1&mediaId=2&mediaUrl=hxxp://www.ivids.net/1.html&srcPageUrl=hxxp://www.ivids.net/1.html&contentLength=300 | 52.21.182.111 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.ivids.net/css1.css | 69.88.149.139 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://thm.vidvib.com/abcd.mp4 | 94.31.29.128 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://cdn.tremorhub.com/static/noad.xml | 52.222.171.29 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,conversant,appnexus,TubeMogul-GP,adgear,dataxu,SundaySky,dynadmic,videoamp,Videology,rocketfuel,thetradedesk,1,google,BidTheatre,centro,mediamath,_dmp_turbine,audiencescience,Pulsepoint,ignitionone,Bidswitch,eyeview,adapTV,tremornet&uid=69be0537b12244c29476d5cd69b6ece4&init=true | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,centro,_dmp_turbine,Pulsepoint,TubeMogul-GP,adapTV,TapAd,rocketfuel,1,thetradedesk,Bidswitch,beeswax,appnexus,tremornet,audiencescience,BidTheatre,videoamp,dynadmic,ignitionone,conversant,mediamath,eyeview,google,Videology,dataxu&uid=69be0537b12244c29476d5cd69b6ece4&init=true | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://www.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323 | 52.222.174.193 |
hxxp://www.ivids.net/img/lbg.png | 69.88.149.139 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://cdn.tremorhub.com/crossdomain.xml | 52.222.171.29 |
hxxp://www.statcounter.com/counter/counter.js | 151.249.90.5 |
hxxp://we1sb-wwcgk.ads.tremorhub.com/crossdomain.xml | 52.20.16.82 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://thm.vidvib.com/crossdomain.xml | 94.31.29.128 |
hxxp://www.ivids.net/page-1.htm?lid=937115 | 69.88.149.139 |
hxxp://xlf5t.ads.tremorhub.com/crossdomain.xml | 52.21.182.111 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hxxp://www.ivids.net/1.html&contentLength=[CONTENT_LENGTH] | 52.20.16.82 |
hxxp://partners.tremorhub.com/syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
hxxp://109.201.148.40/bck.php?1480466602000 | |
hxxp://partners.tremorhub.com/syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 | 52.20.69.191 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.ivids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.763910521.1480466603; _gat=1
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:47:03 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 11 Nov 2014 03:08:25 GMT
ETag: "a1b01-52-5078c97abfc40"
Accept-Ranges: bytes
Content-Length: 82
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/xml
<cross-domain-policy>.. <allow-access-from domain="*"/>..</cross-domain-policy>....
GET /v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hXXp://VVV.ivids.net/1.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Entertainment videos ivids.net&LR_FORMAT=application/x-shockwave-flash HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.ivids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.763910521.1480466603; _gat=1
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:47:03 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Set-Cookie: PHPSESSID=6or4a519r4tp1eoeotmth65b26; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private
Pragma: no-cache
Content-Length: 514
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/xml
<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0">..<Ad id="1"><Wrapper><AdSystem>1</AdSystem><VASTAdTagURI><![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=[CONTENT_LENGTH]]]></VASTAdTagURI><Impression/><Creatives></Creatives></Wrapper></Ad>..</VAST>HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:47:03 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Set-Cookie: PHPSESSID=6or4a519r4tp1eoeotmth65b26; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control: private..Pragma: no-cache..Content-Length: 514..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/xml..<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0">..<Ad id="1"><Wrapper><AdSystem>1</AdSystem><VASTAdTagURI><![CDATA[http://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=[CONTENT_LENGTH]]]></VASTAdTagURI><Impression/><Creatives></Creatives></Wrapper></Ad>
<<< skipped >>>
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 30 Nov 2016 00:43:28 GMT
ETag: W/"144-1446243360000"
Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>. <!-- Very Liberal -->. <allow-access-from domain="*" secure="false"/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net - 1&mediaDesc=Entertainment videos ivids.net - 1&mediaId=2&mediaUrl=hXXp://VVV.ivids.net/1.html&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=300 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Wed, 30 Nov 2016 00:43:29 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com; Expires=Thu, 30-Nov-2017 06:31:49 GMT; Path=/
Set-Cookie: tvrg_60409="1,1480466609"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 30-Nov-2016 00:44:29 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
Content-Length: 544
Connection: keep-alive
...........R]o.0.}..`..[....J.2.*...%......w....?(.......e...q.......P.:{4V(...^?..d..Y%.C...:....c..g...Q..7..6...0t.ke6..1U.....n...m.|._g.A.g.....h..a..:.......*..6[...P=|[.....mVdO';..I:P./..dR.....h:.l:...S..F.c..O.x...x...I.%.c.=....Jg..5...yS..DW~gQ !.....EU~wy."..t.....8.F.-...wD....:..9.-........p.h_....Z...F..Gbc.....-k...b.@""{.QA.....^.FPTR8.I..gJ6.A{.....\c.G..|!T)U...c.o...1888...g.OK...&.`8."6.F.1.1N.cd.u..&.x|~N......(.Oz..........*.ew...6y...X.(..........z....6h.a..xn........g..HY.`[......................n.^......d...H...HTTP/1.1 200 OK..Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding: gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Wed, 30 Nov 2016 00:43:29 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com; Expires=Thu, 30-Nov-2017 06:31:49 GMT; Path=/..Set-Cookie: tvrg_60409="1,1480466609"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 30-Nov-2016 00:44:29 GMT; Path=/..Vary: Accept-Encoding..x-tremorvideo-status: NO_AD..Content-Length: 544..Connection: keep-alive.............R]o.0.}..`..[....J.2.*...%......w....?(.......e...q.......P.:{4V(...^?..d..Y%.C...:....c..g...Q..7..6...0t.ke6..1U.....n...m.|._g.A.g.....h..a..:.......*..6[...P=|[.....mVdO';..I:P./..dR.....h:.l:...S..F.c..O.x...x...I.%.c.=....Jg..5...yS..DW~gQ !.....EU~wy."..t.....8.F.-...wD....:..9.-........p.h_....Z...F..Gbc.....-k...b.@""{.Q
<<< skipped >>>
GET /report3.php HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:46:49 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:46:49 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8......
GET /report3.php HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: vi.ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:46:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:46:50 GMT..Server: Apache/2.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=utf-8..
GET /5/10/logo.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/player1.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: l.longtailvideo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: image/png
Date: Wed, 30 Nov 2016 00:43:25 GMT
Etag: "3015243340"
Expires: Wed, 07 Dec 2016 00:43:25 GMT
Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT
Server: ECAcc (arn/46B0)
X-Cache: HIT
Content-Length: 1845
.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP....0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......cv..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. ...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !.....Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9kL....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{......>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'....x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`...8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.bi..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
<<< skipped >>>
GET /counter/counter.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.statcounter.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:23 GMT
Server: PWS/8.1.41.3
X-Px: ht h0-s1150.p11-fra.cdngp.net
ETag: W/"576924c5-654e"
Cache-Control: max-age=43200
Expires: Wed, 30 Nov 2016 10:14:08 GMT
Age: 8955
Content-Length: 9529
Content-Type: application/x-javascript
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT
Connection: keep-alive
...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C........l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&....d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q......$|...._.;...Em..itPa......P..Gj.. .5. G..1m.....Ee...F70..ZUU&.&.?.>..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4.................#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*..EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t.........J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D...y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\....'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
<<< skipped >>>
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 08:51:05 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Wed, 30 Nov 2016 08:51:05 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /page-1.html?lid=937115 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:21 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Content-Encoding: gzip
f45.............\.S.H..9.....[.`.l....3..L..I....[S).-.,aYR......}..zX~...l..T.j.....O..u...Brf.<...j..v....J...v....u....t.s...... 4f....D......m.......v.}..FW......SqF..U<!....P6*..h......ZMc.Ea..;..U.-.....J....$..@t5)nd...x....5..z..|"B.r...j.; .h.C&ma......`>..U6_...C....^...x\.C..b......}........F-....C.:. ..n;.).,.....q7.@....-.(.}...z..1.b...*.o`P}.....k..[.....3.~,7..S.a........_...?6..n|.Dqo.......l..~fz.V.:...CG...C[p..M..|s.z}.w}...,....<...}.1.v......0.....h...c..9._r...-..[3...w.....U..gT..|.......X......... ..{..'.....lU.A.q.r5..D.C6. u..|..1......$vk7.<ll.$..u.x...`."..[.$..M..).I..\.|.....0.n1........./- ..^...~5...(,$..y.4..B...e..q!.K.h8.....X}...m..u0..T.T..R...~..h.{.?...Y}]q......T...W@63...V`.GN.b..*...s..g.ks.....i../w<.nlU0=.`....L.0Q...i.y.Sk...hli./.k..dT..3c...$.n..m$.X.....D.......fJl.....g....DHB[.1..>`nO..Y.e4B.9_....H......4...QPM...?.(..N$..J.P.h..l.f...3(.l.}...Vf(.......U,D..qn.1f...z.....Av..-..g.}']f.I.L...}...D...i..9d...3(.?.H2Q...1.a...U.aO.S.Q..."...ER.P...(.M.Ax0.z.]..E.-.X...D...[.a..A(v.IW........D.i..y.l..% I........|.......R...Y....&9}.....Z...U$.{h...3....7O}St.B.z;.~.._&..w...6[....Gi.ki.E:Z]... 8.t. .g..B...d2.w.G,.$.....Dd..|nv.I%.B....jis_.....q[...{.,V.QK.v2B.w\...t,B....O.fn.._...7.s...T.=..K.j#.....A......4`...:...~y.........o.>\...6..F.%R?..9.....\.wF.wLJ=.t.....?1..t..........._.......Z.B*................5J.8.p.....n..R......[....Y.....<}...s...Rx...............).......<.,...M.......E.............]...K U...;.:EO..e...]s..`...D
<<< skipped >>>
GET /page-1.htm?lid=937115 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:22 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Content-Encoding: gzip
117f.............\kS.H...T.?.hkb{...m...)B....*!;..JQm.e.dIH.....{n...F..............=}.O.".... ...L"k...?...(..........>.l.zc.G....3<7..........1....5...C....P.....V..m.. .F |/...?..6..S...T.wP..f...d.H......14...X4...D.2j..).S......f..."....U4..i].S..h$....w..-g.......`.......a6.......j.b..G.. C.)...........8]...}d..p.L.m*l......;..M.....=.,.}f[..y..x.&.s..Y(. {...H.N...&Q...r8.J/L...1.*5.~....|V..`lG....:.6.oLk6.....,.#Q.<..n.....g..`hx..<...?....PW.....1..6D..8..........nFO........D..@.}.c.4*.O..{$J.......2..#/.hB!.Ld..M{.l..7.[)X.h]q...`...L...6......3....b.._.I..Or....../...6=. .......,-...C.7...k......f..3..c.j*.J.......E0.............u......T.P.....u.ln...VBs...I. ...NTH......u.._.q..sM..o.s.P.b..XCwPHr...Yo...|.....Y!.Z.2v&.B..pl...y!.......dRm/..D!E.I..r</....@..Z.M.V....Q.sR..lG.l.B..X.........>0...dO.S...R..b.O...G..baA.b...f..Z3....R...*..d...3c.....m7.:..$..y.Qb.L..Dz.CJ.........Bg.HB_.0.s.C....j..\..._.;....]VG.)i)3.#...,...(.p.0:.*.Z...=...&...A....EV.ja.b.M.|...X^...j%...R.PU(....*..c.I..o."SHG..3.A,I.g..@..e.yc.J..S|g...J>EU>.1tT.uL.4..Y.....[.....~........(.1..D..S\.~....4.?.[..#...~P......>.....$.d........l..1j.C(....v.(K`],.D.^...t..H.....=.M..g6..)7.=S.3.....a.......i.t;......i..I..D....1vz~bG..G...R...2.w..,.$.....Eh..|l................6.;X%.eKL.WRc..s.).z.......E@8X..|b..>.......Mg<Q..|.*9...Nd..N...L'...S.$.........w...:.......s....;...........{.....6).....w.........oN......:~~.....W.q.RqF.EU....~8>9~.FoR....'o....c;..N.O^.]....M.....r..O.........K.5.
<<< skipped >>>
GET /css1.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.ivids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1480466603.4768EC11B3054F99C2BAA38B65E80AD8.1.1.1.1.1.1.1.1.1; _ga=GA1.2.763910521.1480466603; _gat=1
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:23 GMT
Content-Type: text/css
Content-Length: 1963
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 10 Nov 2014 09:13:53 GMT
ETag: "a1af7-7ab-5077d94d75640"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Accept-Ranges: bytes
A..{..COLOR: #000000; ..TEXT-DECORATION: none;..}..A:link ..{..COLOR: #000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 13px;..}..A:visited ..{..COLOR: #000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 13px;..}..A:hover ..{..COLOR: #000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 13px;..}..table ..{..FONT-SIZE: 10px;..FONT-FAMILY: verdana, Arial, Helvetica, sans-serif;..}..td {font-family:Verdana;font-size:8.5pt}...body {..BACKGROUND-COLOR: #ffffff;..margin-left: 10%;..margin-right: 10%; ..border: 0px solid #979696;..}...topmenu {..BACKGROUND-COLOR: #eeeeee;..border-bottom: 1px solid #B5B5B5;..height: 35px;..}...topmenufont..{..COLOR: #B5B5B5; ..TEXT-DECORATION: none;..}...topmenufont:link ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...topmenufont:visited ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...topmenufont:hover ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...logo {..b
<<< skipped >>>
GET /img/lbg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.ivids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1480466603.4768EC11B3054F99C2BAA38B65E80AD8.1.1.1.1.1.1.1.1.1; _ga=GA1.2.763910521.1480466603; _gat=1
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:23 GMT
Content-Type: image/png
Content-Length: 200
Connection: keep-alive
Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT
ETag: "a1c85-c8-4ebb56fac1880"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Accept-Ranges: bytes
.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:43:23 GMT..Content-Type: image/png..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT..ETag: "a1c85-c8-4ebb56fac1880"..Server: CDCE..X-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-001.ams002.internap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`...
GET /jwplayer1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 08:51:05 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT
ETag: "4403af-25d37-53444eccf91c0"
Accept-Ranges: bytes
Content-Length: 154935
Cache-Control: max-age=2592000, public
Expires: Wed, 01 Nov 2017 08:51:05 GMT
Connection: close
Content-Type: text/javascriptvar dtn = Date.parse(new Date().toString());..document.write(unescape(>>
'
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 08:51:06 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Wed, 30 Nov 2016 08:51:06 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /itd.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: aoaomo.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:22 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 1325
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html<html>..<head>..<title>a</title>..</head>>>
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {.. var nameEQ = name "
=";.. var ca = document.cookie.split(';');.. for(var i=0;i < ca.l
ength;i ) {.. var c = ca[i];.. while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);.. if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);.. }.. return null;..}..function uapcc()
{..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime() (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 50);.
.setInterval(function() {..uapcc();..}, 90);..//-->..setInterval( "
onl()", 60000);function onl(){if(document.images){document.images['onl
v'].src = 'o.php?' Date.parse(new Date().toString());}}..</script
><div style="visibility:hidden"><img name="onlv" src="o.ph
p"></div>..<meta http-equiv="refresh" content="300"><
;/html>....
GET /o.php HTTP/1.1
Accept: */*
Referer: hXXp://aoaomo.tremorhub.com/itd.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: aoaomo.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:22 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 3
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html...HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:43:22 GMT..Server: Apach
e/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length:
3..Keep-Alive: timeout=5, max=99..Connection: Keep-Alive..Content-Typ
e: text/html.......
GET /bck.php?1480466602000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.html?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:46:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8....
GET /bck.php?1480466602000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:46:50 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:46:50 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..
GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Timing-Allow-Origin: *
Date: Tue, 29 Nov 2016 23:55:00 GMT
Expires: Wed, 30 Nov 2016 01:55:00 GMT
Last-Modified: Wed, 28 Sep 2016 20:19:01 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11590
Age: 2900
Cache-Control: public, max-age=7200...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'>>
V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W]
.b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..
~.............>..........GB..N....?...?.I2.....U...o<.....W.;...
x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/
..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<
.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo..
...]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..
~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.
E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)
....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]..........
..*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.
........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9
..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....
q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z...
...Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....
C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.
X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'
....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P
..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...z
Z...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@
........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
GET /r/collect?v=1&_v=j47&a=105673728&t=pageview&_s=1&dl=http://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323&ul=en-us&de=utf-8&dt=searchbox&sd=24-bit&sr=1276x846&vp=679x392&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=495422830&cid=2093138924.1480466601&tid=UA-74694740-5&_r=1&z=1103281923 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 30 Nov 2016 00:43:21 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 30 Nov 2016 00:43:21 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;....
GET /r/collect?v=1&_v=j47&a=1085413297&t=pageview&_s=1&dl=http://VVV.ivids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=24-bit&sr=1276x846&vp=850x480&je=1&fl=23.0 r0&_u=AEAAAEAAI~&jid=1777473885&cid=763910521.1480466603&tid=UA-74694740-2&_r=1&z=1229294853 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 30 Nov 2016 00:43:23 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 30 Nov 2016 00:43:23 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..
GET /img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.ivids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1480466603.4768EC11B3054F99C2BAA38B65E80AD8.1.1.1.1.1.1.1.1.1; _ga=GA1.2.763910521.1480466603; _gat=1
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:23 GMT
Content-Type: image/png
Content-Length: 2536
Connection: keep-alive
Last-Modified: Thu, 10 Jul 2014 23:39:15 GMT
ETag: "a1c81-9e8-4fddf55270ec0"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adob>>
e ImageReadyq.e<...zIDATx..]]S.W..N.......7.NE.........(...H.8S..V.
....H;j.v..%.3...^.`...3...3....7.6......>..r..n...$....a`M.ys.9.y.
.,..U.[..a.a9M..8M .....4.`..8..4...i...:M2MXd.&J..{..K....=.?........
m.....!sX...M!.5.}...){.....].r..l.U..Vv9.afH.......Wr.i[FEX..v...;...
. Y.=."d.bjy..L,.......Ph..$..I.B...]W...}.3*.B.....-..&....!..gT..{.q
.`...hv.........i..8M ....#~z.|]......}a.......5y..!..&...NzV........&
gt;1....wb..A.E.|g..j....J7m./.w].Df.v.N.FN.}.%...#........g.7...G.wW.
.8"............SGe...x...M..%kV.%.B...7........gz.....K.....d.Da......
../........=).....G?. ..<...Q...k0...v.B.....fn4.:._a...|...J7.g.(:
...&..k.1.i......&.;........@....y.z..|[....w-....}.......c5....I=..J.
..j...5...."MV..[..8.Qw....w..........Ec}..~J.9m...A..v.?...m...FvU.;
....~...r...g..x=....... .....>V....9...~.....!.u.J.FZ.iB.L.T..S./L
..*.q1..|..8.2.z1..5{....kdg....h.S..k...8.K.v.....Y..-.o.E@S..F.oo|.
o.2.6.B...6..)m.T..Y........).O..........Q.'`.M.*J..p.tGW.....FO.C.=..
....b...*O..@....p*].h..Z.}.~....*G.....n$...D.....Q..4Y..8L..;...K...
Z..H1...ai.t.*yL...`-)2E..ip..C.d.&$*....p..[{.......4Ez..Gf.V..T.D[..
..g....Rm......u(Y.o@HT.*>?;}..D2ks...6>-\.)}Rb..ky......Pc.....
.-.\..?..s......319....^..D.i.C.....s.z.[..\...GJ...'8...Hi.s......-.S
.#...1...)..._S.V.ocE.\..cB.*Y.Z..B..%..r..73.8..p....P.U..\......2.2u
....S.....iQ.............P.y...{ 7i......v.s..N..-....K]\v.%..Vo$.P..&
lt;....}....Wb..9..7.p..$4=N Mj..0..4gj..Hie..5;-......6...8..m.(.
GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=4768EC11B3054F99C2BAA38B65E80AD8&sc_random=0.6264624061063745&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.ivids.net/page-1.html?lid=937115&u=http://VVV.ivids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:23 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Set-Cookie: __cfduid=dc6b71b1b298a73db8b24e47946c18be61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=/; domain=.statcounter.com; HttpOnly
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10675947.1480466603.0; expires=Mon, 29-Nov-2021 00:43:23 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1480466603302962551; expires=Fri, 30-Nov-2018 00:43:23 GMT; path=/; domain=.statcounter.com
Server: cloudflare-nginx
CF-RAY: 309a43cf757e405c-SOFGIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Wed, 30 Nov 2016 00:43:23 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=dc6b71b1b298a73db
8b24e47946c18be61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10675947.148
0466603.0; expires=Mon, 29-Nov-2021 00:43:23 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1480466603302962551; expire
s=Fri, 30-Nov-2018 00:43:23 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 309a43cf757e405c-SOF..GIF89a............
.......!.......,...........T..;..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: cdn.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 130
Connection: keep-alive
Date: Thu, 22 Sep 2016 17:57:27 GMT
Last-Modified: Thu, 04 Dec 2014 23:41:04 GMT
ETag: "2cf4c5e3d4c1206209355ac1065b0efc"
Accept-Ranges: bytes
Server: AmazonS3
Age: 21840
X-Cache: Hit from cloudfront
Via: 1.1 3ef066dcf359ad5dbc339df978147194.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 3a4igCQjSMA394Ibj8YDGTKBHSZoRfhl9x9QD9GcnhPjWHIw5fJdyw==<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" />.</cro
ss-domain-policy>....
GET /static/noad.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: cdn.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 73
Connection: keep-alive
Date: Thu, 22 Sep 2016 17:57:27 GMT
Last-Modified: Thu, 04 Dec 2014 23:38:15 GMT
ETag: "074455bdeaf186ffa7b220bc14965cd5"
Accept-Ranges: bytes
Server: AmazonS3
Age: 21841
X-Cache: Hit from cloudfront
Via: 1.1 3ef066dcf359ad5dbc339df978147194.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qD1xw02Y4UGp6bidxqGvsPQ4E25jSXcay4A9OxJD3FmVU-gFyYkmOQ==<VAST version="2.0" t:status="NO_AD" xmlns:t="hXXp://tremorhub.com/
ssp"/>HTTP/1.1 200 OK..Content-Type: text/xml..Content-Length: 73..
Connection: keep-alive..Date: Thu, 22 Sep 2016 17:57:27 GMT..Last-Modi
fied: Thu, 04 Dec 2014 23:38:15 GMT..ETag: "074455bdeaf186ffa7b220bc14
965cd5"..Accept-Ranges: bytes..Server: AmazonS3..Age: 21841..X-Cache:
Hit from cloudfront..Via: 1.1 3ef066dcf359ad5dbc339df978147194.cloudfr
ont.net (CloudFront)..X-Amz-Cf-Id: qD1xw02Y4UGp6bidxqGvsPQ4E25jSXcay4A
9OxJD3FmVU-gFyYkmOQ==..<VAST version="2.0" t:status="NO_AD" xmlns:t
="hXXp://tremorhub.com/ssp"/>..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: thm.vidvib.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:41 GMT
Content-Type: application/xml
Content-Length: 82
Connection: keep-alive
Last-Modified: Fri, 20 Jun 2014 22:54:54 GMT
ETag: "1000000015848-52-4fc4c61b7eb80"
Server: NetDNA-cache/2.2
Expires: Sat, 25 Nov 2017 00:43:41 GMT
Cache-Control: max-age=31104000
X-Cache: HIT
Accept-Ranges: bytes<cross-domain-policy>.. <allow-access-from domain="*"/>
..</cross-domain-policy>....
GET /abcd.mp4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/player1.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: thm.vidvib.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:41 GMT
Content-Type: video/mp4
Content-Length: 5784
Connection: keep-alive
Last-Modified: Sun, 04 May 2014 13:45:24 GMT
ETag: "10000000157fb-1698-4f8933a030500"
Server: NetDNA-cache/2.2
Expires: Sat, 25 Nov 2017 00:43:41 GMT
Cache-Control: max-age=31104000
X-Cache: HIT
Accept-Ranges: bytes....ftypmp42....mp41isom....mdat.................3../..aP.pAr.2H..*=4M>>
icrosoft H.264 Encoder V1.5.3..............sC....B.5l.src:3 h:480 w:85
4 fps:29.970 pf:66 lvl:9 b:0 bqp:3 gop:60 idr:60 slc:1 cmp:0 rc:1 qp:2
4 rate:5500000 peak:0 buff:2062500 ref:1 srch:32 asrch:1 subp:1 par:6
3 3 rnd:0 cabac:0 lp:2 ctnt:0 aud:1 lat:0 wrk:4 vui:1 lyr:1 <<..
....e..K....P..#...}..}..}..}..}..}..}..}..}..}..}..}..}..".."........
......................................................................
...;...c..[.o.......?....{m....?....{e........Y.}z~...?}..}....[...}..
..[......?..5.....M<4....=4.}..}.._...:.../.._......Z.Sd..t...ET...
..3...1..........u...t..u.M......\.<....B.u....:......`.5.U..\..U/.
.D.y..Dj..).(=......:.Q.o.?...o...8 ...6....C..]..?..DJ.U. y.e. .v.M..
..D&No..W.....Y...Q*RU... ._...n....x(.....eU*.........Z.j..........B.
...kU..H..&U..x.'..~.>....!yI..^^U..Iv..''!-p.?Dd.....7..P..d`.j.Z.
......d.....x&..'V.WW..say]....R..u....JXd~........u.}k_p...Z.U.jl..F.
.K...GY?:.:d)-........!^U......B.O.?......'....!.G.......>.w."..".N
.k*.....\NN..........U........R....~R..Cz...%...\.Z.W.j.r..R*..UV...;.
..*.W.._NJo.H....LG.........l.....W...u'....?...!2..'' ....,.//'OZ.W..
"......{.R.W..y........)4H......._^..,.;XS../...O.^.....j....O...EUU..
E..y.g.Uw_Y........B....!:.(..../.... F.....W..w\.NN^]JMjG....G.....O.
.....`.....BuiI.e$..Il../....}k.~_...yTu...i.{..RC.b....]._.,.....kA..
.a.Z.[{e.{X.m....._{s.Z.. .].'...^..Z..ZHZ..S........DK.tL'.9./}D.....
......'.xF....2.......?.p..a......p.X....X..y?..`.%y..k.>......
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ivids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.763910521.1480466603; _gat=1
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 08:51:07 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Wed, 01 Nov 2017 08:51:07 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....>>
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T.....
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
GET /homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323 HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.hikeemissivity.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 860
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Encoding: gzip
Date: Wed, 30 Nov 2016 00:43:20 GMT
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 7419ebe6dc61a036c7f081375facfd52.cloudfront.net (CloudFront)
X-Amz-Cf-Id: qZgR5wslkOiXEwPAv9FbFWrcyNwzsYfihh0Gy_YkPi2Zr0nhepo-Tg==...........UKs.6..g&.....*. .'j"A.<<.{H.q...... .....(F...w.....>>
.3.. ........wj.n...u..'....g..w._....._.. .,.s....;......4.F{..r~..n
..5...1o.;..}...EY...^........k:..t".5.!Q......,-..........w..p...Nv\9
X...O.NX..Dq.........S."..GIp..(.l......'{n.m...h5......{(...L........
.R7.lv...B.Q....2.sgt1E.&....B...,}...!w..q... ....:Z...d.."....j#.L./
F .)Y..E..Y..P.W..y......._.9....1^F...I.<j...J..d........`cA0.F)L.
K........f..7.)....v...tT..!...KH.oA.....P.$.v..!...]n.&.9....yI>..
(x..:x).o.k..\1............K.....M.........f..1.n.5.J....{i.. ..<.*
.......CE..(uo.....1....Z..........f..FE....Bj............Y6uX~W..L/..
...MM.}....5.?];.lxLk@lxF&............I.x..|.&.N..t..=>...1..t....E
x..6...Gt.5.5]..5....Blc.8.*.=...G-...tT..Qe.8.t...2.fi......x....5vR.
...>FA..s/....H.*...eU..../....3Z.4...M.?.._..29;=.pv.......)..4^..
.$...L#..c....\..`.E'u(..[MBy.?.o-._jJ...HTTP/1.1 200 OK..Content-Type
: text/html..Content-Length: 860..Connection: keep-alive..Server: Apac
he/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Encodi
ng: gzip..Date: Wed, 30 Nov 2016 00:43:20 GMT..Vary: Accept-Encoding..
X-Cache: Miss from cloudfront..Via: 1.1 7419ebe6dc61a036c7f081375facfd
52.cloudfront.net (CloudFront)..X-Amz-Cf-Id: qZgR5wslkOiXEwPAv9FbFWrcy
NwzsYfihh0Gy_YkPi2Zr0nhepo-Tg==.............UKs.6..g&.....*. .'j"A.<
;<.{H.q...... .....(F...w......3.. ........wj.n...u..'....g..w._...
.._.. .,.s....;......4.F{..r~..n ..5...1o.;..}...EY...^........k:..t".
5.!Q......,-..........w..p...Nv\9X...O.NX..Dq.........S."..GIp..(.
GET /jquery.min.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.hikeemissivity.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 878
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT
ETag: "b0000003c0a95-1d65-5418029ba830a"
Accept-Ranges: bytes
Content-Encoding: gzip
Date: Sat, 26 Nov 2016 22:59:44 GMT
Vary: Accept-Encoding
Age: 1504
X-Cache: Hit from cloudfront
Via: 1.1 7419ebe6dc61a036c7f081375facfd52.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 5djjYFnfujygNBhvGosrVESWBr1cBfKE9PWBQ_JbksUWlwYJAN0BCQ==............Qo.6.....;.z....$.....6`...o} .@.'..D..e.h..w...B.u..:.0dK>>
...........A...H.$...<.)v...2.......v.Q.[>l.q..X.,J.............
....I...nG:% G..|.H.C.....p`.. A.<~...;....0.D...W.<.S.....v....
...fIK}.VS^.S..;C93......2%k.{..x.....].z...j.....8..@...nM3.l......f.
d.,)/.......8..=.Rr..#..8I..1..b(.{.F.a... [..Z3....%q..._S..p.%..L...
#..&.|.Qf.:{..;.,...D.YmF..P._....;.?vD}^...6]...<.....19M.2.EBSmd.
j..V..L_%(.....l<...F[L..V"M'[(..4.........K..{HW..0).}2.Z.u.6.8.l.
..I.../.~Y..>.*v.....0[..Jk.....u..............b......a.....^..e.e.
......T..F...VPZ.<,...q^....\.]4.....nn.yi........>I...k&....n.W
....r..%.......;..q2..^..`1l.Ra.D....yT..v.d.^..z.\/2..p.....c1R....*.
o.<.""....T....7............6....C..n!..........._J<.v...h...L.Q
..!...D!.=!.B..y............?...........(`..Yp......<.0.<3=3=3=3
=3=3=3Gf._0..8.L=7=7=7=7=7=7=7Gn......3.3.3.3.3.?d...7G....*._.9......
...e...HTTP/1.1 200 OK..Content-Type: application/javascript..Content-
Length: 878..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..Last-Modified: Thu, 17 Nov 2016 14:39:55 GMT..ETag: "b0000003
c0a95-1d65-5418029ba830a"..Accept-Ranges: bytes..Content-Encoding: gzi
p..Date: Sat, 26 Nov 2016 22:59:44 GMT..Vary: Accept-Encoding..Age: 15
04..X-Cache: Hit from cloudfront..Via: 1.1 7419ebe6dc61a036c7f081375fa
cfd52.cloudfront.net (CloudFront)..X-Amz-Cf-Id: 5djjYFnfujygNBhvGosrVE
SWBr1cBfKE9PWBQ_JbksUWlwYJAN0BCQ==..............Qo.6.....;.z....$.....
6`...o} .@.'..D..e.h..w...B.u..:.0dK...........A...H.$...<.)v..
GET /amg.php HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.hikeemissivity.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 359
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Date: Wed, 30 Nov 2016 00:18:15 GMT
Age: 1505
X-Cache: Hit from cloudfront
Via: 1.1 6e8dd39e00d9a5c1a31d69ffa2821a5e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: MrPjTjl3ZL3_WXMUTnYEbmaFKi8cIK7uI4xgIQuSAraDjjc6MQ2V0A==...<script type="text/javascript">setInterval( "vwu()", 200000);
function vwu(){if(document.images){document.images['viewers'].src = 'h
ttp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png?' Date.parse
(new Date().toString());}}</script><div style="visibility:hid
den"><img name="viewers" src="hXXp://whos.amung.us/cwidget/iebro
wser1/000000ffffff.png"></div>HTTP/1.1 200 OK..Content-Type:
text/html..Content-Length: 359..Connection: keep-alive..Server: Apache
/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Date: Wed, 30 No
v 2016 00:18:15 GMT..Age: 1505..X-Cache: Hit from cloudfront..Via: 1.1
6e8dd39e00d9a5c1a31d69ffa2821a5e.cloudfront.net (CloudFront)..X-Amz-C
f-Id: MrPjTjl3ZL3_WXMUTnYEbmaFKi8cIK7uI4xgIQuSAraDjjc6MQ2V0A==.....<
;script type="text/javascript">setInterval( "vwu()", 200000);functi
on vwu(){if(document.images){document.images['viewers'].src = 'hXXp://
whos.amung.us/cwidget/iebrowser1/000000ffffff.png?' Date.parse(new D
ate().toString());}}</script><div style="visibility:hidden"&g
t;<img name="viewers" src="hXXp://whos.amung.us/cwidget/iebrowser1/
000000ffffff.png"></div>..
GET /draw/?w=colored&n=2470&c=000000ffffff&p= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hikeemissivity.pw/amg.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Cookie: uid=CgH9I1g IKk63nhbx4f/Ag==
Connection: Keep-Alive
Host: widgets.amung.us
HTTP/1.1 200 OK
Server: nginx/1.9.6
Date: Wed, 30 Nov 2016 00:43:21 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Content-Disposition: filename=wau-widget.png
Expires: Fri, 30 Dec 2016 00:43:21 GMT
Cache-Control: max-age=259200068a...PNG........IHDR...Q...........p.....PLTE...EEEYYY...???AAA......>>
.........;<=...~~~...abdWXZ...""",,,...............GGG.............
..'((......222.........uvyEFGzzz...<<<...kln...NNN>>>
;......QQQ~~.vwx...hhi.........OPQ.....................iii......uvv...
opp......UVV......ooo............bbb......bcc...ijj}~~......dee.......
..qqq...SSS......]^^PPP.........TTTaaaVVV............{{{...HHHrss.....
....kllJJJDDDBBBLLL......RRR...III............FFF.........NOO.........
@@@tttkkkvvv:::............|||.........WWW..................;;;.......
..?@@888666ppprrr...............KKK.........CCC...111.................
.000...lll......XYZ(((&&&hhhfff cdeZ[\788...dddccc.........nnn......
...ZZZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjj0..w....tRNS.@..f....IDATH....W
.W....Z)*.....&H..Z.(J.n....Z.Z.....-.....Q....kUR...(.$V!.8.j..F.....
!'(?p.......L>....$. ...7..-]........z_..._.66..WL..6..........!...
./..:...>}V..K<...<...J..G.s.=.....U....r....G..cq....T^V.w..
...X......r.s.FI.u.n.*...v:..]E.8..\ p".].?/_....\.|,y..s......-......
,U8}J...'8..c.....pD.K.g6..d.>.4..< ..w.n..4...l.Y.}.nd..z.N...a
c..~.e.l.....m).....f....M......=..~_.X'..Eq........[. Vo.M.B.>...Q
.. .M..%-T..].|.R.._.S.....B.S..'..V..?......O)|..BX@i..E...|..|...s.y
..Y....h.<7.....vEY._kC].t.0..m..(b-U....S.V.di.$M.NtL`.u..1=1_.&.V
I.W0N....K....c.1....dF...G.3.q.J8....._.eQ.U.t...b1 .....(.....b2..Z.
..A.{!...f. 0..C..b.....Q7.)1.....0.[.=4.rg.2.tj.08s.^KL..a.n.H.1.F...
.[3.......^..X..s..v....O2G.{I.6...P..3(..2..5".i/.....[.O.....W?.
GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hikeemissivity.pw/amg.php
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: whos.amung.us
Connection: Keep-Alive
HTTP/1.1 303 See Other
Date: Wed, 30 Nov 2016 00:43:21 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Location: hXXp://widgets.amung.us/draw/?w=colored&n=2470&c=000000ffffff&p=
Set-Cookie: uid=CgH9I1g IKk63nhbx4f/Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/0..
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.ivids.net/page-1.htm?lid=937115
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ivids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 08:51:06 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Wed, 01 Nov 2017 08:51:06 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....>>
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T.....
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: we1sb-wwcgk.ads.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 30 Nov 2016 00:43:35 GMT
ETag: W/"144-1446243360000"
Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Entertainment videos ivids.net&mediaDesc=Watch Entertainment videos ivids.net&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.ivids.net/1.html&contentLength=[CONTENT_LENGTH] HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: we1sb-wwcgk.ads.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Wed, 30 Nov 2016 00:43:35 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com; Expires=Thu, 30-Nov-2017 06:31:56 GMT; Path=/
Set-Cookie: tvrg_60409="1,1480466616"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 30-Nov-2016 00:44:36 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
Content-Length: 597
Connection: keep-alive...........S.n.@.}.W.H.-........T..6....Eh....a.......r.^.*..3....9;..>>
....(..H..h..@P.....!.......x.m..0....B_.....^{.Q.H........u..Z.b.N.o.
.l..q..i.S....Y..6..y.v......./...T.?.i..q.....\.%..$4...IP!.. ...H...
..yv.L.e.....AD.3?..a......].A...$.......F........_..?....0b..".X..i.?
u.. .....3..i.n;X...P...<[..0;0.0`..hN....j@p.Y....u.@.%.4.8i..!.X.
.......X.Q;........Z...x%.A..8g./.........o....#..U...n.W%.g....~.P.*.
B6...!P...S'FYxzJc.O.VJI..|.......^7...yp..f........?......,..#.^.XU']
].N3....?....>.....]?p..< ...z.*.K7Z.?r..1.._7...-......bw......
G02W..q.V.T[c....{..~K..m.n.y.................HTTP/1.1 200 OK..Cache-C
ontrol: no-cache, no-store, must-revalidate..Content-Encoding: gzip..C
ontent-Type: text/xml;charset=ISO-8859-1..Date: Wed, 30 Nov 2016 00:43
:35 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com
/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; Domain=.tremorhub.com;
Expires=Thu, 30-Nov-2017 06:31:56 GMT; Path=/..Set-Cookie: tvrg_60409=
"1,1480466616"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=
Wed, 30-Nov-2016 00:44:36 GMT; Path=/..Vary: Accept-Encoding..x-tremor
video-status: NO_AD..Content-Length: 597..Connection: keep-alive......
.......S.n.@.}.W.H.-........T..6....Eh....a.......r.^.*..3....9;......
(..H..h..@P.....!.......x.m..0....B_.....^{.Q.H........u..Z.b.N.o..l..
q..i.S....Y..6..y.v......./...T.?.i..q.....\.%..$4...IP!.. ...H.....yv
.L.e.....AD.3?..a......].A...$.......F........_..?....0b..".X..i.?
GET /ova-jw.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/player1.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ivids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.763910521.1480466603; _gat=1
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 08:51:11 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT
ETag: "4403b3-39741-4fbe0551c3280"
Accept-Ranges: bytes
Content-Length: 235329
Cache-Control: max-age=2592000, public
Expires: Wed, 01 Nov 2017 08:51:11 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q>>
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
GET /10114910/0/757d7213/1/ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:24 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Set-Cookie: __cfduid=d9d3a1e1db2f75a801067e6bf74f072b61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=/; domain=.statcounter.com; HttpOnly
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1480466604.0; expires=Mon, 29-Nov-2021 00:43:24 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1480466604145085836; expires=Fri, 30-Nov-2018 00:43:24 GMT; path=/; domain=.statcounter.com
Server: cloudflare-nginx
CF-RAY: 309a43d1a08d401a-SOFGIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Wed, 30 Nov 2016 00:43:24 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=d9d3a1e1db2f75a80
1067e6bf74f072b61480466603; expires=Thu, 30-Nov-17 00:43:23 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.148
0466604.0; expires=Mon, 29-Nov-2021 00:43:24 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1480466604145085836; expire
s=Fri, 30-Nov-2018 00:43:24 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 309a43d1a08d401a-SOF..GIF89a............
.......!.......,...........T..;..
GET /wp-content/themes/howcast/images/icons/love.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: VVV.howcast.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:21 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT
ETag: "5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"
Accept-Ranges: bytes
Content-Length: 127
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: image/png.PNG........IHDR................s....gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx.b...L.`..`.>....jg.....IEND.B`.HTTP/1.
1 200 OK..Date: Wed, 30 Nov 2016 00:43:21 GMT..Server: Apache/2.2.22 (
Win64) PHP/5.3.13..Last-Modified: Thu, 17 Nov 2016 01:56:53 GMT..ETag:
"5ac000000480130-7f-5417580ef28e0;5424c26f9d7dd"..Accept-Ranges: byte
s..Content-Length: 127..Keep-Alive: timeout=5, max=100..Connection: Ke
ep-Alive..Content-Type: image/png...PNG........IHDR................s..
..gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<....IDATx.b...L.
`..`.>....jg.....IEND.B`...
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 30 Nov 2016 00:43:29 GMT
ETag: W/"144-1446243360000"
Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,centro,_dmp_turbine,Pulsepoint,TubeMogul-GP,adapTV,TapAd,rocketfuel,1,thetradedesk,Bidswitch,beeswax,appnexus,tremornet,audiencescience,BidTheatre,videoamp,dynadmic,ignitionone,conversant,mediamath,eyeview,google,Videology,dataxu&uid=69be0537b12244c29476d5cd69b6ece4&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:29 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 516
Connection: keep-alive...........R.n.0... \..-..H. .P.....A... 0F.T&l..Iy....'.r.A......L:;4
.....JfA.....Lq!.,x,?]..Y..]...B.x..J;uY.vNO...l.Y.U..&.V..7..\k....Uq
..i.;y....h..8Z.M^.b;..C..9OE.^B....O.?.o..x:..`...z..=J&....<.'.g.
d..&..$.!@.G....5.']..J.[.0.3%.>.............2E-.#.JzfD.p.........K
..}.RpT[U......G.vC&.q'p.Sh-..Z.[.h.h.....tF..(.........p\l|Z~.....6..
4../.r.@..Q!.=...|C.h/.t..}h....'. ...kM%$v[..pRa?..U.`..l0.GC.0N.!2..
..4.s?..(...z..x].kfBfQW.U6....?K:.:'.k.A..0...!.b........1K.lCG|..IZb
.....9.-E.v.t.gq./.......L\.........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:29 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 534
Connection: keep-alive...........R.n.0... \..-...[ .P.....F... 0F..LX".............7.Y.<N
2..UgK.I.fA?...RB.T.,x.?]M.y..y...[....D.n.,X{on..[..]7E(t.9g...q.|.f.
.o...H..;i...1d[kyp..4?.v..E.].....P>}.H../.wY......^1.....%...[..x
:D1..{.).........&q..{.......@.....)........MY*.y`...>.@0.3........
.6.Y".J....&o...m...m%....(.7...J...8^......>Jt;.....Q....-...XK..&
.P._...5..a. r;.3....6.h`2.{.T....yWX..ol!.u..l4-.7..... ..`..G8......
__.$..[.......uX...."QI..Y...=U.R.....v'.VG. ,...M\......#.3...Xr..Fir
kY..%.........-../...ew...z.....JD...-= ... .....d..C.......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:30 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1e9.............R]o.0.}..`..7....J.2.M...-){.*tc_..b[.....&....=D>.
...~E.S....X.d...C...)..6...O...H.E.4......Ei.\....;.w. e...0U..j.....
W....m..{I..^..0.5.6....J..n/.V..Fv.).a...1...,..<}..i0NRB..|.....0
...|..|<......g...O....[>...8........y.!X....jT.)....t.&....&p6.
....G.W...Kt.8r.;.....c....O.ma....-..b.Jg......p.$...C...gy#.W.......
.gy^"P2.....'B.6!.4..t..\.{.Z..&.......B.MM=.....o..(.....p:.c... ...5
..?'.`.2.....>....WNU.....;....9^<. m..[.'..P..........R.......@
........b..'..5.........d.. ....V.........0......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:30 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 534
Connection: keep-alive...........R...@.}..pI.mE...0..$&{1.....i.R;J..nT.~.....l.....t..S.L/.
.uB.y)B...Z-.y.\.Bk.>}.Y..C....Ns..].zbBko..8.QX.j_e..,....2.m..th}
....V.......I....Z.,..z..$..yO^......y..._f.8._n.$SF....}k....Tq......
.v{c...G..2..8.z}..m......U...Y.>.L.k....T..:.4....<......(.....
b.'....../.n`...E._...(.*.<p.gn.=.........Z0(xN.@..`f.FO..H....>
...S#...`.d.t...FYr...@!7.R.......8....f=.....{...9P~.9z..Q..n..R..k..
@.T.y...W. ....Y.b....T.~..sb..mff..V.......g..V...f1.....L.*.&sQH...T
'.f.,.'.w.....F.T..@..x..hb;?.8w..K..}uiMo6E?..........D.......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:30 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1d6.............RMo.0...Wd..[........v@.b f7;.E@KD,$..IN..?...}\v.#..H
>0^..~p@cE..o<.y.T..Bm....r;....x.....t4....%^..^..3(kS5.....V{.
...\c....Mv..q..i....h.,o.C....A.?..{.o..../.......> ..K;..).h.W.V1
U._...p.q6.....C.h6.(.4.Y8....F'.O..8.bM...SC.....^......].Bg.#G...[&l
t;.<v.Z <5....d!Z...0T...>.n....p.(.m..dy..K..J..$..L/*......
..D....R.,@g..s...k...7\..kL)..4d.d^.(.... .C.....G.S}.....4..4.......
....-....CrH.mo<...y.7..?Jm.v7.............v.b....n..@^Zb..^. ..M..
?2:..z.O...d.................0......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:30 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1cf.............RMo.0...Wd...........v@.a f7;.E@.D,$..IN..?:..}\v.#..H
>0^....@..F%.d4...D.Rm.....q...w.:.. -.i.Q..K..9..}g.nL..#........u
.Z.x_.m.;/.3.....Z........8....c....M3,`...!..?..eE.|i..8......)......
...."..'........Y@.pr..h..@...Cp....2x.S...%R.o.]_...@B.;N....##^F...=
lQ.}d.9pE.r.a.I.=J'*.y...|..b..k)....jp. ...x.NJ"{...C?...a.:C.....n..
..`.7.5.T4l.....qt3 'A.."X..)F..>%A..K....}oLc...p...l...]......|&g
t;7..>......O.[. ... L./<;0.0 v|.....2...._..o...a..].J....d....
.............0......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:31 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 496
Connection: keep-alive...........R]..0.|.....[..@.©8$..=5..p:.M."...l'....G.~HU.<.....7
X^.S.A.y%Bk4.Z=.y..8....|.Y..C..'...v4z(...Va.\8.QXV...A^.......6`j.Z_
......1.E.w.R.......(...%.S..'.Mc..a.m..._V.8._n.$(#H......E.l.8......
.?..........].y.1.N.2d`.R.....@C..3.N..........#..b..L.f.x.u.k..5....L
......g..M^.Nj..M.]Y..`%....8.`.7zZ ...2D}.......$.....O.I......Y)..V.
...i..<..d.g#.....{..MrF.)....F.....JU./.;?..@.Ls..j.N.??.v7...ov.8
..k.. Q......\...lK.Pw[.D.J.3.A}.Q..F.b...#m.cC.kb;?o.;........r77....
.......E........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:30 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 502
Connection: keep-alive...........R...0.}.W.H.[q.Bn."..R.mw..m....{6X...M...C6....> ......
O8?U.........;pz Y...F.&..q...w.c.fW....P.....Z5#.j.j]6..........Kmc".
.].,.8Lx/..i....J[c...sm/M.C..<.MxF...u...Z,.,y..ST[...?........<
;...g.`<.N..4..(-....?.......j....x...}.m......8.....A...J.pjL....,
0.|`....F.Ips.....Fr....-o%..`. ..V.......b0(......:A.R.3....}.7.j!;.9
.Tn.]..../<..0.n....|.yS.<.........9........_......E_..U.Q' ..x.
..e../w.}..}....o...Q~|...>....m.R/....`..#q..h..1W.....Ef.)....._.
...C.d.K.....x.s....................
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:31 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 511
Connection: keep-alive...........R...0.}.W.H.V.!..$(...T. .....r.)..vd;..}'...Hm....x.g&\\..
S.6\.....N.$U..C.....Sg.....4..........).-..k5...*.S%\cJ.c...[....y...
8LX'..hR..[/m...g...4}.....h.2r.m7q..e.J...V.$.Jl..[.FR..[h."..0:.&...
|B.....M<.......2z...I......XM.00Gt....... .R..V..@`..`...Z!x......
....4..M..I....... ..N.. .>:9.9....m...aF...}.N.J..Eg.D......^.C.g9
...$.z..So.O.,...c.........k...CQf........~.D.Y..K.:rHQ.~a.b........).
....c.....M.......]o..D...l.:.m..(5..B.8\j...`.0.?.f...&.....qw......N
v.J...,..M............3<.......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:31 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1c8.............RM..0...WP.........hv[..jW....*2..b%..6$...4.......y..
y.xs..N...F&.|:s....!_.wW||.r7...[..W.?...4k....j.yVc...-...=c.......&
q?..g.n.g...w..B=dyo,.i1.u..1.^..h..{.}.O..O......r.i i.._....a.... ..
G.r6.0`,\-. a..*...,...Vh5..4.w..{..........`..LA..@.........$,.......
..0..A-8..A....'............:...Z.,....c{4..!-%{.......'--..J..7.r..A.
.(X. .@..r........;......]S ..m7....T.w.u>.....P..F...L../j...h....
x.is....4~...1.......#k..._..J.~..{.".........d........6K.......0......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:31 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 468
Connection: keep-alive...........R.n.0... \.....H~A..:)..h.Ji.A`P..E$........q.>.=qv5...6
.....C.d..`6..#.....ip_~|..6...[^..Z8...vk....f.....[..D4.9g.._;.}....
.]~.dI..,.n.1h....G.......K.k.$.C..._o.....:/......k24.K..B7.6VB..b..x
1..0.<^.9.`..2.].4...{.$...[....... ).t.tPG...!.A.;H/j.E....SO.z.AI
AP!H..._.e..<RQ!..?..$`..!Xr...w..C.H....2;..Jj..4.|U.4.ZT.0.".....
b.......1K..y.X...b#_..pp.......q......HyJ...v.4_....72...'......2...2
,K..b......O4.'f9.....(gGl......oO....}9.... ................
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:32 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 436
Connection: keep-alive..........dRMo.0...Wx.......8..xi..(.bv.CQ..D.B Y.d'..c.,..I..#.H*[..[
0.u..y8.L..5.../y.X........{Y..Zt.Q.v ....f....:....w.9g.......<..u
[..EV...~X0....F.Q..17..............]......u.tjg.zM.&...5....."..D.4YL
g)...r...E..xv-....I..}.>D........C......').Nz...z-`.^G.b. .......|
..^........`Oh..;P.`....>.o.M'.'c ....6R.UO..i...z...(.y....H. ..9.
..E........oY..........w^.E.=.9%.)c.....lci.9...".'u@..P....@[r.f.#.Bf
..`....O.........l...........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:31 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 443
Connection: keep-alive...........RMo.0...Wx.......8.......]1;..(.Z"b..,Hr...1Y......H=.OOL.C
....X.....'...wB.].o....~..K..eu..G..*.t..8...9.mg.....e.j.sK...6...l.
k?K..e.w.Z.9F.`..Yu....>a....BT..|]g....uQ...q..S$h...Aq.....i.G...
|2.1...3.Z..\.. 1.F:.^Hz0Z~:>. .....')..t.!\.J.P>....@...lQHh.5?
.U.@r(..........ZM..].:..g....Q.......R..'....It5..A..<...LD\P~....
.,a.ZscLg.qH.c..`O...Q..m.....{S....=)=k[...=.....!.....f.-......'Z..=
}.%6.u..d.[...O.;go........~2..........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:32 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 462
Connection: keep-alive...........R.n.0... 2..m...I......Rtk1...(.Y"j..,Hr....4k......G....r/
.F;0Vt*.B?.F.X..z........,>d?..>......]..k...B.....o|.Ib..Fna.u.
.....r..Y.GE..P....j..dQ.kGUu.....i.k.p.cSd..V....N.45N. ....b..|i...4
.,MfA.BLi2.R..Y..8.. ....r......n..c-..W........r).B.\PI].B.[......>
;.=....Q...T.........r.l..[..F(..(q.6.$.Y.FQ..(.gS.0..)0......5.......
...o`g...8r.N.($4$.......r.m{u...L.h......._r.w(............a.H....'v`
.........P...x...Xd.?7.L&.=A^W...dX.[.......EO.........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:32 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 436
Connection: keep-alive...........RMo.0.....F*...&@P..RV..n .....9..X........e.~\..7.g.y3...r
...:.U....0..4..-...._&....}/..B..4|......{3%.[.......$..0.S..o].~{\..
a..<(.......U.. ...6....|$O.%.......>..o..|9..j......v.)M.....i.
Y.....bJ......#...k>Hz&.....g..h^.....t.y.(..!......)H..@Q........N
p.T..55%....:0Z(...K...m..^..........FQ..(..#.0...0.__.....a....A.`.w.
.c.......|...).{m7y.\<<.{.....Y.N...8wRds........=....-e......w.
&.n..L~..|,.....x. .....?..........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:32 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 418
Connection: keep-alive...........RMo.0...Wx.......8..xi....bv.CQ..H.B Y..4..S....e'=RO||...^
>.;2V...g.4.H...z(.....e....?..9....?Tv...sN..s.do...x/..:...:p.-..
...eX...e....d.Q=ZG.l.o.....[.(Za...........j.......o(.KwT\..k#.H..y..
.....t9.hq..2.].4......X?......P...$. .u....t.^..-.}..G;.....6. ....dI
.B9.lQ...L .M...<ki.^,.Y.'...d1......Sr._..O.W........h...]...=....
.QL...Q.T.ZjC..ZV.......3,./..xfc.?..q.#..g...v&..J..]................
u.......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:32 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 408
Connection: keep-alive...........RMo.0...Wx..[....8..xi.....q.CQ..H4B Y.d7..S.4..e'=R.||..r.
^........h.G.E.R?..C..r./...G....dO...-|.o.7...%..m..D..s&...y.. .o.7.
u\......`..}...'U...h.....<.VX....m.?>....z<...^..F...Z..pi%.
i.....x.S........... .g...A.*)>% E(A....Yb.%..C...7...K......Sa8..W
G....`..l|g......L.......$I..$OgS.......OO%g.........[3r.F...prz|.K...
/......2..~... ........k...Y[./.G.....l.~..d.[.vZqX..a.K........>.l
.......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:33 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 422
Connection: keep-alive...........R.N.0...Wd"...M..M.........af.P..W$*v,....s[.:.. ...=.>.
r.^...k;].q4......~......y.d_..r].a.....[."l.7.B......#.).....p.......
..*d.....-7...[.......`....#x$-e....o.....*...Dg....E.......K..".3).l6
.sH9..S.k9K`...9.F.P [..o...e ..8.D..p.|...J..2hV.........Z...He6..u.a
.#.4.a.Mfu.$i*.<.Me&$.. }zb.........G.....^{.=v.......2.Ybb[x...E.
.......}f4G.'U7.Xp...FW.'....&...:Gde....\...C4y..3..Q.|....4..&@.....
\..e........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:33 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 430
Connection: keep-alive...........RQo.0.~..."..a......P$..U%...*r..X...v(..s.....>....}w..
....w.mx#S.......a\.R..W....|...m~....%J3....V....D..m.....Q.gg.R.....
...>.......R.;o.b,...r.....K.D......5._...,...t.j ]C.7./...es.Y.%1.
.x2.&.Q.O..Vl..4... .....|.....E.`...Y....B93.*c..k....K....U.VW\B.uT.
..A<.T.0..:L....5s.1..=>.....V.F...../..[..L.....-.......q.~.D..
..`.*..M0Z...fS...Y..g.9.|.r-........N1~.s5.......kZ.q.s{.i.C...t...J.
.=...U"...................
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=BidTheatre,beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:33 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 385
Connection: keep-alive............_O.0.....s........d.ML....@..ko`.uM..|{.D...O..=...r...z.6
.MY....].C.kQ.U.?.W.C..N.S6...p's...l...U#B.......x].c.....`....w.l.3.
...g.J...f[c.by;..f.....i&rX=>\3z:.L.<....h ..._.[.e.b.K.FI,x...
..#.x..(. .a............Y8...k.. sP.p.}.jP.......Z.F...N...........a..
0..}.s..}..-......Z...J........E)...A.8.p.._D.....R...1..D......d....S
....K.r....&_/.(&.V.C...=%.. ........L.......
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=beeswax,videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:33 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive183.............R.N.0....!....i.6..*jABB.h...*.^...!....q.By\8..;.3.5.
.......Ve<H.q..i........I<#'..Z.GX...F.......)B...v.6...9g..O...
ue|s...1....~.....h..<HR.{..........5.<._.|.<_Tu.|.3.z..%.x..
S........."....d........0..C..{....M.9K.55...]...h.|..\..om#...0sT4...
.f..Y.."..x.x...A.Z..~*..V.?.$.l...y..n.....E.....r.......t....J..n.ID
......w..|.....-e/.'\t...h.YAG0.6.}.6.....C......|I..d.....0...
...
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=videoamp,TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:33 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 428
Connection: keep-alive...........RM..0...W..........&...vi..aY.,...kYH.....C...aA....y..S._.
gg...ATn..\...x'. .X.>-.5.P..C}.E3.6..2..d.\!d...z....z..t.....QW..
o....$....E..5G.Wm.....9.nK..<..^....=.?.o..&.g:I..V../.W..@.Zu.J..
."......t.Q..<.e..<H}Y.T..E...Y..:al..^6fTm'.....h!H....(IXT$y.S
.m>........ro...?....q.h/OjGm.X.....rEY..I._R3.y.._...0S.\^L.hg...d
.3.....;..[/.<YU.6/.............|!.....t....._.>.E......n&.F[4.T
...~...N...y.........%6.$........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=TapAd,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:33 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 432
Connection: keep-alive...........R.j.0.|.W.....c.v.l.7N.p....=.bdki.........!Mzwp.. .fwf.I..
no.@....=......Y._S{Wn.....$O......f..Z..~.Z,....^.....;...-.P..A....U
..$..E.....r|m......^k.}H..x".XI_w..In.WyVf.g:A..F../.w.....lY...5q...
.0..<..f..s<...LD.0.......V..D..Y..&....5....3....b..,h.....~y!.
.S.Z.^...=.~....$.e.P.G$......>.a...O>...m....\Z..OG^....m...Y..
..e....a'./.*_?..uU.N.O.......E'$.1'.$ .T....J.o.]j..../.....V..>~.
..>.@......'.......#.z.........
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:33 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 394
Connection: keep-alive............MO.0.... ..6........E.V..nES..P..#.A.k........8.J>....}
.cZ>.....t.b~4.}.T;.N.3.]_~..%.Do.U}..{. Tff...V..........CO...gg..
;.......>...8..Bk..n.b,..>.z...........__/8.|{>....h..Z..&...
.V.B..I...l.4....!.i&D#...It&.4.l#{..#6..`t5Y.@...M..I..E.g2m..g.Brw.)
....q......R......5[...-..I.0...v,.p.G.....b.d_....o...-.......t.k...%
...A.n...rz.^C8e..}p_.b....&.'.$&.\A>f..x|(.*@.....p...e....
...
GET /syncnoad?rid=495dc957019e4aa586aabd72e8413d05&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:34 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 351
Connection: keep-alive..........dQ[o. .}......J[..PL..1Y.e....C.(q-..f......op...s8..G...\i!
...<.uxK%..>wW..].N..Z.eu..'.]l......n..Q....^{T6@..u.D.b.u.>
>....Q...^..:.N..S...j.u.....8...".......l^T..lGY....^..V...p.-F...
B)..)I..F.....c@.N.......L.Q:..z...He.8.....:.C.i..$f.e..9.pt".,b4..?.
8$$JcBj..<........h.t..S......!=..#F....2 E..~........'.J.?$..m....
.%@.......}.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type:
text/xml..Date: Wed, 30 Nov 2016 00:43:34 GMT..P3P: CP='This is not a
P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Ap
ache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 351..Connectio
n: keep-alive............dQ[o. .}......J[..PL..1Y.e....C.(q-..f......o
p...s8..G...\i!...<.uxK%..>wW..].N..Z.eu..'.]l......n..Q....^{T6
@..u.D.b.u.>>....Q...^..:.N..S...j.u.....8...".......l^T..lGY...
.^..V...p.-F...B)..)I..F.....c@.N.......L.Q:..z...He.8.....:.C.i..$f.e
..9.pt".,b4..?.8$$JcBj..<........h.t..S......!=..#F....2 E..~......
..'.J.?$..m.....%@.......}.........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,conversant,appnexus,TubeMogul-GP,adgear,dataxu,SundaySky,dynadmic,videoamp,Videology,rocketfuel,thetradedesk,1,google,BidTheatre,centro,mediamath,_dmp_turbine,audiencescience,Pulsepoint,ignitionone,Bidswitch,eyeview,adapTV,tremornet&uid=69be0537b12244c29476d5cd69b6ece4&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4; tvrg_60409="1,1480466616"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:36 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 516
Connection: keep-alive...........R.n.@.}.WPK.-.s....(I.Hi..C....w.{..]....w....K..=3>3s..
.N..s.m..Y...A.....*....7..Y..].W..6.4..fj...VM..jh..].....QA.N.%..,..
}3...t.:y.S..@{k...M^.c;..2.....sV....}...Z......."......n ....4gY.$I.
[.m...pX.q...?JH.<.#.UY%e........G.E.p%|....|Y.. .-v..gF..FT.F..%'.
.E.......^V...`5a.........>.R.N.x..........a.D..3s....WN0..v>-k.
a....`.4../....b.(....... ......F.t{.J.s.....u......nRB.<L.h0...`2J
b6...1P.=?.i........=....n.63....\.%Q4............. ..t..S~.s.y....d..
..^...Gi............Y..^..........<:. .......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:36 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 535
Connection: keep-alive...........R...0.}.W.H..BB.h" ..m.R/Qa.....{.X...M.....I//}@..........
..A..E....3.A%........{g...6i........Y...Z...g54Ro......Q....%.5...[..
;I..A...D)......&...A..#.....,'....$z...O....N.m..r..{.TH....8....W:~.
...IY.AH..4$.....P.T.n,".;...%|.U[.}Z.. .-.,..5..0....F,9.....t...@..:
u.-XM.00;4..{....R....`.8....?.P.VK..83.n..q..FN.. .N...S..0N.b...|...
.Q...9".w.H.z....`........kTa[]r...Sl^.h6....O...O...(C....//I........
g=.q ........\..S............^..,X../o......&{^.&...`.K..h.Q...s.I...%
..kBwx..{..`......{......gzQ".)@.....YE..D.......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:36 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 504
Connection: keep-alive...........R]o.0.}.........h" bi7U..h...."c...`[.I....d.>^..|......
hy....h.....h..@P..(c.).4.u...h.f.5.....0..;..j..VC-u..#*k......Xb..;.
.....D).$..M...EYk,.I...d.:r..^4e9)..?$....]....9E..hh..n ...-5gq.$...
t.:...iQ.AH.......&.F.yS.WY6.....o.K.-.(.`4..0....F,95....,..g ..l;...
...f.!.p.p..PJ..1.l.........a.D..3s..V..F0.f..Y...jN...8.....y...`P..#
9!:t.H.z.%..`...(.E.x.j........k....l.....}...0`3........D.....Z..&r..
...j...5.Gr...........Zi0...I..X0?...$......5.;\...v.`....{Mv.{.}.C..K
..O........7.........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:35 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive20a.............R...0.}.W.H...BH.....JH..M....r.!. .e;@......HU.".....
..pz)...(. .Y.^......"..M.........,I.4...E.'&..c..q...RE..hU:ZK.c&..S.
...m7[Xq8c.8......(i..2N.w;I.........$.<.....|1Kg/.v.(#PP......"l.8
.| A....~4...,....}/ ....hWF<....*..;..G.....#.\j.o....[..:Vy...0.0
`...B.'........na.8...^..P.FU..9.gnh.8..#Mrh..F.Vr....IIL.FO. (...@...
...DJyU..Q...Q...h..X)w.V....[W...G. ....Qw..>.Q.y.(x..q....R.J.5.e
X..............Y..a...S..P.?Gf..vh..i.J.....zv..I...........U.M....t..
N...z.O..0.?....."....<.P4.....;.........7......d.........d.E.....0
......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:36 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 484
Connection: keep-alive...........R]o.@.|......`0`.d..$."UmT;.!...n.Op............>yv=7;;.
xy.......J..p..P....M.....Go....Y^\iAG....\.U....;..6US.Y-}k.7p...56..
~.dw^.g|..?.h.....:.i.....c..5.../`...!..?..."{...`."C.............Q4z
e...|:..e.F,.M#...p.nt2........8885........X..m.. t.8r.;*....c'...Sc;.
pA..e..:..35.O...p.".7.C..:Y.*.R0......:.....PQ".#...:C u.|.`.<6{..
..s..Ro\cJ....r..8.M.r...)...(.3..."...K....}oLm....Kp...[p.!E$..O.I..
B..]...6h....xehWq@{.i..v.b.......@aZb....W.....vetQ..........K.:,....
....
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1de.............R]o.@.|..p.....1..`Q'."EmT...E.r.1'..tw`...8n...>1.
....6^....CmD#.g:...J.p!w..X|...Y...M..W.?...4K.8..j..Vc...-'..]c.3.Kc
..&q.~.f7N.g|..?4(.z...X....v......<.f......4~.......b.@[I.M...%...
..<....{a..."...2.#.zA.....l............%..'.........C.B..#G...{...
..2.O..`......?.a(.n.|....e......|?..^...#X#.P..^.E.@.PQ".#..u.@P.....
4...`P5B..oy......8n...%z.YTN}?.........~.....4v.L.V.F..8....s..ef.H=.
......"{W .f8$7...v... L.{...Yh`{:...B4.v..q.d.7.......k.?.........w..
....0......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 498
Connection: keep-alive...........R]..0.|.....[..!)(...!!..S.....r.=bA..v...]s...T.......x...
:.:...".......5.b.[.|....H>DOi..h...C..:.J....j.U-..ph].J5.@..&.U..
...]YI..A.}..i@.(...*./o.Y.....K...d...I....U....v..Z. ......&l!9.. a8
z......L.".B......^0..&fD.sk{..2.4.'..>....K..0`...B....".A..U....k
.......e...3u.....V0.g.S.....S..0N*..7z^.A1....D..:#.T....@$.......0.w
.jv....0l....F.IX.=...7...M).|.....$r.7.^.Z...1.!.4....Bn.1../...0..z.
Is{...;.e....|.E.U..j$(.vn.-%Z.;P7.D.82Af..=...w..B......._J..{.;wu#.!
@........>........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 502
Connection: keep-alive...........R]..@.}...$...".....Mn.....6..!..(.e!........~<...3.....
....08.....5.G..$......d........1I....iX(..DViL3#.(.jU.....h.X.3...VG.
..<YZq..A.~S.i@.Q.i.U.]j.i.....eh.3........b.d..u\C..(..cn'..). .#.
h...l....dR...0...t.9......Z.y.,....P.:....(..z.!tp.pB..%.[....4.4..0.
@.U#.(.>..J.i 9..}..w..J0..pA j..zV.E1....D.... Z5.,....<...M-d.
8.U..V.B....xZ......q\.9S7...8.}`.>?.!....R...^a.<..h.i..r..J{'.
sm.l..r...V....c..[~...V...X>...\.^..U........B.....8...Pdf..=.^.q.
.....r#._Z..k....... ....V.x.........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 512
Connection: keep-alive...........R]..0.|........$.©.$..=.p}8..c/...............).........8
uj.. .9.......qy..m....3....I..i^K....l....3.....E.....1...3c..L.|..K.
N.&..._5)K.m.6......N.>..[.*......u...Y,.,y...D[.....m$.....,....`O
...t<.........2.x......3P'uh....`5a...1..j.gD...KeZX1......f(H.....
..[Z N .H........N..`..b.......c...3. ....([-v...<U'....b.c...J.\B.
j...0...|.y.1....g..0.....k...z..Z.?,e..Uo..5.p.....G.*u........v.m...
..).....c.....-..-...m........Y.u..8kQj0...q...-...a.~B..23M..O|U.....
...;.....v.x.7;.o.......\..=.......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 471
Connection: keep-alive...........RMo.0...Wd...b...........[1;..(.Ybc!.,H.....n.......G=....,
......L...s& i.............$?..........l......Z...u[.h#\c.3. c.mM.|...
o.,..$K~j...!*zcAd..;)...}M..9 .~...K.>ln.2...)....f.........,.....
D.O.2X,.*.b.yAL....t.R[.....sx.o.......(.......)`..`....A..3s.....V2..
..1.%a.S...'....^.@pd.*.s"gD.g....-......G....b.cB.l. .a...- ..E\.}?..
......a>....c....w.u...q.kf9#G...~.t....].5b...)......\../jwBi0...Y
...:..\a.|...2KM.....Co.....{%..}......e.........Ag~S........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 469
Connection: keep-alive...........R]o.0.}..`H.....X" bi'U......."c....X.!......>^..s/..s.o
.9.g..cE.R.>...(.r..../.|..o.w...(/.`..Ee........g@....)k%.V..[[G]g
S...]~.gI..,.i..`.........^Q.&..y..yI....,y.......,..q..M....S-..#x...
......U.XTU..,..1.-.h.&:..z.....=)8vv.....Xv:..@9.".,.=....E.8....1...
R0........^6@.#...=.#.^ph.................q.w.3.P0..QV.......A..`..._2
.......YB..........c..rkz3mM..F..arOj.@..8.w.5_.....".O.'..........3$K
..s.=.....8.Ef9.....1h.l...\..._..%..9.... ......6k........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 438
Connection: keep-alive..........dR.n.0... <..m..8.........[Q...(.Ybc..,H.....4K...G..|$..
.....X....N....Z..6...._....Sz_.....4LTv.2.qN/.q.dk....V.k....u.u6....
..~......C..3Z.`...:.zey...........^.....eQ...v...P.....b..|e..b.I.<
;...|..fu.....(..<...Bg.D..._.5..............w..N8. .;..P.....(..!.
....5o..............CK..{.-P...{..[.......u.....q.E..|...0."...$.s....
...)O..5].......e/........v..i.e...R....I...N!z.g..?Q.Ef5...r...,....9
.....tx<.Qx.G........,.........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1bc.............R.n.0... T....,.Rm...I..E.Tr{..."7..."H....k...8.'..gw
..M..|..`..T......b..j.......~..I..U}..'..*.r..:.W.8..3m.LY'......:.z.
.7_v....%.....Z.9E.`....k...M.Kr.Z...._7y..n}U...y...).4.k....(/..Y.4I
..6{X,...i.8aq.%4X...MtF{...`.x.....3.....g.X.....C.8 ...\..P..TR....-
P..A.`....Ap....)..5.n.'....a..R.\o..`..T/.......a..p.%1_0....D..yJ...
....c.h...............My......;*=k.Hm........Q......3.@.Y...q.........
....o-..B............qT*.......0......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:37 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 461
Connection: keep-alive...........R]o.0.}..`H.m......K:)S.V.n.U...6X..e.....4k...o.^....{...?
:#(.zQ.......S&v.{.|...]....U..i..f/..0...#.....W.....Hk.:f..6....W.j.
.yE.2......U=i..l.w.....K.(Z...n~l....j]5..INbe.5...;."zL..."..e.=..g.
$..6M3..I..Y......aT.!Z}fT?1C:..AP<....t..rF,.@...t....l.m...'..hd.
z...... ...G..g..bK...A.L.7.<.[.fq..Q.$$.'YJg..~.....2G...P.W....A.
.5a.....q....(@1..8...o...U.jd..<./.mh......{K.G.'........2_)...A.
a._.T.e6..........l.......'..N..9.V.. .....q..........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:38 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 437
Connection: keep-alive...........RM..0...W....8......,.Vj. .m...r.Y..vd;@.}',..........7..Or
...X.U......b.........O.<...(..J.{..*;s..u.....Hm.m=dZ.k..s3..km...
[.7~.......6..>*;.@.... ....%......au.....7EU<^..j......v.)M....
.@.$xf...4...:....QB.I.....>.n.....pQ.....u.y.(..!........W[...A.`.
... 8h*...o......B..r...l..5.P0h...5..qR..0.X8...O..|.....<%...4F..
}.'...p`.n....{....\.;j.......j.?.../z..1`...<]..^..^a.~..(2 C...gy
..,.......o_..K.._.........x.-<........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:38 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive196.............RMo.0...Wx...,.q.%..xi..(..v.CQ....B Y..4..S....e.G...
.T....`...^..4......P.2.k.|......{U7gZr..Be...;....gP.......X...-..7.2
..mS]...x@....Fs...:..9..u}S...Q...l.n.h..~}Q5..IN.q.....;*.z. #x.!.y.
....E:..m..,....y.M.D...8....!Y.Q...y(....:.?..t.^..-.}..G;....=..E0..
...u/....K.q.i...p.g.b<...4I..%.4...q...a..@....Kcz...}..n_.c]...M.
..._.................k.....3........`O.o\.P9...............'{.....d...
....-..$v.....0......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:38 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive18b.............R.n.0... <.....8.........]....(.Zb...,H...}. K....#
...'..v.%..:..2...8B.[!...........@.V..LK.........{3'.[T..v....8g.....
..2.....bF .1...1h..jp......juG.)y..D....7.~|X^Uu.p.3`.......4.-......
."y....,.L.&...'Y..4.....b. .....B!A....E.z..f..At.a.P/...L. 6.6.....i
..!X.e.....x..W.5.L'E3N.,.., r1.".s..=>2J.........[3r..0...d.... v.
.,....7.Xt...F.6..=.3d.[...Y[...K\....l..B.d.f.9.8........d........4..
m.....0......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:38 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 421
Connection: keep-alive...........R.n.0... T....6K.A.P.....A.$. 0(rb..).....K.n....,o..Y.b'_.
......$......P.*.o.......~.W....`.P.....9=G......6b.D..0ps...l...X..!.
5..~4Tk0.o...$i...ju..{.HZ..n..^...iyY7...NS.......WL../..U..,....Lgy.
.mQ........H.DW......K..&x........7...(8.TjoR..j.q7.Z..P.;k.......&..w
.B<..6I.<g.,/.>e...`.??.........7$...D|......|......N/|b[9...
x........|d7G.'U.R....#....H.`.&.7~t....l...j...G...t..?Z..g..?m... ..
..!.^.........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=mediamath,BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:39 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 430
Connection: keep-alive...........R...0.}.W...[q...$(...T.UI...*r..`u.X.C....(."U};c..3sf....
8GP.."wgS.u@..2..n]m..w....K..n.`..D..&w....BF...ah...Hk.:f..6......r.
.YI."......h.....:.:..C...g..V..?o....j]V..ENbe.mh.... ..t.....i.?..s&
lt;...m.$%......dF&2.c.:..E.`.....d..Q.1..b..V.<./.d...AC.l..Z&`2.Z
...8L.Y.D...Q...P............ .....'.rl..w........NV*.O.P...Z...1..7.v
.......vM]o-ZO...s....\*...Q......A.`.}.V`...&.....A.m......./%.. ../.
.?.......Jh.........
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=BidTheatre,beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:39 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 386
Connection: keep-alive............]O.0.....s....16!].....52.....#,..i;..o..~.xw..{..'/..W...
.)k... .=....\e.}qy~....~...Q..dnQ......j...P.z.....2F....Kmc2..f.O|.s
.....R.w.|k,T.hw.......5.EAW.w3.O..I^......J.....VrYS1.....i.>..s..
.z.%I..0Ni.........7.~..7...V..T..jW.6..T]J......6...:....A.....Eq..A.
&....'.!~z"....j].?,..|.Pa.6`..k......k..Bj=...Ji0....c....0... .B....
.......85.zAG1.v..2ty.)............M.......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=beeswax,videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:39 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 389
Connection: keep-alive...........RMO.0.....F....4Mh....HHhA4..*T9..Z...N..{..P`/....y.y....K
..uB.*.'i..b.........<^...O.j..l..A....w..9B...v.....9g......sU..vS
_...<".......... I...V.;.>.{..7t.p.M.....n....P.U..|.}ULi..V...Z
....?Mg.d..EQ.".K.N.b.F....M...-)...!..^..-....K...m..Q7,...N'e;..<
g.,/.>e<..`.?>...J..V...H...1V....&B#........r..S.G.X..:.....
.N..^Z.^...!.7.,...R....e....F..t..O ..m....@.......^.H.e......
.
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=videoamp,adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:39 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1a0.............RMk.0...W....._.7AV.&...n.8.C)F...i-.I6.._9$.~..:hf..{
o..xo....n:...$p.........\.|q...?.....F.m.znr...9G.(h;......Hk.:f..5..
.o..b..\p....J.j...m.%....n.1.H.I.^..........(....... h...A0.Q.P..S.Y.
<..y:K....4ci.d4.Fi.|.S....hy..i.]#..*.....n...8iVC0..:..$a.,.R>
e..S`.<=....{.T....O..CG[y..kk.J^..T. J. Lf.95b.Oh...F.3...........
la....n.Px.....V....V.gVx4~..i..=.."x...f.}..|g.I-.T......@.m..\A.0.m.
...{..U._...d.................0......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=adgear,Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:39 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive16e.............._O.0.....s.{s.clB..e.!.!n..!.k.,..i;......y.....{~7..
w...2....v..l.qR...b{.....}t._.,......r.....Z....U.\7.K..(%lK....Q..&l
t;^$....Z..I,...*. .*..g.,.@pn.M.....e...,.$y2;..,57@./.='.../K...G..$
.e....E..... .^..[.....(&....?].J,t#..3.9,.........A@.n...C.....`>G
....JY.?..r1]....0l .O.... ..wL...t<~.......On.JH.....S....L]..>
...Q...w..p..VF..~.E......L2.k.....d...........7.....0......
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=Pulsepoint,_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:39 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive17d...............n.0.E...E@..).z..IA...@.........I,4..!.$._....E.p1..
.=.!-^.go.h.^1?....J.M.....>}...~A..eu..;. Tfj...VO...]......#.h..S
c.....|].3....8..Bk..n.f,t...z....SroZ6.xZ}.szy.= ...h..Z..F...).z...6
,........I2..u..2..\.i.E2.l.tzm..[............8Id<I..Ie...HH..8%...
...`.q@...}..[.!h..B;.4..(.`....|f...X....!N.......a.?......N#..(....
..[0...[...) .....7[P.85y?!g1...r.......O...d.......d.h.e.....0..
t>....
GET /syncnoad?rid=6ea770fc1f59433bb667c6047a05261c&p=_dmp_turbine&uid=69be0537b12244c29476d5cd69b6ece4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://ivids.net/ova-jw.swf
x-flash-version: 23,0,0,185
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=69be0537b12244c29476d5cd69b6ece4
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 30 Nov 2016 00:43:40 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive150............dQ[o. .}...x.m.....F]b.l.Z..1..j....f......op...s8..G..
t\.Z........d..g`Y.......U^.WZp..E..&..c.1.F.F..{.R.@.[...6....<>
;m...(g.F...-W.[...op..:E.....MsV...e...z:..|}..L..,.WM....6.f...-1WJ.
.J.)...Xs..1..&..k...m...p..u.Z.F*.'..{q.V~.D..FQ...2.'..h..8ISoG.]<
;.....$.........}.s.E.*.O.B.....t\_..=....,..G.9....-.~O....H.K...s#.K
..e.........U........0..HTTP/1.1 200 OK..Content-Encoding: gzip..Conte
nt-Type: text/xml..Date: Wed, 30 Nov 2016 00:43:40 GMT..P3P: CP='This
is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Se
rver: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chu
nked..Connection: keep-alive..150............dQ[o. .}...x.m.....F]b.l.
Z..1..j....f......op...s8..G..t\.Z........d..g`Y.......U^.WZp..E..&..c
.1.F.F..{.R.@.[...6....<>m...(g.F...-W.[...op..:E.....MsV...e...
z:..|}..L..,.WM....6.f...-1WJ..J.)...Xs..1..&..k...m...p..u.Z.F*.'..{q
.V~.D..FQ...2.'..h..8ISoG.]<.....$.........}.s.E.*.O.B.....t\_..=..
..,..G.9....-.~O....H.K...s#.K..e.........U........0..
GET /a.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323&rnd=1480466600000 HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml xml, image/pjpeg, application/x-ms-xbap, */*
Referer: hXXp://VVV.hikeemissivity.pw/homepage.php?id=21ACea9xB5LGdPdyy8go&date=2016-11-26&p=none&t=&ca=73996323
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: ww.hikeemissivity.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 30 Nov 2016 00:43:22 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 325
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html......<meta http-equiv="cache-control" content="max-age=0" />..&
lt;meta http-equiv="cache-control" content="no-cache" />..<meta
http-equiv="expires" content="0" />..<meta http-equiv="expires"
content="Tue, 01 Jan 1980 1:00:00 GMT" />..<meta http-equiv="pra
gma" content="no-cache" /><meta http-equiv="refresh" content="60
">806127HTTP/1.1 200 OK..Date: Wed, 30 Nov 2016 00:43:22 GMT..Serve
r: Apache/2.2.22 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content
-Length: 325..Keep-Alive: timeout=5, max=100..Connection: Keep-Alive..
Content-Type: text/html........<meta http-equiv="cache-control" con
tent="max-age=0" />..<meta http-equiv="cache-control" content="n
o-cache" />..<meta http-equiv="expires" content="0" />..<m
eta http-equiv="expires" content="Tue, 01 Jan 1980 1:00:00 GMT" />.
.<meta http-equiv="pragma" content="no-cache" /><meta http-eq
uiv="refresh" content="60">806127..
The Trojan connects to the servers at the folowing location(s):
Map
Strings from Dumps
inferno.exe_1596:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
ers\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll
ers\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp\ExecCmd.dll
"%Program Files%\Dendritic\allegro.exe"
"%Program Files%\Dendritic\allegro.exe"
p\ExecCmd.dll
p\ExecCmd.dll
.reloc
.reloc
EnumWindows
EnumWindows
ExecCmd.dll
ExecCmd.dll
Kernel32.DLL
Kernel32.DLL
%Program Files%
%Program Files%
\Dendritic\allegro.exe"
\Dendritic\allegro.exe"
\ExecCmd.dll
\ExecCmd.dll
%SystemRoot%\
%SystemRoot%\
eq allegro.exe" | %SystemRoot%\
eq allegro.exe" | %SystemRoot%\
\find /I "allegro.exe"
\find /I "allegro.exe"
\Dendritic\allegro.exe
\Dendritic\allegro.exe
\allegro.exe"
\allegro.exe"
$$\wininit.ini
$$\wininit.ini
e%uy%u
e%uy%u
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp
nss5457.tmp
nss5457.tmp
rogram Files\Dendritic\allegro.exe"
rogram Files\Dendritic\allegro.exe"
ecCmd.dll
ecCmd.dll
egro.exe" | %SystemRoot%\System32\find /I "allegro.exe"
egro.exe" | %SystemRoot%\System32\find /I "allegro.exe"
\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp
\Users\"%CurrentUserName%"\AppData\Local\Temp\nss5457.tmp
"%Program Files%\enormities\inferno.exe"
"%Program Files%\enormities\inferno.exe"
%Program Files%\enormities
%Program Files%\enormities
inferno.exe
inferno.exe
ers\"%CurrentUserName%"\AppData\Local\Temp\nsd402B.tmp
ers\"%CurrentUserName%"\AppData\Local\Temp\nsd402B.tmp
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\
%Program Files%\enormities\inferno.exe
%Program Files%\enormities\inferno.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Windows\
Windows\
Nullsoft Install System v2.46
Nullsoft Install System v2.46
mities\inferno.exe"
mities\inferno.exe"
dritic\allegro.exe"
dritic\allegro.exe"
taskeng.exe_2992:
.text
.text
`.data
`.data
.rsrc
.rsrc
@.reloc
@.reloc
USER32.dll
USER32.dll
msvcrt.dll
msvcrt.dll
ntdll.dll
ntdll.dll
API-MS-Win-Core-Debug-L1-1-0.dll
API-MS-Win-Core-Debug-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-ErrorHandling-L1-1-0.dll
API-MS-Win-Core-File-L1-1-0.dll
API-MS-Win-Core-File-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-Handle-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Heap-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-Interlocked-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-LibraryLoader-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-Misc-L1-1-0.dll
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll
API-MS-Win-Core-ProcessEnvironment-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-ProcessThreads-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Profile-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-Synch-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-SysInfo-L1-1-0.dll
API-MS-Win-Core-ThreadPool-L1-1-0.dll
API-MS-Win-Core-ThreadPool-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
API-MS-Win-Security-Base-L1-1-0.dll
ole32.dll
ole32.dll
OLEAUT32.dll
OLEAUT32.dll
RPCRT4.dll
RPCRT4.dll
KERNEL32.dll
KERNEL32.dll
d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp
d:\w7rtm\admin\wmi\jobs\server\session\session\main.cpp
Session::ChannelMsgReceived
Session::ChannelMsgReceived
d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp
d:\w7rtm\admin\wmi\jobs\server\session\session\session.cpp
d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp
d:\w7rtm\admin\wmi\jobs\server\session\session\clientchannel2.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\task.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\comhandlerbase.cpp
StopJobMsg
StopJobMsg
StartJobMsg
StartJobMsg
ClientPipeName
ClientPipeName
Invalid parameter passed to C runtime function.
Invalid parameter passed to C runtime function.
d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp
d:\w7rtm\admin\wmi\jobs\common\xml\taskxmlreader.cpp
TaskScheduler.log
TaskScheduler.log
j%Xf;
j%Xf;
d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp
d:\w7rtm\admin\wmi\jobs\server\engine\action.cpp
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-Management-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
API-MS-WIN-Service-winsvc-L1-1-0.dll
ADVAPI32.dll
ADVAPI32.dll
SHELL32.dll
SHELL32.dll
SHLWAPI.dll
SHLWAPI.dll
SspiCli.dll
SspiCli.dll
XmlLite.dll
XmlLite.dll
MPR.dll
MPR.dll
RegOpenKeyTransactedW
RegOpenKeyTransactedW
RegCloseKey
RegCloseKey
RegOpenKeyExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegNotifyChangeKeyValue
RegCreateKeyExW
RegCreateKeyExW
FindExecutableW
FindExecutableW
MsgWaitForMultipleObjects
MsgWaitForMultipleObjects
EnumThreadWindows
EnumThreadWindows
EnumWindows
EnumWindows
GetProcessWindowStation
GetProcessWindowStation
_wcmdln
_wcmdln
_amsg_exit
_amsg_exit
GetProcessHeap
GetProcessHeap
SetProcessShutdownParameters
SetProcessShutdownParameters
TaskEng.pdb
TaskEng.pdb
version="5.1.0.0"
version="5.1.0.0"
name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"
name="Microsoft.Windows.WMI.TaskScheduler.TaskEng"
8 8$8(878
8 8$8(878
3=4Z4w4
3=4Z4w4
=!=(=0=4=?=>>
=!=(=0=4=?=>>
5 5U5_5
5 5U5_5
5b6u6
5b6u6
-131J1X1o1}1
-131J1X1o1}1
=$=
=$=
Password
Password
hXXp://schemas.microsoft.com/windows/2004/02/mit/task
hXXp://schemas.microsoft.com/windows/2004/02/mit/task
-ieframe.dll
-ieframe.dll
%SystemRoot%\SYSTEM32\cmd.exe
%SystemRoot%\SYSTEM32\cmd.exe
%SystemRoot%\System32\Tasks
%SystemRoot%\System32\Tasks
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Handshake
WindowSeconds
WindowSeconds
InitializeCmdlineProcessing()
InitializeCmdlineProcessing()
pCrimson provider registration failed for taskeng, hr=0x%x
pCrimson provider registration failed for taskeng, hr=0x%x
CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]
CATCH_KNOWN: %S ==> hr=0x%x [%S(),%d,%S]
InteractiveTokenOrPassword
InteractiveTokenOrPassword
%d.%d
%d.%d
%s, (%d)
%s, (%d)
hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout
hXXp://schemas.microsoft.com/cdo/configuration/smtpconnectiontimeout
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/smtpauthenticate
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/sendusing
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
hXXp://schemas.microsoft.com/cdo/configuration/smtpserver
201ef99a-7fa0-444c-9399-19ba84f12a1a
201ef99a-7fa0-444c-9399-19ba84f12a1a
C:\Windows\SYSTEM32\cmd.exe
C:\Windows\SYSTEM32\cmd.exe
6.1.7601.17514 (win7sp1_rtm.101119-1850)
6.1.7601.17514 (win7sp1_rtm.101119-1850)
taskeng.exe
taskeng.exe
Windows
Windows
Operating System
Operating System
6.1.7601.17514
6.1.7601.17514
allegro.exe_3288_rwx_00232000_00009000:
.hP9)h
.hP9)h