Application.Agent.RA (AdAware), Trojan.NSIS.StartPage.FD (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: c1efdf1d2f9d814dbdd620eadccd7ec2
SHA1: 21c8a1e1d26fe8eef0c40df8055a7004f208d129
SHA256: e42757369c28858b14739bd513fc9aeb691166a85e260e038f105adf7e40ad7e
SSDeep: 12288:bjlVIlOxOEwLxfBMiRMb67oo282ryHjglpJc7ilfs pdEbqBC8SRVUdz:bhVIlOkViiRMb6f282ODggvuduqw8SQz
Size: 717689 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: Software sharing company
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Application creates the following process(es):
taskkill.exe:1040
taskkill.exe:1244
83506.exe:948
tasklist.exe:1176
tasklist.exe:1236
tasklist.exe:780
tasklist.exe:2040
tasklist.exe:1860
tasklist.exe:1076
tasklist.exe:1272
tasklist.exe:1156
tasklist.exe:304
tasklist.exe:1816
tasklist.exe:1276
tasklist.exe:1052
tasklist.exe:1920
tasklist.exe:560
tasklist.exe:520
tasklist.exe:1532
tasklist.exe:1376
tasklist.exe:1264
tasklist.exe:1036
tasklist.exe:284
109341.exe:1816
40512.exe:1016
52022.exe:792
26172.exe:1524
%original file name%.exe:1676
voracious.exe:1620
find.exe:1164
find.exe:1176
find.exe:1984
find.exe:1244
find.exe:1160
find.exe:1056
find.exe:1996
find.exe:1368
find.exe:1336
find.exe:1344
find.exe:1604
find.exe:624
find.exe:1936
find.exe:776
find.exe:1388
find.exe:1108
find.exe:1452
find.exe:264
find.exe:476
find.exe:492
find.exe:2012
The Application injects its code into the following process(es):
noo.exe:1520
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process 83506.exe:948 makes changes in the file system.
The Application creates and/or writes to the following file(s):
%System%\drivers\etc\hosts (123 bytes)
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsc4.tmp (0 bytes)
The process 109341.exe:1816 makes changes in the file system.
The Application creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\ShellLink.dll (4 bytes)
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\ShellLink.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsxA.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp (0 bytes)
The process 40512.exe:1016 makes changes in the file system.
The Application creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsf6.tmp\SimpleFC.dll (5289 bytes)
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsf6.tmp\SimpleFC.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf6.tmp (0 bytes)
The process 52022.exe:792 makes changes in the file system.
The Application creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsg8.tmp\System.dll (11 bytes)
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsg8.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg8.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu7.tmp (0 bytes)
The process 26172.exe:1524 makes changes in the file system.
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsc3.tmp (0 bytes)
The process %original file name%.exe:1676 makes changes in the file system.
The Application creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\AccessControl.dll (13 bytes)
%Program Files%\ozzie\voracious.exe (1056 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\109341.exe (10589 bytes)
%Program Files%\chapel\noo.exe (10845 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\40512.exe (3081 bytes)
%WinDir%\noo.exe (10845 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\26172.exe (1094 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\52022.exe (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\83506.exe (1082 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\knifing.lnk (451 bytes)
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsu1.tmp (0 bytes)
The process voracious.exe:1620 makes changes in the file system.
The Application creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nskC.tmp\ExecCmd.dll (4 bytes)
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsn9.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskC.tmp (0 bytes)
The process noo.exe:1520 makes changes in the file system.
The Application creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Cookies\Current_User@trufflechores[1].txt (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[3].xml (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[2].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[3].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\page-2[1].htm (3973 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAEB45AN.xml (775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[6].xml (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[2].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\flaD.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\analytics[1].js (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CACT6ZGP.xml (767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CALBWO43.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\v[1].xml (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[1].xml (704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CASFPJMN.xml (811 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[3].xml (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA4C1OL8.xml (815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA0XE74L.xml (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAPOJEJT.xml (782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA638XMB.xml (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[6].xml (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[3].xml (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[8].xml (687 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (544 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[2].xml (719 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (1066 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\css1[1].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\crossdomain[1].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[5].xml (804 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (292 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (15228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA8L49I5.xml (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\abcd[1].mp4 (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[4].xml (687 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAM0RPYJ.xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAA5IRW1.xml (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[5].xml (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\player1[1].swf (17377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA5S8Z1M.xml (777 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@trufflechores[2].txt (324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\player1[1].swf (19901 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (1485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAKK5PCL.xml (714 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[1].xml (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[2].xml (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[7].xml (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[5].xml (617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[1].xml (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\collect[1].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[5].xml (695 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA23S1MZ.xml (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[8].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[7].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\page-2[1].htm (3942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[7].xml (652 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA6XDINC.xml (733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[6].xml (705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[7].xml (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[2].xml (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAUFC9QV.xml (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAUJM7MH.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[1].xml (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[2].xml (645 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jwplayer1[1].js (75873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAJX8CWV.xml (760 bytes)
%System%\d3d9caps.tmp (1324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lbg[1].png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[3].xml (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ova-jw[1].swf (33929 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAZDLL39.xml (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[6].xml (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[2].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\counter[2].js (1353 bytes)
The Application deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\css1[1].css (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\counter[1].js (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@trufflechores[1].txt (0 bytes)
%System%\d3d9caps.dat (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416\index.dat (0 bytes)
%Documents and Settings%\%current user%\Local Settings\History\History.IE5\MSHist012014041520140416 (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\player1[1].swf (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\page-2[1].htm (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\collect[1].gif (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sol (0 bytes)
Registry activity
The process taskkill.exe:1040 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "22 9A B0 94 A5 7C F9 E2 EB B3 98 C6 1D 4C 93 7B"
The process taskkill.exe:1244 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB 80 24 CA 52 80 56 09 E8 CB 69 F9 F6 D3 BC 26"
The process 83506.exe:948 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "86 F4 96 21 7C A1 5F 0E C2 FB 4C B3 F8 6D DF CD"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process tasklist.exe:1176 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 01 18 1C D3 18 F0 56 A9 78 CD D2 63 2A 94 AE"
The process tasklist.exe:1236 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9C B2 C6 75 7C 3C 62 5D 00 B7 3A 62 A8 DA 5A AE"
The process tasklist.exe:780 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 D0 C8 2D 75 05 E2 FF D2 F4 31 1C 1B D9 02 AC"
The process tasklist.exe:2040 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D2 2D 2D 06 42 F6 17 AE 91 69 3A F1 D1 27 A8 AD"
The process tasklist.exe:1860 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F4 20 07 8A 35 67 BA 9B E1 F2 D0 A3 44 A2 8A D9"
The process tasklist.exe:1076 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C3 28 E7 C9 2C C4 AC 30 7E 6E 5E E9 5F 62 F4 BF"
The process tasklist.exe:1272 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E9 77 76 61 90 FC EC E5 6B 55 B6 AA DF 3A 60 B9"
The process tasklist.exe:1156 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "14 3E 5F 17 09 07 DB F7 29 A2 6D 80 C4 79 6A 12"
The process tasklist.exe:304 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "23 75 32 3F 1A 82 93 E9 47 42 B5 14 7B 83 EB 62"
The process tasklist.exe:1816 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EE 7A F8 AB 33 30 1A 2C 91 38 46 AD 78 0C 7D 44"
The process tasklist.exe:1276 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "31 14 C5 A7 53 A9 87 A3 FE F4 86 D0 4B 34 73 CE"
The process tasklist.exe:1052 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "94 79 CF CB 6A CE 25 16 D0 3A B6 11 39 3B 7C 6A"
The process tasklist.exe:1920 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 F4 E0 FB C2 D7 5E B4 95 C0 31 C4 71 2B 17 73"
The process tasklist.exe:560 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F2 F6 26 21 E0 D1 0D E3 1A 3E 80 0F 1E EC 66 8D"
The process tasklist.exe:520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 10 C8 F0 B5 D3 6E 4A 64 B0 7F 26 4E 7B DC 1C"
The process tasklist.exe:1532 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "91 95 31 36 BF 79 B4 1B C4 AD 01 48 BD C1 EB E6"
The process tasklist.exe:1376 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F CB BD 94 05 6D 69 D1 0B B7 88 B5 17 CE 83 1A"
The process tasklist.exe:1264 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "88 84 08 E5 CF 36 9F 41 51 AC B3 59 76 C7 E8 8B"
The process tasklist.exe:1036 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A D8 4F A4 22 41 EF 87 E1 F9 9B F6 0A 61 D1 2C"
The process tasklist.exe:284 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "56 D6 17 50 64 AF 0B EE 42 8D 60 80 18 91 E3 78"
The process 109341.exe:1816 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CE DE A6 52 1C 57 97 A7 C9 F0 55 EF 27 B2 CD 82"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process 40512.exe:1016 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "CF 87 0F 4E CA 9C 24 CD 2D B5 A2 8E 1A 2F A4 90"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process 52022.exe:792 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 28 B8 44 F1 A9 D0 CE 44 7C B5 A3 1C B7 FD FE"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process 26172.exe:1524 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EA 63 F9 23 A0 84 FE 01 B5 E2 18 8B 7A E4 50 73"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process %original file name%.exe:1676 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D1 B8 61 7E F1 89 7E 0A 5E E2 51 E6 FF 09 0E A7"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"firefighter" = "%Program Files%\chapel\noo.exe"
"neuwirth" = "%Program Files%\chapel\noo.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"coyne" = "%Program Files%\chapel\noo.exe"
"unsettling" = "%Program Files%\chapel\noo.exe"
The process voracious.exe:1620 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "62 C1 DF 28 8F F8 F8 85 9C BD C8 17 8D DD 5E AA"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Application adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"voracious" = "%Program Files%\ozzie\voracious.exe"
"givers" = "%Program Files%\chapel\noo.exe"
The process noo.exe:1520 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Direct3D\MostRecentApplication]
"Name" = "noo.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101220161013]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016101220161013\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101220161013]
"CachePrefix" = ":2016101220161013:"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1D 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A3 F9 26 5B AE 3F 05 FF 58 43 97 D9 E1 59 DF 61"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101220161013]
"CacheOptions" = "11"
"CacheLimit" = "8192"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016101220161013]
"CacheRepair" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\System\CurrentControlSet\Control\VIDEO\{6CED940B-3310-4568-885E-22B19ACF6715}\0000]
"Attach.ToDesktop" = "1"
The Application modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Application modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Application modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Application deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014041520140416]
The Application deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process find.exe:1164 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3B D7 15 39 68 0A 1C 3C 4B 5E A9 09 83 69 62 61"
The process find.exe:1176 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 E0 9A 58 7E B6 68 CB F9 A6 8E BC 32 15 AB 49"
The process find.exe:1984 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "39 1B 65 78 9B 4F 17 0E AD 50 A9 0D 2F 8A 77 C2"
The process find.exe:1244 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 55 1F 7D 48 5E C2 1B 16 76 6F 43 87 A7 48 D2"
The process find.exe:1160 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "48 ED 0E E9 B5 DE E7 AA 5C 06 F5 89 67 B9 54 49"
The process find.exe:1056 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0C A8 71 AF 0C A6 70 8D 5A 5E 0D 89 B9 7C AF 2D"
The process find.exe:1996 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 28 7F D2 86 B2 7B B6 73 72 1A 53 FE 64 9C E8"
The process find.exe:1368 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 3E 44 D3 F4 17 A6 F4 8D 89 8C 0E 2B 00 BA 12"
The process find.exe:1336 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1F 4D 22 7F 9F 87 B4 B0 3B 22 09 BD 00 88 DB BD"
The process find.exe:1344 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "02 DC 3F B7 AF 81 41 77 63 78 83 03 3E 1B 7C 6F"
The process find.exe:1604 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA F3 B8 FB 17 B5 F4 39 B0 53 D8 23 B2 D0 64 DC"
The process find.exe:624 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 35 26 96 9E ED 26 D9 31 A6 7A E0 33 85 B0 55"
The process find.exe:1936 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "64 AB CC B5 26 B2 2C 2B C2 E1 F5 B0 3C 34 DB 30"
The process find.exe:776 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6B 3A C2 AB 83 54 CE 42 99 95 DB 85 FB B3 55 59"
The process find.exe:1388 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "C2 44 D4 45 B5 55 16 06 6E E5 16 33 4C 03 13 C1"
The process find.exe:1108 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D7 B4 A7 2E 03 54 CC C3 C7 0D B0 A7 4A F9 D5 63"
The process find.exe:1452 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E CC 6F 61 3F 03 0B A0 A6 1C FC 73 EE 77 79 4E"
The process find.exe:264 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D CE 05 9A 2D 86 76 4F 70 39 10 A5 10 E7 E8 1B"
The process find.exe:476 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DF A0 FB 4F 99 F6 B8 6D FE 5C 88 26 90 16 56 4F"
The process find.exe:492 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E FF C7 A1 A3 4C 5C 78 1E 6F 72 4F A4 C3 67 71"
The process find.exe:2012 makes changes in the system registry.
The Application creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 A8 75 C2 7F CD A4 0D AB 67 C2 17 BD A3 46 93"
Dropped PE files
MD5 | File path |
---|---|
57eebbc1fe3ea6ade8ab503f626a218f | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\109341.exe |
4a70aa2020197bfad5237309b86ea3a7 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\26172.exe |
823c268c9b730efb6baa37081b5fb9bd | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\40512.exe |
ba28b2ca5676203c9cd5e2068fdf4233 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\52022.exe |
82e83f9f30004f4c525b012713bc9376 | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\83506.exe |
b9380b0bea8854fd9f93cc1fda0dfeac | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nskC.tmp\ExecCmd.dll |
9829887a159d1f7a25795660a5e5f2e6 | c:\Program Files\chapel\noo.exe |
43fa6d8f75734b9ee77124c25c81f933 | c:\Program Files\ozzie\voracious.exe |
9829887a159d1f7a25795660a5e5f2e6 | c:\WINDOWS\roberta.exe |
HOSTS file anomalies
The Application modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 857 bytes in size. The following strings are added to the hosts file listed below:
162.222.194.13 | cocomo.tremorhub.com |
162.222.194.13 | www.virustotal.com |
162.222.194.13 | virustotal.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:1040
taskkill.exe:1244
83506.exe:948
tasklist.exe:1176
tasklist.exe:1236
tasklist.exe:780
tasklist.exe:2040
tasklist.exe:1860
tasklist.exe:1076
tasklist.exe:1272
tasklist.exe:1156
tasklist.exe:304
tasklist.exe:1816
tasklist.exe:1276
tasklist.exe:1052
tasklist.exe:1920
tasklist.exe:560
tasklist.exe:520
tasklist.exe:1532
tasklist.exe:1376
tasklist.exe:1264
tasklist.exe:1036
tasklist.exe:284
109341.exe:1816
40512.exe:1016
52022.exe:792
26172.exe:1524
%original file name%.exe:1676
voracious.exe:1620
find.exe:1164
find.exe:1176
find.exe:1984
find.exe:1244
find.exe:1160
find.exe:1056
find.exe:1996
find.exe:1368
find.exe:1336
find.exe:1344
find.exe:1604
find.exe:624
find.exe:1936
find.exe:776
find.exe:1388
find.exe:1108
find.exe:1452
find.exe:264
find.exe:476
find.exe:492
find.exe:2012 - Delete the original Application file.
- Delete or disinfect the following files created/modified by the Application:
%System%\drivers\etc\hosts (123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsnB.tmp\ShellLink.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsf6.tmp\SimpleFC.dll (5289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsg8.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsp2.tmp\AccessControl.dll (13 bytes)
%Program Files%\ozzie\voracious.exe (1056 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\109341.exe (10589 bytes)
%Program Files%\chapel\noo.exe (10845 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\40512.exe (3081 bytes)
%WinDir%\noo.exe (10845 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\26172.exe (1094 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\52022.exe (820 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\83506.exe (1082 bytes)
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\knifing.lnk (451 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nskC.tmp\ExecCmd.dll (4 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@trufflechores[1].txt (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[3].xml (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[2].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[3].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\page-2[1].htm (3973 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAEB45AN.xml (775 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[6].xml (708 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[2].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\flaD.tmp (5 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\analytics[1].js (333 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CACT6ZGP.xml (767 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CALBWO43.xml (819 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\v[1].xml (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[1].xml (704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CASFPJMN.xml (811 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[3].xml (648 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA4C1OL8.xml (815 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA0XE74L.xml (766 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAPOJEJT.xml (782 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CA638XMB.xml (760 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[6].xml (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[3].xml (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[8].xml (687 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (544 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[2].xml (719 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (1066 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\css1[1].css (25 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\crossdomain[1].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[5].xml (804 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (292 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (15228 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA8L49I5.xml (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\abcd[1].mp4 (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[4].xml (687 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAM0RPYJ.xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAA5IRW1.xml (726 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[5].xml (634 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\player1[1].swf (17377 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CA5S8Z1M.xml (777 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@trufflechores[2].txt (324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\player1[1].swf (19901 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (1485 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\CAKK5PCL.xml (714 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (712 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[1].xml (706 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[2].xml (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[7].xml (596 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[5].xml (617 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[1].xml (628 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\collect[1].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (161 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[5].xml (695 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CA23S1MZ.xml (818 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[8].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[7].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\page-2[1].htm (3942 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[7].xml (652 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (288 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CA6XDINC.xml (733 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[6].xml (705 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\syncnoad[7].xml (599 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[2].xml (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAUFC9QV.xml (856 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\logo[1].png (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\CAUJM7MH.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[1].xml (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[2].xml (645 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (171 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\jwplayer1[1].js (75873 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\CAJX8CWV.xml (760 bytes)
%System%\d3d9caps.tmp (1324 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\lbg[1].png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\syncnoad[3].xml (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\ova-jw[1].swf (33929 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\CAZDLL39.xml (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\syncnoad[6].xml (575 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\WLMVCPYN\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQNSD2J\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\4DQJW9YN\crossdomain[2].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OPQISTQM\counter[2].js (1353 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"firefighter" = "%Program Files%\chapel\noo.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"neuwirth" = "%Program Files%\chapel\noo.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"coyne" = "%Program Files%\chapel\noo.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"unsettling" = "%Program Files%\chapel\noo.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"voracious" = "%Program Files%\ozzie\voracious.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"givers" = "%Program Files%\chapel\noo.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 61440 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 253952 | 2536 | 2560 | 3.13983 | 5b5a2d9d119a78aca9bef9d54b647674 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 465
87af60575e95350381303447cd2e0d96
3b59c9c06351fe2dc7ab07fbec5cf3f4
e20c2ee024fb4a3ea1b3416c7e39b340
a9efe494b8b83d12f5e17908c7efb634
786b1a641feab64bdb3604994a1555a7
e60a88037b13ef389b0883e46f245a1c
3f51c8788642751530132a9f3d027551
36f36ac1d61e3d88c9e20b1124209453
0dfa63e653b8e42ef88dfe0b87e0e998
4c59bb5c4cbbe5c13b67a5824b8d866e
17632b5c3594c6040fb5b2223b5c3c28
28a81e67c867325cea1f0383247d88aa
bd9726e2c29e002d07c80b3eb1dc880f
90b17f8eb0ef07b46f978fb7d58d6eae
bebf5e8b9bd776b72b05d6ea12763ba7
a93b6f7b8b3853465fb9b860a6412718
a359342d66abf0b2c8d6a28267967402
5471702b7080d35d18df683ffcea4e9e
2be50e91d783981e62ab1c4280e5ac5d
8370bc749888a1b73acee95d10e10244
dc4e95e1573314f4bbfd3a416b4e14c4
d73c265ce1b86f222455f719d016dfc5
742030e989fa9ab766154b01a7387081
7e319fc3a4d25226bcba86affd0a7991
73f369dc95839a9f01a64b29d8f972ec
Network Activity
URLs
URL | IP |
---|---|
hxxp://d3cpqb3ouewn5u.cloudfront.net/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t= | |
hxxp://d3cpqb3ouewn5u.cloudfront.net/func.js?r=5 | |
hxxp://www-google-analytics.l.google.com/analytics.js | |
hxxp://www.shanaluby.pw/count.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=&rand= | 162.222.193.17 |
hxxp://cocomo.tremorhub.com/itd.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=&rand= | |
hxxp://c.statcounter.com/10114910/0/757d7213/1/ | 104.20.3.47 |
hxxp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png | 67.202.94.94 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j47&a=508514117&t=pageview&_s=1&dl=http://www.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=105333898&cid=1715124662.1476264957&tid=UA-74694740-5&_r=1&z=2048820847 | |
hxxp://8c715ae47b.site.internapcdn.net/page-2.html?lid=937115 | |
hxxp://widgets.amung.us/draw/?w=colored&n=646&c=000000ffffff&p= | 173.192.200.70 |
hxxp://109.201.148.40/report1.php?url=/govids/page-2.html?lid=937115 | |
hxxp://govids.net/jwplayer1.js | 162.222.194.11 |
hxxp://109.201.148.40/bck.php?1476264958000 | |
hxxp://govids.net/1.js | 162.222.194.11 |
hxxp://8c715ae47b.site.internapcdn.net/page-2.htm?lid=937115 | |
hxxp://109.201.148.40/report1.php?url=/govids/page-2.htm?lid=937115 | |
hxxp://109.201.148.40/bck.php?1476264959000 | |
hxxp://g1.panthercdn.com/counter/counter.js | |
hxxp://govids.net/player1.swf | 162.222.194.11 |
hxxp://c.statcounter.com/t.php?sc_project=10675947&java=1&security=299981d6&u1=DFC313228BC44FF3C01A0DCC64F1B685&sc_random=0.8440365745267391&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://www.govids.net/page-2.html?lid=937115&u=http://www.govids.net/page-2.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 | 104.20.3.47 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j47&a=1608029956&t=pageview&_s=1&dl=http://www.govids.net/page-2.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=672389418&cid=757982639.1476264960&tid=UA-74694740-2&_r=1&z=1226883924 | |
hxxp://8c715ae47b.site.internapcdn.net/css1.css | |
hxxp://8c715ae47b.site.internapcdn.net/img/logo.png | |
hxxp://8c715ae47b.site.internapcdn.net/img/lbg.png | |
hxxp://cs28.wpc.thetacdn.net/5/10/logo.png | |
hxxp://govids.net/ova-jw.swf | 162.222.194.11 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 2&mediaDesc=Home videos, Funny Videos - 2&mediaId=2&mediaUrl=hxxp://www.govids.net/2.html&srcPageUrl=hxxp://www.govids.net/2.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=thetradedesk,conversant,_dmp_turbine,rocketfuel,mediamath,centro,audiencescience,Bidswitch,dataxu,videoamp,tremornet,beeswax,appnexus,SundaySky,google,TapAd,dynadmic,eyeview,TubeMogul-GP,BidTheatre,ignitionone,adapTV,Videology&uid=ccb1cc725c2d43108581cf70d4976e4e&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=google,conversant,TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=conversant,TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://dyhd7e8p4cqed.cloudfront.net/crossdomain.xml | |
hxxp://dyhd7e8p4cqed.cloudfront.net/static/noad.xml | |
hxxp://vi.govids.net/crossdomain.xml | 109.201.148.40 |
hxxp://vi.govids.net/v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hxxp://www.govids.net/2.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Home videos, Funny Videos - 2&LR_FORMAT=application/x-shockwave-flash | 109.201.148.40 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 2&mediaDesc=Watch Home videos, Funny Videos - 2&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hxxp://www.govids.net/2.html&contentLength=[CONTENT_LENGTH] | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=beeswax,appnexus,TubeMogul-GP,_dmp_turbine,thetradedesk,rocketfuel,tremornet,BidTheatre,centro,adapTV,Bidswitch,videoamp,Videology,audiencescience,SundaySky,1,TapAd,dataxu,conversant,google,mediamath,eyeview,ignitionone&uid=ccb1cc725c2d43108581cf70d4976e4e&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | |
hxxp://thumb.none1366649718.netdna-cdn.com/crossdomain.xml | |
hxxp://thumb.none1366649718.netdna-cdn.com/abcd.mp4 | |
hxxp://xlf5t.ads.tremorhub.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 2&mediaDesc=Home videos, Funny Videos - 2&mediaId=2&mediaUrl=hxxp://www.govids.net/2.html&srcPageUrl=hxxp://www.govids.net/2.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | 52.206.162.106 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/crossdomain.xml | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=conversant,TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://cdn.tremorhub.com/crossdomain.xml | 52.85.184.188 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://www.govids.net/img/logo.png | 69.88.149.137 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://www.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t= | 216.137.61.243 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j47&a=1608029956&t=pageview&_s=1&dl=http://www.govids.net/page-2.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=672389418&cid=757982639.1476264960&tid=UA-74694740-2&_r=1&z=1226883924 | 173.194.32.136 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=beeswax,appnexus,TubeMogul-GP,_dmp_turbine,thetradedesk,rocketfuel,tremornet,BidTheatre,centro,adapTV,Bidswitch,videoamp,Videology,audiencescience,SundaySky,1,TapAd,dataxu,conversant,google,mediamath,eyeview,ignitionone&uid=ccb1cc725c2d43108581cf70d4976e4e&init=true | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 2&mediaDesc=Watch Home videos, Funny Videos - 2&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hxxp://www.govids.net/2.html&contentLength=[CONTENT_LENGTH] | 52.206.162.106 |
hxxp://www.govids.net/page-2.html?lid=937115 | 69.88.149.137 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j47&a=508514117&t=pageview&_s=1&dl=http://www.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=105333898&cid=1715124662.1476264957&tid=UA-74694740-5&_r=1&z=2048820847 | 173.194.32.136 |
hxxp://we1sb-wwcgk.ads.tremorhub.com/crossdomain.xml | 52.206.162.106 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=thetradedesk,conversant,_dmp_turbine,rocketfuel,mediamath,centro,audiencescience,Bidswitch,dataxu,videoamp,tremornet,beeswax,appnexus,SundaySky,google,TapAd,dynadmic,eyeview,TubeMogul-GP,BidTheatre,ignitionone,adapTV,Videology&uid=ccb1cc725c2d43108581cf70d4976e4e&init=true | 107.23.35.51 |
hxxp://cdn.tremorhub.com/static/noad.xml | 52.85.184.188 |
hxxp://thm.vidvib.com/crossdomain.xml | 108.161.189.160 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://www.govids.net/page-2.htm?lid=937115 | 69.88.149.137 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://www.govids.net/img/lbg.png | 69.88.149.137 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://xlf5t.ads.tremorhub.com/crossdomain.xml | 52.206.162.106 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://thm.vidvib.com/abcd.mp4 | 108.161.189.160 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://www.google-analytics.com/analytics.js | 173.194.32.136 |
hxxp://www.statcounter.com/counter/counter.js | 151.249.89.7 |
hxxp://www.trufflechores.pw/func.js?r=5 | 216.137.61.243 |
hxxp://l.longtailvideo.com/5/10/logo.png | 93.184.221.48 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=google,conversant,TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://www.govids.net/css1.css | 69.88.149.137 |
hxxp://partners.tremorhub.com/syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
hxxp://partners.tremorhub.com/syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e | 107.23.35.51 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.757982639.1476264960; _gat=1
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 17:42:23 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Wed, 13 Sep 2017 17:42:23 GMT
Connection: close
Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
<<< skipped >>>
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 17:42:22 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Wed, 12 Oct 2016 17:42:22 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: we1sb-wwcgk.ads.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 12 Oct 2016 09:36:10 GMT
ETag: W/"144-1446243360000"
Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>. <!-- Very Liberal -->. <allow-access-from domain="*" secure="false"/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 2&mediaDesc=Watch Home videos, Funny Videos - 2&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.govids.net/2.html&contentLength=[CONTENT_LENGTH] HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: we1sb-wwcgk.ads.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Wed, 12 Oct 2016 09:36:11 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; Domain=.tremorhub.com; Expires=Thu, 12-Oct-2017 15:24:31 GMT; Path=/
Set-Cookie: tvrg_60409="2,1476264957"; Version=1; Domain=.tremorhub.com; Max-Age=46; Expires=Wed, 12-Oct-2016 09:36:57 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
transfer-encoding: chunked
Connection: keep-alive
20a.............R.n.0... \..-.b'r.I...E..A... 0(r,..H..l.}...w...73...y....n..6\.<.GQ0.A%........4.....\TgZ.ixQ.[...k.m.Z....W..lCcT0.....L.|..*.." ...~h..h.-zc.-....b.....c..U.y..Pd...weU>..)..@A......I.Ls..(.$qDiZO'...&.8I....qrC.P.5.....d.....AX.......?=b.b.ZY.k..C......f...t.v.`.kG1.,...U. .....Z.6..j..l......3..U....d.{.c...C..f.N0./...{.D..OF,98.G.o..^A#e...Z`....^.C.a..7.[4T..:...u..J.h.&.8.^Mc.N#6.I.a.C...j.//E..m...R....9..X.....!....tf.6j..->..c.#.O..{....{.xR..*../oXds........g.. ...nq..;4. ;.].....'..m..=M...)..e..@......d..X.....0..HTTP/1.1 200 OK..Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding: gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Wed, 12 Oct 2016 09:36:11 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..Set-Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; Domain=.tremorhub.com; Expires=Thu, 12-Oct-2017 15:24:31 GMT; Path=/..Set-Cookie: tvrg_60409="2,1476264957"; Version=1; Domain=.tremorhub.com; Max-Age=46; Expires=Wed, 12-Oct-2016 09:36:57 GMT; Path=/..Vary: Accept-Encoding..x-tremorvideo-status: NO_AD..transfer-encoding: chunked..Connection: keep-alive..20a.............R.n.0... \..-.b'r.I...E..A... 0(r,..H..l.}...w...73...y....n..6\.<.GQ0.A%........4.....\TgZ.ixQ.[...k.m.Z....W..lCcT0.....L.|..*.." ...~h..h.-zc.-....b.....c..U.y..Pd...weU>..)..@A......I.Ls..(.$qDiZO'...&.8I....qrC.P.5.....d.....AX.......?=b.b.ZY.k..C......f...t.v.`.kG1.,...U. .....Z.6..j..l....
<<< skipped >>>
GET /ova-jw.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.757982639.1476264960; _gat=1
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 17:42:24 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT
ETag: "4403b3-39741-4fbe0551c3280"
Accept-Ranges: bytes
Content-Length: 235329
Cache-Control: max-age=2592000, public
Expires: Wed, 13 Sep 2017 17:42:24 GMT
Connection: close
Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b...k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K......tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&........Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.HW....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E..............&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T..O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=..........).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
<<< skipped >>>
GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: whos.amung.us
Connection: Keep-Alive
HTTP/1.1 303 See Other
Date: Wed, 12 Oct 2016 09:35:51 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Location: hXXp://widgets.amung.us/draw/?w=colored&n=646&c=000000ffffff&p=
Set-Cookie: uid=CgH9H1f A/esS1DChRW/Ag==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/
0..
GET /jwplayer1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 17:42:21 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT
ETag: "4403af-25d37-53444eccf91c0"
Accept-Ranges: bytes
Content-Length: 154935
Cache-Control: max-age=2592000, public
Expires: Wed, 13 Sep 2017 17:42:21 GMT
Connection: close
Content-Type: text/javascriptvar dtn = Date.parse(new Date().toString());..document.write(unescape(>>
'
GET /itd.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=&rand= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cocomo.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:52 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 1118
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html<html>..<head>..<title>a</title>..</head>>>
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {.. var nameEQ = name "
=";.. var ca = document.cookie.split(';');.. for(var i=0;i < ca.l
ength;i ) {.. var c = ca[i];.. while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);.. if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);.. }.. return null;..}..function uapcc()
{..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime() (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 90);.
.setInterval(function() {..uapcc();..}, 90);..//-->..</script>
;..<meta http-equiv="refresh" content="300">..</html>HTTP/
1.1 200 OK..Date: Wed, 12 Oct 2016 09:35:52 GMT..Server: Apache/2.2.22
(Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 1118..K
eep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: t
ext/html..<html>..<head>..<title>a</title>..&l
t;/head>..<body>..<script language="JavaScript" type="
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 17:42:23 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Wed, 13 Sep 2017 17:42:23 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....>>
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T.....
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
GET /index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t= HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.trufflechores.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 902
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Encoding: gzip
Date: Wed, 12 Oct 2016 09:35:51 GMT
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 8a4d4882753d62d900bb1b7541308eca.cloudfront.net (CloudFront)
X-Amz-Cf-Id: zodKrc5kSXv-Eg01edbPB0ud8cLzblR69KTAhgWJWvfyeqn6ZJmU1Q==...........U]o.6.}/..@.!.6Y...... m.&...k..0.@K..3.T. .F..>....=...>>
..$/....zQc.,.5.r.h.9)j.. .=n&o.........^l..k.....j;.b..%......<gPV
...V-.....[.F....zs.ev%.l`..r...E:.Z.rG..`.u%$..%..goJ.d?....#...lxc`N
.._-.F........I......K...]..i.z.IWw..dY~..o....?..g_.....<(9.;...I.
..A...p..@sY2J.Qb.hNI.......k.K...).j.! F......3.c.|.$..E.....S.i.....
..Y....%.B..U.jh...ub_S..."....a1...x.5....0........7.,P(....*.b....n.
*..T....d..0..o......X.k......G.>..&...sw.....7uh.Go....>......0
...M..93I....7...*.]..NT..Q.~w......_e.s.p......U..../7~V%$B....6JC...
..Q8.Y.!.U.Q..X. ...Xy...'..yz.1ve..h.JLH..`D..$...M..Mg.lr...G... ...
.;^.V...f.>H. ..]..:'.7|..(]..pi........}....f...{A.....pO2..=.D.?.
V..........`..Z.........u.U"...j.u.S.f..O...4 .zE....'..T_Q[g.Q4....Z.
-1.k,..0b-....Z.%H{.E[.i.v..$}.7. B..{.h........}...%..<....4KgG.rv
..I..Zo.vB....W.........\...........G......Ug.....t......8A..;..(X>
..]..w...\ .5...HTTP/1.1 200 OK..Content-Type: text/html..Content-Leng
th: 902..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3
.13..X-Powered-By: PHP/5.3.13..Content-Encoding: gzip..Date: Wed, 12 O
ct 2016 09:35:51 GMT..Vary: Accept-Encoding..X-Cache: Miss from cloudf
ront..Via: 1.1 8a4d4882753d62d900bb1b7541308eca.cloudfront.net (CloudF
ront)..X-Amz-Cf-Id: zodKrc5kSXv-Eg01edbPB0ud8cLzblR69KTAhgWJWvfyeqn6ZJ
mU1Q==.............U]o.6.}/..@.!.6Y...... m.&...k..0.@K..3.T. .F..>
....=.....$/....zQc.,.5.r.h.9)j.. .=n&o.........^l..k.....j;.b..%.....
.<gPV...V-.....[.F....zs.ev%.l`..r...E:.Z.rG..`.u%$..%..goJ.d?.
GET /func.js?r=5 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.trufflechores.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 597
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT
ETag: "90000001e1520-f7a-537ea953f7333"
Accept-Ranges: bytes
Content-Encoding: gzip
Date: Sun, 09 Oct 2016 21:02:22 GMT
Vary: Accept-Encoding
X-Cache: RefreshHit from cloudfront
Via: 1.1 8a4d4882753d62d900bb1b7541308eca.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Fsu9uxR10k83Ia_lPBRsouUjfx4knvOLY9Tus2WetuxsrUdCsKnBZw==............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l&l>>
t;3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.]...
..Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9...
...P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o..
.T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z..
...=.9%}.t......T........'..t...g.....L.. *.V2..p...rv.....F..x?W..*..
..........3_.q.q....S.~....7_e.G..P..7w..h..R ..$.w....H.41.W.n...D...
.wZ..x.ZG....6..:a.5!....t:O..:.5MvM...(...f.@..S.\.......SuY....:....
.....>...P..{|:.<.<...I...=........}..=...|.8.......{1z...HTT
P/1.1 200 OK..Content-Type: application/javascript..Content-Length: 59
7..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..L
ast-Modified: Mon, 18 Jul 2016 15:25:49 GMT..ETag: "90000001e1520-f7a-
537ea953f7333"..Accept-Ranges: bytes..Content-Encoding: gzip..Date: Su
n, 09 Oct 2016 21:02:22 GMT..Vary: Accept-Encoding..X-Cache: RefreshHi
t from cloudfront..Via: 1.1 8a4d4882753d62d900bb1b7541308eca.cloudfron
t.net (CloudFront)..X-Amz-Cf-Id: Fsu9uxR10k83Ia_lPBRsouUjfx4knvOLY9Tus
2WetuxsrUdCsKnBZw==..............MO.@...H..k/vJ.8....U U.R.q.z..N.....
..DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$......
..AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.&
lt;......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&].
.~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>...V
:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L.. *.V
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 12 Oct 2016 09:35:57 GMT
ETag: W/"144-1446243360000"
Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=thetradedesk,conversant,_dmp_turbine,rocketfuel,mediamath,centro,audiencescience,Bidswitch,dataxu,videoamp,tremornet,beeswax,appnexus,SundaySky,google,TapAd,dynadmic,eyeview,TubeMogul-GP,BidTheatre,ignitionone,adapTV,Videology&uid=ccb1cc725c2d43108581cf70d4976e4e&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:35:57 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 505
Connection: keep-alive...........R...0.}.W.H.m....J.Rv[.........M.!XKl.v..}.,....'......I..f
....B.4......).d......i...$..(/...Q..s..[..<...F.m[..jBku.ss...6..}
_..A....%?.h..[Eg.6Yy....]..:OEs^B}..6K.>,..2.8..`.......$........l
X..F.0.a4..c..x.6.1g..Nk.....-..^.HGF.V.U...........r$=.8.rE...cK....&
gt;t%8...;...3...}".;..<..ZK<......8Zvz|'(.Q.>.n...-.........
....F.A....}..[.j......Hh...F{Y.sN..7z.ZS......U.c.h.F|.>.N'..m.!..
b..>>fI..:n.Q.....F...5.!....*..h.....J...6...7.f...6.G{.Y....1K
...n.fO...._~..9.-E.z.tpgq./..................
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=google,conversant,TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:35:58 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 524
Connection: keep-alive...........R.n.0... \..-.....I...E...*.=..@.......l..;.]...'......D..h>>
.;0. .{c...@R...b.).t3.V..h.f.5,..0Q.....9...g@(S..O......-.#.....[..z
I..A..0Dk0..u..H.c. .....<6MYN....I..y}......&.I$.....T*.V........"
. .....0!.r6...........XD.w.:oK........&.$w8....aD....8rh..:K.S7..jT..
...!...-....../...Ck{.2.B....=..3..G...;Z#.Z.H.m......N..`....Sx^.A2h.
.vO..v=!"t?..)..`B..5%.0l{}h9.t.Ni.&....t>.....,f(...$Q.....Q..eP.W
>Sm..m8..(J....U.T.@!..I....`......Y:....y....m..w.$....|.......%..
.B.x.w;T.bt..'.........GyV".)@.....<..O2...HTTP/1.1 200 OK..Content
-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:35:
58 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/
en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..
Content-Length: 524..Connection: keep-alive.............R.n.0... \..-.
....I...E...*.=..@.......l..;.]...'......D..h.;0. .{c...@R...b.).t3.V.
.h.f.5,..0Q.....9...g@(S..O......-.#.....[..zI..A..0Dk0..u..H.c. .....
<6MYN....I..y}......&.I$.....T*.V........". .....0!.r6...........XD
.w.:oK........&.$w8....aD....8rh..:K.S7..jT.....!...-....../...Ck{.2.B
....=..3..G...;Z#.Z.H.m......N..`....Sx^.A2h..vO..v=!"t?..)..`B..5%.0l
{}h9.t.Ni.&....t>.....,f(...$Q.....Q..eP.W>Sm..m8..(J....U.T.@!.
.I....`......Y:....y....m..w.$....|.......%...B.x.w;T.bt..'.........Gy
V".)@.....<..O2.......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=conversant,TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:35:59 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1df.............RMo.0...Wd..[..s........tk1...(.Zbc!.$Hr....N.......'&>>
gt;....X.z{4V(.{.....d.......K..-.w.*...-hi.P.....9=.}g.R....S.o..znn.
......uz.%Q.{I....h.(k..*....,{...d'...6.?n.....:.......$54.K..L*..#x.
f.a.8..!.p4..!L.I.^.!g. ..u.......>|..b#....D....W.888..Nb......vj.
.........Blp/....Z...-.. o.....C..".Yp{.....Zrh.m[.7.x%......\y..%.5CA
.h.p$.o..J..A...5...........V....c....h8.OG.e2..lB...s.....c.2...r.O..
r..S..>......}B.x....A....DKC#.=..L.;.....`[Z..=yh........[..m.h..3
&....d........&.k......0..HTTP/1.1 200 OK..Content-Encoding: gzip..Con
tent-Type: text/xml..Date: Wed, 12 Oct 2016 09:35:59 GMT..P3P: CP='Thi
s is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..
Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: c
hunked..Connection: keep-alive..1df.............RMo.0...Wd..[..s......
..tk1...(.Zbc!.$Hr....N.......'>....X.z{4V(.{.....d.......K..-.w.*.
..-hi.P.....9=.}g.R....S.o..znn.......uz.%Q.{I....h.(k..*....,{...d'..
.6.?n.....:.......$54.K..L*..#x.f.a.8..!.p4..!L.I.^.!g. ..u.......>
|..b#....D....W.888..Nb......vj..........Blp/....Z...-.. o.....C..".Yp
{.....Zrh.m[.7.x%......\y..%.5CA.h.p$.o..J..A...5...........V....c....
h8.OG.e2..lB...s.....c.2...r.O..r..S..>......}B.x....A....DKC#.=..L
.;.....`[Z..=yh........[..m.h..3&....d........&.k......0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=TubeMogul-GP,ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:35:59 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1fe.............R]..0.|.....[1...J.rp'!]..%....9.B,.c......G.~HU.<.>>
...g7...C....JF...w: Y...E.*{.4vf..p......4|(..FNa...b5..............K
mm"...M.p.0..8...R..(m..2..o;i......i.3.[=/....|.d......J....o#..(.i.#
6..s.......&...A..l;.9.wU$vRX.T%....S...pj..F.V].E....C.k.|.VS....Ch.(
...PJ..6-..@3.............$, .....I.mY.H.K.....-.-..Y...`....=#:..h..f
T%.../...:...u........y......x..A........8$.;}.u..2\[..u.v.....Z...'O.
....v.Q...9 ...#r...e....\.w..Uz..Y..`....]D_e.K....I.p..%q.s.q..^Pdf.
.=.....`.M~.....R..o*n........d...........3.....0..HTTP/1.1 200 OK..Co
ntent-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 0
9:35:59 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo
.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encod
ing..transfer-encoding: chunked..Connection: keep-alive..1fe..........
...R]..0.|.....[1...J.rp'!]..%....9.B,.c......G.~HU.<....g7...C....
JF...w: Y...E.*{.4vf..p......4|(..FNa...b5..............Kmm"...M.p.0..
8...R..(m..2..o;i......i.3.[=/....|.d......J....o#..(.i.#6..s.......&.
..A..l;.9.wU$vRX.T%....S...pj..F.V].E....C.k.|.VS....Ch.(...PJ..6-..@3
.............$, .....I.mY.H.K.....-.-..Y...`....=#:..h..fT%.../...:...
u........y......x..A........8$.;}.u..2\[..u.v.....Z...'O.....v.Q...9 .
..#r...e....\.w..Uz..Y..`....]D_e.K....I.p..%q.s.q..^Pdf..=.....`.M~..
...R..o*n........d...........3.....0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=ignitionone,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:35:59 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 472
Connection: keep-alive...........RMo.0...Wd..[..s..........0...(.Zbc!.,H.....I.......'......
......N..p..P.ZH.M.....,X.o.u..WZ....v.....f....j[5....9g.._8..qI...&.
..8..4.a...}.w..J...A....k.44..l..?.....]VdO.q..............R$|>...
............F.e..>.1..0..]......8.......z_o..^.. P..Q......H..c.z..
I....@......G).Az^...-..w}[.i.Jr......:.......Dt.8.j..@....LP..e6....x
...y9.|.Nx(....l2....HD.)....i........c......W...C2E...g...Y|.vi...E..
.K..%u.Ew.i..4.1..|G'x..}........o-..M..\..?.......5.t....HTTP/1.1 200
OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct
2016 09:35:59 GMT..P3P: CP='This is not a P3P policy. See hXXp://trem
orvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accep
t-Encoding..Content-Length: 472..Connection: keep-alive.............RM
o.0...Wd..[..s..........0...(.Zbc!.,H.....I.......'............N..p..P
.ZH.M.....,X.o.u..WZ....v.....f....j[5....9g.._8..qI...&...8..4.a...}.
w..J...A....k.44..l..?.....]VdO.q..............R$|>...............F
.e..>.1..0..]......8.......z_o..^.. P..Q......H..c.z..I....@......G
).Az^...-..w}[.i.Jr......:.......Dt.8.j..@....LP..e6....x...y9.|.Nx(..
..l2....HD.)....i........c......W...C2E...g...Y|.vi...E...K..%u.Ew.i..
4.1..|G'x..}........o-..M..\..?.......5.t........
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1da.............R]..0.|.....[....J.rpHHU[]...tB.{.X.'..@.}7.w.C.....xw>>
v...\.{.*-J.Z.....d%.r.Z.t.ij-...c..7......s.Z.1..q...Ty..XY8ZWV....S.
...m...(.y/.~(.*T]...`.....$..8..K.....>l....r.....]..H.4..o .,./..
!......E.....3z.g..^&.g.~.r0p.mw.ZF.!.(8..r.v........Bl..x"D3H<...5
...jv9(.P.U...\..a9...........^.F.@..........P.!....5. (*.)T1.s..jgj..
.....e#.|w.\..G..d:b/..{3.....(p~..^.R..lg..8T..\....c.O.mw.1..z..S{..
.;.e....|.E.U.....n..(X*2C4.o0....@.T.;...7..&..v..../%....-.......d..
.....d........0..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Typ
e: text/xml..Date: Wed, 12 Oct 2016 09:36:00 GMT..P3P: CP='This is not
a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server:
Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chunked..
Connection: keep-alive..1da.............R]..0.|.....[....J.rpHHU[]...t
B.{.X.'..@.}7.w.C.....xwv...\.{.*-J.Z.....d%.r.Z.t.ij-...c..7......s.Z
.1..q...Ty..XY8ZWV....S....m...(.y/.~(.*T]...`.....$..8..K.....>l..
..r.....]..H.4..o .,./..!......E.....3z.g..^&.g.~.r0p.mw.ZF.!.(8..r.v.
.......Bl..x"D3H<...5...jv9(.P.U...\..a9...........^.F.@..........P
.!....5. (*.)T1.s..jgj.......e#.|w.\..G..d:b/..{3.....(p~..^.R..lg..8T
..\....c.O.mw.1..z..S{...;.e....|.E.U.....n..(X*2C4.o0....@.T.;...7..&
..v..../%....-.......d.. .....d........0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:01 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 493
Connection: keep-alive...........R]..0.|.....[cHC.P......^E.....9.B,.c.N ....;..C..y.....n0?>>
..^...J....8=...B.Cg.~~?q....>N....h.(...Na...b5.....eUI.QN.....6..
....N.....?4U.t.%..PF.%..$...ryi......u..}X,.4~..ST[...?........<d.
. .0.....p..|:..>..|..}.>eK......P..}...`5....0....'D(]..6...@..
...7.....O.....@....69tey )/.CX.....x...P..A.`N......R!L..9../Ufk.....
{#.........a8..&C....?..s..1...N...._...4.1.. ....4V.{.........M_....{
...z.3.N;.@....?..H..[.J....D.B.7X..`.|A.(2SM.....4. .<.!72yU......
...........1.r....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Typ
e: text/xml..Date: Wed, 12 Oct 2016 09:36:01 GMT..P3P: CP='This is not
a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server:
Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 493..Connect
ion: keep-alive.............R]..0.|.....[cHC.P......^E.....9.B,.c.N ..
..;..C..y.....n0?..^...J....8=...B.Cg.~~?q....>N....h.(...Na...b5..
...eUI.QN.....6......N.....?4U.t.%..PF.%..$...ryi......u..}X,.4~..ST[.
..?........<d.. .0.....p..|:..>..|..}.>eK......P..}...`5....0
....'D(]..6...@.....7.....O.....@....69tey )/.CX.....x...P..A.`N......
R!L..9../Ufk.....{#.........a8..&C....?..s..1...N...._...4.1.. ....4V.
{.........M_....{...z.3.N;.@....?..H..[.J....D.B.7X..`.|A.(2SM.....4.
.<.!72yU.................1.r........
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:00 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1e9.............R...0.}.W.H.V.!....,..i..H.>.V...b...v...NX..".}...>>
x....f.qjU..W2t.....I....:.t.i.....s..w.....4S.:....u...t^f]..kL....Xb
K.:_......1kE.7M..t.%.. .....$O..~y..YJ...:.>...q..............JE.L
s.......x....?..>.e#...>..N.>s....u.....&...#.PC......p)M.K..
0.z...i.B...9sKs.I)...c....0.)B...Al.FOs X>...9....)...aJ....c...R
g\B.l..Y...7......x8........[...(p.uo......l....g ..^..g...U..!A;.....
:..S.S.S.....U3..`.$l.....6YnvkD..........(4.f).(.kt.W`.0...3..T.z..^V
8..l...{'.?.p...7.fg.]..e...........R/.....0..HTTP/1.1 200 OK..Content
-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:
00 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/
en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..
transfer-encoding: chunked..Connection: keep-alive..1e9.............R.
..0.}.W.H.V.!....,..i..H.>.V...b...v...NX..".}...x....f.qjU..W2t...
..I....:.t.i.....s..w.....4S.:....u...t^f]..kL....XbK.:_......1kE.7M..
t.%.. .....$O..~y..YJ...:.>...q..............JE.Ls.......x....?..&g
t;.e#...>..N.>s....u.....&...#.PC......p)M.K.. 0.z...i.B...9sKs.
I)...c....0.)B...Al.FOs X>...9....)...aJ....c...Rg\B.l..Y...7......
x8........[...(p.uo......l....g ..^..g...U..!A;.....:..S.S.S.....U3..`
.$l.....6YnvkD..........(4.f).(.kt.W`.0...3..T.z..^V8..l...{'.?.p...7.
fg.]..e...........R/.....0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:02 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 461
Connection: keep-alive...........R.n.0... \.......eH2T'-..MQ..!...w...(..d...r...KO;$g9;....
.i....Q.7.L..)..T...->.]z..U.=...-.h....%^..^..3T7.j..hj.Z....:p.M.
/....K..Gi....d.S.[GuZ.zGy.5._.O......v....6WY....4..x.._.....\.....i.
..D..4..S..r...y.b:.....@B..7..z.$........`..C! N.o.)g...$..t.b......=
c..`-...PB..z..............H...a.:C.;..........E.3!..\....M...L<,..
F..E..i.....1..'.!....O.;E..8G)..L>....k..9.......}V...!;......feG.
...3[.f........4-.._/........8.$g..O.........T....HTTP/1.1 200 OK..Con
tent-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09
:36:02 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.
com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encodi
ng..Content-Length: 461..Connection: keep-alive.............R.n.0... \
.......eH2T'-..MQ..!...w...(..d...r...KO;$g9;.....i....Q.7.L..)..T...-
>.]z..U.=...-.h....%^..^..3T7.j..hj.Z....:p.M./....K..Gi....d.S.[Gu
Z.zGy.5._.O......v....6WY....4..x.._.....\.....i...D..4..S..r...y.b:..
...@B..7..z.$........`..C! N.o.)g...$..t.b......=c..`-...PB..z........
......H...a.:C.;..........E.3!..\....M...L<,..F..E..i.....1..'.!...
.O.;E..8G)..L>....k..9.......}V...!;......feG....3[.f........4-.._/
........8.$g..O.........T........
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:02 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1be.............R]o.0.}..`H..p`d...X.I...*t{....7..l,....wI.f./{......>>
.7[...o.cE.r?.....u\.}.?.../.u.&.VV...M4.....~..^......}..N.k....u..6.
.|..W~... ...j.f...:.E}..U.]F^7O.%........>n...|<.ij.BC._..b..|m
..Y....i.@....#.4i....1g...a.A..].AO....`........a....|....c-..W......
..r).B.\PI].B.[.......... 8tTj.5.%.u.....4B.....&d,..,...p.\,C.K.<N
...........1..')....rk..tf.?E.3arG.....v.o5j.d9.J.E...'.........4%..6.
;....,.[.."..L..]...E6.uB.d....ulpD...?...d..........~......0..HTTP/1.
1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 1
2 Oct 2016 09:36:02 GMT..P3P: CP='This is not a P3P policy. See http:/
/tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary:
Accept-Encoding..transfer-encoding: chunked..Connection: keep-alive..1
be.............R]o.0.}..`H..p`d...X.I...*t{....7..l,....wI.f./{.......
7[...o.cE.r?.....u\.}.?.../.u.&.VV...M4.....~..^......}..N.k....u..6..
|..W~... ...j.f...:.E}..U.]F^7O.%........>n...|<.ij.BC._..b..|m.
.Y....i.@....#.4i....1g...a.A..].AO....`........a....|....c-..W.......
.r).B.\PI].B.[.......... 8tTj.5.%.u.....4B.....&d,..,...p.\,C.K.<N.
..........1..')....rk..tf.?E.3arG.....v.o5j.d9.J.E...'.........4%..6.;
....,.[.."..L..]...E6.uB.d....ulpD...?...d..........~......0...
...
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:02 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive19e............dR...0.~._..vok..Q*.b..t.i...=.N.I|GtK@I......v?....l..
.m...7.........C.;!.s.......M.*.VV....4*.v.r.u._3.....C...b........l..
.. .." .Wd...=...&.P....../.;..CKQ....."{.......4...4.Z.3w.\w 6F...i..
.."....{.!i..?-c...>'%...}.ma.......E8jg:....{.xK.....z...I.P..T($(
p./z.".2r.D....Q..@..k.KAv'T.s.i...a.....$Z.H...`.\..).D.&..........c:
..~......G.{.....(sls*.U.A;_.....n9...".#u@.z.I?.f..Xb...v!.?Z.....'..
O...d.........s.t.....0..HTTP/1.1 200 OK..Content-Encoding: gzip..Cont
ent-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:02 GMT..P3P: CP='This
is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..S
erver: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: ch
unked..Connection: keep-alive..19e............dR...0.~._..vok..Q*.b..t
.i...=.N.I|GtK@I......v?....l...m...7.........C.;!.s.......M.*.VV....4
*.v.r.u._3.....C...b........l.... .." .Wd...=...&.P....../.;..CKQ.....
"{.......4...4.Z.3w.\w 6F...i...."....{.!i..?-c...>'%...}.ma.......
E8jg:....{.xK.....z...I.P..T($(p./z.".2r.D....Q..@..k.KAv'T.s.i...a...
..$Z.H...`.\..).D.&..........c:..~......G.{.....(sls*.U.A;_.....n9..."
.#u@.z.I?.f..Xb...v!.?Z.....'..O...d.........s.t.....0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:03 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1a5..............]o.0.....!...NBJ.*....*M......r....v,.....i( ........
.~t..(.{.0V.*..y.{.X........v.....kU7.[t..CeW..;....g@....9.%.V..[YG.`
s.........^.}3Tk0.]=Z..h..^]..........o.l......j..s;M.S.h.W.Q1.S^..s..
AK!..h.A....&m...E.Y0.9.....e..&Z3P..(>.n..c..zP........r).J.\PI]..
.t@1.nZ..D....CO.F.P]q\w\...L ...SN...%..E<~....2d.I..4..p._d.O....
..(..S..vB......y..Mu.b........m.6`O.C.lm..8...".A.......'....-....r1.
.J....q9.)~...d.......B.........0..HTTP/1.1 200 OK..Content-Encoding:
gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:03 GMT..P3P
: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-
policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-en
coding: chunked..Connection: keep-alive..1a5..............]o.0.....!..
.NBJ.*....*M......r....v,.....i( .........~t..(.{.0V.*..y.{.X........v
.....kU7.[t..CeW..;....g@....9.%.V..[YG.`s.........^.}3Tk0.]=Z..h..^].
.........o.l......j..s;M.S.h.W.Q1.S^..s..AK!..h.A....&m...E.Y0.9.....e
..&Z3P..(>.n..c..zP........r).J.\PI]...t@1.nZ..D....CO.F.P]q\w\...L
...SN...%..E<~....2d.I..4..p._d.O......(..S..vB......y..Mu.b......
..m.6`O.C.lm..8...".A.......'....-....r1..J....q9.)~...d.......B......
...0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=audiencescience,centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:03 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1b7.............RQo.0.~..`H.m..2B.D,..L.:..=TUd.k.:..64..9i...K.......
.._../o.mx/.?.....=......O....|.....L..4.(...~g.Z"d5.^wC..^ c.........
.^..._......&J.>...X.es....[......k....m...Yo...9.SD[......$.=a .YA
.......$1D..HH.....'..@......x..3..-......T?L..I.&8uP..D..=.... ..-.y$
{.F..'B9..U1w..P;;..K...*.F.....,.Ex1_D...,.R'.no.....B.^.o...$.0..C..
}.fI.!.!.f..3..6_v.W.....N....mY...^.,x..G.'.[.4....2_k.....a._:W.c6..
..t....ql......./.....9.V....d.. .....7.S......0..HTTP/1.1 200 OK..Con
tent-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09
:36:03 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.
com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encodi
ng..transfer-encoding: chunked..Connection: keep-alive..1b7...........
..RQo.0.~..`H.m..2B.D,..L.:..=TUd.k.:..64..9i...K........._../o.mx/.?.
....=......O....|.....L..4.(...~g.Z"d5.^wC..^ c..........^..._......&J
.>...X.es....[......k....m...Yo...9.SD[......$.=a .YA.......$1D..HH
.....'..@......x..3..-......T?L..I.&8uP..D..=.... ..-.y${.F..'B9..U1w.
.P;;..K...*.F.....,.Ex1_D...,.R'.no.....B.^.o...$.0..C..}.fI.!.!.f..3.
.6_v.W.....N....mY...^.,x..G.'.[.4....2_k.....a._:W.c6....t....ql.....
../.....9.V....d.. .....7.S......0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=centro,Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:04 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 427
Connection: keep-alive...........R.n.0... <..m..9u....4..lk....(.Yb.!.,Hr..}.,m......G>
;>Q.. .... Z...8.=P..B=..m........_eU.i.@.Beg..7...!..l..k....Z.{nf
.u......../..{E..P...Q.[.....^U.d.5y.-yM.oWWE..nqY...INS...4.K.WL.....
9K....F.4. L/ .I...a.s..t.Up...m>E..S....G.{E........n. ...EM......
D;...R#...9.k...u...F.0.kB..h.".....d...$.q..\p._d....1....8........;.
F.?......}k.y.Z..^...)..'. ...a.........3,..h.".6.m..,w..E6y.!g2y.....
.|.[<......(us.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content
-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:04 GMT..P3P: CP='This is
not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Serv
er: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 427..Con
nection: keep-alive.............R.n.0... <..m..9u....4..lk....(.Yb.
!.,Hr..}.,m......G>>Q.. .... Z...8.=P..B=..m........_eU.i.@.Beg.
.7...!..l..k....Z.{nf.u......../..{E..P...Q.[.....^U.d.5y.-yM.oWWE..nq
Y...INS...4.K.WL.....9K....F.4. L/ .I...a.s..t.Up...m>E..S....G.{E.
.......n. ...EM......D;...R#...9.k...u...F.0.kB..h.".....d...$.q..\p._
d....1....8........;.F.?......}k.y.Z..^...)..'. ...a.........3,..h.".6
.m..,w..E6y.!g2y......|.[<......(us.........
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=Bidswitch,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:05 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 409
Connection: keep-alive............_o. ....)<K....9u.aGn.I.........k..Q.F.....dY.?/{.....q
.....l.X1.2L.8.P....T.w....pU.....=.....Tv...wN/.q..`.... ..:...:p.-./
7..2.h...~7.5.....CY...A..R..x..y.Ow_. ..~}Y...1N.q.....;)... #x.."...
.......3..<c....x..fT...y:K.|R..`^J..$..........I.h_`..Vp.@j/[.5...
K.q....../.u.cy:g).>&.b.H.c....}-..PQ.'..1...v.u....X.)t......'...h
.a....6h..$.].O'.hO...=.xgk.=..p.E..w._;.d&.]A...[y..^........5.h...HT
TP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: W
ed, 12 Oct 2016 09:36:05 GMT..P3P: CP='This is not a P3P policy. See h
ttp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..V
ary: Accept-Encoding..Content-Length: 409..Connection: keep-alive.....
........._o. ....)<K....9u.aGn.I.........k..Q.F.....dY.?/{.....q...
..l.X1.2L.8.P....T.w....pU.....=.....Tv...wN/.q..`.... ..:...:p.-./7..
2.h...~7.5.....CY...A..R..x..y.Ow_. ..~}Y...1N.q.....;)... #x.."......
....3..<c....x..fT...y:K.|R..`^J..$..........I.h_`..Vp.@j/[.5...K.q
....../.u.cy:g).>&.b.H.c....}-..PQ.'..1...v.u....X.)t......'...h.a.
...6h..$.].O'.hO...=.xgk.=..p.E..w._;.d&.]A...[y..^........5.h...
t>....
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:05 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive181.............R]o. .}...,.o....q.....*Mk...CUE.p...........d./}.\8..
......h@.d..8.$q..wB..*.k......@..Us.e;Zh.n..x.....-..n.v.;E.3q.....].
..Y..1.....i....j5:..5..h........E..w?.......... g.z..4.Gw.\w .V...e..
..".......h..?Ms..3S.Q.P........~......!..E...`.. .v.L...Z.u-.Y...R.Y.
..m.y.My&..i2..R.T$"/.........]Y........^....x4wx.s.[...{....2...D....
.r@w..~.6 0...%|....w.M~.....1..S....._...d........:.._.....0..HTTP/1.
1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 1
2 Oct 2016 09:36:05 GMT..P3P: CP='This is not a P3P policy. See http:/
/tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary:
Accept-Encoding..transfer-encoding: chunked..Connection: keep-alive..1
81.............R]o. .}...,.o....q.....*Mk...CUE.p...........d./}.\8...
.....h@.d..8.$q..wB..*.k......@..Us.e;Zh.n..x.....-..n.v.;E.3q.....]..
.Y..1.....i....j5:..5..h........E..w?.......... g.z..4.Gw.\w .V...e...
.".......h..?Ms..3S.Q.P........~......!..E...`.. .v.L...Z.u-.Y...R.Y..
.m.y.My&..i2..R.T$"/.........]Y........^....x4wx.s.[...{....2...D.....
r@w..~.6 0...%|....w.M~.....1..S....._...d........:.._.....0...
...
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:05 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 413
Connection: keep-alive...........R.n.0... <..m..8s........[....(.Zbk#.,H..... m....H...=R
t.......zU.I...*..N=..m...<\...W.........].2l...B.A..vh".Kb.......`
....Mu.2Z...;.Z.9d..u(Y}|...7..\.I Q....kF?......?.i0NyA........4.(yQ.
.`."B.bR|...&...,.<..R..@.k/...N.-.o.........N`.R...]..n...7..S8..L
.I8...OE6M..l...<.Y.{R|x`...seLo.....&.. g.GC v..d..n.....3.../k:..
.=...L.....Zj...m.....t#.s..7o.<.6....\....h.\!g0...yY._.i*........
.H.j....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xm
l..Date: Wed, 12 Oct 2016 09:36:05 GMT..P3P: CP='This is not a P3P pol
icy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coy
ote/1.1..Vary: Accept-Encoding..Content-Length: 413..Connection: keep-
alive.............R.n.0... <..m..8s........[....(.Zbk#.,H..... m...
.H...=Rt.......zU.I...*..N=..m...<\...W.........].2l...B.A..vh".Kb.
......`....Mu.2Z...;.Z.9d..u(Y}|...7..\.I Q....kF?......?.i0NyA.......
.4.(yQ..`."B.bR|...&...,.<..R..@.k/...N.-.o.........N`.R...]..n...7
..S8..L.I8...OE6M..l...<.Y.{R|x`...seLo.....&.. g.GC v..d..n.....3.
../k:...=...L.....Zj...m.....t#.s..7o.<.6....\....h.\!g0...yY._.i*.
........H.j........
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:06 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive198.............R]..0.|..H#...$$.A.Q..........S..{`.N,.P...A..C....=..
..x~...#h#....q.{....nW.u.z7.....Rn..-.h..33[.{k..!.A.z.h......{vf,..S
..?5..'...._5U..p.....T.Xo.}...x.-yEw..5.o....*./r.j.......t..).k....a
K!..h.C....fm...4.,...N.j..%..E.`~..CG...R9XQUrw6\...t :...........<
;.D.4.F.9.y.gN....F.{.....Y.j.Kj....&........T..4p.........LV.z..&. ..
l..^;...OG.5_.\K....G./.k.8..A.?.VP..4e.............../).u.../]"?...d.
................0..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Ty
pe: text/xml..Date: Wed, 12 Oct 2016 09:36:06 GMT..P3P: CP='This is no
t a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server:
Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chunked.
.Connection: keep-alive..198.............R]..0.|..H#...$$.A.Q.........
.S..{`.N,.P...A..C....=....x~...#h#....q.{....nW.u.z7.....Rn..-.h..33[
.{k..!.A.z.h......{vf,..S..?5..'...._5U..p.....T.Xo.}...x.-yEw..5.o...
.*./r.j.......t..).k....aK!..h.C....fm...4.,...N.j..%..E.`~..CG...R9XQ
Urw6\...t :...........<.D.4.F.9.y.gN....F.{.....Y.j.Kj....&........
T..4p.........LV.z..&. ..l..^;...OG.5_.\K....G./.k.8..A.?.VP..4e......
........./).u.../]"?...d.................0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:07 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive169.............Q]O.0.}.W.%.......J.....qS..!]{.E.5mA.......O.m.=.9x..
...(]5"u..w.....X..Sqs.s...?gyq..{.]..oRwe..#d...Z.K.55.Z...kC.Z....&l
t;...g.!.EQ)A.o.N..I..:y.......xA.O......QVd......k.....L4..T.S.$~I!..
h.B.\CD.2....q.wdZ..w......CCki.....s.k97kUV.:.=! .....B.].~....".y...
.f3..O.c....}M.[y..r...7 .6G..3O..W.V..2..../..<T....>....(.".E.
.-y..a.E...t..o....m...|...d.......u...?.....0..HTTP/1.1 200 OK..Conte
nt-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:3
6:07 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.co
m/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding
..transfer-encoding: chunked..Connection: keep-alive..169.............
Q]O.0.}.W.%.......J.....qS..!]{.E.5mA.......O.m.=.9x.....(]5"u..w.....
X..Sqs.s...?gyq..{.]..oRwe..#d...Z.K.55.Z...kC.Z....<...g.!.EQ)A.o.
N..I..:y.......xA.O......QVd......k.....L4..T.S.$~I!..h.B.\CD.2....q.w
dZ..w......CCki.....s.k97kUV.:.=! .....B.].~....".y....f3..O.c....}M.[
y..r...7 .6G..3O..W.V..2..../..<T....>....(.".E..-y..a.E...t..o.
...m...|...d.......u...?.....0......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:07 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 376
Connection: keep-alive.............N.0.E.|E.Dw.IHIS9......D.,...{...!....q.BylX.ug.._<{..
Q.....8K.8..4....o...I<#{..Y.;Y>.B.rS_. ...!oAj.Zw...9g..O..~...
.j....7<"..Rc...... I.....k...7..o....9......m..v.Z..P...]1.).Y.kVU
iG...h.CV.CA..,....,.....4.. ...4<.K....m'...C..e......8...x...2.EU
....H0..{j....%.l...y..n.....E........?.......r.Kc...!.....=.....0,...
R...?.Ay........[...fHn...C.........,W...HTTP/1.1 200 OK..Content-Enco
ding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:07 GM
T..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/pr
ivacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Conte
nt-Length: 376..Connection: keep-alive...............N.0.E.|E.Dw.IHIS9
......D.,...{...!....q.BylX.ug.._<{..Q.....8K.8..4....o...I<#{..
Y.;Y>.B.rS_. ...!oAj.Zw...9g..O..~....j....7<"..Rc...... I.....k
...7..o....9......m..v.Z..P...]1.).Y.kVUiG...h.CV.CA..,....,.....4.. .
..4<.K....m'...C..e......8...x...2.EU....H0..{j....%.l...y..n.....E
........?.......r.Kc...!.....=.....0,...R...?.Ay........[...fHn...C...
......,W.......
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:07 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 419
Connection: keep-alive...........RMk.0........F...q.....@.-..=.bd..5].B.M.. ....CA..i..y...k
...@.....O"...;.......os.I..;. ..d..Fi.....U.......}=.]..Q.g..2.......
k.`*<..j.....{3.ZR.z...........=.o...._.iI..t.i ..._.o.....nD..<
.....K....HYVg)....G.*J....U%ZU.^.....{y.s.%3..t.G..<..Y$.<sc...
`... .;...~24.:.....8.N...@....(..<<.FL......h.....)...;...}...t
....`......:...:..i....n[....@..40..`.W.....!K..........F..t...F....D.
.&........E. ....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type
: text/xml..Date: Wed, 12 Oct 2016 09:36:07 GMT..P3P: CP='This is not
a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: A
pache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 419..Connecti
on: keep-alive.............RMk.0........F...q.....@.-..=.bd..5].B.M..
....CA..i..y...k...@.....O"...;.......os.I..;. ..d..Fi.....U.......}=.
]..Q.g..2.......k.`*<..j.....{3.ZR.z...........=.o...._.iI..t.i ...
_.o.....nD..<.....K....HYVg)....G.*J....U%ZU.^.....{y.s.%3..t.G..&l
t;..Y$.<sc...`... .;...~24.:.....8.N...@....(..<<.FL......h..
...)...;...}...t....`......:...:..i....n[....@..40..`.W.....!K........
..F..t...F....D..&........E. ........
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:09 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 421
Connection: keep-alive...........R_k.0.|.....[#.q.8..^...t.q..R.,........~..!M..FA..s...qxqh
w...n:....w.....xN.m........g......%.=7..b..#d...z..1.Z..t.3...^....*.
].3...[Q)A....6....u6._../.../.... ...2....$'.2......&..(_...,I..B...(
. ....u...i..?.i.[Y.^...Q?pX.0..S..h....,`O...$.tx|$...l.T..5..`76TR~t
......R.....4BeUC.:.}.9.......)......&.....O>.d.-....^.y..2...}.\UE
.... ..c8.^.R.....^*..N./[.ol.."KE....j..h.F./..F..@...^..'........@..
....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..D
ate: Wed, 12 Oct 2016 09:36:09 GMT..P3P: CP='This is not a P3P policy.
See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/
1.1..Vary: Accept-Encoding..Content-Length: 421..Connection: keep-aliv
e.............R_k.0.|.....[#.q.8..^...t.q..R.,........~..!M..FA..s...q
xqhw...n:....w.....xN.m........g......%.=7..b..#d...z..1.Z..t.3...^...
.*.].3...[Q)A....6....u6._../.../.... ...2....$'.2......&..(_...,I..B.
..(. ....u...i..?.i.[Y.^...Q?pX.0..S..h....,`O...$.tx|$...l.T..5..`76T
R~t......R.....4BeUC.:.}.9.......)......&.....O>.d.-....^.y..2...}.
\UE.... ..c8.^.R.....^*..N./[.ol.."KE....j..h.F./..F..@...^..'........
@..........
GET /syncnoad?rid=c990bae92eea42e196e4a7b74cf54dc0&p=_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:08 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive151............d._o.0....).......Sj...d......S....%m%.._%N.....w..=...
...@.J4..9.mA....]j/.............'..6j.S{.u;BHK....K...)....)M.Q....&.
..g.".M...y...JCM.~........4...-^....&...Vg;........j...Yn.&....I).?%.
.S.q...u4.......K..D.0.(...R..... =."?d>...........$....=.$nI!..h..
.....(`.0....;o4.[...."x".<..u=..X5@.YH...sf.4Z..}w..F?$.%m..9..%..
e..@.......SY......0..HTTP/1.1 200 OK..Content-Encoding: gzip..Content
-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:08 GMT..P3P: CP='This is
not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Serv
er: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chunk
ed..Connection: keep-alive..151............d._o.0....).......Sj...d...
...S....%m%.._%N.....w..=......@.J4..9.mA....]j/.............'..6j.S{.
u;BHK....K...)....)M.Q....&...g.".M...y...JCM.~........4...-^....&...V
g;........j...Yn.&....I).?%..S.q...u4.......K..D.0.(...R..... =."?d>
;...........$....=.$nI!..h.......(`.0....;o4.[...."x".<..u=..X5@.YH
...sf.4Z..}w..F?$.%m..9..%..e..@.......SY......0......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=beeswax,appnexus,TubeMogul-GP,_dmp_turbine,thetradedesk,rocketfuel,tremornet,BidTheatre,centro,adapTV,Bidswitch,videoamp,Videology,audiencescience,SundaySky,1,TapAd,dataxu,conversant,google,mediamath,eyeview,ignitionone&uid=ccb1cc725c2d43108581cf70d4976e4e&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:12 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1ea.............R.n.0... \..-..9r.I...E...".=..A.c..E.$...;t......o.7.>>
..t..6.-h....p.x..T2...{..\L.Y.!].eu.E....Lm......[...m_...|c.7.Sc..M.
.._.7^..l..?5Q..........wP.....xLZ..4O.wy..y~ST..)."..,h.W...B.6..e,H.
(.(M.I..W5./.$..z.F...U.H.l.S4.R8}DX4......7._.......K..!........d.#x-
C.s_p.r#..{o.j...Y....r...J......q.:.z.\5 ...>sfv...q..F......q....
r...V.F.`vd.h.. .rz.*..K....u...{...u....4b.e.L.................s..Z..
.1. .6.........,......qLu.~.)..-...s........7T@.YiB....[..A.......o!..
..M;......d........[z.......0..HTTP/1.1 200 OK..Content-Encoding: gzip
..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:12 GMT..P3P: CP
='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-poli
cy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encodi
ng: chunked..Connection: keep-alive..1ea.............R.n.0... \..-..9r
.I...E...".=..A.c..E.$...;t......o.7...t..6.-h....p.x..T2...{..\L.Y.!]
.eu.E....Lm......[...m_...|c.7.Sc..M..._.7^..l..?5Q..........wP.....xL
Z..4O.wy..y~ST..)."..,h.W...B.6..e,H.(.(M.I..W5./.$..z.F...U.H.l.S4.R8
}DX4......7._.......K..!........d.#x-C.s_p.r#..{o.j...Y....r...J......
q.:.z.\5 ...>sfv...q..F......q....r...V.F.`vd.h.. .rz.*..K....u...{
...u....4b.e.L.................s..Z...1. .6.........,......qLu.~.)..-.
..s........7T@.YiB....[..A.......o!....M;......d........[z.......0..
font>....
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:11 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 521
Connection: keep-alive...........R.n.0... \..-..D.!.P.....A... .(r"..H....}G.kw..@.....8.b.w>>
.5h..H......*..M.<...f."{.,..<.......m......Y....P.T..1.......&u
.~..;'Kr6....(.z.....g.>vR.O.wr....$....,y.r{......"..l....NP!.[h.R
..Q.....,......a..u...7.MUJ...".~.o.../.....Oh.Fp..K.h.x.#.\"`.....P].
....d'...o.j...Y..;Xs..)........Ql0t.....Z"....pK[.. ....1m.......)[ .
..5...-......8.Q9..b....k.`:.0.....^..E..?....-.Yt._C...Y..)...R....w.
.....v..\T.S|........X. R...bu?=...2t.?......C.4.q!.,..(._.9.,y.q.2KM.
...~...d{.^.3..-.w.P.....O.........O ...HTTP/1.1 200 OK..Content-Encod
ing: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:11 GMT
..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/pri
vacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Conten
t-Length: 521..Connection: keep-alive.............R.n.0... \..-..D.!.P
.....A... .(r"..H....}G.kw..@.....8.b.w.5h..H......*..M.<...f."{.,.
.<.......m......Y....P.T..1.......&u.~..;'Kr6....(.z.....g.>vR.O
.wr....$....,y.r{......"..l....NP!.[h.R..Q.....,......a..u...7.MUJ..."
.~.o.../.....Oh.Fp..K.h.x.#.\"`.....P].....d'...o.j...Y..;Xs..).......
.Ql0t.....Z"....pK[.. ....1m.......)[ ...5...-......8.Q9..b....k.`:.0.
....^..E..?....-.Yt._C...Y..)...R....w......v..\T.S|........X. R...bu?
=...2t.?......C.4.q!.,..(._.9.,y.q.2KM....~...d{.^.3..-.w.P.....O.....
....O .......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:13 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 490
Connection: keep-alive...........RMo.0...Wd..[".u.4..xi7...bv.CQ....BbI..$.......e.A......d~>>
h.... .L.`.{#.Lq!...T~.O.y..Y.Ey..=.?J;s.W;.g.8..2u[M.j......u..6..~[.
.^..|.%?...L...u.d..wT...yK..9/....}...^..e.|...8..M...$.....<.~...
.X\M....hu..qPU.Ax...N.../j.n...?.......J.F.......8u.."8.Jp......u..kp
.r.`7.B.;.........a.......f.Hg......p.F\......e...6..GNY...0.........h
...T....o.......Z...*@#. ...2..W....>.n.k...%K.......?....cG..p.T#.
..y2....A..q.h.....%..#...3.....".4.mp;.vh.E6..B.d.[...n.Z............
zA....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml.
.Date: Wed, 12 Oct 2016 09:36:13 GMT..P3P: CP='This is not a P3P polic
y. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyot
e/1.1..Vary: Accept-Encoding..Content-Length: 490..Connection: keep-al
ive.............RMo.0...Wd..[".u.4..xi7...bv.CQ....BbI..$.......e.A...
...d~h.... .L.`.{#.Lq!...T~.O.y..Y.Ey..=.?J;s.W;.g.8..2u[M.j......u..6
..~[..^..|.%?...L...u.d..wT...yK..9/....}...^..e.|...8..M...$.....<
.~....X\M....hu..qPU.Ax...N.../j.n...?.......J.F.......8u.."8.Jp......
u..kp.r.`7.B.;.........a.......f.Hg......p.F\......e...6..GNY...0.....
....h...T....o.......Z...*@#. ...2..W....>.n.k...%K.......?....cG..
p.T#...y2....A..q.h.....%..#...3.....".4.mp;.vh.E6..B.d.[...n.Z.......
.....zA........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:13 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1fc.............R...0.}.W.H...B..(... !......Z!....q,......t.E......x.>>
..D.su..Ai^.......Ak....V....5M>D.4.o4...E.'&.Jc..q...VeS.h]9ZK.g&.
......m...$JY/.. "%...Zm.J...^.=E.{..4e9....I..e6O....N.e.......T..M.g
1s...\J.b...]A....^Ql=......Np.C..l...G.....#....o....k..>.....`.a.
@.1....N].)......q4.4.... ...<p.O...q..F.l....qR.S.q...*....'rFt.T.
J"..L...V..iT.............Y0...h..m...>...^_......R...ie..4.z.k....
..........n..%.../c...m...j....s....a.-.7.......b..W..J*..F:I4S..?...$
..^.d...=n....kd;?.87..K..}Eq..6%?...d........W/s,.....0..HTTP/1.1 200
OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct
2016 09:36:13 GMT..P3P: CP='This is not a P3P policy. See hXXp://trem
orvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accep
t-Encoding..transfer-encoding: chunked..Connection: keep-alive..1fc...
..........R...0.}.W.H...B..(... !......Z!....q,......t.E......x...D.su
..Ai^.......Ak....V....5M>D.4.o4...E.'&.Jc..q...VeS.h]9ZK.g&.......
m...$JY/.. "%...Zm.J...^.=E.{..4e9....I..e6O....N.e.......T..M.g1s...\
J.b...]A....^Ql=......Np.C..l...G.....#....o....k..>.....`.a.@.1...
.N].)......q4.4.... ...<p.O...q..F.l....qR.S.q...*....'rFt.T.J"..L.
..V..iT.............Y0...h..m...>...^_......R...ie..4.z.k..........
....n..%.../c...m...j....s....a.-.7.......b..W..J*..F:I4S..?...$..^.d.
..=n....kd;?.87..K..}Eq..6%?...d........W/s,.....0......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:13 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 470
Connection: keep-alive...........RMo.0...Wd..[#.u.4..xi.....v.CQ....F"Y..$.......e'>RO$..
..^nF[4.iU..c.....h.*.../..o.}H.yQ.i.@...N]....)c..lM.Uc.Jf..Fnj......
......\........Y.[.2 ..GE.....ah.JX=?=d....]^./.q..S.........13.H..Ga.
s.W.(.o*...8...-.o...i.)...]...p....{*t....v....^.3 P.]S.=n...-.V....;
...h.!P..r.%...v.8^..:%./.C[.....>r...6..B.;....[...K.....R/]g.F.EG
r9....^.PDW.?....-.Et..`...Y..4.......Q~....Kp.19!..`0....=.;......n.e
....f..... i.b....n.~K.Yb._/.Lf..`..D.s.... .....|......HTTP/1.1 200 O
K..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2
016 09:36:13 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremor
video.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-
Encoding..Content-Length: 470..Connection: keep-alive.............RMo.
0...Wd..[#.u.4..xi.....v.CQ....F"Y..$.......e'>RO$....^nF[4.iU..c..
...h.*.../..o.}H.yQ.i.@...N]....)c..lM.Uc.Jf..Fnj............\........
Y.[.2 ..GE.....ah.JX=?=d....]^./.q..S.........13.H..Ga.s.W.(.o*...8...
-.o...i.)...]...p....{*t....v....^.3 P.]S.=n...-.V....;...h.!P..r.%...
v.8^..:%./.C[.....>r...6..B.;....[...K.....R/]g.F.EGr9....^.PDW.?..
..-.Et..`...Y..4.......Q~....Kp.19!..`0....=.;......n.e....f..... i.b.
...n.~K.Yb._/.Lf..`..D.s.... .....|..........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:14 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 464
Connection: keep-alive...........RMo.0...Wx...".u.4..xi..(.av.CQ....BjY.d'.......e'>RO...
...}..4Vv*..i.{.x'..d.C...._...UQVgZ4....s...sz..3.v...).Zf..=7..\o3..
.uq..i!.<.a@k4cV...6...........i!*.<|........*.O.4..h.._}......H
.. ..0.<.gq.\.P_DI...s.]s1......C...`..x.S..........z...@.vK).p..#D
.(..v...d.Z~.T.....|........W...v.mQHh.5...A..(.......q.h5..t!(.E...7.
T8.iU......y$..0.].B...".N.0...<e..zkLg.....t..L..]hR.....ylr..k.A;
..............f.bV.....v .,....v&..$................E-.....HTTP/1.1 20
0 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oc
t 2016 09:36:14 GMT..P3P: CP='This is not a P3P policy. See hXXp://tre
morvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Acce
pt-Encoding..Content-Length: 464..Connection: keep-alive.............R
Mo.0...Wx...".u.4..xi..(.av.CQ....BjY.d'.......e'>RO......}..4Vv*..
i.{.x'..d.C...._...UQVgZ4....s...sz..3.v...).Zf..=7..\o3...uq..i!.<
.a@k4cV...6...........i!*.<|........*.O.4..h.._}......H.. ..0.<.
gq.\.P_DI...s.]s1......C...`..x.S..........z...@.vK).p..#D.(..v...d.Z~
.T.....|........W...v.mQHh.5...A..(.......q.h5..t!(.E...7.T8.iU......y
$..0.].B...".N.0...<e..zkLg.....t..L..]hR.....ylr..k.A;............
..f.bV.....v .,....v&..$................E-.........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:14 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 483
Connection: keep-alive...........R.n.0.}.Wx......u.........0;.CQ....BbY.d'...i....{.!uD..0..>>
..........=..A.....7.........,/..`..G.g&. c..u...QU[.iS.ZK.23m.iub....
.v.g.J...H.j..^...........^<..XAv.o.4...XfE.|.'.2.......*......yQ..
..Q9.C..$.$.".,_.....L.1..:........3h.......E.0.{L....... .......k..9`
..0.Ap..>rC .y ........IML..)* ....@...Q7. .DX..1.[V..iU...Z.......
...p.{...O_#..w.-.......>>(.....|..F..t.d.6....l'X.Lg......,...E
9.r.?...]..k.@.....B....}.i.. .d...=^.C..kd.?_. .....~nxZ.7.........ab
.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..
Date: Wed, 12 Oct 2016 09:36:14 GMT..P3P: CP='This is not a P3P policy
. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote
/1.1..Vary: Accept-Encoding..Content-Length: 483..Connection: keep-ali
ve.............R.n.0.}.Wx......u.........0;.CQ....BbY.d'...i....{.!uD.
.0............=..A.....7.........,/..`..G.g&. c..u...QU[.iS.ZK.23m.iub
.....v.g.J...H.j..^...........^<..XAv.o.4...XfE.|.'.2.......*......
yQ....Q9.C..$.$.".,_.....L.1..:........3h.......E.0.{L....... .......k
..9`..0.Ap..>rC .y ........IML..)* ....@...Q7. .DX..1.[V..iU...Z...
.......p.{...O_#..w.-.......>>(.....|..F..t.d.6....l'X.Lg......,
...E9.r.?...]..k.@.....B....}.i.. .d...=^.C..kd.?_. .....~nxZ.7.......
..ab.........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:15 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 488
Connection: keep-alive...........R...0.}.W.H.[1.d.F@D.T..v..l .V...`%..6..}.l....}@>c...9>>
.xzlv.=h#Z.8..9....Bn.gU||?v....1.. -.i.(..&Nm...b54....emC.Q..N...3..
....N.g|...4U.t..'c.I.s. .......4......i..i6.....NQm%.r..{.L..O.....0.
=..j...mE.. ...Z....C..dK..............j....b.'..8 B.....a........a .n
.|....e5......m_...hCm..)j...........WA....*.x..Q..t%$.;.........xx.{.
..g....]t.!<?.1........E..F#...D...(...F...&......Pwz.....j9......C
..r.?op.z..l.....I..Fo....4...Pd...-.^..q.l....../%.....].I......./...
....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..D
ate: Wed, 12 Oct 2016 09:36:15 GMT..P3P: CP='This is not a P3P policy.
See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/
1.1..Vary: Accept-Encoding..Content-Length: 488..Connection: keep-aliv
e.............R...0.}.W.H.[1.d.F@D.T..v..l .V...`%..6..}.l....}@>c.
..9.xzlv.=h#Z.8..9....Bn.gU||?v....1.. -.i.(..&Nm...b54....emC.Q..N...
3......N.g|...4U.t..'c.I.s. .......4......i..i6.....NQm%.r..{.L..O....
.0.=..j...mE.. ...Z....C..dK..............j....b.'..8 B.....a........a
.n.|....e5......m_...hCm..)j...........WA....*.x..Q..t%$.;.........xx
.{...g....]t.!<?.1........E..F#...D...(...F...&......Pwz.....j9....
..C..r.?op.z..l.....I..Fo....4...Pd...-.^..q.l....../%.....].I......./
...........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:15 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 498
Connection: keep-alive...........R...0.}.W.H......%AY..R.V$l.V .... vd;....J.^..O>c...93.>>
.\.{-(...-.v...*........ck.....,..........*..'.c.TR.MaSY9Z.V.L.!......
6.[I..^.}U..AuQv...$...e...y....,'..z.D._f.4O_nr5QF`A.o..A.$l.8......R
... p..R..0..b........3.G.....).(...>`..h9..a.....`.8...^... ....8.
'nh.8k.#......qR.S~..%.....@...Q.UA..aN....eU.5.*..A..PZx..?.>...;.
.=..].<.....k.9.Z.PJ.?.c...u...'.S...T..Jy....vi..f....;h.1..P....K
.........i.-.......&um.......n..$.)t....0.>.g..."....hqF......Nv~J.
..&................$...HTTP/1.1 200 OK..Content-Encoding: gzip..Conten
t-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:15 GMT..P3P: CP='This i
s not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Ser
ver: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 498..Co
nnection: keep-alive.............R...0.}.W.H......%AY..R.V$l.V .... vd
;....J.^..O>c...93..\.{-(...-.v...*........ck.....,..........*..'.c
.TR.MaSY9Z.V.L.!......6.[I..^.}U..AuQv...$...e...y....,'..z.D._f.4O_nr
5QF`A.o..A.$l.8......R... p..R..0..b........3.G.....).(...>`..h9..a
.....`.8...^... ....8.'nh.8k.#......qR.S~..%.....@...Q.UA..aN....eU.5.
*..A..PZx..?.>...;..=..].<.....k.9.Z.PJ.?.c...u...'.S...T..Jy...
.vi..f....;h.1..P....K.........i.-.......&um.......n..$.)t....0.>.g
..."....hqF......Nv~J...&................$.......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:16 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1bb.............RMo.0...Wx.....:u.........0;..(.Ydk!.,H.....^.......G=>>
.....<;=j#Z....w....!.RwW...t7...[^..Z8..Q..M..Z..<..iu.Us.6.1.u
..Xf;...>...7Krp...fJ.._.`,6Y9.:E.%.^..h.%{.}...........r.i i.._...
.e...R..(.|..j.E.u...0...z.....Jm.V3@@sx.nq.^....(....v ..4|...(.n...`
....p.I`Cq..7..5..?9e....G.h..D...-k.....(..Q{..JH.u...U@....Bt....2..
...*..........[.[..[.-s .=.~....y....b.1S.6.Hs.Z....I..v.(.f<./K...
.=.......#f..?.q..d.!....]..o_x/.B.q.6.!..e..@........Q......0..HTTP/1
.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Wed,
12 Oct 2016 09:36:16 GMT..P3P: CP='This is not a P3P policy. See http:
//tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary:
Accept-Encoding..transfer-encoding: chunked..Connection: keep-alive..
1bb.............RMo.0...Wx.....:u.........0;..(.Ydk!.,H.....^.......G=
.....<;=j#Z....w....!.RwW...t7...[^..Z8..Q..M..Z..<..iu.Us.6.1.u
..Xf;...>...7Krp...fJ.._.`,6Y9.:E.%.^..h.%{.}...........r.i i.._...
.e...R..(.|..j.E.u...0...z.....Jm.V3@@sx.nq.^....(....v ..4|...(.n...`
....p.I`Cq..7..5..?9e....G.h..D...-k.....(..Q{..JH.u...U@....Bt....2..
...*..........[.[..[.-s .=.~....y....b.1S.6.Hs.Z....I..v.(.f<./K...
.=.......#f..?.q..d.!....]..o_x/.B.q.6.!..e..@........Q......0..
>....
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=thetradedesk,eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:16 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 455
Connection: keep-alive...........R]o.0.}..`H..0PZ...h.I..m..{....7.jm,....wI.f./}.......7[..
.7...S......b..j......s.Y|....>......]..o...B.....o..Ib..=........o
.../..{E..P..LU5Z....w........h.k...q[d..W.e]>..45N.....Q1.Q.4..<
;L.8..K.y....m..4..f.....t.#..v...zR....{.0........L..Jp......^q:V.#b.
\PI]...[.h........ 8tTj.5.%.u..^..4B..G..5....Y...(...#.IC.\.....S...s
.1.3...VX.Pn.`..l.{({&Ln..07.....F...gS.....{.;.9J.Jm.N.A.le.s1.=."...
(2.......yZd..'.D&.<A.f....z.K.......q......HTTP/1.1 200 OK..Conten
t-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36
:16 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com
/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding.
.Content-Length: 455..Connection: keep-alive.............R]o.0.}..`H..
0PZ...h.I..m..{....7.jm,....wI.f./}.......7[...7...S......b..j......s.
Y|....>......]..o...B.....o..Ib..=........o.../..{E..P..LU5Z....w..
......h.k...q[d..W.e]>..45N.....Q1.Q.4..<L.8..K.y....m..4..f....
.t.#..v...zR....{.0........L..Jp......^q:V.#b.\PI]...[.h........ 8tTj.
5.%.u..^..4B..G..5....Y...(...#.IC.\.....S...s.1.3...VX.Pn.`..l.{({&Ln
..07.....F...gS.....{.;.9J.Jm.N.A.le.s1.=."...(2.......yZd..'.D&.<A
.f....z.K.......q..........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=eyeview,appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:17 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 423
Connection: keep-alive..........dR.n.0.}.Wx...E...i` ...(PlC.n.E....B'Y.d'..1i....C..<"U.
..g4...7U...8.#z..K.?..?..%}W~...D.v4,4~.........t....D...6......_._..
......h..1k...f..4m..Q.| .1..Z...<........n...8.\0(h......3.tJV2).,
M.(.<..K..yV.)..iv%...P....?d 6H.o./..#.Lp=.OJ....C..F..y..k..i..7N
..C9.p..a[D...3m......Zj........:..)...D&..4._.S.\$2.*.!..'Z...q.\..[J
pL..`.Q..I.\.f...9..j....Ih.r.[..O..w..!.....p3.6<....9...-...x..p.
K......U=..i...HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type:
text/xml..Date: Wed, 12 Oct 2016 09:36:17 GMT..P3P: CP='This is not a
P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apa
che-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 423..Connection
: keep-alive............dR.n.0.}.Wx...E...i` ...(PlC.n.E....B'Y.d'..1i
....C..<"U...g4...7U...8.#z..K.?..?..%}W~...D.v4,4~.........t....D.
..6......_._........h..1k...f..4m..Q.| .1..Z...<........n...8.\0(h.
.....3.tJV2).,M.(.<..K..yV.)..iv%...P....?d 6H.o./..#.Lp=.OJ....C..
F..y..k..i..7N..C9.p..a[D...3m......Zj........:..)...D&..4._.S.\$2.*.!
..'Z...q.\..[JpL..`.Q..I.\.f...9..j....Ih.r.[..O..w..!.....p3.6<...
.9...-...x..p.K......U=..i.......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=appnexus,audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:17 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1a0.............R.n.0... T.....(.cP.T'...iP..!...b.))......V...Cz.Yrvw
v......V:.zS..4.#ix/.......q.W...V7....hPh.<.q...#......6..F..8.s.h
.|..~Y.W1...........f.....k......q.Z..nV_...._\.m}..g....M...7..TTN.R$
E.......yr.(;.."e.1.......B....1|..\..z.....*..p3.A......BQMC..i;IA.$L
J.Lw..J..j.......B.u..SFN...9KAYv.3.....|..."..eq!s..@0...k.z....M.0;?
.....Wo.T....."&.c....m....p&....k.V..$.....l..Opf.[0.....A'2...z.....
7.....d........T........0..HTTP/1.1 200 OK..Content-Encoding: gzip..Co
ntent-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:17 GMT..P3P: CP='Th
is is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'.
.Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding:
chunked..Connection: keep-alive..1a0.............R.n.0... T.....(.cP.T
'...iP..!...b.))......V...Cz.Yrvwv......V:.zS..4.#ix/.......q.W...V7..
..hPh.<.q...#......6..F..8.s.h.|..~Y.W1...........f.....k......q.Z.
.nV_...._\.m}..g....M...7..TTN.R$E.......yr.(;.."e.1.......B....1|..\.
.z.....*..p3.A......BQMC..i;IA.$LJ.Lw..J..j.......B.u..SFN...9KAYv.3..
...|..."..eq!s..@0...k.z....M.0;?.....Wo.T....."&.c....m....p&....k.V.
.$.....l..Opf.[0.....A'2...z.....7.....d........T........0.....
.
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=audiencescience,centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:18 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 447
Connection: keep-alive...........RQO.0.~..."...v.H..TY..".h...P...X,.e;..........?...}..e.u.
.....W.OB.{B..K...7..o..V|.n..>..-......o..S...]o...Y.!k....u..6./.
V../..{Evg...lo..:...........wEK^..._.".z?_.uy./..q......(.z.gF...4..f
,m&I.O...Q...y$.)....P..G.....E:.......z........}....P............v.`M
u..\.N..`..D0.....:.c..$&xr<!.1.<9MOD".....o....|.[.q..1Z&C%.:'1
4.(A....1.f.....y.n2;{....K....O(.>..N.^...F...."...K...`.]. ......
6.l.)X`../.@F.|..V..doX.G.......X.=....HTTP/1.1 200 OK..Content-Encodi
ng: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:18 GMT.
.P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/priv
acy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content
-Length: 447..Connection: keep-alive.............RQO.0.~..."...v.H..TY
..".h...P...X,.e;..........?...}..e.u......W.OB.{B..K...7..o..V|.n..&g
t;..-......o..S...]o...Y.!k....u..6./.V../..{Evg...lo..:...........wEK
^..._.".z?_.uy./..q......(.z.gF...4..f,m&I.O...Q...y$.)....P..G.....E:
.......z........}....P............v.`Mu..\.N..`..D0.....:.c..$&xr<!
.1.<9MOD".....o....|.[.q..1Z&C%.:'14.(A....1.f.....y.n2;{....K....O
(.>..N.^...F...."...K...`.]. ......6.l.)X`../.@F.|..V..doX.G.......
X.=........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=centro,Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:18 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 423
Connection: keep-alive............Mo.0..........v.:.d.n....v...P..,...J.$9...L.5[w.I$.R._Pt.
./...W.).t.....Ie....}.<.'....n.I..e.h.8..2.;&$8..[..Pt.xo.(.}...e|
{......2..O......... v....;%o.....?..o*..az]...........qwF....S..I.gi"
D...<.hy{..E..Oiv)...WJ...b.).6..|..v.k..k..u..%p.a.....b.V.:.-...Z
.....B.Ze`...B.)..s...,MF..T<.../........o.3.:..]....W....p..._..MO
..M.V%.........@?.n.u...%..:....OaE..).J..X.......j.......'...q.G.....
....w.A.z...HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: tex
t/xml..Date: Wed, 12 Oct 2016 09:36:18 GMT..P3P: CP='This is not a P3P
policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache
-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 423..Connection: k
eep-alive..............Mo.0..........v.:.d.n....v...P..,...J.$9...L.5[
w.I$.R._Pt../...W.).t.....Ie....}.<.'....n.I..e.h.8..2.;&$8..[..Pt.
xo.(.}...e|{......2..O......... v....;%o.....?..o*..az]...........qwF.
...S..I.gi"D...<.hy{..E..Oiv)...WJ...b.).6..|..v.k..k..u..%p.a.....
b.V.:.-...Z.....B.Ze`...B.)..s...,MF..T<.../........o.3.:..]....W..
..p..._..MO..M.V%.........@?.n.u...%..:....OaE..).J..X.......j.......'
...q.G.........w.A.z.......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=Bidswitch,SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:19 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive187...............n.0.E...U@..()J.....I..E[TJ.....ID....r....u.>6]q
..3..C......|..m."........Mz...;O.....v.IV.eXh."6...[..=......hH..M."D
.....?.....V%.~..9............>S..y0mU..o..0..nu......q.-^(..wg...Z
z....UY.R.b^U.......B.....j..n.......re@inx.0~.U?..........m.....a.].p
] ..q.B[.M.*.(..<.....|~>/.C..........%..]{?......*<.(..B<
.-.a.....A<......!.GH.]y..........Q.{....\o...j.........e.8.#..!..e
..@......*t-].....0..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-
Type: text/xml..Date: Wed, 12 Oct 2016 09:36:19 GMT..P3P: CP='This is
not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Serve
r: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chunke
d..Connection: keep-alive..187...............n.0.E...U@..()J.....I..E[
TJ.....ID....r....u.>6]q..3..C......|..m."........Mz...;O.....v.IV.
eXh."6...[..=......hH..M."D.....?.....V%.~..9............>S..y0mU..
o..0..nu......q.-^(..wg...Zz....UY.R.b^U.......B.....j..n.......re@inx
.0~.U?..........m.....a.].p] ..q.B[.M.*.(..<.....|~>/.C.........
.%..]{?......*<.(..B<.-.a.....A<......!.GH.]y..........Q.{...
.\o...j.........e.8.#..!..e..@......*t-].....0......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=SundaySky,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:19 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 389
Connection: keep-alive............]O.0.....s..I.1...d.&$F... ...X.].v.... .q.U.i...o_8..w...
..L.......d.\..,.....t._.i~.E...(M....Z...j.J..H.....|.....2.....F>
....|.X)...to,.(?....g...Gh.r...L....GY..O8....A._.....l.... ..0.4!.8.
:..V.$!!.0.Q.P.......M4. X....t...|..............u..Z.J.B.F.H...a.6.X.
..n...U....tx.....O?c.K..V]...$.{.....>.......#.D....9$...jg......&
gt;8..)s...%?....................}......O.EgT...HTTP/1.1 200 OK..Conte
nt-Encoding: gzip..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:3
6:19 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.co
m/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding
..Content-Length: 389..Connection: keep-alive..............]O.0.....s.
.I.1...d.&$F... ...X.].v.... .q.U.i...o_8..w.....L.......d.\..,.....t.
_.i~.E...(M....Z...j.J..H.....|.....2.....F>....|.X)...to,.(?....g.
..Gh.r...L....GY..O8....A._.....l.... ..0.4!.8.:..V.$!!.0.Q.P.......M4
. X....t...|..............u..Z.J.B.F.H...a.6.X...n...U....tx.....O?c.K
..V]...$.{.....>.......#.D....9$...jg......>8..)s...%?..........
..........}......O.EgT.......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:20 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 423
Connection: keep-alive...........R]o.0.}..H#...$...c.B..J;.d{..._.k.c....?.1.V.....s........
.....UE...0...L.M....f.N...V...,.`>Q.. ..sz..3\.f.#}.J`...7....-...
.....,@...Zs.....q..cn.^....x,Z..o..K...g..*.O.46N.....}WT..M.`...,MbJ
s2....`2H.<!.5I...tq'X....D..pn........K.......aR7ng.P.......S.C..l
....(..y..q~.3... .[..1.. .../..:.9..Bn..5..K..=..0....t.eF.E.\...<
...VM]/}4...#..O]..6.v.....7I.....>x .GV...~c..\9.............~.'..
/.........~....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type:
text/xml..Date: Wed, 12 Oct 2016 09:36:20 GMT..P3P: CP='This is not a
P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apa
che-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 423..Connection
: keep-alive.............R]o.0.}..H#...$...c.B..J;.d{..._.k.c....?.1.V
.....s.............UE...0...L.M....f.N...V...,.`>Q.. ..sz..3\.f.#}.
J`...7....-........,@...Zs.....q..cn.^....x,Z..o..K...g..*.O.46N.....}
WT..M.`...,MbJs2....`2H.<!.5I...tq'X....D..pn........K.......aR7ng.
P.......S.C..l....(..y..q~.3... .[..1.. .../..:.9..Bn..5..K..=..0....t
.eF.E.\...<...VM]/}4...#..O]..6.v.....7I.....>x .GV...~c..\9....
.........~.'../.........~........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:21 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 375
Connection: keep-alive...........Q[O.0.}.W.%.......J...........`..k....[&......=......zs.\..
...x..pAkV.M.............3,<........1r..Q..U......Z...h.M.S..a..].3
. ....\.n..6.By...f....[...x3.."x....<[..$VFXC./.....l.J.2?....4&I.
.=.I7....u..)...p....*.mK.k\I;.Xf.. V..i.)..4..R.X....,..~r..t..,..=..
..A...D.Z.q_aC..3M..).)8.9...yZ..B..G.i%......#eI.-....;..[d.0}.%O.\.m
.........8.f.:.D.......RB.e?...HTTP/1.1 200 OK..Content-Encoding: gzip
..Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:21 GMT..P3P: CP
='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-poli
cy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length:
375..Connection: keep-alive.............Q[O.0.}.W.%.......J..........
.`..k....[&......=......zs.\.....x..pAkV.M.............3,<........1
r..Q..U......Z...h.M.S..a..].3. ....\.n..6.By...f....[...x3.."x....<
;[..$VFXC./.....l.J.2?....4&I..=.I7....u..)...p....*.mK.k\I;.Xf.. V..i
.)..4..R.X....,..~r..t..,..=....A...D.Z.q_aC..3M..).)8.9...yZ..B..G.i%
......#eI.-....;..[d.0}.%O.\.m.........8.f.:.D.......RB.e?.....
..
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:21 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 377
Connection: keep-alive............[O.0.....s...ns.A...1!1jd..1.'.....E....x.............=..u
B.:..4......Z....y....|l..A.oe.P......f...\j.Z..j..3q.G.c.vu|s.l.c...!
.d.1.nO...\.vW...w.|_.L...........e.6...........(.4fc X........TE...&.
yYf..d.....;...........u..Y..%B..:...d.G..9 ....W.})SV.../..3..7..Zm.1
K..*1V...f.....M..-6.r..c.{.....s....m...N,.^t....^.aqP............_/.
.?Z..4Cr..@..........9W...HTTP/1.1 200 OK..Content-Encoding: gzip..Co
ntent-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:21 GMT..P3P: CP='Th
is is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'.
.Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 377
..Connection: keep-alive..............[O.0.....s...ns.A...1!1jd..1.'..
...E....x.............=..uB.:..4......Z....y....|l..A.oe.P......f...\j
.Z..j..3q.G.c.vu|s.l.c...!.d.1.nO...\.vW...w.|_.L...........e.6.......
....(.4fc X........TE...&.yYf..d.....;...........u..Y..%B..:...d.G..9
....W.})SV.../..3..7..Zm.1K..*1V...f.....M..-6.r..c.{.....s....m...N,.
^t....^.aqP............_/. .?Z..4Cr..@..........9W.......
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=videoamp,TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:22 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 420
Connection: keep-alive...........R.N.0...Wd#%...'4m..2-.*!@4......@...l'....Z..{.....<...
..[....6u s?.E.'$ky-.s.[.~M.9..vdS.`p..Aif6._.U3...M._.j.....|.....3..
s[......F.5UJ...y7V4...z......=)..}...1...X..<....V:A..x.%.-.s]..GY
.......i4.h..,...).S.C..T...E..U.NW..a.f..b7./..i.G..I......l,R.......
J.V.#...5.-m.^`g.h'r~X.t\p.Eq:....S..!...Z0..\AB..r.......$..zG.d.d..S
ud..ex.i.........B.0ZhAm..s.bt....Yh.^]..z!.qhp....|..|..%.`5.. ....u"
4n....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml.
.Date: Wed, 12 Oct 2016 09:36:22 GMT..P3P: CP='This is not a P3P polic
y. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyot
e/1.1..Vary: Accept-Encoding..Content-Length: 420..Connection: keep-al
ive.............R.N.0...Wd#%...'4m..2-.*!@4......@...l'....Z..{.....&l
t;.....[....6u s?.E.'$ky-.s.[.~M.9..vdS.`p..Aif6._.U3...M._.j.....|...
..3..s[......F.5UJ...y7V4...z......=)..}...1...X..<....V:A..x.%.-.s
]..GY.......i4.h..,...).S.C..T...E..U.NW..a.f..b7./..i.G..I......l,R..
.....J.V.#...5.-m.^`g.h'r~X.t\p.Eq:....S..!...Z0..\AB..r.......$..zG.d
.d..Sud..ex.i.........B.0ZhAm..s.bt....Yh.^]..z!.qhp....|..|..%.`5.. .
...u"4n........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=TapAd,_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:23 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 423
Connection: keep-alive...........R[k.0.}......"[v.4..Z...lcq..R.,}m.bYHrH....&..(.A.st.w8dy.
....i{...4.=....|..]..4....rO....G.#J....b.Z d5t.~..).;d..=.0...d...5-
..P....fJ..O.Wc......n..t.<.RQ....2'..V....YN1m.34.K.Ur.3....D.&8.9
O.y....51N..i."|..De..Tm....&..p.D..o8.I....y...P$....x|.....Z.^.k.=.~
j.b.....7.G..C{..y....p.L....-...f..A..Q..1.........]Y. ...........\..
...b...N1../;....@9Yi`.Mg.....t.CV....Z..Hk..... .....t....|.K........
.X....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml.
.Date: Wed, 12 Oct 2016 09:36:23 GMT..P3P: CP='This is not a P3P polic
y. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyot
e/1.1..Vary: Accept-Encoding..Content-Length: 423..Connection: keep-al
ive.............R[k.0.}......"[v.4..Z...lcq..R.,}m.bYHrH....&..(.A.st.
w8dy.....i{...4.=....|..]..4....rO....G.#J....b.Z d5t.~..).;d..=.0...d
...5-..P....fJ..O.Wc......n..t.<.RQ....2'..V....YN1m.34.K.Ur.3....D
.&8.9O.y....51N..i."|..De..Tm....&..p.D..o8.I....y...P$....x|.....Z.^.
k.=.~j.b.....7.G..C{..y....p.L....-...f..A..Q..1.........]Y. .........
..\.....b...N1../;....@9Yi`.Mg.....t.CV....Z..Hk..... .....t....|.K...
......X........
GET /syncnoad?rid=d074210cc7b84406bab32771bbf129cd&p=_dmp_turbine&uid=ccb1cc725c2d43108581cf70d4976e4e HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="2,1476264957"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Wed, 12 Oct 2016 09:36:22 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive153............d._o. ....):.|[)X.j(.Q..,..V.`............q.?op...s9..G
...R.R..@~.<Ys%.z..E.p..1.!.4....07X..M...f....Rz.,|.*hL.<;2...I
...&..JR.Q..Y.H...OceE....e/.^.'.T.l.x.Sr..L.<].....?.....VL.n.....
[b.......~......ca....J.,.&....g4....ViW..@.Gx....(..1..(..0....u.....
.qE...}..>."T.[..\..;o4..-M...d..{H ..H.cYK..\3~p.3kem...w.^a.C.^.v
...._...d.........m&......0..HTTP/1.1 200 OK..Content-Encoding: gzip..
Content-Type: text/xml..Date: Wed, 12 Oct 2016 09:36:22 GMT..P3P: CP='
This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy
'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding
: chunked..Connection: keep-alive..153............d._o. ....):.|[)X.j(
.Q..,..V.`............q.?op...s9..G...R.R..@~.<Ys%.z..E.p..1.!.4...
.07X..M...f....Rz.,|.*hL.<;2...I...&..JR.Q..Y.H...OceE....e/.^.'.T.
l.x.Sr..L.<].....?.....VL.n.....[b.......~......ca....J.,.&....g4..
..ViW..@.Gx....(..1..(..0....u......qE...}..>."T.[..\..;o4..-M...d.
.{H ..H.cYK..\3~p.3kem...w.^a.C.^.v...._...d.........m&......0..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 130
Connection: keep-alive
Date: Wed, 21 Sep 2016 06:31:31 GMT
Last-Modified: Thu, 04 Dec 2014 23:41:04 GMT
ETag: "2cf4c5e3d4c1206209355ac1065b0efc"
Accept-Ranges: bytes
Server: AmazonS3
Age: 54168
X-Cache: Hit from cloudfront
Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)
X-Amz-Cf-Id: 0_n83GU8q-JinE3Hj2uMi8KDsdCg-6J9gT7gNvRgEWa2fwkPI8QJWw==<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" />.</cro
ss-domain-policy>....
GET /static/noad.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cdn.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; tvrg_60409="1,1476264957"
HTTP/1.1 200 OK
Content-Type: text/xml
Content-Length: 73
Connection: keep-alive
Date: Wed, 21 Sep 2016 09:04:53 GMT
Last-Modified: Thu, 04 Dec 2014 23:38:15 GMT
ETag: "074455bdeaf186ffa7b220bc14965cd5"
Accept-Ranges: bytes
Server: AmazonS3
Age: 54167
X-Cache: Hit from cloudfront
Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xHKcZJ8jIrWcC7GDD8unXqVtfQ9dh276aV-AbvniqX2Tv2xWthORJw==<VAST version="2.0" t:status="NO_AD" xmlns:t="hXXp://tremorhub.com/
ssp"/>HTTP/1.1 200 OK..Content-Type: text/xml..Content-Length: 73..
Connection: keep-alive..Date: Wed, 21 Sep 2016 09:04:53 GMT..Last-Modi
fied: Thu, 04 Dec 2014 23:38:15 GMT..ETag: "074455bdeaf186ffa7b220bc14
965cd5"..Accept-Ranges: bytes..Server: AmazonS3..Age: 54167..X-Cache:
Hit from cloudfront..Via: 1.1 5fc330730b7a22af558c1164ae769565.cloudfr
ont.net (CloudFront)..X-Amz-Cf-Id: xHKcZJ8jIrWcC7GDD8unXqVtfQ9dh276aV-
AbvniqX2Tv2xWthORJw==..<VAST version="2.0" t:status="NO_AD" xmlns:t
="hXXp://tremorhub.com/ssp"/>..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: thm.vidvib.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:36:24 GMT
Content-Type: application/xml
Content-Length: 82
Connection: keep-alive
Last-Modified: Fri, 20 Jun 2014 22:54:54 GMT
ETag: "1000000015848-52-4fc4c61b7eb80"
Server: NetDNA-cache/2.2
Expires: Sat, 07 Oct 2017 09:36:24 GMT
Cache-Control: max-age=31104000
X-Cache: HIT
Accept-Ranges: bytes<cross-domain-policy>.. <allow-access-from domain="*"/>
..</cross-domain-policy>....
GET /abcd.mp4 HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: thm.vidvib.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:36:24 GMT
Content-Type: video/mp4
Content-Length: 5784
Connection: keep-alive
Last-Modified: Sun, 04 May 2014 13:45:24 GMT
ETag: "10000000157fb-1698-4f8933a030500"
Server: NetDNA-cache/2.2
Expires: Sat, 07 Oct 2017 09:36:24 GMT
Cache-Control: max-age=31104000
X-Cache: HIT
Accept-Ranges: bytes....ftypmp42....mp41isom....mdat.................3../..aP.pAr.2H..*=4M>>
icrosoft H.264 Encoder V1.5.3..............sC....B.5l.src:3 h:480 w:85
4 fps:29.970 pf:66 lvl:9 b:0 bqp:3 gop:60 idr:60 slc:1 cmp:0 rc:1 qp:2
4 rate:5500000 peak:0 buff:2062500 ref:1 srch:32 asrch:1 subp:1 par:6
3 3 rnd:0 cabac:0 lp:2 ctnt:0 aud:1 lat:0 wrk:4 vui:1 lyr:1 <<..
....e..K....P..#...}..}..}..}..}..}..}..}..}..}..}..}..}..".."........
......................................................................
...;...c..[.o.......?....{m....?....{e........Y.}z~...?}..}....[...}..
..[......?..5.....M<4....=4.}..}.._...:.../.._......Z.Sd..t...ET...
..3...1..........u...t..u.M......\.<....B.u....:......`.5.U..\..U/.
.D.y..Dj..).(=......:.Q.o.?...o...8 ...6....C..]..?..DJ.U. y.e. .v.M..
..D&No..W.....Y...Q*RU... ._...n....x(.....eU*.........Z.j..........B.
...kU..H..&U..x.'..~.>....!yI..^^U..Iv..''!-p.?Dd.....7..P..d`.j.Z.
......d.....x&..'V.WW..say]....R..u....JXd~........u.}k_p...Z.U.jl..F.
.K...GY?:.:d)-........!^U......B.O.?......'....!.G.......>.w."..".N
.k*.....\NN..........U........R....~R..Cz...%...\.Z.W.j.r..R*..UV...;.
..*.W.._NJo.H....LG.........l.....W...u'....?...!2..'' ....,.//'OZ.W..
"......{.R.W..y........)4H......._^..,.;XS../...O.^.....j....O...EUU..
E..y.g.Uw_Y........B....!:.(..../.... F.....W..w\.NN^]JMjG....G.....O.
.....`.....BuiI.e$..Il../....}k.~_...yTu...i.{..RC.b....]._.,.....kA..
.a.Z.[{e.{X.m....._{s.Z.. .].'...^..Z..ZHZ..S........DK.tL'.9./}D.....
......'.xF....2.......?.p..a......p.X....X..y?..`.%y..k.>......
GET /draw/?w=colored&n=646&c=000000ffffff&p= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uid=CgH9H1f A/esS1DChRW/Ag==
Connection: Keep-Alive
Host: widgets.amung.us
HTTP/1.1 200 OK
Server: nginx/1.9.6
Date: Wed, 12 Oct 2016 09:35:52 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Content-Disposition: filename=wau-widget.png
Expires: Fri, 11 Nov 2016 09:35:52 GMT
Cache-Control: max-age=2592000547...PNG........IHDR...Q...........p.....PLTE...EEEYYY???AAA......;&l>>
t;=...abdWXZ,,,..................GGG......'((..................uvyEFGL
LL......""".........kln...NNN...QQQqqq{{{............~~.vwx...hhi.....
....OPQ...ooo...........................uvv...opp......UVV......bbb...
...bcc...ijj}~~......dee............SSS......]^^PPP.........TTTaaaRRR.
.....yyy...HHHrss.........kllJJJDDD|||BBB...............NOO.........@@
@tttkkkvvv:::WWW.....................?@@888666ppprrrCCC...111>>&
gt;FFF............000...lll......XYZ(((&&&hhhfff cdeZ[\788...dddccc.
........nnn.........ZZZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjj.p......tRNS.@
..f....IDATH...iS.@.....^TE...(... .....7.x`@9.*$ .G....RQ@i...%J..F..
..n....Qg.....w.....&..0......h......D...4....''4c. ......w.c.7.]3..".
M.......z.....0.....a...H...E.`..x............=^........NUG.^d........
..a'.v.#..7s....Ru..6.y..j.>.&...D..X.t.<~.J...U.MS#............
R..gQ.r......R[..h8l.....U..do.,[AbU.KS.o........ :..)2.....2L...../-.
p.0.sg.c.lDg.iEG3...L...N.`..N....c$...a.....#6.....!xP...>$2,....f
.~...........n>....w.d...Z.....,.....l...&Bf& .h$.\... mK......&g
t;8Lw.`c*.).......PT.7m$..6.....'.6.......y.qA.H-.^O....uPf<...k..:
.h2...h...Y...Y9c`.......4.S....od< ...C........M.J.1.S.;..Hg5$.!.l
R.W.../.......B^.).K....`..'..$|v.......#0.L.....JH.M.......)N........
....q...)....=.......... ..B.../..j....Wu..M6#e....IEND.B`...0..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi.govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.757982639.1476264960; _gat=1
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:39:40 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Tue, 11 Nov 2014 03:08:25 GMT
ETag: "a1b01-52-5078c97abfc40"
Accept-Ranges: bytes
Content-Length: 82
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/xml<cross-domain-policy>.. <allow-access-from domain="*"/>
..</cross-domain-policy>....
GET /v?LR_PUBLISHER_ID=38834&LR_SCHEMA=vast2-vpaid&LR_AUTOPLAY=1&LR_CONTENT=1&LR_VIDEO_URL=hXXp://VVV.govids.net/2.html&LR_VIDEO_ID=&LR_VIDEO_POSITION=0&LR_PARTNERS=937115&LR_TITLE=Home videos, Funny Videos - 2&LR_FORMAT=application/x-shockwave-flash HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: vi.govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.757982639.1476264960; _gat=1
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:39:40 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Set-Cookie: PHPSESSID=kpil2si10pdrb41ok7l7hrnrv2; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private
Pragma: no-cache
Content-Length: 654
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/xml<?xml version="1.0" encoding="UTF-8"?>..<VAST version="2.0"&g>>
t;..<Ad id="1"><Wrapper><AdSystem>1</AdSystem>
<VASTAdTagURI><![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/a
d/tag?adCode=we1sb-fspan&playerWidth=645&playerHeight=380&playerPositi
on=1&mediaTitle=Home videos, Funny Videos - 2&mediaDesc=Watch Home vid
eos, Funny Videos - 2&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl
=hXXp://VVV.govids.net/2.html&contentLength=[CONTENT_LENGTH]]]><
/VASTAdTagURI><Impression><![CDATA[hXXp://z.frightenedomni
scient.info/chki.php?ww=tremor&aa=hXXp://VVV.govids.net/2.html&lrp=937
115&TIMESTAMP=3530908069]]></Impression><Creatives><
/Creatives></Wrapper></Ad>..</VAST>HTTP/1.1 200 O
K..Date: Wed, 12 Oct 2016 09:39:40 GMT..Server: Apache/2.2.15 (CentOS)
..X-Powered-By: PHP/5.3.3..Set-Cookie: PHPSESSID=kpil2si10pdrb41ok7l7h
rnrv2; path=/..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Cache-Control:
private..Pragma: no-cache..Content-Length: 654..Keep-Alive: timeout=5.
.Connection: Keep-Alive..Content-Type: text/xml..<?xml version="1.0
" encoding="UTF-8"?>..<VAST version="2.0">..<Ad id="1">
<Wrapper><AdSystem>1</AdSystem><VASTAdTagURI>&
lt;![CDATA[hXXp://we1sb-wwcgk.ads.tremorhub.com/ad/tag?adCode=we1sb-fs
pan&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home
videos, Funny Videos - 2&mediaDesc=Watch Home videos, Funny Videos - 2
&mediaId=&mediaUrl=[CONTENT_MEDIA_URL]&srcPageUrl=hXXp://VVV.govid
GET /5/10/logo.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: l.longtailvideo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: image/png
Date: Wed, 12 Oct 2016 09:35:55 GMT
Etag: "3015243340"
Expires: Wed, 19 Oct 2016 09:35:55 GMT
Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT
Server: ECAcc (arn/46B0)
X-Cache: HIT
Content-Length: 1845.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP...>>
.0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......c
v..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*].
...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !..
...Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{
.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9k
L....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j
.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.
]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...
........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0
.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...
S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j
.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O
.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{..
....>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'.
...x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`.
..8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..
t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.
q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'
.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......
j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.b
i..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
GET /count.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=&rand= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.shanaluby.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:52 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 47
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html......<meta http-equiv="refresh" content="300">HTTP/1.1 200 OK..
Date: Wed, 12 Oct 2016 09:35:52 GMT..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 47..Keep-Alive: tim
eout=5, max=100..Connection: Keep-Alive..Content-Type: text/html......
..<meta http-equiv="refresh" content="300">..
GET /counter/counter.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.statcounter.com
Connection: Keep-Alive
Cookie: __cfduid=d7811866dcaa36891ef05dc4c11a8bf9e1476264951; is_unique=sc10114910.1476264951.0; is_visitor_unique=1476264951396170093
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:54 GMT
Server: PWS/8.1.41.3
X-Px: ht h0-s1082.p11-fra.cdngp.net
ETag: W/"576924c5-654e"
Cache-Control: max-age=43200
Expires: Wed, 12 Oct 2016 12:42:23 GMT
Age: 32011
Content-Length: 9529
Content-Type: application/x-javascript
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT
Connection: keep-alive...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u>>
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5. G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
GET /10114910/0/757d7213/1/ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:51 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
Set-Cookie: __cfduid=d7811866dcaa36891ef05dc4c11a8bf9e1476264951; expires=Thu, 12-Oct-17 09:35:51 GMT; path=/; domain=.statcounter.com; HttpOnly
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1476264951.0; expires=Mon, 11-Oct-2021 09:35:51 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1476264951396170093; expires=Fri, 12-Oct-2018 09:35:51 GMT; path=/; domain=.statcounter.com
Server: cloudflare-nginx
CF-RAY: 2f09906ba20f404a-SOFGIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Wed, 12 Oct 2016 09:35:51 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..Set-Cookie: __cfduid=d7811866dcaa36891
ef05dc4c11a8bf9e1476264951; expires=Thu, 12-Oct-17 09:35:51 GMT; path=
/; domain=.statcounter.com; HttpOnly..P3P: policyref="hXXp://VVV.statc
ounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expire
s: Mon, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.147
6264951.0; expires=Mon, 11-Oct-2021 09:35:51 GMT; path=/; domain=.stat
counter.com..Set-Cookie: is_visitor_unique=1476264951396170093; expire
s=Fri, 12-Oct-2018 09:35:51 GMT; path=/; domain=.statcounter.com..Serv
er: cloudflare-nginx..CF-RAY: 2f09906ba20f404a-SOF..GIF89a............
.......!.......,...........T..;....
GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=DFC313228BC44FF3C01A0DCC64F1B685&sc_random=0.8440365745267391&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.govids.net/page-2.html?lid=937115&u=http://VVV.govids.net/page-2.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
Cookie: __cfduid=d7811866dcaa36891ef05dc4c11a8bf9e1476264951; is_unique=sc10114910.1476264951.0; is_visitor_unique=1476264951396170093
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:54 GMT
Content-Type: image/gif
Content-Length: 49
Connection: keep-alive
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1476264951.0-10675947.1476264954.0; expires=Mon, 11-Oct-2021 09:35:54 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1476264951396170093; expires=Fri, 12-Oct-2018 09:35:54 GMT; path=/; domain=.statcounter.com
Server: cloudflare-nginx
CF-RAY: 2f09907c3039404a-SOFGIF89a...................!.......,...........T..;HTTP/1.1 200 OK..Date
: Wed, 12 Oct 2016 09:35:54 GMT..Content-Type: image/gif..Content-Leng
th: 49..Connection: keep-alive..P3P: policyref="hXXp://VVV.statcounter
.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"..Expires: Mon
, 26 Jul 1997 05:00:00 GMT..Set-Cookie: is_unique=sc10114910.147626495
1.0-10675947.1476264954.0; expires=Mon, 11-Oct-2021 09:35:54 GMT; path
=/; domain=.statcounter.com..Set-Cookie: is_visitor_unique=14762649513
96170093; expires=Fri, 12-Oct-2018 09:35:54 GMT; path=/; domain=.statc
ounter.com..Server: cloudflare-nginx..CF-RAY: 2f09907c3039404a-SOF..GI
F89a...................!.......,...........T..;..
GET /report1.php?url=/govids/page-2.html?lid=937115 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:39:21 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Wed, 12 Oct 2016 09:39:21 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......
GET /bck.php?1476264958000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:39:22 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Wed, 12 Oct 2016 09:39:22 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......
GET /report1.php?url=/govids/page-2.htm?lid=937115 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:39:23 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8....
GET /bck.php?1476264959000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:39:23 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Wed, 12 Oct 2016 09:39:23 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..
GET /img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1476264960.DFC313228BC44FF3C01A0DCC64F1B685.1.1.1.1.1.1.1.1.1; _ga=GA1.2.757982639.1476264960; _gat=1
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:54 GMT
Content-Type: image/png
Content-Length: 3856
Connection: keep-alive
Last-Modified: Tue, 10 Jun 2014 14:29:28 GMT
ETag: "a1bf2-f10-4fb7c27bc2200"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adob>>
e ImageReadyq.e<....IDATx..].O....V^.....rI........c..F..M.y0..-H..
..P.KH\.-.%-....J.[...5..S.... R...c....K/O.w...........93svY..i..e..w
...}..}gvy..E?.Q..%....J...(Q.V.DaZ....JN........(.fL...cM.....Z...'..
...A.....k.x....8....E..O..;.W...f.q.X..l..=.....k................%...
fd)........,..J..G...!...m.Q...J.../..................Y,0.......%...S6
R..=..t.0..%...|(..?T.V.DaZ...i%.b>..6:.~.=..7.-*.g....y<.,4>
....W..jv.(...}...8..YdF.l. .,,~5s..X<..h~.p...'......b...[6.0.D.Ci
........ Bo.C]....g..........y.i.........]N....p$.-~}8..... .....n.z..
.$~.9.).........P.....g....!.':.J..O...X.U.?:..#.g.{ .^......L..0..I..
"H<.5.u0...n^.3.ER.<......ZI......*f..... .fN.......q.n.........
.........Z.0.A.m|@.v. .uI......u........Y...u.t..........db...L.......
T.=21...8.(......i.$......y4...t:....(.`sG.H..Q...&...u.<..2L..Wl..
5...9...<. I....d...P.._h..n....MA7Y.....'..FsZ?....kH.l.s.<.QD.
...$q>lK...`1....x.Ha ^....L..W.#.C....._1...."^..6..WRz...4..z`.Ch
|R..H....:1..C..o. ........8..8.$...;..,..N.....S..O......W":.).}...IR
!.F8`=..lc..9n...O~a.....k7^-~........r........YO.C..0@I.v....7Dt.....
.............2..NmX...&.h.......f) ....;?...b8.~.>L..../.....C.l.Pf
g..............0..4k>.f.k-....X.9!a>.0.i.b.....$h.;.b.....`.32.T
r...bx.".:5K00..9..h...a........l....U..M..Z3..v..:....<:E........
#./...4p.y.....b....u.f.#[*e%.%p....|RO.dP\b...~.f...C......@..s......
....X.{.m0.k..T.O.?<&.M....C...6o.9..C..Pd.,.......O..`5.L.xP,.
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Wed, 12 Oct 2016 09:35:56 GMT
ETag: W/"144-1446243360000"
Last-Modified: Fri, 30 Oct 2015 22:16:00 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 2&mediaDesc=Home videos, Funny Videos - 2&mediaId=2&mediaUrl=hXXp://VVV.govids.net/2.html&srcPageUrl=hXXp://VVV.govids.net/2.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Wed, 12 Oct 2016 09:35:57 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; Domain=.tremorhub.com; Expires=Thu, 12-Oct-2017 15:24:17 GMT; Path=/
Set-Cookie: tvrg_60409="1,1476264957"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Wed, 12-Oct-2016 09:36:57 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
transfer-encoding: chunked
Connection: keep-alive206.............R.n.0... \..-..*.....I..}......X.k..E.$e[.....}\z.,...>>
..d~..... .L..`..P2.......x=...U....%-.i.Q..K..sz...`...).L...:...u...
._.... Kr......F..ek..Y...-..I.z........}..yZ..E.t..`........I.|n.O.t:
,...".....1.q9...&.l.....3.......LI.%HG...z..S.....v.6..).....m.'..(..
pA.C...n>.n..1.....!p......K...\.h.p.<ZK<5........%\)U.=k.:..
...k..b...G....EU.....K.....(....,T]C.A. . _.^Um..Sc...qt."....'7.....
<..i...D.:...s....tg.2...|@s..C&dv.I'.....N.L{_k../a.%.Cm.........P
fa..h...d.....KxI...._..6..Vv.S........=. .....0..HTTP/1.1 200 OK..Cac
he-Control: no-cache, no-store, must-revalidate..Content-Encoding: gzi
p..Content-Type: text/xml;charset=ISO-8859-1..Date: Wed, 12 Oct 2016 0
9:35:57 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo
.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/1.1..
Set-Cookie: tvid=ccb1cc725c2d43108581cf70d4976e4e; Domain=.tremorhub.c
om; Expires=Thu, 12-Oct-2017 15:24:17 GMT; Path=/..Set-Cookie: tvrg_60
409="1,1476264957"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expi
res=Wed, 12-Oct-2016 09:36:57 GMT; Path=/..Vary: Accept-Encoding..x-tr
emorvideo-status: NO_AD..transfer-encoding: chunked..Connection: keep-
alive..206.............R.n.0... \..-..*.....I..}......X.k..E.$e[.....}
\z.,.....d~..... .L..`..P2.......x=...U....%-.i.Q..K..sz...`...).L...:
...u...._.... Kr......F..ek..Y...-..I.z........}..yZ..E.t..`........I.
|n.O.t:,...".....1.q9...&.l.....3.......LI.%HG...z..S.....v.6..).....m
.'..(..pA.C...n>.n..1.....!p......K...\.h.p.<ZK<5........
GET /page-2.html?lid=937115 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:51 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-003.ams002.internap.come5b..<img src="hXXp://109.201.148.40/report1.php?url=/govids/page-2>>
.html?lid=937115" alt="" width="0" height="0"><script type="text
/javascript" src="hXXp://govids.net/jwplayer1.js"></script>&l
t;script>var thecc ="ok";</script><script type="text/javas
cript" src="hXXp://govids.net/1.js"></script><form action=
"hXXp://VVV.govids.net/page-4.php" method="get" name="redirect"><
;input type="hidden" name="lid" value="937115"></form>..<s
cript type="text/javascript"> if (top.location!= self.location) { d
ocument.write('<head></head><body bgcolor="#ffffff" cla
ss="body" topmargin="0" leftmargin="0">');}</script>..<for
m action="hXXp://VVV.govids.net/page-2.htm" method="get" name="redirec
t1"><input type="hidden" name="lid" value="937115"></form&
gt;<script type="text/javascript"> if (top.location!= self.locat
ion) { document.forms['redirect1'].submit();}</script>..<scri
pt type='text/javascript'>..var cb = Math.round(new Date().getTime(
) / 1000);..var items = Array('mp4:lqbyul0x.mp4','mp4:hc6lawyi.mp4','m
p4:iblsdh2f.mp4','mp4:nbsyph4t.mp4','mp4:peyjpa0x.mp4','mp4:9mzecklt.m
p4','mp4:vnt9ciyd.mp4','mp4:q5fufgnb.mp4','mp4:lzcpj8vr.mp4','mp4:pfdx
i3pj.mp4','mp4:romfc7uu.mp4','mp4:qgmcib5y.mp4','mp4:ifgfn0gh.mp4');..
var item = items[Math.floor(Math.random()*items.length)];..var ffile =
"hXXp://thm.vidvib.com/abcd.mp4";..jwplayer('ova-jwplayer-container')
.setup({.. "flashplayer": "hXXp://govids.net/player1.swf",.."file"
GET /page-2.htm?lid=937115 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.govids.net/page-2.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:53 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-003.ams002.internap.come5c..<img src="hXXp://109.201.148.40/report1.php?url=/govids/page-2>>
.htm?lid=937115" alt="" width="0" height="0"><script type="text/
javascript" src="hXXp://govids.net/jwplayer1.js"></script><
;script>var thecc ="ok";</script><script type="text/javasc
ript" src="hXXp://govids.net/1.js"></script><form action="
hXXp://VVV.govids.net/page-4.php" method="get" name="redirect"><
input type="hidden" name="lid" value="937115"></form>..<sc
ript type="text/javascript"> if (top.location!= self.location) { do
cument.write('<head></head><body bgcolor="#ffffff" clas
s="body" topmargin="0" leftmargin="0">');}</script>..<scri
pt type="text/javascript"> if (top.location!= self.location) { var
rc = document.referrer.split('/')[2];if (rc == window.location.hostnam
e) {document.write('<div id="ova-jwplayer-container" style="positio
n:absolute; top:0px; left:0px;width:300px;height:250px;"></div&g
t;');}}</script>..<script type='text/javascript'>..var cb
= Math.round(new Date().getTime() / 1000);..var items = Array('mp4:lqb
yul0x.mp4','mp4:hc6lawyi.mp4','mp4:iblsdh2f.mp4','mp4:nbsyph4t.mp4','m
p4:peyjpa0x.mp4','mp4:9mzecklt.mp4','mp4:vnt9ciyd.mp4','mp4:q5fufgnb.m
p4','mp4:lzcpj8vr.mp4','mp4:pfdxi3pj.mp4','mp4:romfc7uu.mp4','mp4:qgmc
ib5y.mp4','mp4:ifgfn0gh.mp4');..var item = items[Math.floor(Math.rando
m()*items.length)];..var ffile = "hXXp://thm.vidvib.com/abcd.mp4";..jw
player('ova-jwplayer-container').setup({.. "flashplayer": "hXXp://
GET /css1.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1476264960.DFC313228BC44FF3C01A0DCC64F1B685.1.1.1.1.1.1.1.1.1; _ga=GA1.2.757982639.1476264960; _gat=1
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:54 GMT
Content-Type: text/css
Content-Length: 1963
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT
ETag: "a1af0-7ab-5077d27777580"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Accept-Ranges: bytesA..{..COLOR: #000000; ..TEXT-DECORATION: none;..}..A:link ..{..COLOR:>>
#000000;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DE
CORATION: none;..FONT-SIZE: 13px;..}..A:visited ..{..COLOR: #000000;..
FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION:
none;..FONT-SIZE: 13px;..}..A:hover ..{..COLOR: #000000;..FONT-FAMILY:
Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-
SIZE: 13px;..}..table ..{..FONT-SIZE: 10px;..FONT-FAMILY: verdana, Ari
al, Helvetica, sans-serif;..}..td {font-family:Verdana;font-size:8.5pt
}...body {..BACKGROUND-COLOR: #ffffff;..margin-left: 10%;..margin-righ
t: 10%; ..border: 0px solid #979696;..}...topmenu {..BACKGROUND-COLOR:
#eeeeee;..border-bottom: 1px solid #B5B5B5;..height: 35px;..}...topme
nufont..{..COLOR: #B5B5B5; ..TEXT-DECORATION: none;..}...topmenufont:l
ink ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans
-serif;..TEXT-DECORATION: none;..FONT-SIZE: 12px;..-webkit-font-smooth
ing: antialiased !important;..text-shadow: 1px 1px 1px rgba(0,0,0,0.00
4);..}...topmenufont:visited ..{..COLOR: #B5B5B5;..FONT-FAMILY: Verdan
a, Arial, Helvetica, sans-serif;..TEXT-DECORATION: none;..FONT-SIZE: 1
2px;..-webkit-font-smoothing: antialiased !important;..text-shadow: 1p
x 1px 1px rgba(0,0,0,0.004);..}...topmenufont:hover ..{..COLOR: #B5B5B
5;..FONT-FAMILY: Verdana, Arial, Helvetica, sans-serif;..TEXT-DECORATI
ON: none;..FONT-SIZE: 12px;..-webkit-font-smoothing: antialiased !impo
rtant;..text-shadow: 1px 1px 1px rgba(0,0,0,0.004);..}...logo {..b
GET /img/lbg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1476264960.DFC313228BC44FF3C01A0DCC64F1B685.1.1.1.1.1.1.1.1.1; _ga=GA1.2.757982639.1476264960; _gat=1
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 09:35:54 GMT
Content-Type: image/png
Content-Length: 200
Connection: keep-alive
Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT
ETag: "a1bf1-c8-4ebb56fac1880"
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-003.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Wed, 12 Oct 2016 09:35:54 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21
Nov 2013 20:06:42 GMT..ETag: "a1bf1-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: HIT..X-INAP-Server: cdce-ams002-003.ams002.interna
p.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......gAMA
....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b .....t
V.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.![...
..O...........IEND.B`...
GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 08:13:39 GMT
Expires: Wed, 12 Oct 2016 10:13:39 GMT
Last-Modified: Wed, 28 Sep 2016 20:19:01 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11590
Age: 4932
Cache-Control: public, max-age=7200...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'>>
V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W]
.b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..
~.............>..........GB..N....?...?.I2.....U...o<.....W.;...
x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/
..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<
.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo..
...]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..
~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.
E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)
....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]..........
..*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.
........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9
..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....
q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z...
...Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....
C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.
X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'
....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P
..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...z
Z...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@
........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
GET /r/collect?v=1&_v=j47&a=508514117&t=pageview&_s=1&dl=http://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=105333898&cid=1715124662.1476264957&tid=UA-74694740-5&_r=1&z=2048820847 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.trufflechores.pw/index5.php?id=01ARL47Q8x54AQuSmWmd&date=2016-10-10&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 12 Oct 2016 09:35:51 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 12 Oct 2016 09:35:51 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;....
GET /r/collect?v=1&_v=j47&a=1608029956&t=pageview&_s=1&dl=http://VVV.govids.net/page-2.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=672389418&cid=757982639.1476264960&tid=UA-74694740-2&_r=1&z=1226883924 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Wed, 12 Oct 2016 09:35:54 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Wed, 12 Oct 2016 09:35:54 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-2.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 12 Oct 2016 17:42:23 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Wed, 12 Oct 2016 17:42:23 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
The Application connects to the servers at the folowing location(s):
Map
Strings from Dumps
noo.exe_1520_rwx_00A2A000_00001000:
okEy
okEy
voracious.exe_1620:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp\ExecCmd.dll
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp\ExecCmd.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp\ExecCmd.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp\ExecCmd.dll
"%Program Files%\chapel\noo.exe"
"%Program Files%\chapel\noo.exe"
ExecCmd.dll
ExecCmd.dll
.reloc
.reloc
EnumWindows
EnumWindows
Kernel32.DLL
Kernel32.DLL
e%uy%u
e%uy%u
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp
nskC.tmp
nskC.tmp
rogram Files\chapel\noo.exe"
rogram Files\chapel\noo.exe"
q noo.exe" | %SystemRoot%\System32\find /I "noo.exe"
q noo.exe" | %SystemRoot%\System32\find /I "noo.exe"
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nskC.tmp
"%Program Files%\ozzie\voracious.exe"
"%Program Files%\ozzie\voracious.exe"
%Program Files%\ozzie
%Program Files%\ozzie
voracious.exe
voracious.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn9.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsn9.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
%Program Files%\ozzie\voracious.exe
%Program Files%\ozzie\voracious.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Nullsoft Install System v2.46
Nullsoft Install System v2.46
zie\voracious.exe"
zie\voracious.exe"
chapel\noo.exe"
chapel\noo.exe"