Dropped:Trojan.Generic.17338822 (B) (Emsisoft), Dropped:Trojan.Generic.17338822 (AdAware), Trojan.NSIS.StartPage.FD (Lavasoft MAS)Behaviour: Trojan
The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.
Summary
MD5: db5758991e0deed7870c5e00ac1784f9
SHA1: 39d92feb6c68f1883bbfa79a202380f47bef9e1d
SHA256: 373e680e3c15ded35736b334f5dbb950f8c8faece035ed7799eaef6a6d436aac
SSDeep: 24576:NJpKVXCZs0g6hl55nrkwlgd47UWO6ACa4o0UY:wVXQg6hftkDu7UWOCGY
Size: 790495 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: BoostSoftware Inc.
Created at: 2009-12-06 00:50:52
Analyzed on: WindowsXP SP3 32-bit
Summary: Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Dynamic Analysis
Payload
No specific payload has been found.
Process activity
The Dropped creates the following process(es):
taskkill.exe:908
taskkill.exe:1944
%original file name%.exe:1736
tasklist.exe:1080
tasklist.exe:312
tasklist.exe:628
tasklist.exe:252
tasklist.exe:1896
tasklist.exe:172
tasklist.exe:492
tasklist.exe:1616
tasklist.exe:232
tasklist.exe:1652
tasklist.exe:1676
tasklist.exe:1564
tasklist.exe:1212
tasklist.exe:468
tasklist.exe:140
tasklist.exe:560
tasklist.exe:264
tasklist.exe:160
tasklist.exe:236
tasklist.exe:1976
tasklist.exe:644
tasklist.exe:1764
klar.exe:1904
30973.exe:1276
79142644.exe:1320
find.exe:216
find.exe:1320
find.exe:1208
find.exe:748
find.exe:272
find.exe:236
find.exe:1712
find.exe:1884
find.exe:1612
find.exe:324
find.exe:1676
find.exe:1752
find.exe:1132
find.exe:1336
find.exe:264
find.exe:224
find.exe:1760
find.exe:2044
find.exe:1992
find.exe:1556
find.exe:644
find.exe:2008
find.exe:1764
The Dropped injects its code into the following process(es):
assigned.exe:212
Mutexes
The following mutexes were created/opened:No objects were found.
File activity
The process %original file name%.exe:1736 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\slippery.lnk (487 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\AccessControl.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\30973.exe (1082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\ShellLink.dll (4 bytes)
%WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%WinDir%\assigned.exe (4387 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\79142644.exe (3083 bytes)
%Program Files%\ministry\assigned.exe (4387 bytes)
%WinDir%\settings.dll (10219 bytes)
%Program Files%\ministry\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Program Files%\crystallization\klar.exe (1036 bytes)
%Program Files%\ministry\settings.dll (10219 bytes)
%System%\drivers\etc\hosts (123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\System.dll (11 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\ShellLink.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (0 bytes)
The process klar.exe:1904 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsy7.tmp\ExecCmd.dll (4 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsy7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb6.tmp (0 bytes)
The process 30973.exe:1276 makes changes in the file system.
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp (0 bytes)
The process 79142644.exe:1320 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SimpleFC.dll (5289 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SimpleFC.dll (0 bytes)
The process assigned.exe:212 makes changes in the file system.
The Dropped creates and/or writes to the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\logo[1].png (3 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[2].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CATH9SJY.xml (825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[1].xml (694 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CALG9QV7.xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[4].xml (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAO9X9NF.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CAKLQRSP.xml (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAKKO4BV.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[1].xml (692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[3].xml (575 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[3].xml (648 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[5].xml (691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA57VGKC.xml (810 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\lbg[1].png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[2].js (1353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA8NEFUR.xml (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA5OP85J.xml (725 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[2].xml (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\page-1[1].htm (5002 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2J452J.xml (722 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[7].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CA6DE709.xml (765 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[2].xml (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA1JGXHY.xml (808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\analytics[1].js (2168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[5].xml (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAQRWXYZ.xml (811 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CAOTG8KB.xml (774 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (728 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAKPQNCT.xml (710 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[2].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\jwplayer1[1].js (69987 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[4].xml (628 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[2].xml (704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2BUBE5.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[2].xml (633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA490JGR.xml (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[1].xml (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[3].xml (144 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[5].xml (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[5].xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\ova-jw[1].swf (36761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[3].xml (599 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[2].txt (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAC9MZ0D.xml (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\v[1].xml (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\collect[1].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\player1[1].swf (12413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\player1[1].swf (15193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[6].xml (645 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA56KLV5.xml (807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[2].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[1].css (659 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\page-1[1].htm (3950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\logo[1].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[6].xml (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[6].xml (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[3].xml (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[1].xml (616 bytes)
The Dropped deletes the following file(s):
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\collect[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\player1[1].swf (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\bck[1].htm (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[1].css (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\page-1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (0 bytes)
Registry activity
The process taskkill.exe:908 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 B3 AB 6A B1 EE 9A 9B AC D5 DB C2 FE 1E 91 5B"
The process taskkill.exe:1944 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C CC 86 67 91 46 CF B2 8C F6 D6 0E 03 BC C2 FB"
The process %original file name%.exe:1736 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"
"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 4D 08 AF CB 11 53 3E 3E B9 7F 2C 6E 0D E8 61"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"insupportable" = "%Program Files%\ministry\assigned.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hajji" = "%Program Files%\ministry\assigned.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"forestland" = "%Program Files%\ministry\assigned.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eales" = "%Program Files%\ministry\assigned.exe"
The process tasklist.exe:1080 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 29 95 7B B4 BB 4E 80 1C 71 7F C3 9A 27 64 AB"
The process tasklist.exe:312 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 41 83 F4 4B 65 16 6B 31 C3 E4 6F 29 EF CD D5"
The process tasklist.exe:628 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 6B A9 48 DF 20 33 C0 82 38 C2 EE 6A 9B F4 CB"
The process tasklist.exe:252 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 76 56 B2 0B FA E5 01 00 56 B8 8A 52 3C F3 03"
The process tasklist.exe:1896 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 FD 18 00 87 A8 D5 63 AE EE 65 CB 7E 3D 00 74"
The process tasklist.exe:172 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 46 4E 3F EC D9 F3 EC 7B F5 5C 88 93 1B 23 EC"
The process tasklist.exe:492 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 19 93 AD 6D 93 88 B2 B1 DD 8D 54 45 87 57 9E"
The process tasklist.exe:1616 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 51 A9 11 B7 83 9D 00 9B 25 9E DF 4C 5C AB 2C"
The process tasklist.exe:232 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 2B 9C E3 7F 4F C9 0D B0 43 E8 AF AB C6 83 1E"
The process tasklist.exe:1652 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 4C 03 15 EE E8 19 CC 31 BE 2B D7 74 8A E0 C3"
The process tasklist.exe:1676 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 17 84 68 8A 4F EB 65 45 9A F1 04 1D B9 70 7C"
The process tasklist.exe:1564 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 56 C5 B3 A1 11 41 7C FF 2C C0 1B 4C 8F BA 3C"
The process tasklist.exe:1212 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 43 0C 93 EF F9 2F 3A 91 8B 98 CD 3D 8A 19 EF"
The process tasklist.exe:468 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 B4 E8 A3 A2 45 97 52 C3 94 F9 40 55 30 A0 20"
The process tasklist.exe:140 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 27 8F C5 2E 1D A5 64 97 91 AC B2 43 50 93 E0"
The process tasklist.exe:560 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E A1 FA 69 B0 C6 E2 89 99 5A C4 31 EA 85 90 D6"
The process tasklist.exe:264 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 2E 97 98 E9 AD 7A 60 88 F1 84 9E 47 0D CC CA"
The process tasklist.exe:160 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 DD 68 AE D7 0B 94 8D 41 D1 5D 16 18 4C 09 4D"
The process tasklist.exe:236 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 CA 9F 97 A6 B3 7E 6C E7 4C 7A C0 C3 34 5A B8"
The process tasklist.exe:1976 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E DF 47 0D CB BC D1 C5 0D 11 FE 29 93 FF 5F 1E"
The process tasklist.exe:644 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 A8 2B 1A 4C 3A 55 D5 7B 45 80 0B C1 1A 64 8C"
The process tasklist.exe:1764 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 48 E8 2C 5D 77 A7 C6 0A 93 33 21 75 AC 10 84"
The process klar.exe:1904 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 49 1F ED 5D FC E2 F7 9D 07 7B 1F 15 03 53 27"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"tassel" = "%Program Files%\ministry\assigned.exe"
"klar" = "%Program Files%\crystallization\klar.exe"
The process 30973.exe:1276 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 B4 1A 6A E8 75 DA 0A 94 3C 14 2D E0 AA D1 97"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process 79142644.exe:1320 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 01 1D 0E 79 D4 5B CB D5 51 84 38 3B 1C EC FF"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
The process assigned.exe:212 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016091320160914\"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CacheLimit" = "8192"
[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CacheOptions" = "11"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"
[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 5D 64 D1 08 7F 56 19 26 12 C7 89 F0 1A 41 FE"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CacheRepair" = "0"
"CachePrefix" = ":2016091320160914:"
The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"
The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:
"ProxyBypass" = "1"
Proxy settings are disabled:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"
The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"
The Dropped deletes the following registry key(s):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]
The Dropped deletes the following value(s) in system registry:
[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"
The process find.exe:216 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB D6 26 0A 10 08 89 B1 92 E7 FE 8D A4 8C A2 DE"
The process find.exe:1320 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 AD 7C 14 C1 2C 60 02 25 AF 15 F3 E8 08 48 4C"
The process find.exe:1208 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 3D 39 B4 83 D0 B2 5E 2D BB 79 06 DD F7 0D 57"
The process find.exe:748 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 F3 8F F2 CA 46 33 28 28 DB D8 60 E7 00 64 BF"
The process find.exe:272 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C 19 A8 2D 3B 43 03 7A AF FB FE 03 9E F0 2F 62"
The process find.exe:236 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D A3 5A 24 F3 15 9A F1 98 C3 EA BE 1E 55 8A 88"
The process find.exe:1712 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 3B 49 D2 57 CD E3 1B 95 F2 63 7F AB 8D 5E 63"
The process find.exe:1884 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E B8 13 A0 1A F5 CE 09 63 38 30 7D A9 9E B2 C3"
The process find.exe:1612 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 85 22 C4 47 A1 79 A7 B6 71 01 4D 8D 9D 7F 0C"
The process find.exe:324 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF E3 28 00 14 82 C9 E9 47 02 1F E7 E4 32 D4 30"
The process find.exe:1676 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 F9 43 9C 57 D4 32 96 83 93 02 49 CA A7 F8 B0"
The process find.exe:1752 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 C5 DE 81 17 5B 2A 40 5E CE CA 07 CC 79 45 AD"
The process find.exe:1132 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 C5 63 B9 DB 94 BF 8B 42 F0 76 0A 44 E4 4E 3F"
The process find.exe:1336 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 29 3F B8 04 C7 6A E9 27 AC 19 8E F9 C3 30 B5"
The process find.exe:264 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 D0 A8 5F 54 10 B4 17 5E 1E 1E E9 B4 8B 97 C3"
The process find.exe:224 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 45 A6 58 85 63 32 9E 54 CB 5A D7 AF 5D 43 EA"
The process find.exe:1760 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 98 CB 7D D1 25 E8 C3 28 D4 07 6A 7E 18 0E C0"
The process find.exe:2044 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 D5 05 C5 81 1C 06 61 B2 E8 9F 1A 58 9F 57 DD"
The process find.exe:1992 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 69 E9 5E AB E6 C5 0F 67 9D 88 C9 45 E6 67 DC"
The process find.exe:1556 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 5C D0 B6 AB DD FA 9B 48 1D B7 FB 80 99 38 59"
The process find.exe:644 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D BE D2 18 96 67 F2 59 78 45 B9 30 6A 65 E6 06"
The process find.exe:2008 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 A8 72 95 16 14 90 0B C7 5E 18 84 3E 88 45 4F"
The process find.exe:1764 makes changes in the system registry.
The Dropped creates and/or sets the following values in system registry:
[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 6F 8E 88 D1 65 7C F5 E9 84 35 AA 6F D0 DE 88"
Dropped PE files
MD5 | File path |
---|---|
6351426f5922b23dd580621eee7b681c | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\30973.exe |
e7d305ae3129ea163f28aa141c51060a | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Application Data\79142644.exe |
b9380b0bea8854fd9f93cc1fda0dfeac | c:\Documents and Settings\"%CurrentUserName%"\Local Settings\Temp\nsy7.tmp\ExecCmd.dll |
662aac406d172571392b861fbec0edd9 | c:\Program Files\crystallization\klar.exe |
c8ff52bfddc6898c202c08c4a61a3d22 | c:\Program Files\ministry\Microsoft.Win32.TaskScheduler.dll |
de8ce032e276eee18ad1bc3196f2d23d | c:\Program Files\ministry\assigned.exe |
501a783962b9a7d5e92b59943d773b9a | c:\Program Files\ministry\settings.dll |
c8ff52bfddc6898c202c08c4a61a3d22 | c:\WINDOWS\Microsoft.Win32.TaskScheduler.dll |
de8ce032e276eee18ad1bc3196f2d23d | c:\WINDOWS\chump.exe |
501a783962b9a7d5e92b59943d773b9a | c:\WINDOWS\settings.dll |
HOSTS file anomalies
The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 857 bytes in size. The following strings are added to the hosts file listed below:
162.222.194.13 | cocomo.tremorhub.com |
162.222.194.13 | www.virustotal.com |
162.222.194.13 | virustotal.com |
Rootkit activity
No anomalies have been detected.
Propagation
Removals
Remove it with Ad-Aware
- Click (here) to download and install Ad-Aware Free Antivirus.
- Update the definition files.
- Run a full scan of your computer.
Manual removal*
- Terminate malicious process(es) (How to End a Process With the Task Manager):
taskkill.exe:908
taskkill.exe:1944
%original file name%.exe:1736
tasklist.exe:1080
tasklist.exe:312
tasklist.exe:628
tasklist.exe:252
tasklist.exe:1896
tasklist.exe:172
tasklist.exe:492
tasklist.exe:1616
tasklist.exe:232
tasklist.exe:1652
tasklist.exe:1676
tasklist.exe:1564
tasklist.exe:1212
tasklist.exe:468
tasklist.exe:140
tasklist.exe:560
tasklist.exe:264
tasklist.exe:160
tasklist.exe:236
tasklist.exe:1976
tasklist.exe:644
tasklist.exe:1764
klar.exe:1904
30973.exe:1276
79142644.exe:1320
find.exe:216
find.exe:1320
find.exe:1208
find.exe:748
find.exe:272
find.exe:236
find.exe:1712
find.exe:1884
find.exe:1612
find.exe:324
find.exe:1676
find.exe:1752
find.exe:1132
find.exe:1336
find.exe:264
find.exe:224
find.exe:1760
find.exe:2044
find.exe:1992
find.exe:1556
find.exe:644
find.exe:2008
find.exe:1764 - Delete the original Dropped file.
- Delete or disinfect the following files created/modified by the Dropped:
%Documents and Settings%\%current user%\Start Menu\Programs\Startup\slippery.lnk (487 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\AccessControl.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\30973.exe (1082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\ShellLink.dll (4 bytes)
%WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%WinDir%\assigned.exe (4387 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\79142644.exe (3083 bytes)
%Program Files%\ministry\assigned.exe (4387 bytes)
%WinDir%\settings.dll (10219 bytes)
%Program Files%\ministry\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Program Files%\crystallization\klar.exe (1036 bytes)
%Program Files%\ministry\settings.dll (10219 bytes)
%System%\drivers\etc\hosts (123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\System.dll (11 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy7.tmp\ExecCmd.dll (4 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SimpleFC.dll (5289 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\logo[1].png (3 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[2].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CATH9SJY.xml (825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[1].xml (694 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CALG9QV7.xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[4].xml (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAO9X9NF.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CAKLQRSP.xml (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAKKO4BV.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[1].xml (692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[3].xml (575 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[3].xml (648 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[5].xml (691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA57VGKC.xml (810 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\lbg[1].png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[2].js (1353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA8NEFUR.xml (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA5OP85J.xml (725 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[2].xml (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\page-1[1].htm (5002 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2J452J.xml (722 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[7].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CA6DE709.xml (765 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[2].xml (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA1JGXHY.xml (808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\analytics[1].js (2168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[5].xml (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAQRWXYZ.xml (811 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CAOTG8KB.xml (774 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (728 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAKPQNCT.xml (710 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[2].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\jwplayer1[1].js (69987 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[4].xml (628 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[2].xml (704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2BUBE5.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[2].xml (633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA490JGR.xml (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[1].xml (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[3].xml (144 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[5].xml (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[5].xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\ova-jw[1].swf (36761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[3].xml (599 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[2].txt (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAC9MZ0D.xml (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\v[1].xml (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\collect[1].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\player1[1].swf (12413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\player1[1].swf (15193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[6].xml (645 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA56KLV5.xml (807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[2].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[1].css (659 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\page-1[1].htm (3950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\logo[1].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[6].xml (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[6].xml (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[3].xml (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[1].xml (616 bytes) - Delete the following value(s) in the autorun key (How to Work with System Registry):
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"insupportable" = "%Program Files%\ministry\assigned.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hajji" = "%Program Files%\ministry\assigned.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"forestland" = "%Program Files%\ministry\assigned.exe"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eales" = "%Program Files%\ministry\assigned.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"tassel" = "%Program Files%\ministry\assigned.exe"
[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"klar" = "%Program Files%\crystallization\klar.exe" - Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
- Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
- Reboot the computer.
Static Analysis
VersionInfo
No information is available.
No information is available.
PE Sections
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Section MD5 |
---|---|---|---|---|---|
.text | 4096 | 23628 | 24064 | 4.46394 | 856b32eb77dfd6fb67f21d6543272da5 |
.rdata | 28672 | 4764 | 5120 | 3.4982 | dc77f8a1e6985a4361c55642680ddb4f |
.data | 36864 | 154712 | 1024 | 3.3278 | 7922d4ce117d7d5b3ac2cffe4b0b5e4f |
.ndata | 192512 | 86016 | 0 | 0 | d41d8cd98f00b204e9800998ecf8427e |
.rsrc | 278528 | 2536 | 2560 | 3.13622 | b9f20defc9dd650d8dcc7fc5d4708ad4 |
Dropped from:
Downloaded by:
Similar by SSDeep:
Similar by Lavasoft Polymorphic Checker:
Total found: 108
7bcde813c50a0b0e20e5f9f233bc3040
ca004345bdd1cb292744ed711de04d19
2a9af6bcab5eb49d9a62a6ea72cdd286
e4e8ea421895b321bea9afa16d8a6fb5
851b5de8d1e586ba0301b1027800dea8
54c304cd37a8ae6ce5c21d5a5240d80c
f4ae937348a591e02f7ccb79f47cdc1f
c27730e88a7e5003ff846e8f0e578968
023529d5b4f5db6fc3e123bf47ac15d6
8e38be8c510a94c0a96ee39bc32ed333
14055969428fc76bc66b28491ff90d63
2b8b2136bdf153f722ecd721fabcf1aa
9dec231998f0f3d8301aa5c1a6e0119f
0affe53e87c71d2b7f9066427a5d71e5
3f92282b316430f68d847ff93565f264
1f4ab1b0f88d2b1805bcfbdaa2c461f1
3fadc54dc0f9a4e6af4b370749973ec3
2d43a582840285217ab6adaf45ff8c22
4ad98fe1fd6a020f491e31eb4aa16205
562254cc7ac0f92876c4964400fb6cd7
a261aa83665bed04243da16ecade0df0
bea91233ff3a67b260b02a18d7cb54c2
b1a5b5b97ab40559c62f27923a7322c1
830674c88d54f6aa3c6f1bcf72147f75
fb9b2e8e0616dc9aecab4078c571a0f8
f3636d03e448990429c0cd25a2f93345
Network Activity
URLs
URL | IP |
---|---|
hxxp://d3cpqb3ouewn5u.cloudfront.net/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t= | |
hxxp://d3cpqb3ouewn5u.cloudfront.net/func.js?r=5 | |
hxxp://www-google-analytics.l.google.com/analytics.js | |
hxxp://cocomo.tremorhub.com/itd.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&rand= | |
hxxp://www.clangburkitt.info/count.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&rand= | 162.222.194.132 |
hxxp://whos.amung.us/cwidget/iebrowser1/000000ffffff.png | 67.202.94.86 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j46&a=356611280&t=pageview&_s=1&dl=http://www.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=555460349&cid=1377690454.1473782234&tid=UA-74694740-5&_r=1&z=1612721500 | |
hxxp://c.statcounter.com/10114910/0/757d7213/1/ | 67.215.253.140 |
hxxp://8c715ae47b.site.internapcdn.net/page-1.html?lid=937115 | |
hxxp://widgets.amung.us/draw/?w=colored&n=998&c=000000ffffff&p= | 173.192.200.70 |
hxxp://109.201.148.40/report1.php?url=/govids/page-1.html?lid=937115 | |
hxxp://govids.net/jwplayer1.js | 162.222.194.11 |
hxxp://109.201.148.40/bck.php?1473782235000 | |
hxxp://govids.net/1.js | 162.222.194.11 |
hxxp://8c715ae47b.site.internapcdn.net/page-1.htm?lid=937115 | |
hxxp://109.201.148.40/report1.php?url=/govids/page-1.htm?lid=937115 | |
hxxp://g1.panthercdn.com/counter/counter.js | |
hxxp://govids.net/player1.swf | 162.222.194.11 |
hxxp://www-google-analytics.l.google.com/r/collect?v=1&_v=j46&a=607540295&t=pageview&_s=1&dl=http://www.govids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1916155861&cid=44415039.1473782236&tid=UA-74694740-2&_r=1&z=256026923 | |
hxxp://8c715ae47b.site.internapcdn.net/css1.css | |
hxxp://8c715ae47b.site.internapcdn.net/img/logo.png | |
hxxp://8c715ae47b.site.internapcdn.net/img/lbg.png | |
hxxp://c.statcounter.com/t.php?sc_project=10675947&java=1&security=299981d6&u1=F76D7BABCB714F614E7A5CF7E571261E&sc_random=0.475769053747595&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://www.govids.net/page-1.html?lid=937115&u=http://www.govids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 | 67.215.253.140 |
hxxp://cs28.wpc.thetacdn.net/5/10/logo.png | |
hxxp://govids.net/ova-jw.swf | 162.222.194.11 |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://wildcard-ads-1386167347.us-east-1.elb.amazonaws.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 1&mediaDesc=Home videos, Funny Videos - 1&mediaId=2&mediaUrl=hxxp://www.govids.net/1.html&srcPageUrl=hxxp://www.govids.net/1.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/crossdomain.xml | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=rocketfuel,adapTV,centro,mediamath,TubeMogul-GP,_dmp_turbine,Videology,thetradedesk,appnexus,TapAd,videoamp,beeswax,eyeview,dataxu,google,ignitionone,tremornet,SundaySky,conversant,1,audiencescience,BidTheatre,dynadmic&uid=66c0e761009a4593b3aea4e8af5db5bf&init=true | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners-1732315393.us-east-1.elb.amazonaws.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.google-analytics.com/analytics.js | 216.58.214.238 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/crossdomain.xml | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.govids.net/page-1.htm?lid=937115 | 69.88.149.142 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.govids.net/img/logo.png | 69.88.149.142 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.govids.net/page-1.html?lid=937115 | 69.88.149.142 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j46&a=607540295&t=pageview&_s=1&dl=http://www.govids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1916155861&cid=44415039.1473782236&tid=UA-74694740-2&_r=1&z=256026923 | 216.58.214.238 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.google-analytics.com/r/collect?v=1&_v=j46&a=356611280&t=pageview&_s=1&dl=http://www.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=555460349&cid=1377690454.1473782234&tid=UA-74694740-5&_r=1&z=1612721500 | 216.58.214.238 |
hxxp://xlf5t.ads.tremorhub.com/ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 1&mediaDesc=Home videos, Funny Videos - 1&mediaId=2&mediaUrl=hxxp://www.govids.net/1.html&srcPageUrl=hxxp://www.govids.net/1.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash | 52.72.222.207 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t= | 54.230.45.35 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.govids.net/css1.css | 69.88.149.142 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.govids.net/img/lbg.png | 69.88.149.142 |
hxxp://xlf5t.ads.tremorhub.com/crossdomain.xml | 52.72.222.207 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.bruindorsett.pw/func.js?r=5 | 54.230.45.35 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://www.statcounter.com/counter/counter.js | 151.249.89.198 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://l.longtailvideo.com/5/10/logo.png | 93.184.221.48 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf | 54.210.87.134 |
hxxp://partners.tremorhub.com/syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=rocketfuel,adapTV,centro,mediamath,TubeMogul-GP,_dmp_turbine,Videology,thetradedesk,appnexus,TapAd,videoamp,beeswax,eyeview,dataxu,google,ignitionone,tremornet,SundaySky,conversant,1,audiencescience,BidTheatre,dynadmic&uid=66c0e761009a4593b3aea4e8af5db5bf&init=true | 54.210.87.134 |
IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)
Traffic
GET /5/10/logo.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: l.longtailvideo.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=604800
Content-Type: image/png
Date: Tue, 13 Sep 2016 15:57:13 GMT
Etag: "3015243340"
Expires: Tue, 20 Sep 2016 15:57:13 GMT
Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT
Server: ECAcc (arn/46B0)
X-Cache: HIT
Content-Length: 1845
.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP....0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......cv..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. ...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !.....Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9kL....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{......>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'....x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`...8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.bi..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se
<<< skipped >>>
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.44415039.1473782236; _gat=1
HTTP/1.1 200 OK
Date: Wed, 14 Sep 2016 00:02:57 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Wed, 16 Aug 2017 00:02:57 GMT
Connection: close
Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
<<< skipped >>>
GET /jwplayer1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 14 Sep 2016 00:02:54 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT
ETag: "4403af-25d37-53444eccf91c0"
Accept-Ranges: bytes
Content-Length: 154935
Cache-Control: max-age=2592000, public
Expires: Wed, 16 Aug 2017 00:02:54 GMT
Connection: close
Content-Type: text/javascriptvar dtn = Date.parse(new Date().toString());..document.write(unescape(>>
'
GET /draw/?w=colored&n=998&c=000000ffffff&p= HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Cookie: uid=CgH9JlfYIdUdNA7VDEHXAg==
Connection: Keep-Alive
Host: widgets.amung.us
HTTP/1.1 200 OK
Server: nginx/1.9.6
Date: Tue, 13 Sep 2016 15:57:09 GMT
Content-Type: image/png
Transfer-Encoding: chunked
Connection: keep-alive
Content-Disposition: filename=wau-widget.png
Expires: Thu, 13 Oct 2016 15:57:09 GMT
Cache-Control: max-age=2592000593...PNG........IHDR...Q...........p....^PLTE...EEE???AAA......""";&l>>
t;=CCC......***abdWXZ..................GGG......'((..................u
vyEFGLLL......zzz,,,...kln...NNN>>>...............~~.vwx...hh
i.........OPQ.........ooo...............uvv...opp......UVV...RRR......
.........bcc...ijj}~~......dee..................]^^PPP.........TTTaaa.
.....{{{......HHHrss.........kllJJJ|||......YYY......OOO......DDD.....
.NOO.........@@@tttkkkvvv:::qqq...............FFF.....................
......?@@888666ppprrrSSS............BBB............MMM............000.
..lll......XYZ(((&&&hhhfff cdeZ[\788...dddccc.........nnn.........ZZ
ZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjj.t......tRNS.@..f....IDATH....?SQ..o
O=.a...2.....B. =()]b.......<...#..)K...B.s....s...n>.........|.
..s..g..EQ._...IO...d....Y.E.jw..~..8N..c.E..rtbd..h..X..e..yp``.<.
._..)..............z.X....h4.;?.:?...l......[...o^.jm1......Mz}c...s}#
.44......=..O.V[.....|.w......1.....}..w.`... ...-..."x.a.o.0.........
\.M.T...r.....F.2....jb....4..i.....I./.4.J4=...}....".R.[..\.]@.,....
.%a...A.tb.G3..T.(B.I...".bE'*UH..f....8~,...s..{.r.x\.e.....C%.......
...>..z....@.^.R.G....V....'..Z........|...oQE.h.......qQA.....r2..
...M|....@.*".u..n@ . *..L..P..zUD2....7..9...d......p._..C`Uk.$...Q\.
..8.....S.pY.j]...W......s.k.p.H.@..n....jkr..ju......$.%........E6)..
...&..,^.._...$...(..X.|H.7...}.....I..$....vz.$E.W.R...F.-....^.....R
/....`_Oz..g.......E. ..A.d...A&.......0a.s.....IEND.B`...0..
GET /count.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&rand= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.clangburkitt.info
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:09 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 47
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html......<meta http-equiv="refresh" content="300">HTTP/1.1 200 OK..
Date: Tue, 13 Sep 2016 15:57:09 GMT..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 47..Keep-Alive: tim
eout=5, max=100..Connection: Keep-Alive..Content-Type: text/html......
..<meta http-equiv="refresh" content="300">..
GET /index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t= HTTP/1.1
Accept: */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.bruindorsett.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 906
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Encoding: gzip
Date: Tue, 13 Sep 2016 15:57:08 GMT
Vary: Accept-Encoding
X-Cache: Miss from cloudfront
Via: 1.1 f507e21f7d1fb46eecab2dff9302173f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: EMQiproLLRs56VJhipCOXQEqUYNBrxJxI9YQoMEH8juVSRqlf3IYdA==...........UMs.6..g&....I..?.%...q.O..4=..z...".$..`......^..l9=u.....
.}.....6.b^...........2.a19..2. .v..;.f.v.....jZ.bU.%.......d...f.V...
..}[C..T;......D.5,x...q9...V*....l...d4..U..Sr......{.;-I.k.3.x.n....
Fg..d.....(..,W..&.#!..g....U{.r..\.L.|,n.......>...^...~..O..Ir..
2.$.!..\...^.X1.RR.( .... .s.C.&....,.......wr.... ......K..x]..m2...d
.a....3..FE..Q..V.......|...as.-...k..d.aT}.......Nf(..EhB....y...b.}V
...B.z."3...!C....X.;...._...C<g......qy.Dmg*..Hg..M.......H..'...f
..(.`7.5....B.......j>lnx.....er7..7.....\e.Y.....*..K.4~.Bi..0..).
{!s......Bo...zcC........y...{..^0s%&...7f..........N....3...pv<i@.
........0....g..nZ`..)..k>Z..N.k 2...O......d?q.`.%....Q.[..h..&x..
..\...w.JH.......x..2.L.Y%X&b. .z[.4..L.....<......... ...?P[e.A0{z
z...51..-..0b%j...J.9H...)..t;..$};<.k.N...Q....9F.9....@y....i..I&
lt;=..... Ncj.m..%.].........|u....d..gN...{.!q...Ug. ..............w.
...x..k..?..!n^.:.......
GET /func.js?r=5 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.bruindorsett.pw
Connection: Keep-Alive
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 597
Connection: keep-alive
Server: Apache/2.2.22 (Win64) PHP/5.3.13
Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT
ETag: "90000001e1520-f7a-537ea953f7333"
Accept-Ranges: bytes
Content-Encoding: gzip
Date: Fri, 19 Aug 2016 01:35:05 GMT
Vary: Accept-Encoding
Age: 447
X-Cache: Hit from cloudfront
Via: 1.1 f507e21f7d1fb46eecab2dff9302173f.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BA8Y8YX6o_8A3QZ85T_rMXn710eO3SJF6jJXmZcm9KQzhmSHT4RxFA==............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l&l>>
t;3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.]...
..Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9...
...P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o..
.T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z..
...=.9%}.t......T........'..t...g.....L.. *.V2..p...rv.....F..x?W..*..
..........3_.q.q....S.~....7_e.G..P..7w..h..R ..$.w....H.41.W.n...D...
.wZ..x.ZG....6..:a.5!....t:O..:.5MvM...(...f.@..S.\.......SuY....:....
.....>...P..{|:.<.<...I...=........}..=...|.8.......{1z...HTT
P/1.1 200 OK..Content-Type: application/javascript..Content-Length: 59
7..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..L
ast-Modified: Mon, 18 Jul 2016 15:25:49 GMT..ETag: "90000001e1520-f7a-
537ea953f7333"..Accept-Ranges: bytes..Content-Encoding: gzip..Date: Fr
i, 19 Aug 2016 01:35:05 GMT..Vary: Accept-Encoding..Age: 447..X-Cache:
Hit from cloudfront..Via: 1.1 f507e21f7d1fb46eecab2dff9302173f.cloudf
ront.net (CloudFront)..X-Amz-Cf-Id: BA8Y8YX6o_8A3QZ85T_rMXn710eO3SJF6j
JXmZcm9KQzhmSHT4RxFA==..............MO.@...H..k/vJ.8....U U.R.q.z..N..
.....DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$...
.....AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.Br
B.<......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v
&]..~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>.
..V:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L..
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Tue, 13 Sep 2016 15:57:15 GMT
ETag: W/"144-1446501138000"
Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=rocketfuel,adapTV,centro,mediamath,TubeMogul-GP,_dmp_turbine,Videology,thetradedesk,appnexus,TapAd,videoamp,beeswax,eyeview,dataxu,google,ignitionone,tremornet,SundaySky,conversant,1,audiencescience,BidTheatre,dynadmic&uid=66c0e761009a4593b3aea4e8af5db5bf&init=true HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:16 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 502
Connection: keep-alive...........RMo.@...W.H.-.bc'.`Q'.".mT.{."k`....]......u.......Y.|.....>>
v7..6\...G.7@QI.E.x.... o...WY^.i..F...m.m.Us...[.7]9.d.........3....:
...8c.4..A)...{c.M.c. ..b...X4c.4........& ..S9...jh.W.^TB.[h.....J..B
VN...f.0........P%....?\. ).>.... ..l.....ry#.%.R8fH.0P.........6..
..g(w...........\.q....PJ..3.v....TG..Aa.$.w.A.o]*..`-....8.`7.?rVl...
rJD...B{.......1.k....t...;..tZ.8..Ap...z\..a.WPG.....9..?.p....nc.k..
..]p..C...,......X....U...5?.....=.3L.{R..,4T[...=..........o)....C;.K
.......I3B.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type:
text/xml..Date: Tue, 13 Sep 2016 15:57:16 GMT..P3P: CP='This is not a
P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apa
che-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 502..Connection
: keep-alive.............RMo.@...W.H.-.bc'.`Q'.".mT.{."k`....]......u.
......Y.|.....v7..6\...G.7@QI.E.x.... o...WY^.i..F...m.m.Us...[.7]9.d.
........3....:...8c.4..A)...{c.M.c. ..b...X4c.4........& ..S9...jh.W.^
TB.[h.....J..BVN...f.0........P%....?\. ).>.... ..l.....ry#.%.R8fH.
0P.........6....g(w...........\.q....PJ..3.v....TG..Aa.$.w.A.o]*..`-..
..8.`7.?rVl...rJD...B{.......1.k....t...;..tZ.8..Ap...z\..a.WPG.....9.
.?.p....nc.k....]p..C...,......X....U...5?.....=.3L.{R..,4T[...=......
....o)....C;.K.......I3B.........
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:16 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1fc.............R.n.0... \..-Z.%.!.P.....A... 0F.X&,..I9..w..v.K....gy>>
.8.b..... .L.....J...U.=...f."}./..8.].a.(..%..9=..g.Qf..>SM`...nn.
..&..o...K..........V.Y.MZ.r.y...'..i.................4.'...W.N2../...
..!..f./..p.W.(...c."...u......>\..m._T...........V......],.pp.o..u
.../.GU.....t.8r.[2............a........0..(.y 9t../.;....`.\@.nC.....
...Q".W....$...8.3N..7z.ZS....t.NY.W.(..a<...#@.....^N...K.....g.2.
|.k....-kd.`[.....c....j\Ij.....l..fx|c'd............m..A....B...a.?..
@.....}......._/.98..DpZPZ....O...d........a..*.....0..HTTP/1.1 200 OK
..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 20
16 15:57:16 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorv
ideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-E
ncoding..transfer-encoding: chunked..Connection: keep-alive..1fc......
.......R.n.0... \..-Z.%.!.P.....A... 0F.X&,..I9..w..v.K....gy.8.b.....
.L.....J...U.=...f."}./..8.].a.(..%..9=..g.Qf..>SM`...nn...&..o...
K..........V.Y.MZ.r.y...'..i.................4.'...W.N2../.....!..f./.
.p.W.(...c."...u......>\..m._T...........V......],.pp.o..u.../.GU..
...t.8r.[2............a........0..(.y 9t../.;....`.\@.nC........Q".W..
..$...8.3N..7z.ZS....t.NY.W.(..a<...#@.....^N...K.....g.2.|.k....-k
d.`[.....c....j\Ij.....l..fx|c'd............m..A....B...a.?..@.....}..
....._/.98..DpZPZ....O...d........a..*.....0......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:17 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 489
Connection: keep-alive...........R.n.@... \.....?.....I..i.D.{.........vW....d'........!....>>
....X.d......,..r.{O.....'..e........J;s.W9.g....e....J..j..f...m.}..J
o.$JY/.~...M.e.u(..{......';....yz.K.....4O.Or...4../.F.R.....1..(....
.M..\..`8\.(.l=..q^..Mm.].......H.hG%...>`..%....5...DGx.....4-_.3.
...R...9..-..x.m.k.._.e..)Q:..d.d.d...k$0.K......"....B..().. ....!@h.
9..Q\1.W.6..xQ...I...$..k.......F8.....b...D.......?.....De5`.).;.....
.e~.x.....m..O........&.=-.T..(.t..{..R....?...........c.K......C4.g..
..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Dat
e: Tue, 13 Sep 2016 15:57:17 GMT..P3P: CP='This is not a P3P policy. S
ee hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.
1..Vary: Accept-Encoding..Content-Length: 489..Connection: keep-alive.
............R.n.@... \.....?.....I..i.D.{.........vW....d'........!...
.....X.d......,..r.{O.....'..e........J;s.W9.g....e....J..j..f...m.}..
Jo.$JY/.~...M.e.u(..{......';....yz.K.....4O.Or...4../.F.R.....1..(...
..M..\..`8\.(.l=..q^..Mm.].......H.hG%...>`..%....5...DGx.....4-_.3
....R...9..-..x.m.k.._.e..)Q:..d.d.d...k$0.K......"....B..().. ....!@h
.9..Q\1.W.6..xQ...I...$..k.......F8.....b...D.......?.....De5`.).;....
..e~.x.....m..O........&.=-.T..(.t..{..R....?...........c.K......C4.g.
.......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:17 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 520
Connection: keep-alive...........R...0.}.W.H..$!..%AY`%.m.....Z.I<...X............5g....3>>
.....sB.y%B...V.E^1.v..N.>M.Y.!..IzK..i.P.....1r.8FaY.}....t..V.L..
S....u./.(.Y'..)..U.%.6XF..m'I...=xi...v..U.||./.4~..... B.?.6".....,.
b.B...c.`..`<.\./.d<V..2.;..}..h....` ......5.........:V.....(`.
P....O....R.<...5.$(..b(..0."...A...R...J..,.q(....s.....9..~.3.SK.
JI0..3.[V...U..vk..h..8.y.{.......0...C.....5....^*U...V..L.....x.....
.9O}1.6E1SDY...../.....z.~........u.|....x....]H_i.J.P...D.\.J........
..L...Z.........qn../%....m...}. .....|-. ...HTTP/1.1 200 OK..Content-
Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:1
7 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/e
n/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..C
ontent-Length: 520..Connection: keep-alive.............R...0.}.W.H..$!
..%AY`%.m.....Z.I<...X............5g....3.....sB.y%B...V.E^1.v..N.&
gt;M.Y.!..IzK..i.P.....1r.8FaY.}....t..V.L..S....u./.(.Y'..)..U.%.6XF.
.m'I...=xi...v..U.||./.4~..... B.?.6".....,.b.B...c.`..`<.\./.d<
V..2.;..}..h....` ......5.........:V.....(`.P....O....R.<...5.$(..b
(..0."...A...R...J..,.q(....s.....9..~.3.SK.JI0..3.[V...U..vk..h..8.y.
{.......0...C.....5....^*U...V..L.....x......9O}1.6E1SDY...../.....z.~
........u.|....x....]H_i.J.P...D.\.J..........L...Z.........qn../%....
m...}. .....|-. .......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:18 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 469
Connection: keep-alive...........RMo.0...Wd..[#;_M....v@.a j7;.E@KL"$..Iv..?:..}\v.#E=.=0...
...u..I......WB.M.<._...<../......6....'..{3c.[T...e.W.9g...9..v
I...*...8..4.a...]....J...^.?...x....6.O.i..eq....y...5-..kn...@......
!....(G.p.7.(...#..X..L.}.,@.)...x8...85z.K)..W...o.[.(..(...........u
...,D.O.*.........|.Q.V.P..T($(.[...(....%%.;..P.-...,.d..J(...-.....N
&<..I...0....! .p...(....5.....[[...}S?8@..5.}..Pzs.. ._...........
ai...N6..0............7d..n...]..o.....n..........d../....HTTP/1.1 200
OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep
2016 15:57:18 GMT..P3P: CP='This is not a P3P policy. See hXXp://trem
orvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accep
t-Encoding..Content-Length: 469..Connection: keep-alive.............RM
o.0...Wd..[#;_M....v@.a j7;.E@KL"$..Iv..?:..}\v.#E=.=0......u..I......
WB.M.<._...<../......6....'..{3c.[T...e.W.9g...9..vI...*...8..4.
a...]....J...^.?...x....6.O.i..eq....y...5-..kn...@......!....(G.p.7.(
...#..X..L.}.,@.)...x8...85z.K)..W...o.[.(..(...........u...,D.O.*....
.....|.Q.V.P..T($(.[...(....%%.;..P.-...,.d..J(...-.....N&<..I...0.
...! .p...(....5.....[[...}S?8@..5.}..Pzs.. ._...........ai...N6..0...
.........7d..n...]..o.....n..........d../........
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:18 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 463
Connection: keep-alive...........RMo.0...Wd...".q.4..xi....av.CQ...$BjY.d7.......e'>RO...
...~.ud.lT.........j.x....so....Y^\hW..?*.p..wN/.p.....rR5..V{#...\k..
..Mv..q..4.n@k2C...Q.....<......i...........mVd..v..S<......T..4
...m}(...X....u....6...v6.. .b..j....2....1^K.....C}O....=pJ=u.^..2...
.`...#[..W*R.4..V!..a..^...bX.J......X..x.NJ"..GF.0...a.:C..........-o
.E.O.Q..7..n....B..v....>=.....;c.......U'/...R.z.....S...}....\D..
.o%;.....xv`fa.:...ul.e...".d...x.....Z..........~.....HTTP/1.1 200 OK
..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 20
16 15:57:18 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorv
ideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-E
ncoding..Content-Length: 463..Connection: keep-alive.............RMo.0
...Wd...".q.4..xi....av.CQ...$BjY.d7.......e'>RO......~.ud.lT......
...j.x....so....Y^\hW..?*.p..wN/.p.....rR5..V{#...\k....Mv..q..4.n@k2C
...Q.....<......i...........mVd..v..S<......T..4...m}(...X....u.
...6...v6.. .b..j....2....1^K.....C}O....=pJ=u.^..2....`...#[..W*R.4..
V!..a..^...bX.J......X..x.NJ"..GF.0...a.:C..........-o.E.O.Q..7..n....
B..v....>=.....;c.......U'/...R.z.....S...}....\D...o%;.....xv`fa.:
...ul.e...".d...x.....Z..........~.........
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:19 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 482
Connection: keep-alive...........R.n.@.}.W.H....o.....d.j....(..v.W6.jw!..;8n..T.i....9s4..\>>
.z.*. .Z...z(..q...m..4.....)N..m.....s.Z.c..q...R.:..U.h-...k........
^YQ..^.|W %..KZm.....^.<..{.24f)...6Q..y.....:N.2.......\T....p....
.3.e..;...s}..Q.X1.....sm..om...O.au..mW?.Q...>R.-6._.......`.8..:.
...(...$.`.&...k.....Kd.J0........@I.._.L..D@).. cFq.J.3....~M.N&.....
.w0......#.A1f.8 ^^.......*....m.` ...$..U...^..u....v.......$.....c.E
.U....uw\N.,.....7...ie f. ?.q>4..&......._Z8..F.uu#.!@............
.HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date
: Tue, 13 Sep 2016 15:57:19 GMT..P3P: CP='This is not a P3P policy. Se
e hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1
..Vary: Accept-Encoding..Content-Length: 482..Connection: keep-alive..
...........R.n.@.}.W.H....o.....d.j....(..v.W6.jw!..;8n..T.i....9s4..\
.z.*. .Z...z(..q...m..4.....)N..m.....s.Z.c..q...R.:..U.h-...k........
^YQ..^.|W %..KZm.....^.<..{.24f)...6Q..y.....:N.2.......\T....p....
.3.e..;...s}..Q.X1.....sm..om...O.au..mW?.Q...>R.-6._.......`.8..:.
...(...$.`.&...k.....Kd.J0........@I.._.L..D@).. cFq.J.3....~M.N&.....
.w0......#.A1f.8 ^^.......*....m.` ...$..U...^..u....v.......$.....c.E
.U....uw\N.,.....7...ie f. ?.q>4..&......._Z8..F.uu#.!@............
.....
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:19 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1da.............R]..0.|.....[.p..CIP.TB..*...N...7..8......p.....!.Ygv>>
w<.`v....h#j.:..sz Y.....&..q...w.c..W.MG.Bi.6tJk......u.... b.rzvj
,......Y.p. ..(...R..,i..*J...$.........t.Y.....|....e...J...1..L.....
...Gs`...GcoLoG.o8,F.....*|..`?.....z_o[....)..f.).p.pD..%......4..;.&
lt;a ...$...Mv] .J. ..V....-...<-...Lr.s.'D.N.......c.x.2..\H.7x...
yp;.x....w.|H..`B...~^<?G.........D..}..x}...3..Jw ...a.^~yX.u....M
.mV..av,....e..y.....U.4.n.H..5z.}..F.=:@..j.v(xy@......r%._Z.........
...d.. .....n]J......0..HTTP/1.1 200 OK..Content-Encoding: gzip..Conte
nt-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:19 GMT..P3P: CP='This
is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Se
rver: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chu
nked..Connection: keep-alive..1da.............R]..0.|.....[.p..CIP.TB.
.*...N...7..8......p.....!.Ygvw<.`v....h#j.:..sz Y.....&..q...w.c..
W.MG.Bi.6tJk......u.... b.rzvj,......Y.p. ..(...R..,i..*J...$.........
t.Y.....|....e...J...1..L........Gs`...GcoLoG.o8,F.....*|..`?.....z_o[
....)..f.).p.pD..%......4..;.<a ...$...Mv] .J. ..V....-...<-...L
r.s.'D.N.......c.x.2..\H.7x...yp;.x....w.|H..`B...~^<?G.........D..
}..x}...3..Jw ...a.^~yX.u....M.mV..av,....e..y.....U.4.n.H..5z.}..F.=:
@..j.v(xy@......r%._Z............d.. .....n]J......0......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:19 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 498
Connection: keep-alive...........R...0.}.W.H..$...(..r..VmE..a.BN<!...l'.................>>
`~..^.J3)Bkh.V.D.)......OSk.}.^.$....4.(...ViL5s...KU...K.h]Y=3...Z...
/.xiEAL{Q.M....yI...(...%...y.^Ic...n......e...7..(#.!.7.V.B.:W..>.
.. ..i6....0...W...i.....Q.'yh...).(B..>..-4....]..Zw......_.Fr.FI.
I-(i.cW...P.r..(#......i..[F'..grA.tM.^!LI.S.{....U...j.e2.]x..]....G/
...1LI.......(p~Ul..T..G.}...3...P..Y...Kyd...vi.|.I........u'....J.[w
.....?...v.A...........J.......B5Y......5#..*....W..Hc.....';?.p./...&
g.]..........#...HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type
: text/xml..Date: Tue, 13 Sep 2016 15:57:19 GMT..P3P: CP='This is not
a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: A
pache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 498..Connecti
on: keep-alive.............R...0.}.W.H..$...(..r..VmE..a.BN<!...l'.
................`~..^.J3)Bkh.V.D.)......OSk.}.^.$....4.(...ViL5s...KU.
..K.h]Y=3...Z.../.xiEAL{Q.M....yI...(...%...y.^Ic...n......e...7..(#.!
.7.V.B.:W..>... ..i6....0...W...i.....Q.'yh...).(B..>..-4....]..
Zw......_.Fr.FI.I-(i.cW...P.r..(#......i..[F'..grA.tM.^!LI.S.{....U...
j.e2.]x..]....G/...1LI.......(p~Ul..T..G.}...3...P..Y...Kyd...vi.|.I..
......u'....J.[w.....?...v.A...........J.......B5Y......5#..*....W..Hc
.....';?.p./...&g.]..........#.......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:20 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1b9.............RMo.@...WP..V.c...`Q'."EmUp{."k`..rXV..1...r.~\z..3o..>>
<M.=..NG..FF.l.....A!."w.}|.r....{.f...@.Fi66r k.......U.O....Q.c7.
.mM.~.rHn.8L......"=...X..l.u..k..&G..3x.........$K..r...<../.^....
j.Q@..9...................DE."......]...N..#.Q..5.lQ.)d.1p. iu. m%B..{
..K.Z..kB.5.....YE.c.#'2/pb....j.0.. ....`[..I..._.....3._."X..9.,h.e.
y....q..................m.D..(..t:..T.-...u0...F...].4..6.8.i^Vtd.0..y
%`f..8.m.v..a....]..o_x....q.6.)..e..@......9........0..HTTP/1.1 200 O
K..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2
016 15:57:20 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremor
video.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-
Encoding..transfer-encoding: chunked..Connection: keep-alive..1b9.....
........RMo.@...WP..V.c...`Q'."EmUp{."k`..rXV..1...r.~\z..3o..<M.=.
.NG..FF.l.....A!."w.}|.r....{.f...@.Fi66r k.......U.O....Q.c7..mM.~.rH
n.8L......"=...X..l.u..k..&G..3x.........$K..r...<../.^....j.Q@..9.
..................DE."......]...N..#.Q..5.lQ.)d.1p. iu. m%B..{..K.Z..k
B.5.....YE.c.#'2/pb....j.0.. ....`[..I..._.....3._."X..9.,h.e.y....q..
................m.D..(..t:..T.-...u0...F...].4..6.8.i^Vtd.0..y%`f..8.m
.v..a....]..o_x....q.6.)..e..@......9........0......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:21 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1c6.............R.n.0... T.....?.....I..E.TJ{..cE.,"%E..b.}W...q.ig.!g
v....~.=Z'[...4.....R......~.n.7...(....F..[.4l.7k..E......U.9..~.<
...../..:..\.Y...1h....G....AQ.%...(....._o.....:/......5....;h.[.. E.
.:...*..|.-.r.G.Y=...z11)..K|~w.%O....a'$......p.....N.......4.š.B..
... E. ./j*D...B....2.K0......|g .q.....Gx........Y5..9..^.jQ...Y.....
.....Y........vO......f{..$.x/v.4_....72.'.....I.V..n...%[K.....f.'...
Y.&h.nz........d....uUh-N.g?.........=......0..HTTP/1.1 200 OK..Conten
t-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57
:21 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com
/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding.
.transfer-encoding: chunked..Connection: keep-alive..1c6.............R
.n.0... T.....?.....I..E.TJ{..cE.,"%E..b.}W...q.ig.!gv....~.=Z'[...4..
...R......~.n.7...(....F..[.4l.7k..E......U.9..~.<...../..:..\.Y...
1h....G....AQ.%...(....._o.....:/......5....;h.[.. E..:...*..|.-.r.G.Y
=...z11)..K|~w.%O....a'$......p.....N.......4.š.B..... E. ./j*D...B.
...2.K0......|g .q.....Gx........Y5..9..^.jQ...Y..........Y........vO.
.....f{..$.x/v.4_....72.'.....I.V..n...%[K.....f.'...Y.&h.nz........d.
...uUh-N.g?.........=......0......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:21 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive198............dRMo.0...Wx..."...4..xi....bv.CQ..D7B'Y.d7..c.4.....#.D
*_...`D.d..0.Ea...B.."|h>.\...]....3.rO.B.......%c....vhg.W.9..~.&l
t;.....o..&,.J.e...1h.^=9..l..A]....<..D...........j...8..k.4.g....
A...E.].-.E,.$.2.J.h>..2....S.....}.\. $...?..p.....A.......4.š.B
...%.I.f.@j.i.. ...R`...l.T..F(...m....df...*......z...!..t.h..{z*s..2
n....;.....'.%..p..PF.C.c..2........t.......R..l.=.7....Gl..ag2...;..N
y.^....d.. ....^j{Dh.....0..HTTP/1.1 200 OK..Content-Encoding: gzip..C
ontent-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:21 GMT..P3P: CP='T
his is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding:
chunked..Connection: keep-alive..198............dRMo.0...Wx..."...4..
xi....bv.CQ..D7B'Y.d7..c.4.....#.D*_...`D.d..0.Ea...B.."|h>.\...]..
..3.rO.B.......%c....vhg.W.9..~.<.....o..&,.J.e...1h.^=9..l..A]....
<..D...........j...8..k.4.g....A...E.].-.E,.$.2.J.h>..2....S....
.}.\. $...?..p.....A.......4.š.B...%.I.f.@j.i.. ...R`...l.T..F(...m.
...df...*......z...!..t.h..{z*s..2n....;.....'.%..p..PF.C.c..2........
t.......R..l.=.7....Gl..ag2...;..Ny.^....d.. ....^j{Dh.....0...
...
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:21 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 428
Connection: keep-alive...........RMo.0...Wx...".q.4........0;..(......,Hr...1F......(=...L..
....X........j:....7....?..$......N4*Tv.R...^2......z.t.Y.}.-........-
n.,)..%..h.....u(.j....K.^.....`..........*...4..H.....jT.<7..sl...
Y.... ..(.f.6...v>.).\..h.1..Z5.......0.O.a>(.R4.%r........=.I..
F..p$t..;..`.....\...M-.Nz...M..q..7..of..."\@;...n........1....QO....
..........uq......8*=k[Km....e...5............4Otew.......a.2...{9.:..
7.O......h.......HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type
: text/xml..Date: Tue, 13 Sep 2016 15:57:21 GMT..P3P: CP='This is not
a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: A
pache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 428..Connecti
on: keep-alive.............RMo.0...Wx...".q.4........0;..(......,Hr...
1F......(=...L......X........j:....7....?..$......N4*Tv.R...^2......z.
t.Y.}.-........-n.,)..%..h.....u(.j....K.^.....`..........*...4..H....
.jT.<7..sl...Y.... ..(.f.6...v>.).\..h.1..Z5.......0.O.a>(.R4
.%r........=.I..F..p$t..;..`.....\...M-.Nz...M..q..7..of..."\@;...n...
.....1....QO..............uq......8*=k[Km....e...5............4Otew...
....a.2...{9.:..7.O......h...........
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:22 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive1b2.............RMo.0...Wx...,9.h......Rt.0...(...k..lHr...)Y....'>>>
QO..#..^.pv.4.e..>u..M..|..............:.f..}(..dng.. .(.....ozA..\
.,..3...|.-.n...........TN.....[.,...9y,Z.....n....j]T......H ....$...
[*...[.56...QB......mdC.......Q.....%..|.,f..&xc.@.A..,..Y.!...P#....h
... .. ..f...akFUs..h.$IC.".(..(.....".C..:....<%/..R.W....4...t.}.
.\.a4......P?.......v.......v.t....y.P...............<])....>.&l
t;....eV..'.hW;;.m....9..__....[r2,.%..e..@........m......0..HTTP/1.1
200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13
Sep 2016 15:57:22 GMT..P3P: CP='This is not a P3P policy. See hXXp://t
remorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Ac
cept-Encoding..transfer-encoding: chunked..Connection: keep-alive..1b2
.............RMo.0...Wx...,9.h......Rt.0...(...k..lHr...)Y....'>QO.
.#..^.pv.4.e..>u..M..|..............:.f..}(..dng.. .(.....ozA..\.,.
.3...|.-.n...........TN.....[.,...9y,Z.....n....j]T......H ....$...[*.
..[.56...QB......mdC.......Q.....%..|.,f..&xc.@.A..,..Y.!...P#....h...
.. ..f...akFUs..h.$IC.".(..(.....".C..:....<%/..R.W....4...t.}..\.
a4......P?.......v.......v.t....y.P...............<])....>.<.
...eV..'.hW;;.m....9..__....[r2,.%..e..@........m......0......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:23 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive198.............._o.0....).......i.D,..J.Z..=TUt...Jm,.....&...y......
.O..|/.... :...8.=TM..z.......?......:...6jTv.2....1....l.z.t.Y.}.....
...v....<-...?.h..P..u(......]..6......~u......EU<..4...A..r....
.......Pc3.y.%A..Q.L&mDK..x...W..r;|.X.A...!)....6.?.^m.(........Np.@j
.......R.]oj.p.......2......jRO.!.).1...}|.S.'.....K ..<...m...Q).u
.$..B...mV.._oW...?...n.6h..ey.0. vh.2O.....2.l.{,w..%7.u..f....m.4..o
.S..e........$.?.y.....0..HTTP/1.1 200 OK..Content-Encoding: gzip..Con
tent-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:23 GMT..P3P: CP='Thi
s is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..
Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: c
hunked..Connection: keep-alive..198.............._o.0....).......i.D,.
.J.Z..=TUt...Jm,.....&...y.......O..|/.... :...8.=TM..z.......?......:
...6jTv.2....1....l.z.t.Y.}........v....<-...?.h..P..u(......]..6..
....~u......EU<..4...A..r...........Pc3.y.%A..Q.L&mDK..x...W..r;|.X
.A...!)....6.?.^m.(........Np.@j.......R.]oj.p.......2......jRO.!.).1.
..}|.S.'.....K ..<...m...Q).u.$..B...mV.._oW...?...n.6h..ey.0. vh.2
O.....2.l.{,w..%7.u..f....m.4..o.S..e........$.?.y.....0......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:23 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 398
Connection: keep-alive...........R.N.0....!.r.Nh.J......V...8 TM.....e;...u...{........1...[
....Uy...0@U.\..<./.O'.....bQ.hg..oTv..p..........jT..X...M....<
..gY\...<`....h6.b..% ...bqK....-x./.w7..?./..x..i0N.......V-...<
;O....z..*.....8......7......KQ.8.K..$...?./W.~.O*D..k.z....=,A...%.z.
:S..'....:..,...H..q5...'...J....Q....1...a.........{s.w>..&.er..S.
....,.0:7..... .......@..?.U..Y.&.'.@&.F..V..w.._......e".._...HTTP/1.
1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 1
3 Sep 2016 15:57:23 GMT..P3P: CP='This is not a P3P policy. See http:/
/tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary:
Accept-Encoding..Content-Length: 398..Connection: keep-alive..........
...R.N.0....!.r.Nh.J......V...8 TM.....e;...u...{........1...[....Uy..
.0@U.\..<./.O'.....bQ.hg..oTv..p..........jT..X...M....<..gY\...
<`....h6.b..% ...bqK....-x./.w7..?./..x..i0N.......V-...<O....z.
.*.....8......7......KQ.8.K..$...?./W.~.O*D..k.z....=,A...%.z.:S..'...
.:..,...H..q5...'...J....Q....1...a.........{s.w>..&.er..S.....,.0:
7..... .......@..?.U..Y.&.'.@&.F..V..w.._......e".._.......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:23 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 413
Connection: keep-alive...........RMo.0...W....,..H........[...!(...k#.,H....)A.....I.....]..
/oDm.^.~......y'_r....q./...Q..3...s...m....9!V..u;TA..b..=;7..`r...Mq
.3Zp.....B}.V{cQ..X..V...?.I.^.....F.....,.':..J'(..w/k.._...)6!TX."^%
Y..4..8n.g"................-.k.......yc.....[.*.........$N...eu..,..[H
.....!..4)...y~f..=.....o.:.L....z{.......&P.Z..6.:..v.......O...Q.I..
P.......vK.F4g../ntp.RC.u..~Di.C...9...-.....O[a.........V-....HTTP/1.
1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 1
3 Sep 2016 15:57:23 GMT..P3P: CP='This is not a P3P policy. See http:/
/tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary:
Accept-Encoding..Content-Length: 413..Connection: keep-alive..........
...RMo.0...W....,..H........[...!(...k#.,H....)A.....I.....]../oDm.^.~
......y'_r....q./...Q..3...s...m....9!V..u;TA..b..=;7..`r...Mq.3Zp....
.B}.V{cQ..X..V...?.I.^.....F.....,.':..J'(..w/k.._...)6!TX."^%Y..4..8n
.g"................-.k.......yc.....[.*.........$N...eu..,..[H.....!..
4)...y~f..=.....o.:.L....z{.......&P.Z..6.:..v.......O...Q.I..P.......
vK.F4g../ntp.RC.u..~Di.C...9...-.....O[a.........V-........
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:24 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive199.............R.n.0.}...F.o..r)..(."!..jI..U.M..D]'.m(..:..^..>..
>3s....#.i.P..k......m....&v.-.......H7..6.i&.US..;....-.wr./.U..R.
..Ti.{.._.....q.,.?J..e...)..f.Xk.y....T4e.l.. ..~./.,}:.. uk......Vm.
l&...X.Pb5.X.Dn.7...~...cu8..m....I...%.z..A..a.\...H.9..E...lZ..M.(.\
..<..@.N......P.........w.wRv./ ..!...... ..........$.F&.4...}../..
z...'.]..<_....OGN..*W\HT......4.9..B...V.af....1w.l.2l..C.d.K.rY.3
.s......d.......*.w1......0..HTTP/1.1 200 OK..Content-Encoding: gzip..
Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:24 GMT..P3P: CP='
This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy
'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding
: chunked..Connection: keep-alive..199.............R.n.0.}...F.o..r)..
(."!..jI..U.M..D]'.m(..:..^..>..>3s....#.i.P..k......m....&v.-..
.....H7..6.i&.US..;....-.wr./.U..R...Ti.{.._.....q.,.?J..e...)..f.Xk.y
....T4e.l.. ..~./.,}:.. uk......Vm.l&...X.Pb5.X.Dn.7...~...cu8..m....I
...%.z..A..a.\...H.9..E...lZ..M.(.\..<..@.N......P.........w.wRv./
..!...... ..........$.F&.4...}../..z...'.]..<_....OGN..*W\HT......4
.9..B...V.af....1w.l.2l..C.d.K.rY.3.s......d.......*.w1......0..
>....
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:25 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
transfer-encoding: chunked
Connection: keep-alive16b.............Q.N.0....!......R9...HH..M..P..7m.q,.-..qC.<..v....
...[...Q.........,[Q.E......?d..>..{........._Z...X.M.. ..mC.Q.g...
]......c..\x.>hP...5.... .]o:...k.............8/.....m.;(.....lA.u-
....8..H.8.S8.....bW"Q%.*......NG.Z`..rm.*...E..v.y-.x......,........{
..c..D..WOO...gO.n......2.a.&...K...s......D..S.l.F...0:...^....^9 ...
....<Y..........7....Kh......d...........?.....0..HTTP/1.1 200 OK..
Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016
15:57:25 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvid
eo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Enc
oding..transfer-encoding: chunked..Connection: keep-alive..16b........
.....Q.N.0....!......R9...HH..M..P..7m.q,.-..qC.<..v.......[...Q...
......,[Q.E......?d..>..{........._Z...X.M.. ..mC.Q.g...]......c..\
x.>hP...5.... .]o:...k.............8/.....m.;(.....lA.u-....8..H.8.
S8.....bW"Q%.*......NG.Z`..rm.*...E..v.y-.x......,........{..c..D..WOO
...gO.n......2.a.&...K...s......D..S.l.F...0:...^....^9 .......<Y..
........7....Kh......d...........?.....0......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:25 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 381
Connection: keep-alive............[O.0....Wd#.7..&...WQa%....a..B.$.P.|..F..q.B...4.........
c4.uB.*..4.Pu..u_.....I<g?..z..eg;Yx...W..{3#.[..n.m.iI.3q.g....*..
../bFk.1...1hw....(Y...-..)y;........ F....uS..v..W.(....:.....U.}.-v.
..y..p.g.x...d./F...G....-.05.u..Y..m...6.)....2K.)..t...!....o....c.|
...V./..|.I..<i.......A....x9..w.G..nOu.......G.]X./.t.%.........!.
.9.......9.....-............. ...W...HTTP/1.1 200 OK..Content-Encoding
: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:25 GMT..P
3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privac
y-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-L
ength: 381..Connection: keep-alive..............[O.0....Wd#.7..&...WQa
%....a..B.$.P.|..F..q.B...4.........c4.uB.*..4.Pu..u_.....I<g?..z..
eg;Yx...W..{3#.[..n.m.iI.3q.g....*..../bFk.1...1hw....(Y...-..)y;.....
... F....uS..v..W.(....:.....U.}.-v...y..p.g.x...d./F...G....-.05.u..Y
..m...6.)....2K.)..t...!....o....c.|...V./..|.I..<i.......A....x9..
w.G..nOu.......G.]X./.t.%.........!..9.......9.....-............. ...W
.......
GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: partners.tremorhub.com
Connection: Keep-Alive
Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"
HTTP/1.1 200 OK
Content-Encoding: gzip
Content-Type: text/xml
Date: Tue, 13 Sep 2016 15:57:26 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Server: Apache-Coyote/1.1
Vary: Accept-Encoding
Content-Length: 420
Connection: keep-alive...........R.j.0.|..............4.(..q.....:nM...d..}..4{{(.$.....&]..
....n:..........x..C..6wW.KzO...6.a.Q....gc...
GET /img/logo.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1473782236.F76D7BABCB714F614E7A5CF7E571261E.1.1.1.1.1.1.1.1.1; _ga=GA1.2.44415039.1473782236; _gat=1
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:12 GMT
Content-Type: image/png
Content-Length: 3856
Connection: keep-alive
Last-Modified: Tue, 10 Jun 2014 14:29:28 GMT
ETag: "a1bf2-f10-4fb7c27bc2200"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adob>>
e ImageReadyq.e<....IDATx..].O....V^.....rI........c..F..M.y0..-H..
..P.KH\.-.%-....J.[...5..S.... R...c....K/O.w...........93svY..i..e..w
...}..}gvy..E?.Q..%....J...(Q.V.DaZ....JN........(.fL...cM.....Z...'..
...A.....k.x....8....E..O..;.W...f.q.X..l..=.....k................%...
fd)........,..J..G...!...m.Q...J.../..................Y,0.......%...S6
R..=..t.0..%...|(..?T.V.DaZ...i%.b>..6:.~.=..7.-*.g....y<.,4>
....W..jv.(...}...8..YdF.l. .,,~5s..X<..h~.p...'......b...[6.0.D.Ci
........ Bo.C]....g..........y.i.........]N....p$.-~}8..... .....n.z..
.$~.9.).........P.....g....!.':.J..O...X.U.?:..#.g.{ .^......L..0..I..
"H<.5.u0...n^.3.ER.<......ZI......*f..... .fN.......q.n.........
.........Z.0.A.m|@.v. .uI......u........Y...u.t..........db...L.......
T.=21...8.(......i.$......y4...t:....(.`sG.H..Q...&...u.<..2L..Wl..
5...9...<. I....d...P.._h..n....MA7Y.....'..FsZ?....kH.l.s.<.QD.
...$q>lK...`1....x.Ha ^....L..W.#.C....._1...."^..6..WRz...4..z`.Ch
|R..H....:1..C..o. ........8..8.$...;..,..N.....S..O......W":.).}...IR
!.F8`=..lc..9n...O~a.....k7^-~........r........YO.C..0@I.v....7Dt.....
.............2..NmX...&.h.......f) ....;?...b8.~.>L..../.....C.l.Pf
g..............0..4k>.f.k-....X.9!a>.0.i.b.....$h.;.b.....`.32.T
r...bx.".:5K00..9..h...a........l....U..M..Z3..v..:....<:E........
#./...4p.y.....b....u.f.#[*e%.%p....|RO.dP\b...~.f...C......@..s......
....X.{.m0.k..T.O.?<&.M....C...6o.9..C..Pd.,.......O..`5.L.xP,.
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 14 Sep 2016 00:02:56 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Wed, 14 Sep 2016 00:02:56 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /itd.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&rand= HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: cocomo.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:09 GMT
Server: Apache/2.2.22 (Win64) PHP/5.3.13
X-Powered-By: PHP/5.3.13
Content-Length: 1118
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html<html>..<head>..<title>a</title>..</head>>>
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {.. var nameEQ = name "
=";.. var ca = document.cookie.split(';');.. for(var i=0;i < ca.l
ength;i ) {.. var c = ca[i];.. while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);.. if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);.. }.. return null;..}..function uapcc()
{..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime() (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 90);.
.setInterval(function() {..uapcc();..}, 90);..//-->..</script>
;..<meta http-equiv="refresh" content="300">..</html>HTTP/
1.1 200 OK..Date: Tue, 13 Sep 2016 15:57:09 GMT..Server: Apache/2.2.22
(Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 1118..K
eep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: t
ext/html..<html>..<head>..<title>a</title>..&l
t;/head>..<body>..<script language="JavaScript" type="
GET /counter/counter.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.statcounter.com
Connection: Keep-Alive
Cookie: is_unique=sc10114910.1473782229.0; is_visitor_unique=1473782229289162047
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:11 GMT
Server: PWS/8.1.38
X-Px: ht h0-s1153.p11-fra.cdngp.net
ETag: W/"576924c5-654e"
Cache-Control: max-age=43200
Expires: Tue, 13 Sep 2016 18:24:46 GMT
Age: 34345
Content-Length: 9529
Content-Type: application/x-javascript
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT
Connection: keep-alive...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u>>
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5. G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
GET /report1.php?url=/govids/page-1.html?lid=937115 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 16:00:40 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Tue, 13 Sep 2016 16:00:40 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......
GET /bck.php?1473782235000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 16:00:41 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Tue, 13 Sep 2016 16:00:41 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......
GET /report1.php?url=/govids/page-1.htm?lid=937115 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 16:00:41 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8....
GET /bck.php?1473782235000 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: 109.201.148.40
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 16:00:41 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Content-Length: 0
Keep-Alive: timeout=5
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8HTTP/1.1 200 OK..Date: Tue, 13 Sep 2016 16:00:41 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..
GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: whos.amung.us
Connection: Keep-Alive
HTTP/1.1 303 See Other
Date: Tue, 13 Sep 2016 15:57:09 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: close
Location: hXXp://widgets.amung.us/draw/?w=colored&n=998&c=000000ffffff&p=
Set-Cookie: uid=CgH9JlfYIdUdNA7VDEHXAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/0..
GET /page-1.html?lid=937115 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:09 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.come5b..<img src="hXXp://109.201.148.40/report1.php?url=/govids/page-1>>
.html?lid=937115" alt="" width="0" height="0"><script type="text
/javascript" src="hXXp://govids.net/jwplayer1.js"></script>&l
t;script>var thecc ="ok";</script><script type="text/javas
cript" src="hXXp://govids.net/1.js"></script><form action=
"hXXp://VVV.govids.net/page-4.php" method="get" name="redirect"><
;input type="hidden" name="lid" value="937115"></form>..<s
cript type="text/javascript"> if (top.location!= self.location) { d
ocument.write('<head></head><body bgcolor="#ffffff" cla
ss="body" topmargin="0" leftmargin="0">');}</script>..<for
m action="hXXp://VVV.govids.net/page-1.htm" method="get" name="redirec
t1"><input type="hidden" name="lid" value="937115"></form&
gt;<script type="text/javascript"> if (top.location!= self.locat
ion) { document.forms['redirect1'].submit();}</script>..<scri
pt type='text/javascript'>..var cb = Math.round(new Date().getTime(
) / 1000);..var items = Array('mp4:lqbyul0x.mp4','mp4:hc6lawyi.mp4','m
p4:iblsdh2f.mp4','mp4:nbsyph4t.mp4','mp4:peyjpa0x.mp4','mp4:9mzecklt.m
p4','mp4:vnt9ciyd.mp4','mp4:q5fufgnb.mp4','mp4:lzcpj8vr.mp4','mp4:pfdx
i3pj.mp4','mp4:romfc7uu.mp4','mp4:qgmcib5y.mp4','mp4:ifgfn0gh.mp4');..
var item = items[Math.floor(Math.random()*items.length)];..var ffile =
"hXXp://thm.vidvib.com/abcd.mp4";..jwplayer('ova-jwplayer-container')
.setup({.. "flashplayer": "hXXp://govids.net/player1.swf",.."file"
GET /page-1.htm?lid=937115 HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:11 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Powered-By: PHP/5.3.3
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.come5c..<img src="hXXp://109.201.148.40/report1.php?url=/govids/page-1>>
.htm?lid=937115" alt="" width="0" height="0"><script type="text/
javascript" src="hXXp://govids.net/jwplayer1.js"></script><
;script>var thecc ="ok";</script><script type="text/javasc
ript" src="hXXp://govids.net/1.js"></script><form action="
hXXp://VVV.govids.net/page-4.php" method="get" name="redirect"><
input type="hidden" name="lid" value="937115"></form>..<sc
ript type="text/javascript"> if (top.location!= self.location) { do
cument.write('<head></head><body bgcolor="#ffffff" clas
s="body" topmargin="0" leftmargin="0">');}</script>..<scri
pt type="text/javascript"> if (top.location!= self.location) { var
rc = document.referrer.split('/')[2];if (rc == window.location.hostnam
e) {document.write('<div id="ova-jwplayer-container" style="positio
n:absolute; top:0px; left:0px;width:300px;height:250px;"></div&g
t;');}}</script>..<script type='text/javascript'>..var cb
= Math.round(new Date().getTime() / 1000);..var items = Array('mp4:lqb
yul0x.mp4','mp4:hc6lawyi.mp4','mp4:iblsdh2f.mp4','mp4:nbsyph4t.mp4','m
p4:peyjpa0x.mp4','mp4:9mzecklt.mp4','mp4:vnt9ciyd.mp4','mp4:q5fufgnb.m
p4','mp4:lzcpj8vr.mp4','mp4:pfdxi3pj.mp4','mp4:romfc7uu.mp4','mp4:qgmc
ib5y.mp4','mp4:ifgfn0gh.mp4');..var item = items[Math.floor(Math.rando
m()*items.length)];..var ffile = "hXXp://thm.vidvib.com/abcd.mp4";..jw
player('ova-jwplayer-container').setup({.. "flashplayer": "hXXp://
GET /css1.css HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1473782236.F76D7BABCB714F614E7A5CF7E571261E.1.1.1.1.1.1.1.1.1; _ga=GA1.2.44415039.1473782236; _gat=1
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:12 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT
Server: CDCE
X-INAP-Cache-Status: HIT
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Content-Encoding: gzip293.............U[O.0.~.R..G5.IM.B/.>.(..P..i......cG.{a...s..]7..0
..G....s..w<.........6 ...!..f.o3.||6...&...(...^{..F....t.>X.]L
of...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...M~...9..........#H...W.oi(y.
.....B;.@.....j.y.ke.9M.|.J..N...<8n.2...P.......>_.N...{U.....R
jb.<......oEF.I)..Bm.7...I..`.q28........Y......-P..y..V..rk.....$.
p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<.......Z.D.8 TY`..9P..H3m,..
...A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X#.B...F/...50.3j..da...H..2.
.....f..s\..q.....k.I..4.2..6..4....;(. .Rb(.........Z.,/..S....lur.*.
. ..B.....X....Jc3.P.x...I.$...)..`..F..iZ..E.pK...{F...&.....i..ja1&g
t;..s.&X..Q..~....v...*m...3.Dq".|oo%.MpTn..qU..~..-.q......0..
....
GET /img/lbg.png HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.govids.net
Connection: Keep-Alive
Cookie: sc_is_visitor_unique=rx10675947.1473782236.F76D7BABCB714F614E7A5CF7E571261E.1.1.1.1.1.1.1.1.1; _ga=GA1.2.44415039.1473782236; _gat=1
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:12 GMT
Content-Type: image/png
Content-Length: 200
Connection: keep-alive
Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT
ETag: "a1bf1-c8-4ebb56fac1880"
Server: CDCE
X-INAP-Cache-Status: EXPIRED
X-INAP-Server: cdce-ams002-001.ams002.internap.com
Accept-Ranges: bytes.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Tue, 13 Sep 2016 15:57:12 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21
Nov 2013 20:06:42 GMT..ETag: "a1bf1-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-001.ams002.int
ernap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......
gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b ..
...tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.!
[.....O...........IEND.B`...
GET /analytics.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Strict-Transport-Security: max-age=10886400; includeSubDomains; preload
Date: Tue, 13 Sep 2016 14:02:05 GMT
Expires: Tue, 13 Sep 2016 16:02:05 GMT
Last-Modified: Mon, 15 Aug 2016 04:25:11 GMT
X-Content-Type-Options: nosniff
Content-Type: text/javascript
Vary: Accept-Encoding
Content-Encoding: gzip
Server: Golfe2
Content-Length: 11590
Cache-Control: public, max-age=7200
Age: 6904...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'>>
V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W]
.b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..
~.............>..........GB..N....?...?.I2.....U...o<.....W.;...
x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/
..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<
.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo..
...]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..
~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.
E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)
....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]..........
..*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.
........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9
..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....
q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z...
...Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....
C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.
X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'
....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P
..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...z
Z...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@
........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
GET /r/collect?v=1&_v=j46&a=356611280&t=pageview&_s=1&dl=http://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=555460349&cid=1377690454.1473782234&tid=UA-74694740-5&_r=1&z=1612721500 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Tue, 13 Sep 2016 15:57:09 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 13 Sep 2016 15:57:09 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;....
GET /r/collect?v=1&_v=j46&a=607540295&t=pageview&_s=1&dl=http://VVV.govids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1916155861&cid=44415039.1473782236&tid=UA-74694740-2&_r=1&z=256026923 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: VVV.google-analytics.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Date: Tue, 13 Sep 2016 15:57:12 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, no-store, must-revalidate
Last-Modified: Sun, 17 May 1998 03:00:00 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
Server: Golfe2
Content-Length: 35GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 13 Sep 2016 15:57:12 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..
GET /1.js HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.html?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 14 Sep 2016 00:02:55 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.5.30
Cache-Control: max-age=0
Expires: Wed, 14 Sep 2016 00:02:55 GMT
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8
GET /10114910/0/757d7213/1/ HTTP/1.1
Accept: */*
Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:09 GMT
Server: Apache/2.2.3 (CentOS)
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1473782229.0; expires=Sun, 12-Sep-2021 15:57:09 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1473782229289162047; expires=Thu, 13-Sep-2018 15:57:09 GMT; path=/; domain=.statcounter.com
Content-Length: 49
Connection: close
Content-Type: image/gifGIF89a...................!.......,...........T..;..
GET /ova-jw.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/player1.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
Cookie: _ga=GA1.2.44415039.1473782236; _gat=1
HTTP/1.1 200 OK
Date: Wed, 14 Sep 2016 00:02:58 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT
ETag: "4403b3-39741-4fbe0551c3280"
Accept-Ranges: bytes
Content-Length: 235329
Cache-Control: max-age=2592000, public
Expires: Wed, 16 Aug 2017 00:02:58 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q>>
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=F76D7BABCB714F614E7A5CF7E571261E&sc_random=0.475769053747595&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.govids.net/page-1.html?lid=937115&u=http://VVV.govids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1
Accept: */*
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: c.statcounter.com
Connection: Keep-Alive
Cookie: is_unique=sc10114910.1473782229.0; is_visitor_unique=1473782229289162047
HTTP/1.1 200 OK
Date: Tue, 13 Sep 2016 15:57:12 GMT
Server: Apache/2.2.3 (CentOS)
P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Set-Cookie: is_unique=sc10114910.1473782229.0-10675947.1473782232.0; expires=Sun, 12-Sep-2021 15:57:12 GMT; path=/; domain=.statcounter.com
Set-Cookie: is_visitor_unique=1473782229289162047; expires=Thu, 13-Sep-2018 15:57:12 GMT; path=/; domain=.statcounter.com
Content-Length: 49
Connection: close
Content-Type: image/gifGIF89a...................!.......,...........T..;..
GET /player1.swf HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: govids.net
Connection: Keep-Alive
HTTP/1.1 200 OK
Date: Wed, 14 Sep 2016 00:02:56 GMT
Server: Apache/2.2.15 (CentOS)
Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT
ETag: "4403c4-1bb61-4fbe0230ad080"
Accept-Ranges: bytes
Content-Length: 113505
Cache-Control: max-age=2592000, public
Expires: Wed, 16 Aug 2017 00:02:56 GMT
Connection: close
Content-Type: application/x-shockwave-flashCWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....>>
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T.....
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
GET /crossdomain.xml HTTP/1.1
Accept: */*
Accept-Language: en-US
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Tue, 13 Sep 2016 15:57:14 GMT
ETag: W/"144-1446501138000"
Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT
Server: Apache-Coyote/1.1
Content-Length: 144
Connection: keep-alive<?xml version="1.0" ?>.<cross-domain-policy>. <!-- V
ery Liberal -->. <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....
GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 1&mediaDesc=Home videos, Funny Videos - 1&mediaId=2&mediaUrl=hXXp://VVV.govids.net/1.html&srcPageUrl=hXXp://VVV.govids.net/1.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash HTTP/1.1
Accept: */*
Accept-Language: en-US
Referer: hXXp://govids.net/ova-jw.swf
x-flash-version: 11,6,602,168
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)
Host: xlf5t.ads.tremorhub.com
Connection: Keep-Alive
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, must-revalidate
Content-Encoding: gzip
Content-Type: text/xml;charset=ISO-8859-1
Date: Tue, 13 Sep 2016 15:57:15 GMT
P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
Pragma: no-cache
Server: Apache-Coyote/1.1
Set-Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; Domain=.tremorhub.com; Expires=Wed, 13-Sep-2017 21:45:35 GMT; Path=/
Set-Cookie: tvrg_60409="1,1473782235"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 13-Sep-2016 15:58:15 GMT; Path=/
Vary: Accept-Encoding
x-tremorvideo-status: NO_AD
transfer-encoding: chunked
Connection: keep-alive1f9.............R.n.0... \..-../q.I...E..A... 0F.H&l........7.r.i....f>>
.&Z...`..p)b/....E)..u.=../.."..Vi.....2z(...........F.. F.l|c.7....u&
..~[.w^..l.D?4(.....Xl...;.....;.ES.C...!..=/..<}>.).VPC..t[Q..l
.9..X.P`9.Y1..3....x\M(....U.e.E[9...Z......(....d...... .......#.k...
u...)]q.r'..........v.J.<:.q.J..}W.."X ....a.{..B.,...Z.z...ZpK./{.
...Z.....l...Rt&....N.1N~.).@'.8.7......X..........ga...dz3...0.9TSVL.
j....j.//I......R.c.qTpf.....u......_....I.....Q.M..~.-5...h.0.>..@
...rKK|.' .U..n.s.................d........... .....0..HTTP/1.1 200 OK
..Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding
: gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Tue, 13 Sep 2
016 15:57:15 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremor
video.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/
1.1..Set-Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; Domain=.tremor
hub.com; Expires=Wed, 13-Sep-2017 21:45:35 GMT; Path=/..Set-Cookie: tv
rg_60409="1,1473782235"; Version=1; Domain=.tremorhub.com; Max-Age=60;
Expires=Tue, 13-Sep-2016 15:58:15 GMT; Path=/..Vary: Accept-Encoding.
.x-tremorvideo-status: NO_AD..transfer-encoding: chunked..Connection:
keep-alive..1f9.............R.n.0... \..-../q.I...E..A... 0F.H&l......
..7.r.i....f.&Z...`..p)b/....E)..u.=../.."..Vi.....2z(...........F.. F
.l|c.7....u&..~[.w^..l.D?4(.....Xl...;.....;.ES.C...!..=/..<}>.)
.VPC..t[Q..l.9..X.P`9.Y1..3....x\M(....U.e.E[9...Z......(....d...... .
......#.k...u...)]q.r'..........v.J.<:.q.J..}W.."X ....a.{..B.,
The Dropped connects to the servers at the folowing location(s):
Map
Strings from Dumps
klar.exe_1904:
.text
.text
`.rdata
`.rdata
@.data
@.data
.ndata
.ndata
.rsrc
.rsrc
uDSSh
uDSSh
.DEFAULT\Control Panel\International
.DEFAULT\Control Panel\International
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion
GetWindowsDirectoryA
GetWindowsDirectoryA
KERNEL32.dll
KERNEL32.dll
ExitWindowsEx
ExitWindowsEx
USER32.dll
USER32.dll
GDI32.dll
GDI32.dll
SHFileOperationA
SHFileOperationA
ShellExecuteA
ShellExecuteA
SHELL32.dll
SHELL32.dll
RegEnumKeyA
RegEnumKeyA
RegCreateKeyExA
RegCreateKeyExA
RegCloseKey
RegCloseKey
RegDeleteKeyA
RegDeleteKeyA
RegOpenKeyExA
RegOpenKeyExA
ADVAPI32.dll
ADVAPI32.dll
COMCTL32.dll
COMCTL32.dll
ole32.dll
ole32.dll
VERSION.dll
VERSION.dll
verifying installer: %d%%
verifying installer: %d%%
hXXp://nsis.sf.net/NSIS_Error
hXXp://nsis.sf.net/NSIS_Error
... %d%%
... %d%%
~nsu.tmp
~nsu.tmp
%u.%u%s%s
%u.%u%s%s
RegDeleteKeyExA
RegDeleteKeyExA
%s=%s
%s=%s
*?|/":
*?|/":
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll
"%Program Files%\ministry\assigned.exe"
"%Program Files%\ministry\assigned.exe"
md.dll
md.dll
.reloc
.reloc
EnumWindows
EnumWindows
ExecCmd.dll
ExecCmd.dll
Kernel32.DLL
Kernel32.DLL
e%uy%u
e%uy%u
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp
nsy7.tmp
nsy7.tmp
rogram Files\ministry\assigned.exe"
rogram Files\ministry\assigned.exe"
q assigned.exe" | %SystemRoot%\System32\find /I "assigned.exe"
q assigned.exe" | %SystemRoot%\System32\find /I "assigned.exe"
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp
\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp
"%Program Files%\crystallization\klar.exe"
"%Program Files%\crystallization\klar.exe"
%Program Files%\crystallization
%Program Files%\crystallization
klar.exe
klar.exe
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb6.tmp
CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb6.tmp
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\
%Program Files%\crystallization\klar.exe
%Program Files%\crystallization\klar.exe
Software\Microsoft\Windows\CurrentVersion\Run
Software\Microsoft\Windows\CurrentVersion\Run
Nullsoft Install System v2.46
Nullsoft Install System v2.46
allization\klar.exe"
allization\klar.exe"
istry\assigned.exe"
istry\assigned.exe"