Dropped.Trojan.Generic.17338822_db5758991e

Dynamic Analysis

Payload

No specific payload has been found.

Process activity

The Dropped creates the following process(es):

taskkill.exe:908
taskkill.exe:1944
%original file name%.exe:1736
tasklist.exe:1080
tasklist.exe:312
tasklist.exe:628
tasklist.exe:252
tasklist.exe:1896
tasklist.exe:172
tasklist.exe:492
tasklist.exe:1616
tasklist.exe:232
tasklist.exe:1652
tasklist.exe:1676
tasklist.exe:1564
tasklist.exe:1212
tasklist.exe:468
tasklist.exe:140
tasklist.exe:560
tasklist.exe:264
tasklist.exe:160
tasklist.exe:236
tasklist.exe:1976
tasklist.exe:644
tasklist.exe:1764
klar.exe:1904
30973.exe:1276
79142644.exe:1320
find.exe:216
find.exe:1320
find.exe:1208
find.exe:748
find.exe:272
find.exe:236
find.exe:1712
find.exe:1884
find.exe:1612
find.exe:324
find.exe:1676
find.exe:1752
find.exe:1132
find.exe:1336
find.exe:264
find.exe:224
find.exe:1760
find.exe:2044
find.exe:1992
find.exe:1556
find.exe:644
find.exe:2008
find.exe:1764

The Dropped injects its code into the following process(es):

assigned.exe:212

Mutexes

The following mutexes were created/opened:No objects were found.

File activity

The process %original file name%.exe:1736 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Start Menu\Programs\Startup\slippery.lnk (487 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\AccessControl.dll (13 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\30973.exe (1082 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\ShellLink.dll (4 bytes)
%WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%WinDir%\assigned.exe (4387 bytes)
%Documents and Settings%\%current user%\Local Settings\Application Data\79142644.exe (3083 bytes)
%Program Files%\ministry\assigned.exe (4387 bytes)
%WinDir%\settings.dll (10219 bytes)
%Program Files%\ministry\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
%Program Files%\crystallization\klar.exe (1036 bytes)
%Program Files%\ministry\settings.dll (10219 bytes)
%System%\drivers\etc\hosts (123 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\System.dll (11 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\ShellLink.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nst1.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\AccessControl.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\System.dll (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp (0 bytes)

The process klar.exe:1904 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy7.tmp\ExecCmd.dll (4 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsy7.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsb6.tmp (0 bytes)

The process 30973.exe:1276 makes changes in the file system.

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx3.tmp (0 bytes)

The process 79142644.exe:1320 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SimpleFC.dll (5289 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsi4.tmp (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SimpleFC.dll (0 bytes)

The process assigned.exe:212 makes changes in the file system.

The Dropped creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\logo[1].png (3 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\noad[1].xml (73 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[2].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CATH9SJY.xml (825 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[1].xml (694 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CALG9QV7.xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[4].xml (687 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAO9X9NF.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\count[1].htm (47 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CAKLQRSP.xml (713 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[4].xml (503 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAKKO4BV.xml (756 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
%Documents and Settings%\%current user%\Cookies\index.dat (5444 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[1].xml (692 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[3].xml (575 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (556 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\index5[1].htm (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[3].xml (648 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (812 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[4].xml (693 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[5].xml (691 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA57VGKC.xml (810 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (295 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\lbg[1].png (200 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[2].js (1353 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA8NEFUR.xml (771 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA5OP85J.xml (725 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[2].xml (130 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\page-1[1].htm (5002 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2J452J.xml (722 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\wau-widget[1].png (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[7].xml (607 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CA6DE709.xml (765 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[2].xml (707 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA1JGXHY.xml (808 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\analytics[1].js (2168 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[5].xml (616 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAQRWXYZ.xml (811 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (611 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CAOTG8KB.xml (774 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (728 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAKPQNCT.xml (710 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[2].xml (82 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\jwplayer1[1].js (69987 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[4].xml (628 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[2].xml (704 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2BUBE5.gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[1].xml (144 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[2].xml (633 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA490JGR.xml (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[1].xml (803 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[3].xml (144 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (290 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[5].xml (762 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[5].xml (800 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[1].js (392 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\ova-jw[1].swf (36761 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\itd[1].htm (1118 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[3].xml (599 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[2].txt (323 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAC9MZ0D.xml (759 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\v[1].xml (654 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\collect[1].gif (35 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (186 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\player1[1].swf (12413 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\player1[1].swf (15193 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[6].xml (645 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (172 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\func[1].js (3 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA56KLV5.xml (807 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[2].css (1 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\desktop.ini (67 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[1].css (659 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\page-1[1].htm (3950 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\1[1].gif (49 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\logo[1].png (723 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[6].xml (719 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[6].xml (716 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[3].xml (652 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[1].xml (616 bytes)

The Dropped deletes the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\collect[1].gif (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[1].js (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\player1[1].swf (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\bck[1].htm (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[1].css (0 bytes)
%Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (0 bytes)
%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\page-1[1].htm (0 bytes)
%Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (0 bytes)

Registry activity

The process taskkill.exe:908 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "92 B3 AB 6A B1 EE 9A 9B AC D5 DB C2 FE 1E 91 5B"

The process taskkill.exe:1944 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6C CC 86 67 91 46 CF B2 8C F6 D6 0E 03 BC C2 FB"

The process %original file name%.exe:1736 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Start Menu" = "%Documents and Settings%\All Users\Start Menu"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Personal" = "%Documents and Settings%\%current user%\My Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonMusic" = "%Documents and Settings%\All Users\Documents\My Music"
"Common Desktop" = "%Documents and Settings%\All Users\Desktop"
"Common Documents" = "%Documents and Settings%\All Users\Documents"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"My Pictures" = "%Documents and Settings%\%current user%\My Documents\My Pictures"

"Start Menu" = "%Documents and Settings%\%current user%\Start Menu"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"CommonVideo" = "%Documents and Settings%\All Users\Documents\My Videos"
"CommonPictures" = "%Documents and Settings%\All Users\Documents\My Pictures"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0E 4D 08 AF CB 11 53 3E 3E B9 7F 2C 6E 0D E8 61"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common Programs" = "%Documents and Settings%\All Users\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Desktop" = "%Documents and Settings%\%current user%\Desktop"
"Programs" = "%Documents and Settings%\%current user%\Start Menu\Programs"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"insupportable" = "%Program Files%\ministry\assigned.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hajji" = "%Program Files%\ministry\assigned.exe"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"forestland" = "%Program Files%\ministry\assigned.exe"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"eales" = "%Program Files%\ministry\assigned.exe"

The process tasklist.exe:1080 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "12 29 95 7B B4 BB 4E 80 1C 71 7F C3 9A 27 64 AB"

The process tasklist.exe:312 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E7 41 83 F4 4B 65 16 6B 31 C3 E4 6F 29 EF CD D5"

The process tasklist.exe:628 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A0 6B A9 48 DF 20 33 C0 82 38 C2 EE 6A 9B F4 CB"

The process tasklist.exe:252 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D 76 56 B2 0B FA E5 01 00 56 B8 8A 52 3C F3 03"

The process tasklist.exe:1896 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "70 FD 18 00 87 A8 D5 63 AE EE 65 CB 7E 3D 00 74"

The process tasklist.exe:172 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4A 46 4E 3F EC D9 F3 EC 7B F5 5C 88 93 1B 23 EC"

The process tasklist.exe:492 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4F 19 93 AD 6D 93 88 B2 B1 DD 8D 54 45 87 57 9E"

The process tasklist.exe:1616 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BD 51 A9 11 B7 83 9D 00 9B 25 9E DF 4C 5C AB 2C"

The process tasklist.exe:232 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "45 2B 9C E3 7F 4F C9 0D B0 43 E8 AF AB C6 83 1E"

The process tasklist.exe:1652 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "20 4C 03 15 EE E8 19 CC 31 BE 2B D7 74 8A E0 C3"

The process tasklist.exe:1676 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "8C 17 84 68 8A 4F EB 65 45 9A F1 04 1D B9 70 7C"

The process tasklist.exe:1564 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EB 56 C5 B3 A1 11 41 7C FF 2C C0 1B 4C 8F BA 3C"

The process tasklist.exe:1212 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9A 43 0C 93 EF F9 2F 3A 91 8B 98 CD 3D 8A 19 EF"

The process tasklist.exe:468 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 B4 E8 A3 A2 45 97 52 C3 94 F9 40 55 30 A0 20"

The process tasklist.exe:140 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0A 27 8F C5 2E 1D A5 64 97 91 AC B2 43 50 93 E0"

The process tasklist.exe:560 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E A1 FA 69 B0 C6 E2 89 99 5A C4 31 EA 85 90 D6"

The process tasklist.exe:264 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "5A 2E 97 98 E9 AD 7A 60 88 F1 84 9E 47 0D CC CA"

The process tasklist.exe:160 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "67 DD 68 AE D7 0B 94 8D 41 D1 5D 16 18 4C 09 4D"

The process tasklist.exe:236 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "52 CA 9F 97 A6 B3 7E 6C E7 4C 7A C0 C3 34 5A B8"

The process tasklist.exe:1976 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E DF 47 0D CB BC D1 C5 0D 11 FE 29 93 FF 5F 1E"

The process tasklist.exe:644 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "51 A8 2B 1A 4C 3A 55 D5 7B 45 80 0B C1 1A 64 8C"

The process tasklist.exe:1764 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6E 48 E8 2C 5D 77 A7 C6 0A 93 33 21 75 AC 10 84"

The process klar.exe:1904 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1E 49 1F ED 5D FC E2 F7 9D 07 7B 1F 15 03 53 27"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

To automatically run itself each time Windows is booted, the Dropped adds the following link to its file to the system registry autorun key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"tassel" = "%Program Files%\ministry\assigned.exe"

"klar" = "%Program Files%\crystallization\klar.exe"

The process 30973.exe:1276 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "49 B4 1A 6A E8 75 DA 0A 94 3C 14 2D E0 AA D1 97"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process 79142644.exe:1320 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 01 1D 0E 79 D4 5B CB D5 51 84 38 3B 1C EC FF"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

The process assigned.exe:212 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CachePath" = "%USERPROFILE%\Local Settings\History\History.IE5\MSHist012016091320160914\"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd72-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Directory" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path4]
"CacheLimit" = "65452"
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache4"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CacheLimit" = "8192"

[HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache]
"@xpsp3res.dll,-20001" = "Diagnose Connection Problems..."

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd73-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path2]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache2"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CacheOptions" = "11"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c155cd75-744b-11e2-8294-806d6172696f}]
"BaseClass" = "Drive"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKLM\System\CurrentControlSet\Hardware Profiles\0001\Software\Microsoft\windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "3C 00 00 00 1A 00 00 00 01 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Local AppData" = "%Documents and Settings%\%current user%\Local Settings\Application Data"

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "9F 5D 64 D1 08 7F 56 19 26 12 C7 89 F0 1A 41 FE"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path1]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache1"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CacheLimit" = "65452"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MigrateProxy" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b98117e8-75ca-11e2-81b2-000c293708fb}]
"BaseClass" = "Drive"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths\path3]
"CachePath" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\Cache3"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths]
"Paths" = "4"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012016091320160914]
"CacheRepair" = "0"
"CachePrefix" = ":2016091320160914:"

The Dropped modifies IE settings for security zones to map all local web-nodes with no dots which do not refer to any zone to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "1"

The Dropped modifies IE settings for security zones to map all web-nodes that bypassing the proxy to the Intranet Zone:

"ProxyBypass" = "1"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Dropped modifies IE settings for security zones to map all urls to the Intranet Zone:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName" = "1"

The Dropped deletes the following registry key(s):

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012014031720140318]

The Dropped deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"
"ProxyServer"
"ProxyOverride"

The process find.exe:216 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "BB D6 26 0A 10 08 89 B1 92 E7 FE 8D A4 8C A2 DE"

The process find.exe:1320 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "D3 AD 7C 14 C1 2C 60 02 25 AF 15 F3 E8 08 48 4C"

The process find.exe:1208 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "44 3D 39 B4 83 D0 B2 5E 2D BB 79 06 DD F7 0D 57"

The process find.exe:748 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "29 F3 8F F2 CA 46 33 28 28 DB D8 60 E7 00 64 BF"

The process find.exe:272 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3C 19 A8 2D 3B 43 03 7A AF FB FE 03 9E F0 2F 62"

The process find.exe:236 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "1D A3 5A 24 F3 15 9A F1 98 C3 EA BE 1E 55 8A 88"

The process find.exe:1712 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "79 3B 49 D2 57 CD E3 1B 95 F2 63 7F AB 8D 5E 63"

The process find.exe:1884 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "7E B8 13 A0 1A F5 CE 09 63 38 30 7D A9 9E B2 C3"

The process find.exe:1612 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "76 85 22 C4 47 A1 79 A7 B6 71 01 4D 8D 9D 7F 0C"

The process find.exe:324 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "EF E3 28 00 14 82 C9 E9 47 02 1F E7 E4 32 D4 30"

The process find.exe:1676 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 F9 43 9C 57 D4 32 96 83 93 02 49 CA A7 F8 B0"

The process find.exe:1752 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "01 C5 DE 81 17 5B 2A 40 5E CE CA 07 CC 79 45 AD"

The process find.exe:1132 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "78 C5 63 B9 DB 94 BF 8B 42 F0 76 0A 44 E4 4E 3F"

The process find.exe:1336 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "6A 29 3F B8 04 C7 6A E9 27 AC 19 8E F9 C3 30 B5"

The process find.exe:264 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "E0 D0 A8 5F 54 10 B4 17 5E 1E 1E E9 B4 8B 97 C3"

The process find.exe:224 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FB 45 A6 58 85 63 32 9E 54 CB 5A D7 AF 5D 43 EA"

The process find.exe:1760 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A8 98 CB 7D D1 25 E8 C3 28 D4 07 6A 7E 18 0E C0"

The process find.exe:2044 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "04 D5 05 C5 81 1C 06 61 B2 E8 9F 1A 58 9F 57 DD"

The process find.exe:1992 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3E 69 E9 5E AB E6 C5 0F 67 9D 88 C9 45 E6 67 DC"

The process find.exe:1556 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "DA 5C D0 B6 AB DD FA 9B 48 1D B7 FB 80 99 38 59"

The process find.exe:644 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "0D BE D2 18 96 67 F2 59 78 45 B9 30 6A 65 E6 06"

The process find.exe:2008 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A6 A8 72 95 16 14 90 0B C7 5E 18 84 3E 88 45 4F"

The process find.exe:1764 makes changes in the system registry.

The Dropped creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "FD 6F 8E 88 D1 65 7C F5 E9 84 35 AA 6F D0 DE 88"

Dropped PE files

HOSTS file anomalies

The Dropped modifies "%System%\drivers\etc\hosts" file which is used to translate DNS entries to IP addresses. The modified file is 857 bytes in size. The following strings are added to the hosts file listed below:

Rootkit activity

No anomalies have been detected.

Propagation

Removals

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):

   taskkill.exe:908
   taskkill.exe:1944
   %original file name%.exe:1736
   tasklist.exe:1080
   tasklist.exe:312
   tasklist.exe:628
   tasklist.exe:252
   tasklist.exe:1896
   tasklist.exe:172
   tasklist.exe:492
   tasklist.exe:1616
   tasklist.exe:232
   tasklist.exe:1652
   tasklist.exe:1676
   tasklist.exe:1564
   tasklist.exe:1212
   tasklist.exe:468
   tasklist.exe:140
   tasklist.exe:560
   tasklist.exe:264
   tasklist.exe:160
   tasklist.exe:236
   tasklist.exe:1976
   tasklist.exe:644
   tasklist.exe:1764
   klar.exe:1904
   30973.exe:1276
   79142644.exe:1320
   find.exe:216
   find.exe:1320
   find.exe:1208
   find.exe:748
   find.exe:272
   find.exe:236
   find.exe:1712
   find.exe:1884
   find.exe:1612
   find.exe:324
   find.exe:1676
   find.exe:1752
   find.exe:1132
   find.exe:1336
   find.exe:264
   find.exe:224
   find.exe:1760
   find.exe:2044
   find.exe:1992
   find.exe:1556
   find.exe:644
   find.exe:2008
   find.exe:1764

2. Delete the original Dropped file.
   
3. Delete or disinfect the following files created/modified by the Dropped:

   %Documents and Settings%\%current user%\Start Menu\Programs\Startup\slippery.lnk (487 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\AccessControl.dll (13 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\30973.exe (1082 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\ShellLink.dll (4 bytes)
   %WinDir%\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
   %WinDir%\assigned.exe (4387 bytes)
   %Documents and Settings%\%current user%\Local Settings\Application Data\79142644.exe (3083 bytes)
   %Program Files%\ministry\assigned.exe (4387 bytes)
   %WinDir%\settings.dll (10219 bytes)
   %Program Files%\ministry\Microsoft.Win32.TaskScheduler.dll (8850 bytes)
   %Program Files%\crystallization\klar.exe (1036 bytes)
   %Program Files%\ministry\settings.dll (10219 bytes)
   %System%\drivers\etc\hosts (123 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy2.tmp\System.dll (11 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsy7.tmp\ExecCmd.dll (4 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temp\nsx5.tmp\SimpleFC.dll (5289 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\logo[1].png (3 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#govids.net\settings.sxx (193 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\noad[1].xml (73 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[2].xml (607 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CATH9SJY.xml (825 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[1].xml (694 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CALG9QV7.xml (800 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[4].xml (687 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAO9X9NF.xml (756 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\count[1].htm (47 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CAKLQRSP.xml (713 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[4].xml (503 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAKKO4BV.xml (756 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sxx (1076 bytes)
   %Documents and Settings%\%current user%\Cookies\index.dat (5444 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[1].xml (692 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[3].xml (575 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[1].txt (556 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\index5[1].htm (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[3].xml (648 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@statcounter[2].txt (812 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[4].xml (693 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[5].xml (691 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA57VGKC.xml (810 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@govids[2].txt (295 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\lbg[1].png (200 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[2].js (1353 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA8NEFUR.xml (771 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA5OP85J.xml (725 bytes)
   %Documents and Settings%\%current user%\Application Data\Macromedia\Flash Player\#SharedObjects\QEA5Z3QJ\govids.net\com.jeroenwijering.sxx (80 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[1].xml (144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[2].xml (130 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\page-1[1].htm (5002 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2J452J.xml (722 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\wau-widget[1].png (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[7].xml (607 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CA6DE709.xml (765 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[2].xml (707 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CA1JGXHY.xml (808 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\analytics[1].js (2168 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[5].xml (616 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\CAQRWXYZ.xml (811 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@statcounter[1].txt (611 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\CAOTG8KB.xml (774 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@tremorhub[2].txt (728 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAKPQNCT.xml (710 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[2].xml (82 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\jwplayer1[1].js (69987 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[4].xml (628 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@amung[1].txt (163 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[2].xml (704 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\CA2BUBE5.gif (49 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\crossdomain[1].xml (144 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[2].xml (633 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA490JGR.xml (759 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[1].xml (803 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\crossdomain[3].xml (144 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@www.govids[1].txt (290 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[5].xml (762 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[5].xml (800 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\counter[1].js (392 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\ova-jw[1].swf (36761 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\itd[1].htm (1118 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[3].xml (599 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[2].txt (323 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CAC9MZ0D.xml (759 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\v[1].xml (654 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\collect[1].gif (35 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@bruindorsett[1].txt (186 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\player1[1].swf (12413 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\player1[1].swf (15193 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\syncnoad[6].xml (645 bytes)
   %Documents and Settings%\%current user%\Cookies\Current_User@govids[1].txt (172 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\func[1].js (3 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\CA56KLV5.xml (807 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[2].css (1 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\desktop.ini (67 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\css1[1].css (659 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\YKCUY40K\page-1[1].htm (3950 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\1[1].gif (49 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\logo[1].png (723 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[6].xml (719 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\OVWN4Z0B\syncnoad[6].xml (716 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\LAX56M35\syncnoad[3].xml (652 bytes)
   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\2D8LYHA5\syncnoad[1].xml (616 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):

   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "insupportable" = "%Program Files%\ministry\assigned.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "hajji" = "%Program Files%\ministry\assigned.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "forestland" = "%Program Files%\ministry\assigned.exe"
   
   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "eales" = "%Program Files%\ministry\assigned.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "tassel" = "%Program Files%\ministry\assigned.exe"
   
   [HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
   "klar" = "%Program Files%\crystallization\klar.exe"

5. Restore the original content of the HOSTS file (%System%\drivers\etc\hosts): 127.0.0.1 localhost
   
6. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
7. Reboot the computer.
   

Static Analysis

VersionInfo

No information is available.

No information is available.

PE Sections

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 108
7bcde813c50a0b0e20e5f9f233bc3040
ca004345bdd1cb292744ed711de04d19
2a9af6bcab5eb49d9a62a6ea72cdd286
e4e8ea421895b321bea9afa16d8a6fb5
851b5de8d1e586ba0301b1027800dea8
54c304cd37a8ae6ce5c21d5a5240d80c
f4ae937348a591e02f7ccb79f47cdc1f
c27730e88a7e5003ff846e8f0e578968
023529d5b4f5db6fc3e123bf47ac15d6
8e38be8c510a94c0a96ee39bc32ed333
14055969428fc76bc66b28491ff90d63
2b8b2136bdf153f722ecd721fabcf1aa
9dec231998f0f3d8301aa5c1a6e0119f
0affe53e87c71d2b7f9066427a5d71e5
3f92282b316430f68d847ff93565f264
1f4ab1b0f88d2b1805bcfbdaa2c461f1
3fadc54dc0f9a4e6af4b370749973ec3
2d43a582840285217ab6adaf45ff8c22
4ad98fe1fd6a020f491e31eb4aa16205
562254cc7ac0f92876c4964400fb6cd7
a261aa83665bed04243da16ecade0df0
bea91233ff3a67b260b02a18d7cb54c2
b1a5b5b97ab40559c62f27923a7322c1
830674c88d54f6aa3c6f1bcf72147f75
fb9b2e8e0616dc9aecab4078c571a0f8
f3636d03e448990429c0cd25a2f93345

Network Activity

URLs

IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

Traffic

GET /5/10/logo.png HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: l.longtailvideo.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Cache-Control: max-age=604800

Content-Type: image/png

Date: Tue, 13 Sep 2016 15:57:13 GMT

Etag: "3015243340"

Expires: Tue, 20 Sep 2016 15:57:13 GMT

Last-Modified: Fri, 22 Jun 2012 18:10:31 GMT

Server: ECAcc (arn/46B0)

X-Cache: HIT

Content-Length: 1845

.PNG........IHDR...].........9.".....IDATh..Zo..E...e...*!.......RP....0H.|).Y...).4C.#H..2....g{.....GO.....A...(.?H....B..wf.....{.......cv..9sv...3g....A-.).8j......J..*.Ge9.@....Y u(.....k.Nt.3..yR....~*]. ...Y...v..........\.YO....0.....bZ.=...e..ji.g..S..Z.t.9?..N).]`.K !.....Y..?..<.h.v.<.........%..6.O.......R..g.}.i.?.Vh.....?..[..C{.h.-%......s.\..:.M.p.K..u.5....c...X.>..........m.........._.%.d9kL....t..t..N...#...|..VV.2...w.....X.W:^.:.S...n6....E=...$.i......(.j.}S...@.EmE./.....U.u.-.U\..../B......;..Q......@.9....=.'.~Jm0t<c.]...-....D...~......<...X....&....Ky%..j...[...Nk.6.....7.._.e!h...........T7(q..q..v.J=c.^..............--.>......=.....n."...("....0.Z..<... .q!.`.....N...Z....b.....g.,..UjA.j..7{.H...Pa.. /...l(...S.j.Q0.u`...LcthJ.. .BN..............P....e...BPZ...W.I...........Sc.j.!..'..d>c.....xV..2.i#.Z...#j >wa.......[.Y.../.6.g.j'.m...y..O.\..W.....ar.J~..B...0...........~1M....].......;f...>>$...h.{......>zpI/...!>........0...f..ez.....b..!.....X....R..H.l|.r9.#'....x..1.A.qy.......M......Y&}..I...-} ..X.....(..17(...EJ.l..T..(8;.`...8o.{..r@..]..Z.......^n...vy.3S....%^'....)..nDeg..'.1. $....C...x..t...x.d#.......t...?...N.N.............%`..Kc....#4.x....#.....9.ps.a.q........G..R..........B... .S.K$......]..2..-..Hn..t'....4UA9P..69Q.'.......2..d.<b.....{m....).dd...d.(..G.1`*.....<..ql.zs.On......j..$..Fnf.T.Y........}.z....N.ZS.]........U)..K...xJFf........S....&.bi..Mv.F..r....Z...`.~_........._ y.......(.b..f..m....R..k......se

<<< skipped >>>

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.44415039.1473782236; _gat=1

HTTP/1.1 200 OK

Date: Wed, 14 Sep 2016 00:02:57 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Wed, 16 Aug 2017 00:02:57 GMT

Connection: close

Content-Type: application/x-shockwave-flash

CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ.....8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d........ .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6....UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O............w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s....ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... ....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f....9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h).._..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....

<<< skipped >>>

GET /jwplayer1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 14 Sep 2016 00:02:54 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Thu, 02 Jun 2016 05:31:59 GMT

ETag: "4403af-25d37-53444eccf91c0"

Accept-Ranges: bytes

Content-Length: 154935

Cache-Control: max-age=2592000, public

Expires: Wed, 16 Aug 2017 00:02:54 GMT

Connection: close

Content-Type: text/javascript
var dtn = Date.parse(new Date().toString());..document.write(unescape(
'
>>

GET /draw/?w=colored&n=998&c=000000ffffff&p= HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Cookie: uid=CgH9JlfYIdUdNA7VDEHXAg==

Connection: Keep-Alive

Host: widgets.amung.us

HTTP/1.1 200 OK

Server: nginx/1.9.6

Date: Tue, 13 Sep 2016 15:57:09 GMT

Content-Type: image/png

Transfer-Encoding: chunked

Connection: keep-alive

Content-Disposition: filename=wau-widget.png

Expires: Thu, 13 Oct 2016 15:57:09 GMT

Cache-Control: max-age=2592000
593...PNG........IHDR...Q...........p....^PLTE...EEE???AAA......""";&l
t;=CCC......***abdWXZ..................GGG......'((..................u
vyEFGLLL......zzz,,,...kln...NNN>>>...............~~.vwx...hh
i.........OPQ.........ooo...............uvv...opp......UVV...RRR......
.........bcc...ijj}~~......dee..................]^^PPP.........TTTaaa.
.....{{{......HHHrss.........kllJJJ|||......YYY......OOO......DDD.....
.NOO.........@@@tttkkkvvv:::qqq...............FFF.....................
......?@@888666ppprrrSSS............BBB............MMM............000.
..lll......XYZ(((&&&hhhfff   cdeZ[\788...dddccc.........nnn.........ZZ
ZXXXVVV[[[mmm^^^\\\]]]```gggxxxjjj.t......tRNS.@..f....IDATH....?SQ..o
O=.a...2.....B. =()]b.......<...#..)K...B.s....s...n>.........|.
..s..g..EQ._...IO...d....Y.E.jw..~..8N..c.E..rtbd..h..X..e..yp``.<.
._..)..............z.X....h4.;?.:?...l......[...o^.jm1......Mz}c...s}#
.44......=..O.V[.....|.w......1.....}..w.`... ...-..."x.a.o.0.........
\.M.T...r.....F.2....jb....4..i.....I./.4.J4=...}....".R.[..\.]@.,....
.%a...A.tb.G3..T.(B.I...".bE'*UH..f....8~,...s..{.r.x\.e.....C%.......
...>..z....@.^.R.G....V....'..Z........|...oQE.h.......qQA.....r2..
...M|....@.*".u..n@ . *..L..P..zUD2....7..9...d......p._..C`Uk.$...Q\.
..8.....S.pY.j]...W......s.k.p.H.@..n....jkr..ju......$.%........E6)..
...&..,^.._...$...(..X.|H.7...}.....I..$....vz.$E.W.R...F.-....^.....R
/....`_Oz..g.......E. ..A.d...A&.......0a.s.....IEND.B`...0..
>>

GET /count.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&rand= HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.clangburkitt.info

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:09 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 47

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
......<meta http-equiv="refresh" content="300">HTTP/1.1 200 OK..
Date: Tue, 13 Sep 2016 15:57:09 GMT..Server: Apache/2.2.22 (Win64) PHP
/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 47..Keep-Alive: tim
eout=5, max=100..Connection: Keep-Alive..Content-Type: text/html......
..<meta http-equiv="refresh" content="300">..

GET /index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t= HTTP/1.1

Accept: */*

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.bruindorsett.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: text/html

Content-Length: 906

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Encoding: gzip

Date: Tue, 13 Sep 2016 15:57:08 GMT

Vary: Accept-Encoding

X-Cache: Miss from cloudfront

Via: 1.1 f507e21f7d1fb46eecab2dff9302173f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: EMQiproLLRs56VJhipCOXQEqUYNBrxJxI9YQoMEH8juVSRqlf3IYdA==
...........UMs.6..g&....I..?.%...q.O..4=..z...".$..`......^..l9=u.....
.}.....6.b^...........2.a19..2. .v..;.f.v.....jZ.bU.%.......d...f.V...
..}[C..T;......D.5,x...q9...V*....l...d4..U..Sr......{.;-I.k.3.x.n....
 Fg..d.....(..,W..&.#!..g....U{.r..\.L.|,n.......>...^...~..O..Ir..
2.$.!..\...^.X1.RR.( .... .s.C.&....,.......wr.... ......K..x]..m2...d
.a....3..FE..Q..V.......|...as.-...k..d.aT}.......Nf(..EhB....y...b.}V
...B.z."3...!C....X.;...._...C<g......qy.Dmg*..Hg..M.......H..'...f
..(.`7.5....B.......j>lnx.....er7..7.....\e.Y.....*..K.4~.Bi..0..).
{!s......Bo...zcC........y...{..^0s%&...7f..........N....3...pv<i@.
........0....g..nZ`..)..k>Z..N.k 2...O......d?q.`.%....Q.[..h..&x..
..\...w.JH.......x..2.L.Y%X&b. .z[.4..L.....<......... ...?P[e.A0{z
z...51..-..0b%j...J.9H...)..t;..$};<.k.N...Q....9F.9....@y....i..I&
lt;=..... Ncj.m..%.].........|u....d..gN...{.!q...Ug. ..............w.
...x..k..?..!n^.:.......


GET /func.js?r=5 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.bruindorsett.pw

Connection: Keep-Alive

HTTP/1.1 200 OK

Content-Type: application/javascript

Content-Length: 597

Connection: keep-alive

Server: Apache/2.2.22 (Win64) PHP/5.3.13

Last-Modified: Mon, 18 Jul 2016 15:25:49 GMT

ETag: "90000001e1520-f7a-537ea953f7333"

Accept-Ranges: bytes

Content-Encoding: gzip

Date: Fri, 19 Aug 2016 01:35:05 GMT

Vary: Accept-Encoding

Age: 447

X-Cache: Hit from cloudfront

Via: 1.1 f507e21f7d1fb46eecab2dff9302173f.cloudfront.net (CloudFront)

X-Amz-Cf-Id: BA8Y8YX6o_8A3QZ85T_rMXn710eO3SJF6jJXmZcm9KQzhmSHT4RxFA==
............MO.@...H..k/vJ.8....U U.R.q.z..N.......DU.{....-.G.>l&l
t;3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$........AU5^..{.]_M..:.]...
..Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.BrB.<......> .X.9...
...P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v&]..~..Bz_."..:.]... o..
.T.B...q....pC..B..qM...J.<J.....c]..s>...V:.......[a=..|..x.z..
...=.9%}.t......T........'..t...g.....L.. *.V2..p...rv.....F..x?W..*..
..........3_.q.q....S.~....7_e.G..P..7w..h..R ..$.w....H.41.W.n...D...
.wZ..x.ZG....6..:a.5!....t:O..:.5MvM...(...f.@..S.\.......SuY....:....
.....>...P..{|:.<.<...I...=........}..=...|.8.......{1z...HTT
P/1.1 200 OK..Content-Type: application/javascript..Content-Length: 59
7..Connection: keep-alive..Server: Apache/2.2.22 (Win64) PHP/5.3.13..L
ast-Modified: Mon, 18 Jul 2016 15:25:49 GMT..ETag: "90000001e1520-f7a-
537ea953f7333"..Accept-Ranges: bytes..Content-Encoding: gzip..Date: Fr
i, 19 Aug 2016 01:35:05 GMT..Vary: Accept-Encoding..Age: 447..X-Cache:
 Hit from cloudfront..Via: 1.1 f507e21f7d1fb46eecab2dff9302173f.cloudf
ront.net (CloudFront)..X-Amz-Cf-Id: BA8Y8YX6o_8A3QZ85T_rMXn710eO3SJF6j
JXmZcm9KQzhmSHT4RxFA==..............MO.@...H..k/vJ.8....U U.R.q.z..N..
.....DU.{....-.G.>l<3..wVyd.Dk.b.y..d..T.D...."W.<K.n4,X.$...
.....AU5^..{.]_M..:.].....Z P9.p9.F?....'...d.|..o..[e...8E...{.4.U.Br
B.<......> .X.9......P.B...i.J..L....V ..jr*n... ]v..g@.. .M.u.v
&]..~..Bz_."..:.]... o...T.B...q....pC..B..qM...J.<J.....c]..s>.
..V:.......[a=..|..x.z.....=.9%}.t......T........'..t...g.....L.. 
>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Tue, 13 Sep 2016 15:57:15 GMT

ETag: W/"144-1446501138000"

Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=rocketfuel,adapTV,centro,mediamath,TubeMogul-GP,_dmp_turbine,Videology,thetradedesk,appnexus,TapAd,videoamp,beeswax,eyeview,dataxu,google,ignitionone,tremornet,SundaySky,conversant,1,audiencescience,BidTheatre,dynadmic&uid=66c0e761009a4593b3aea4e8af5db5bf&init=true HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:16 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 502

Connection: keep-alive
...........RMo.@...W.H.-.bc'.`Q'.".mT.{."k`....]......u.......Y.|.....
v7..6\...G.7@QI.E.x.... o...WY^.i..F...m.m.Us...[.7]9.d.........3....:
...8c.4..A)...{c.M.c. ..b...X4c.4........& ..S9...jh.W.^TB.[h.....J..B
VN...f.0........P%....?\. ).>.... ..l.....ry#.%.R8fH.0P.........6..
..g(w...........\.q....PJ..3.v....TG..Aa.$.w.A.o]*..`-....8.`7.?rVl...
rJD...B{.......1.k....t...;..tZ.8..Ap...z\..a.WPG.....9..?.p....nc.k..
..]p..C...,......X....U...5?.....=.3L.{R..,4T[...=..........o)....C;.K
.......I3B.....HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: 
text/xml..Date: Tue, 13 Sep 2016 15:57:16 GMT..P3P: CP='This is not a 
P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: Apa
che-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 502..Connection
: keep-alive.............RMo.@...W.H.-.bc'.`Q'.".mT.{."k`....]......u.
......Y.|.....v7..6\...G.7@QI.E.x.... o...WY^.i..F...m.m.Us...[.7]9.d.
........3....:...8c.4..A)...{c.M.c. ..b...X4c.4........& ..S9...jh.W.^
TB.[h.....J..BVN...f.0........P%....?\. ).>.... ..l.....ry#.%.R8fH.
0P.........6....g(w...........\.q....PJ..3.v....TG..Aa.$.w.A.o]*..`-..
..8.`7.?rVl...rJD...B{.......1.k....t...;..tZ.8..Ap...z\..a.WPG.....9.
.?.p....nc.k....]p..C...,......X....U...5?.....=.3L.{R..,4T[...=......
....o)....C;.K.......I3B.........
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=google,conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:16 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1fc.............R.n.0... \..-Z.%.!.P.....A... 0F.X&,..I9..w..v.K....gy
.8.b..... .L.....J...U.=...f."}./..8.].a.(..%..9=..g.Qf..>SM`...nn.
..&..o...K..........V.Y.MZ.r.y...'..i.................4.'...W.N2../...
..!..f./..p.W.(...c."...u......>\..m._T...........V......],.pp.o..u
.../.GU.....t.8r.[2............a........0..(.y 9t../.;....`.\@.nC.....
...Q".W....$...8.3N..7z.ZS....t.NY.W.(..a<...#@.....^N...K.....g.2.
|.k....-kd.`[.....c....j\Ij.....l..fx|c'd............m..A....B...a.?..
@.....}......._/.98..DpZPZ....O...d........a..*.....0..HTTP/1.1 200 OK
..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 20
16 15:57:16 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorv
ideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-E
ncoding..transfer-encoding: chunked..Connection: keep-alive..1fc......
.......R.n.0... \..-Z.%.!.P.....A... 0F.X&,..I9..w..v.K....gy.8.b.....
 .L.....J...U.=...f."}./..8.].a.(..%..9=..g.Qf..>SM`...nn...&..o...
K..........V.Y.MZ.r.y...'..i.................4.'...W.N2../.....!..f./.
.p.W.(...c."...u......>\..m._T...........V......],.pp.o..u.../.GU..
...t.8r.[2............a........0..(.y 9t../.;....`.\@.nC........Q".W..
..$...8.3N..7z.ZS....t.NY.W.(..a<...#@.....^N...K.....g.2.|.k....-k
d.`[.....c....j\Ij.....l..fx|c'd............m..A....B...a.?..@.....}..
....._/.98..DpZPZ....O...d........a..*.....0......
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=conversant,TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:17 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 489

Connection: keep-alive
...........R.n.@... \.....?.....I..i.D.{.........vW....d'........!....
....X.d......,..r.{O.....'..e........J;s.W9.g....e....J..j..f...m.}..J
o.$JY/.~...M.e.u(..{......';....yz.K.....4O.Or...4../.F.R.....1..(....
.M..\..`8\.(.l=..q^..Mm.].......H.hG%...>`..%....5...DGx.....4-_.3.
...R...9..-..x.m.k.._.e..)Q:..d.d.d...k$0.K......"....B..().. ....!@h.
9..Q\1.W.6..xQ...I...$..k.......F8.....b...D.......?.....De5`.).;.....
.e~.x.....m..O........&.=-.T..(.t..{..R....?...........c.K......C4.g..
..HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Dat
e: Tue, 13 Sep 2016 15:57:17 GMT..P3P: CP='This is not a P3P policy. S
ee hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.
1..Vary: Accept-Encoding..Content-Length: 489..Connection: keep-alive.
............R.n.@... \.....?.....I..i.D.{.........vW....d'........!...
.....X.d......,..r.{O.....'..e........J;s.W9.g....e....J..j..f...m.}..
Jo.$JY/.~...M.e.u(..{......';....yz.K.....4O.Or...4../.F.R.....1..(...
..M..\..`8\.(.l=..q^..Mm.].......H.hG%...>`..%....5...DGx.....4-_.3
....R...9..-..x.m.k.._.e..)Q:..d.d.d...k$0.K......"....B..().. ....!@h
.9..Q\1.W.6..xQ...I...$..k.......F8.....b...D.......?.....De5`.).;....
..e~.x.....m..O........&.=-.T..(.t..{..R....?...........c.K......C4.g.
.......
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=TubeMogul-GP,ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:17 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 520

Connection: keep-alive
...........R...0.}.W.H..$!..%AY`%.m.....Z.I<...X............5g....3
.....sB.y%B...V.E^1.v..N.>M.Y.!..IzK..i.P.....1r.8FaY.}....t..V.L..
S....u./.(.Y'..)..U.%.6XF..m'I...=xi...v..U.||./.4~..... B.?.6".....,.
b.B...c.`..`<.\./.d<V..2.;..}..h....` ......5.........:V.....(`.
P....O....R.<...5.$(..b(..0."...A...R...J..,.q(....s.....9..~.3.SK.
JI0..3.[V...U..vk..h..8.y.{.......0...C.....5....^*U...V..L.....x.....
.9O}1.6E1SDY...../.....z.~........u.|....x....]H_i.J.P...D.\.J........
..L...Z.........qn../%....m...}. .....|-. ...HTTP/1.1 200 OK..Content-
Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:1
7 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/e
n/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..C
ontent-Length: 520..Connection: keep-alive.............R...0.}.W.H..$!
..%AY`%.m.....Z.I<...X............5g....3.....sB.y%B...V.E^1.v..N.&
gt;M.Y.!..IzK..i.P.....1r.8FaY.}....t..V.L..S....u./.(.Y'..)..U.%.6XF.
.m'I...=xi...v..U.||./.4~..... B.?.6".....,.b.B...c.`..`<.\./.d<
V..2.;..}..h....` ......5.........:V.....(`.P....O....R.<...5.$(..b
(..0."...A...R...J..,.q(....s.....9..~.3.SK.JI0..3.[V...U..vk..h..8.y.
{.......0...C.....5....^*U...V..L.....x......9O}1.6E1SDY...../.....z.~
........u.|....x....]H_i.J.P...D.\.J..........L...Z.........qn../%....
m...}. .....|-. .......
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=ignitionone,1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:18 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 469

Connection: keep-alive
...........RMo.0...Wd..[#;_M....v@.a j7;.E@KL"$..Iv..?:..}\v.#E=.=0...
...u..I......WB.M.<._...<../......6....'..{3c.[T...e.W.9g...9..v
I...*...8..4.a...]....J...^.?...x....6.O.i..eq....y...5-..kn...@......
!....(G.p.7.(...#..X..L.}.,@.)...x8...85z.K)..W...o.[.(..(...........u
...,D.O.*.........|.Q.V.P..T($(.[...(....%%.;..P.-...,.d..J(...-.....N
&<..I...0....! .p...(....5.....[[...}S?8@..5.}..Pzs.. ._...........
ai...N6..0............7d..n...]..o.....n..........d../....HTTP/1.1 200
 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep
 2016 15:57:18 GMT..P3P: CP='This is not a P3P policy. See hXXp://trem
orvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accep
t-Encoding..Content-Length: 469..Connection: keep-alive.............RM
o.0...Wd..[#;_M....v@.a j7;.E@KL"$..Iv..?:..}\v.#E=.=0......u..I......
WB.M.<._...<../......6....'..{3c.[T...e.W.9g...9..vI...*...8..4.
a...]....J...^.?...x....6.O.i..eq....y...5-..kn...@......!....(G.p.7.(
...#..X..L.}.,@.)...x8...85z.K)..W...o.[.(..(...........u...,D.O.*....
.....|.Q.V.P..T($(.[...(....%%.;..P.-...,.d..J(...-.....N&<..I...0.
...! .p...(....5.....[[...}S?8@..5.}..Pzs.. ._...........ai...N6..0...
.........7d..n...]..o.....n..........d../........


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=1,adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:18 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 463

Connection: keep-alive
...........RMo.0...Wd...".q.4..xi....av.CQ...$BjY.d7.......e'>RO...
...~.ud.lT.........j.x....so....Y^\hW..?*.p..wN/.p.....rR5..V{#...\k..
..Mv..q..4.n@k2C...Q.....<......i...........mVd..v..S<......T..4
...m}(...X....u....6...v6.. .b..j....2....1^K.....C}O....=pJ=u.^..2...
.`...#[..W*R.4..V!..a..^...bX.J......X..x.NJ"..GF.0...a.:C..........-o
.E.O.Q..7..n....B..v....>=.....;c.......U'/...R.z.....S...}....\D..
.o%;.....xv`fa.:...ul.e...".d...x.....Z..........~.....HTTP/1.1 200 OK
..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 20
16 15:57:18 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorv
ideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-E
ncoding..Content-Length: 463..Connection: keep-alive.............RMo.0
...Wd...".q.4..xi....av.CQ...$BjY.d7.......e'>RO......~.ud.lT......
...j.x....so....Y^\hW..?*.p..wN/.p.....rR5..V{#...\k....Mv..q..4.n@k2C
...Q.....<......i...........mVd..v..S<......T..4...m}(...X....u.
...6...v6.. .b..j....2....1^K.....C}O....=pJ=u.^..2....`...#[..W*R.4..
V!..a..^...bX.J......X..x.NJ"..GF.0...a.:C..........-o.E.O.Q..7..n....
B..v....>=.....;c.......U'/...R.z.....S...}....\D...o%;.....xv`fa.:
...ul.e...".d...x.....Z..........~.........


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=adapTV,dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:19 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 482

Connection: keep-alive
...........R.n.@.}.W.H....o.....d.j....(..v.W6.jw!..;8n..T.i....9s4..\
.z.*. .Z...z(..q...m..4.....)N..m.....s.Z.c..q...R.:..U.h-...k........
^YQ..^.|W %..KZm.....^.<..{.24f)...6Q..y.....:N.2.......\T....p....
.3.e..;...s}..Q.X1.....sm..om...O.au..mW?.Q...>R.-6._.......`.8..:.
...(...$.`.&...k.....Kd.J0........@I.._.L..D@).. cFq.J.3....~M.N&.....
.w0......#.A1f.8 ^^.......*....m.` ...$..U...^..u....v.......$.....c.E
.U....uw\N.,.....7...ie f. ?.q>4..&......._Z8..F.uu#.!@............
.HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date
: Tue, 13 Sep 2016 15:57:19 GMT..P3P: CP='This is not a P3P policy. Se
e hXXp://tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1
..Vary: Accept-Encoding..Content-Length: 482..Connection: keep-alive..
...........R.n.@.}.W.H....o.....d.j....(..v.W6.jw!..;8n..T.i....9s4..\
.z.*. .Z...z(..q...m..4.....)N..m.....s.Z.c..q...R.:..U.h-...k........
^YQ..^.|W %..KZm.....^.<..{.24f)...6Q..y.....:N.2.......\T....p....
.3.e..;...s}..Q.X1.....sm..om...O.au..mW?.Q...>R.-6._.......`.8..:.
...(...$.`.&...k.....Kd.J0........@I.._.L..D@).. cFq.J.3....~M.N&.....
.w0......#.A1f.8 ^^.......*....m.` ...$..U...^..u....v.......$.....c.E
.U....uw\N.,.....7...ie f. ?.q>4..&......._Z8..F.uu#.!@............
.....
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dataxu,tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:19 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1da.............R]..0.|.....[.p..CIP.TB..*...N...7..8......p.....!.Ygv
w<.`v....h#j.:..sz Y.....&..q...w.c..W.MG.Bi.6tJk......u.... b.rzvj
,......Y.p. ..(...R..,i..*J...$.........t.Y.....|....e...J...1..L.....
...Gs`...GcoLoG.o8,F.....*|..`?.....z_o[....)..f.).p.pD..%......4..;.&
lt;a ...$...Mv] .J. ..V....-...<-...Lr.s.'D.N.......c.x.2..\H.7x...
yp;.x....w.|H..`B...~^<?G.........D..}..x}...3..Jw ...a.^~yX.u....M
.mV..av,....e..y.....U.4.n.H..5z.}..F.=:@..j.v(xy@......r%._Z.........
...d.. .....n]J......0..HTTP/1.1 200 OK..Content-Encoding: gzip..Conte
nt-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:19 GMT..P3P: CP='This 
is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Se
rver: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: chu
nked..Connection: keep-alive..1da.............R]..0.|.....[.p..CIP.TB.
.*...N...7..8......p.....!.Ygvw<.`v....h#j.:..sz Y.....&..q...w.c..
W.MG.Bi.6tJk......u.... b.rzvj,......Y.p. ..(...R..,i..*J...$.........
t.Y.....|....e...J...1..L........Gs`...GcoLoG.o8,F.....*|..`?.....z_o[
....)..f.).p.pD..%......4..;.<a ...$...Mv] .J. ..V....-...<-...L
r.s.'D.N.......c.x.2..\H.7x...yp;.x....w.|H..`B...~^<?G.........D..
}..x}...3..Jw ...a.^~yX.u....M.mV..av,....e..y.....U.4.n.H..5z.}..F.=:
@..j.v(xy@......r%._Z............d.. .....n]J......0......
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=tremornet,Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:19 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 498

Connection: keep-alive
...........R...0.}.W.H..$...(..r..VmE..a.BN<!...l'.................
`~..^.J3)Bkh.V.D.)......OSk.}.^.$....4.(...ViL5s...KU...K.h]Y=3...Z...
/.xiEAL{Q.M....yI...(...%...y.^Ic...n......e...7..(#.!.7.V.B.:W..>.
.. ..i6....0...W...i.....Q.'yh...).(B..>..-4....]..Zw......_.Fr.FI.
I-(i.cW...P.r..(#......i..[F'..grA.tM.^!LI.S.{....U...j.e2.]x..]....G/
...1LI.......(p~Ul..T..G.}...3...P..Y...Kyd...vi.|.I........u'....J.[w
.....?...v.A...........J.......B5Y......5#..*....W..Hc.....';?.p./...&
g.]..........#...HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type
: text/xml..Date: Tue, 13 Sep 2016 15:57:19 GMT..P3P: CP='This is not 
a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: A
pache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 498..Connecti
on: keep-alive.............R...0.}.W.H..$...(..r..VmE..a.BN<!...l'.
................`~..^.J3)Bkh.V.D.)......OSk.}.^.$....4.(...ViL5s...KU.
..K.h]Y=3...Z.../.xiEAL{Q.M....yI...(...%...y.^Ic...n......e...7..(#.!
.7.V.B.:W..>... ..i6....0...W...i.....Q.'yh...).(B..>..-4....]..
Zw......_.Fr.FI.I-(i.cW...P.r..(#......i..[F'..grA.tM.^!LI.S.{....U...
j.e2.]x..]....G/...1LI.......(p~Ul..T..G.}...3...P..Y...Kyd...vi.|.I..
......u'....J.[w.....?...v.A...........J.......B5Y......5#..*....W..Hc
.....';?.p./...&g.]..........#.......
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=Videology,thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:20 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1b9.............RMo.@...WP..V.c...`Q'."EmUp{."k`..rXV..1...r.~\z..3o..
<M.=..NG..FF.l.....A!."w.}|.r....{.f...@.Fi66r k.......U.O....Q.c7.
.mM.~.rHn.8L......"=...X..l.u..k..&G..3x.........$K..r...<../.^....
j.Q@..9...................DE."......]...N..#.Q..5.lQ.)d.1p. iu. m%B..{
..K.Z..kB.5.....YE.c.#'2/pb....j.0.. ....`[..I..._.....3._."X..9.,h.e.
y....q..................m.D..(..t:..T.-...u0...F...].4..6.8.i^Vtd.0..y
%`f..8.m.v..a....]..o_x....q.6.)..e..@......9........0..HTTP/1.1 200 O
K..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2
016 15:57:20 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremor
video.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-
Encoding..transfer-encoding: chunked..Connection: keep-alive..1b9.....
........RMo.@...WP..V.c...`Q'."EmUp{."k`..rXV..1...r.~\z..3o..<M.=.
.NG..FF.l.....A!."w.}|.r....{.f...@.Fi66r k.......U.O....Q.c7..mM.~.rH
n.8L......"=...X..l.u..k..&G..3x.........$K..r...<../.^....j.Q@..9.
..................DE."......]...N..#.Q..5.lQ.)d.1p. iu. m%B..{..K.Z..k
B.5.....YE.c.#'2/pb....j.0.. ....`[..I..._.....3._."X..9.,h.e.y....q..
................m.D..(..t:..T.-...u0...F...].4..6.8.i^Vtd.0..y%`f..8.m
.v..a....]..o_x....q.6.)..e..@......9........0......
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=thetradedesk,eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:21 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1c6.............R.n.0... T.....?.....I..E.TJ{..cE.,"%E..b.}W...q.ig.!g
v....~.=Z'[...4.....R......~.n.7...(....F..[.4l.7k..E......U.9..~.<
...../..:..\.Y...1h....G....AQ.%...(....._o.....:/......5....;h.[.. E.
.:...*..|.-.r.G.Y=...z11)..K|~w.%O....a'$......p.....N.......4.š.B..
... E. ./j*D...B....2.K0......|g .q.....Gx........Y5..9..^.jQ...Y.....
.....Y........vO......f{..$.x/v.4_....72.'.....I.V..n...%[K.....f.'...
Y.&h.nz........d....uUh-N.g?.........=......0..HTTP/1.1 200 OK..Conten
t-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57
:21 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com
/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding.
.transfer-encoding: chunked..Connection: keep-alive..1c6.............R
.n.0... T.....?.....I..E.TJ{..cE.,"%E..b.}W...q.ig.!gv....~.=Z'[...4..
...R......~.n.7...(....F..[.4l.7k..E......U.9..~.<...../..:..\.Y...
1h....G....AQ.%...(....._o.....:/......5....;h.[.. E..:...*..|.-.r.G.Y
=...z11)..K|~w.%O....a'$......p.....N.......4.š.B..... E. ./j*D...B.
...2.K0......|g .q.....Gx........Y5..9..^.jQ...Y..........Y........vO.
.....f{..$.x/v.4_....72.'.....I.V..n...%[K.....f.'...Y.&h.nz........d.
...uUh-N.g?.........=......0......


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=eyeview,appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:21 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
198............dRMo.0...Wx..."...4..xi....bv.CQ..D7B'Y.d7..c.4.....#.D
*_...`D.d..0.Ea...B.."|h>.\...]....3.rO.B.......%c....vhg.W.9..~.&l
t;.....o..&,.J.e...1h.^=9..l..A]....<..D...........j...8..k.4.g....
A...E.].-.E,.$.2.J.h>..2....S.....}.\. $...?..p.....A.......4.š.B
...%.I.f.@j.i.. ...R`...l.T..F(...m....df...*......z...!..t.h..{z*s..2
n....;.....'.%..p..PF.C.c..2........t.......R..l.=.7....Gl..ag2...;..N
y.^....d.. ....^j{Dh.....0..HTTP/1.1 200 OK..Content-Encoding: gzip..C
ontent-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:21 GMT..P3P: CP='T
his is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'
..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding:
 chunked..Connection: keep-alive..198............dRMo.0...Wx..."...4..
xi....bv.CQ..D7B'Y.d7..c.4.....#.D*_...`D.d..0.Ea...B.."|h>.\...]..
..3.rO.B.......%c....vhg.W.9..~.<.....o..&,.J.e...1h.^=9..l..A]....
<..D...........j...8..k.4.g....A...E.].-.E,.$.2.J.h>..2....S....
.}.\. $...?..p.....A.......4.š.B...%.I.f.@j.i.. ...R`...l.T..F(...m.
...df...*......z...!..t.h..{z*s..2n....;.....'.%..p..PF.C.c..2........
t.......R..l.=.7....Gl..ag2...;..Ny.^....d.. ....^j{Dh.....0...
...


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=appnexus,audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:21 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 428

Connection: keep-alive
...........RMo.0...Wx...".q.4........0;..(......,Hr...1F......(=...L..
....X........j:....7....?..$......N4*Tv.R...^2......z.t.Y.}.-........-
n.,)..%..h.....u(.j....K.^.....`..........*...4..H.....jT.<7..sl...
Y.... ..(.f.6...v>.).\..h.1..Z5.......0.O.a>(.R4.%r........=.I..
F..p$t..;..`.....\...M-.Nz...M..q..7..of..."\@;...n........1....QO....
..........uq......8*=k[Km....e...5............4Otew.......a.2...{9.:..
7.O......h.......HTTP/1.1 200 OK..Content-Encoding: gzip..Content-Type
: text/xml..Date: Tue, 13 Sep 2016 15:57:21 GMT..P3P: CP='This is not 
a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..Server: A
pache-Coyote/1.1..Vary: Accept-Encoding..Content-Length: 428..Connecti
on: keep-alive.............RMo.0...Wx...".q.4........0;..(......,Hr...
1F......(=...L......X........j:....7....?..$......N4*Tv.R...^2......z.
t.Y.}.-........-n.,)..%..h.....u(.j....K.^.....`..........*...4..H....
.jT.<7..sl...Y.... ..(.f.6...v>.).\..h.1..Z5.......0.O.a>(.R4
.%r........=.I..F..p$t..;..`.....\...M-.Nz...M..q..7..of..."\@;...n...
.....1....QO..............uq......8*=k[Km....e...5............4Otew...
....a.2...{9.:..7.O......h...........


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=audiencescience,centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:22 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
1b2.............RMo.0...Wx...,9.h......Rt.0...(...k..lHr...)Y....'>
QO..#..^.pv.4.e..>u..M..|..............:.f..}(..dng.. .(.....ozA..\
.,..3...|.-.n...........TN.....[.,...9y,Z.....n....j]T......H ....$...
[*...[.56...QB......mdC.......Q.....%..|.,f..&xc.@.A..,..Y.!...P#....h
... .. ..f...akFUs..h.$IC.".(..(.....".C..:....<%/..R.W....4...t.}.
.\.a4......P?.......v.......v.t....y.P...............<])....>.&l
t;....eV..'.hW;;.m....9..__....[r2,.%..e..@........m......0..HTTP/1.1 
200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 
Sep 2016 15:57:22 GMT..P3P: CP='This is not a P3P policy. See hXXp://t
remorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Ac
cept-Encoding..transfer-encoding: chunked..Connection: keep-alive..1b2
.............RMo.0...Wx...,9.h......Rt.0...(...k..lHr...)Y....'>QO.
.#..^.pv.4.e..>u..M..|..............:.f..}(..dng.. .(.....ozA..\.,.
.3...|.-.n...........TN.....[.,...9y,Z.....n....j]T......H ....$...[*.
..[.56...QB......mdC.......Q.....%..|.,f..&xc.@.A..,..Y.!...P#....h...
 .. ..f...akFUs..h.$IC.".(..(.....".C..:....<%/..R.W....4...t.}..\.
a4......P?.......v.......v.t....y.P...............<])....>.<.
...eV..'.hW;;.m....9..__....[r2,.%..e..@........m......0......
>>

GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=centro,SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:23 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
198.............._o.0....).......i.D,..J.Z..=TUt...Jm,.....&...y......
.O..|/.... :...8.=TM..z.......?......:...6jTv.2....1....l.z.t.Y.}.....
...v....<-...?.h..P..u(......]..6......~u......EU<..4...A..r....
.......Pc3.y.%A..Q.L&mDK..x...W..r;|.X.A...!)....6.?.^m.(........Np.@j
.......R.]oj.p.......2......jRO.!.).1...}|.S.'.....K ..<...m...Q).u
.$..B...mV.._oW...?...n.6h..ey.0. vh.2O.....2.l.{,w..%7.u..f....m.4..o
.S..e........$.?.y.....0..HTTP/1.1 200 OK..Content-Encoding: gzip..Con
tent-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:23 GMT..P3P: CP='Thi
s is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'..
Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding: c
hunked..Connection: keep-alive..198.............._o.0....).......i.D,.
.J.Z..=TUt...Jm,.....&...y.......O..|/.... :...8.=TM..z.......?......:
...6jTv.2....1....l.z.t.Y.}........v....<-...?.h..P..u(......]..6..
....~u......EU<..4...A..r...........Pc3.y.%A..Q.L&mDK..x...W..r;|.X
.A...!)....6.?.^m.(........Np.@j.......R.]oj.p.......2......jRO.!.).1.
..}|.S.'.....K ..<...m...Q).u.$..B...mV.._oW...?...n.6h..ey.0. vh.2
O.....2.l.{,w..%7.u..f....m.4..o.S..e........$.?.y.....0......


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=SundaySky,dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:23 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 398

Connection: keep-alive
...........R.N.0....!.r.Nh.J......V...8 TM.....e;...u...{........1...[
....Uy...0@U.\..<./.O'.....bQ.hg..oTv..p..........jT..X...M....<
..gY\...<`....h6.b..% ...bqK....-x./.w7..?./..x..i0N.......V-...&lt
;O....z..*.....8......7......KQ.8.K..$...?./W.~.O*D..k.z....=,A...%.z.
:S..'....:..,...H..q5...'...J....Q....1...a.........{s.w>..&.er..S.
....,.0:7..... .......@..?.U..Y.&.'.@&.F..V..w.._......e".._...HTTP/1.
1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 1
3 Sep 2016 15:57:23 GMT..P3P: CP='This is not a P3P policy. See http:/
/tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: 
Accept-Encoding..Content-Length: 398..Connection: keep-alive..........
...R.N.0....!.r.Nh.J......V...8 TM.....e;...u...{........1...[....Uy..
.0@U.\..<./.O'.....bQ.hg..oTv..p..........jT..X...M....<..gY\...
<`....h6.b..% ...bqK....-x./.w7..?./..x..i0N.......V-...<O....z.
.*.....8......7......KQ.8.K..$...?./W.~.O*D..k.z....=,A...%.z.:S..'...
.:..,...H..q5...'...J....Q....1...a.........{s.w>..&.er..S.....,.0:
7..... .......@..?.U..Y.&.'.@&.F..V..w.._......e".._.......


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=dynadmic,mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:23 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 413

Connection: keep-alive
...........RMo.0...W....,..H........[...!(...k#.,H....)A.....I.....]..
/oDm.^.~......y'_r....q./...Q..3...s...m....9!V..u;TA..b..=;7..`r...Mq
.3Zp.....B}.V{cQ..X..V...?.I.^.....F.....,.':..J'(..w/k.._...)6!TX."^%
Y..4..8n.g"................-.k.......yc.....[.*.........$N...eu..,..[H
.....!..4)...y~f..=.....o.:.L....z{.......&P.Z..6.:..v.......O...Q.I..
P.......vK.F4g../ntp.RC.u..~Di.C...9...-.....O[a.........V-....HTTP/1.
1 200 OK..Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 1
3 Sep 2016 15:57:23 GMT..P3P: CP='This is not a P3P policy. See http:/
/tremorvideo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: 
Accept-Encoding..Content-Length: 413..Connection: keep-alive..........
...RMo.0...W....,..H........[...!(...k#.,H....)A.....I.....]../oDm.^.~
......y'_r....q./...Q..3...s...m....9!V..u;TA..b..=;7..`r...Mq.3Zp....
.B}.V{cQ..X..V...?.I.^.....F.....,.':..J'(..w/k.._...)6!TX."^%Y..4..8n
.g"................-.k.......yc.....[.*.........$N...eu..,..[H.....!..
4)...y~f..=.....o.:.L....z{.......&P.Z..6.:..v.......O...Q.I..P.......
vK.F4g../ntp.RC.u..~Di.C...9...-.....O[a.........V-........


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=mediamath,BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:24 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
199.............R.n.0.}...F.o..r)..(."!..jI..U.M..D]'.m(..:..^..>..
>3s....#.i.P..k......m....&v.-.......H7..6.i&.US..;....-.wr./.U..R.
..Ti.{.._.....q.,.?J..e...)..f.Xk.y....T4e.l.. ..~./.,}:.. uk......Vm.
l&...X.Pb5.X.Dn.7...~...cu8..m....I...%.z..A..a.\...H.9..E...lZ..M.(.\
..<..@.N......P.........w.wRv./ ..!...... ..........$.F&.4...}../..
z...'.]..<_....OGN..*W\HT......4.9..B...V.af....1w.l.2l..C.d.K.rY.3
.s......d.......*.w1......0..HTTP/1.1 200 OK..Content-Encoding: gzip..
Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:24 GMT..P3P: CP='
This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy
'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..transfer-encoding
: chunked..Connection: keep-alive..199.............R.n.0.}...F.o..r)..
(."!..jI..U.M..D]'.m(..:..^..>..>3s....#.i.P..k......m....&v.-..
.....H7..6.i&.US..;....-.wr./.U..R...Ti.{.._.....q.,.?J..e...)..f.Xk.y
....T4e.l.. ..~./.,}:.. uk......Vm.l&...X.Pb5.X.Dn.7...~...cu8..m....I
...%.z..A..a.\...H.9..E...lZ..M.(.\..<..@.N......P.........w.wRv./ 
..!...... ..........$.F&.4...}../..z...'.]..<_....OGN..*W\HT......4
.9..B...V.af....1w.l.2l..C.d.K.rY.3.s......d.......*.w1......0..
>....


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=BidTheatre,beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:25 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

transfer-encoding: chunked

Connection: keep-alive
16b.............Q.N.0....!......R9...HH..M..P..7m.q,.-..qC.<..v....
...[...Q.........,[Q.E......?d..>..{........._Z...X.M.. ..mC.Q.g...
]......c..\x.>hP...5.... .]o:...k.............8/.....m.;(.....lA.u-
....8..H.8.S8.....bW"Q%.*......NG.Z`..rm.*...E..v.y-.x......,........{
..c..D..WOO...gO.n......2.a.&...K...s......D..S.l.F...0:...^....^9 ...
....<Y..........7....Kh......d...........?.....0..HTTP/1.1 200 OK..
Content-Encoding: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016
 15:57:25 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremorvid
eo.com/en/privacy-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Enc
oding..transfer-encoding: chunked..Connection: keep-alive..16b........
.....Q.N.0....!......R9...HH..M..P..7m.q,.-..qC.<..v.......[...Q...
......,[Q.E......?d..>..{........._Z...X.M.. ..mC.Q.g...]......c..\
x.>hP...5.... .]o:...k.............8/.....m.;(.....lA.u-....8..H.8.
S8.....bW"Q%.*......NG.Z`..rm.*...E..v.y-.x......,........{..c..D..WOO
...gO.n......2.a.&...K...s......D..S.l.F...0:...^....^9 .......<Y..
........7....Kh......d...........?.....0......


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=beeswax,videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:25 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 381

Connection: keep-alive
............[O.0....Wd#.7..&...WQa%....a..B.$.P.|..F..q.B...4.........
c4.uB.*..4.Pu..u_.....I<g?..z..eg;Yx...W..{3#.[..n.m.iI.3q.g....*..
../bFk.1...1hw....(Y...-..)y;........ F....uS..v..W.(....:.....U.}.-v.
..y..p.g.x...d./F...G....-.05.u..Y..m...6.)....2K.)..t...!....o....c.|
...V./..|.I..<i.......A....x9..w.G..nOu.......G.]X./.t.%.........!.
.9.......9.....-............. ...W...HTTP/1.1 200 OK..Content-Encoding
: gzip..Content-Type: text/xml..Date: Tue, 13 Sep 2016 15:57:25 GMT..P
3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privac
y-policy'..Server: Apache-Coyote/1.1..Vary: Accept-Encoding..Content-L
ength: 381..Connection: keep-alive..............[O.0....Wd#.7..&...WQa
%....a..B.$.P.|..F..q.B...4.........c4.uB.*..4.Pu..u_.....I<g?..z..
eg;Yx...W..{3#.[..n.m.iI.3q.g....*..../bFk.1...1hw....(Y...-..)y;.....
... F....uS..v..W.(....:.....U.}.-v...y..p.g.x...d./F...G....-.05.u..Y
..m...6.)....2K.)..t...!....o....c.|...V./..|.I..<i.......A....x9..
w.G..nOu.......G.]X./.t.%.........!..9.......9.....-............. ...W
.......


GET /syncnoad?rid=5ef0abec81db4606a741033f44101df5&p=videoamp,TapAd,_dmp_turbine&uid=66c0e761009a4593b3aea4e8af5db5bf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: partners.tremorhub.com

Connection: Keep-Alive

Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; tvrg_60409="1,1473782235"

HTTP/1.1 200 OK

Content-Encoding: gzip

Content-Type: text/xml

Date: Tue, 13 Sep 2016 15:57:26 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Server: Apache-Coyote/1.1

Vary: Accept-Encoding

Content-Length: 420

Connection: keep-alive
...........R.j.0.|..............4.(..q.....:nM...d..}..4{{(.$.....&]..
....n:..........x..C..6wW.KzO...6.a.Q....gc...

GET /img/logo.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1473782236.F76D7BABCB714F614E7A5CF7E571261E.1.1.1.1.1.1.1.1.1; _ga=GA1.2.44415039.1473782236; _gat=1

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:12 GMT

Content-Type: image/png

Content-Length: 3856

Connection: keep-alive

Last-Modified: Tue, 10 Jun 2014 14:29:28 GMT

ETag: "a1bf2-f10-4fb7c27bc2200"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L.....3.......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<....IDATx..].O....V^.....rI........c..F..M.y0..-H..
..P.KH\.-.%-....J.[...5..S.... R...c....K/O.w...........93svY..i..e..w
...}..}gvy..E?.Q..%....J...(Q.V.DaZ....JN........(.fL...cM.....Z...'..
...A.....k.x....8....E..O..;.W...f.q.X..l..=.....k................%...
fd)........,..J..G...!...m.Q...J.../..................Y,0.......%...S6
R..=..t.0..%...|(..?T.V.DaZ...i%.b>..6:.~.=..7.-*.g....y<.,4>
....W..jv.(...}...8..YdF.l. .,,~5s..X<..h~.p...'......b...[6.0.D.Ci
........ Bo.C]....g..........y.i.........]N....p$.-~}8..... .....n.z..
.$~.9.).........P.....g....!.':.J..O...X.U.?:..#.g.{ .^......L..0..I..
"H<.5.u0...n^.3.ER.<......ZI......*f..... .fN.......q.n.........
.........Z.0.A.m|@.v. .uI......u........Y...u.t..........db...L.......
T.=21...8.(......i.$......y4...t:....(.`sG.H..Q...&...u.<..2L..Wl..
5...9...<. I....d...P.._h..n....MA7Y.....'..FsZ?....kH.l.s.<.QD.
...$q>lK...`1....x.Ha ^....L..W.#.C....._1...."^..6..WRz...4..z`.Ch
|R..H....:1..C..o. ........8..8.$...;..,..N.....S..O......W":.).}...IR
!.F8`=..lc..9n...O~a.....k7^-~........r........YO.C..0@I.v....7Dt.....
.............2..NmX...&.h.......f) ....;?...b8.~.>L..../.....C.l.Pf
g..............0..4k>.f.k-....X.9!a>.0.i.b.....$h.;.b.....`.32.T
r...bx.".:5K00..9..h...a........l....U..M..Z3..v..:....<:E........ 
#./...4p.y.....b....u.f.#[*e%.%p....|RO.dP\b...~.f...C......@..s......
....X.{.m0.k..T.O.?<&.M....C...6o.9..C..Pd.,.......O..`5.L.xP,.
>>

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 14 Sep 2016 00:02:56 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Wed, 14 Sep 2016 00:02:56 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /itd.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&rand= HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: cocomo.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:09 GMT

Server: Apache/2.2.22 (Win64) PHP/5.3.13

X-Powered-By: PHP/5.3.13

Content-Length: 1118

Keep-Alive: timeout=5, max=100

Connection: Keep-Alive

Content-Type: text/html
<html>..<head>..<title>a</title>..</head&gt
;..<body>..<script language="JavaScript" type="text/javascrip
t">..<!--..function reeadCookie(name) {..  var nameEQ = name   "
=";..  var ca = document.cookie.split(';');..  for(var i=0;i < ca.l
ength;i  ) {..    var c = ca[i];..    while (c.charAt(0)==' ') c = c.s
ubstring(1,c.length);..    if (c.indexOf(nameEQ) == 0) return c.substr
ing(nameEQ.length,c.length);..  }..  return null;..}..function uapcc()
 {..//var paathname = reeadCookie('tvrg_60409');..//if (paathname.subs
tring(0, 2) == '"4') {..//eraseCookie("tvrg_60409");..var date = new D
ate();..date.setTime(date.getTime()   (60 * 1000));..var times = Math.
floor(Date.now() / 1000);..//document.cookie = "tvrg_60409=1," times "
;domain=.tremorhub.com;path=/;expires=" date.toGMTString() "";..docume
nt.cookie = "tvrg_60409=;domain=.tremorhub.com;path=/;expires=-1";..//
}..}..setInterval(function() {..uapcc();..}, 90);..setInterval(functio
n() {..uapcc();..}, 90);..setInterval(function() {..uapcc();..}, 90);.
.setInterval(function() {..uapcc();..}, 90);..//-->..</script&gt
;..<meta http-equiv="refresh" content="300">..</html>HTTP/
1.1 200 OK..Date: Tue, 13 Sep 2016 15:57:09 GMT..Server: Apache/2.2.22
 (Win64) PHP/5.3.13..X-Powered-By: PHP/5.3.13..Content-Length: 1118..K
eep-Alive: timeout=5, max=100..Connection: Keep-Alive..Content-Type: t
ext/html..<html>..<head>..<title>a</title>..&l
t;/head>..<body>..<script language="JavaScript" type="
>>

GET /counter/counter.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.statcounter.com

Connection: Keep-Alive

Cookie: is_unique=sc10114910.1473782229.0; is_visitor_unique=1473782229289162047

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:11 GMT

Server: PWS/8.1.38

X-Px: ht h0-s1153.p11-fra.cdngp.net

ETag: W/"576924c5-654e"

Cache-Control: max-age=43200

Expires: Tue, 13 Sep 2016 18:24:46 GMT

Age: 34345

Content-Length: 9529

Content-Type: application/x-javascript

Content-Encoding: gzip

Vary: Accept-Encoding

Last-Modified: Tue, 21 Jun 2016 11:28:05 GMT

Connection: keep-alive
...........]{s....*....F.,.-..o..M6....$...eQ$%s,.Z..c-}..u7@..<3{u
..?....@.h4..B.y..Z...Q..9..............]...K.%.<L....f...U...\..i.
<..g.f.%.q........O.J.CH..v.....N.H.M..zQ-J..`.'f.*~0....sj....C...
.....l....di|..4t..H........-...;.P.f^...EM....4..I.=.~....e..e..W>
.]..Wt...v..I..Wym.;...y....'....W._;.}.f..#...'.4Lj.:...bv.....&Z.p.&
.&.5.n#sN....X'[..........5-h.n.x..G.5....h...mp.....5..[..G.}.~....&.
...d.%i..G..4....b..h......<.q..c... J....{bTZ\M.w.r.1.Bf...y.l....
v.gQ...v.e./O.....Fi..H..;.Z.Y.a{Os-.A..c.b.c.{.a.....bln|{..t.....:|.
....~......R.eEV..-:h.xwS...Zf..*cHC,...K....p..4i.9.k>..P6[.Q.....
.$|...._.;...Em..itPa......P..Gj.. .5.  G..1m.....Ee...F70..ZUU&.&.?.&
gt;..r.Opc.........MQ<....=9(.v..^.Z<.;C....{....v..v:..N..{8.V;
........a.......v'.......w:...y..... ..^v../.8....W..7...o..IBV..%e...
c.Qt...6M.k.".j.o.E[.;..(#.$...#..T*. .......K/M..S..X.;(`..v.Fx||4...
..............#_.y..]./.y...?.....U...... ..].@...JX....v.?.H.ha8.b.*.
.EE.tx,j.....,.H..;.^...Ps....\.D.A...._..M...`.K...$k....^......j5t..
.......J.G,kt..6:}.I....v%..g.).([......Rlh.F.E..P(...h.U...:.@k>D.
..y.($V.P..B.u[n...[.@u2...;r^.E./..u....-k.......u....K....w...`U....
g^.l....*.1N.....8|.b..R.N.N..yq.s......?..m.m~..^...m.<cT. ....g.c
...E.-.?...O.|O. /Z*l...../46..;......h...8..p....m......&..MD.[.f\...
.'..e..C.*.n..#.....-...h.M..Lj$.....@O....h.,6<,.:..8,.OA...V.`.Pa
[..~v3.Qn...7W..^@[...../ m.t..%.......r$...>-k...{..U .h.r.._...UN
....3../....O..N.............p....5.<....2GM..C3|.q^w.....,....
>>

GET /report1.php?url=/govids/page-1.html?lid=937115 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 16:00:40 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 13 Sep 2016 16:00:40 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /bck.php?1473782235000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 16:00:41 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 13 Sep 2016 16:00:41 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8......


GET /report1.php?url=/govids/page-1.htm?lid=937115 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 16:00:41 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
....


GET /bck.php?1473782235000 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: 109.201.148.40

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 16:00:41 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.3.3

Content-Length: 0

Keep-Alive: timeout=5

Connection: Keep-Alive

Content-Type: text/html; charset=utf-8
HTTP/1.1 200 OK..Date: Tue, 13 Sep 2016 16:00:41 GMT..Server: Apache/2
.2.15 (CentOS)..X-Powered-By: PHP/5.3.3..Content-Length: 0..Keep-Alive
: timeout=5..Connection: Keep-Alive..Content-Type: text/html; charset=
utf-8..

GET /cwidget/iebrowser1/000000ffffff.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: whos.amung.us

Connection: Keep-Alive

HTTP/1.1 303 See Other

Date: Tue, 13 Sep 2016 15:57:09 GMT

Content-Type: text/html

Transfer-Encoding: chunked

Connection: close

Location: hXXp://widgets.amung.us/draw/?w=colored&n=998&c=000000ffffff&p=

Set-Cookie: uid=CgH9JlfYIdUdNA7VDEHXAg==; expires=Thu, 31-Dec-37 23:55:55 GMT; domain=.amung.us; path=/
0..

GET /page-1.html?lid=937115 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:09 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com
e5b..<img src="hXXp://109.201.148.40/report1.php?url=/govids/page-1
.html?lid=937115" alt="" width="0" height="0"><script type="text
/javascript" src="hXXp://govids.net/jwplayer1.js"></script>&l
t;script>var thecc ="ok";</script><script type="text/javas
cript" src="hXXp://govids.net/1.js"></script><form action=
"hXXp://VVV.govids.net/page-4.php" method="get" name="redirect">&lt
;input type="hidden" name="lid" value="937115"></form>..<s
cript type="text/javascript"> if (top.location!= self.location) { d
ocument.write('<head></head><body bgcolor="#ffffff" cla
ss="body" topmargin="0" leftmargin="0">');}</script>..<for
m action="hXXp://VVV.govids.net/page-1.htm" method="get" name="redirec
t1"><input type="hidden" name="lid" value="937115"></form&
gt;<script type="text/javascript"> if (top.location!= self.locat
ion) { document.forms['redirect1'].submit();}</script>..<scri
pt type='text/javascript'>..var cb = Math.round(new Date().getTime(
) / 1000);..var items = Array('mp4:lqbyul0x.mp4','mp4:hc6lawyi.mp4','m
p4:iblsdh2f.mp4','mp4:nbsyph4t.mp4','mp4:peyjpa0x.mp4','mp4:9mzecklt.m
p4','mp4:vnt9ciyd.mp4','mp4:q5fufgnb.mp4','mp4:lzcpj8vr.mp4','mp4:pfdx
i3pj.mp4','mp4:romfc7uu.mp4','mp4:qgmcib5y.mp4','mp4:ifgfn0gh.mp4');..
var item = items[Math.floor(Math.random()*items.length)];..var ffile =
 "hXXp://thm.vidvib.com/abcd.mp4";..jwplayer('ova-jwplayer-container')
.setup({.. "flashplayer": "hXXp://govids.net/player1.swf",.."file"
>>

GET /page-1.htm?lid=937115 HTTP/1.1

Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml xml, */*

Referer: hXXp://VVV.govids.net/page-1.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:11 GMT

Content-Type: text/html; charset=utf-8

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

X-Powered-By: PHP/5.3.3

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com
e5c..<img src="hXXp://109.201.148.40/report1.php?url=/govids/page-1
.htm?lid=937115" alt="" width="0" height="0"><script type="text/
javascript" src="hXXp://govids.net/jwplayer1.js"></script>&lt
;script>var thecc ="ok";</script><script type="text/javasc
ript" src="hXXp://govids.net/1.js"></script><form action="
hXXp://VVV.govids.net/page-4.php" method="get" name="redirect"><
input type="hidden" name="lid" value="937115"></form>..<sc
ript type="text/javascript"> if (top.location!= self.location) { do
cument.write('<head></head><body bgcolor="#ffffff" clas
s="body" topmargin="0" leftmargin="0">');}</script>..<scri
pt type="text/javascript"> if (top.location!= self.location) { var 
rc = document.referrer.split('/')[2];if (rc == window.location.hostnam
e) {document.write('<div id="ova-jwplayer-container" style="positio
n:absolute; top:0px; left:0px;width:300px;height:250px;"></div&g
t;');}}</script>..<script type='text/javascript'>..var cb 
= Math.round(new Date().getTime() / 1000);..var items = Array('mp4:lqb
yul0x.mp4','mp4:hc6lawyi.mp4','mp4:iblsdh2f.mp4','mp4:nbsyph4t.mp4','m
p4:peyjpa0x.mp4','mp4:9mzecklt.mp4','mp4:vnt9ciyd.mp4','mp4:q5fufgnb.m
p4','mp4:lzcpj8vr.mp4','mp4:pfdxi3pj.mp4','mp4:romfc7uu.mp4','mp4:qgmc
ib5y.mp4','mp4:ifgfn0gh.mp4');..var item = items[Math.floor(Math.rando
m()*items.length)];..var ffile = "hXXp://thm.vidvib.com/abcd.mp4";..jw
player('ova-jwplayer-container').setup({.. "flashplayer": "hXXp://
>>

GET /css1.css HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1473782236.F76D7BABCB714F614E7A5CF7E571261E.1.1.1.1.1.1.1.1.1; _ga=GA1.2.44415039.1473782236; _gat=1

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:12 GMT

Content-Type: text/css

Transfer-Encoding: chunked

Connection: keep-alive

Vary: Accept-Encoding

Last-Modified: Mon, 10 Nov 2014 08:43:18 GMT

Server: CDCE

X-INAP-Cache-Status: HIT

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Content-Encoding: gzip
293.............U[O.0.~.R..G5.IM.B/.>.(..P..i......cG.{a...s..]7..0
..G....s..w<.........6 ...!..f.o3.||6...&...(...^{..F....t.>X.]L
of...zr.= _.aT....Ae.|.r...@.S.{97b.F_r...M~...9..........#H...W.oi(y.
.....B;.@.....j.y.ke.9M.|.J..N...<8n.2...P.......>_.N...{U.....R
jb.<......oEF.I)..Bm.7...I..`.q28........Y......-P..y..V..rk.....$.
p}..z.2.I..sy..|.7..ehx..Nl..@.?9q...V<.......Z.D.8 TY`..9P..H3m,..
...A1.L..Ba.p.8..~.=m..~(@...Y...T.a..IT.X#.B...F/...50.3j..da...H..2.
.....f..s\..q.....k.I..4.2..6..4....;(. .Rb(.........Z.,/..S....lur.*.
. ..B.....X....Jc3.P.x...I.$...)..`..F..iZ..E.pK...{F...&.....i..ja1&g
t;..s.&X..Q..~....v...*m...3.Dq".|oo%.MpTn..qU..~..-.q......0..
....


GET /img/lbg.png HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.govids.net

Connection: Keep-Alive

Cookie: sc_is_visitor_unique=rx10675947.1473782236.F76D7BABCB714F614E7A5CF7E571261E.1.1.1.1.1.1.1.1.1; _ga=GA1.2.44415039.1473782236; _gat=1

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:12 GMT

Content-Type: image/png

Content-Length: 200

Connection: keep-alive

Last-Modified: Thu, 21 Nov 2013 20:06:42 GMT

ETag: "a1bf1-c8-4ebb56fac1880"

Server: CDCE

X-INAP-Cache-Status: EXPIRED

X-INAP-Server: cdce-ams002-001.ams002.internap.com

Accept-Ranges: bytes
.PNG........IHDR.......L......O......gAMA....7.......tEXtSoftware.Adob
e ImageReadyq.e<...ZIDATx.b.R.b .....tV.....Z&.'B..!.;......qn...h:
.z!N.T@.l..4#......|..-..z...D..g.f.![.....O...........IEND.B`.HTTP/1.
1 200 OK..Date: Tue, 13 Sep 2016 15:57:12 GMT..Content-Type: image/png
..Content-Length: 200..Connection: keep-alive..Last-Modified: Thu, 21 
Nov 2013 20:06:42 GMT..ETag: "a1bf1-c8-4ebb56fac1880"..Server: CDCE..X
-INAP-Cache-Status: EXPIRED..X-INAP-Server: cdce-ams002-001.ams002.int
ernap.com..Accept-Ranges: bytes...PNG........IHDR.......L......O......
gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<...ZIDATx.b.R.b ..
...tV.....Z&.'B..!.;......qn...h:.z!N.T@.l..4#......|..-..z...D..g.f.!
[.....O...........IEND.B`...

GET /analytics.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Strict-Transport-Security: max-age=10886400; includeSubDomains; preload

Date: Tue, 13 Sep 2016 14:02:05 GMT

Expires: Tue, 13 Sep 2016 16:02:05 GMT

Last-Modified: Mon, 15 Aug 2016 04:25:11 GMT

X-Content-Type-Options: nosniff

Content-Type: text/javascript

Vary: Accept-Encoding

Content-Encoding: gzip

Server: Golfe2

Content-Length: 11590

Cache-Control: public, max-age=7200

Age: 6904
...........}iw..........tc.m'.a.i|B...F6 ...%.6.F.....o..JR/..{.....s'
V..VK..J.W..Hz...=....S....=$......l.j.......d....?Q...-..K...j(FR..W]
.b._..V.Ea-.6u.......D..gF.....[.<..W...../............`z.....g.l..
~.............>..........GB..N....?...?.I2.....U...o<.....W.;...
x qq......J.......zC.q...?.<.....P.."..[.|.....\P.c...[8.......FB;/
..#..N.........,.:..}.mw.....Bx..?...r=&`..,Q....)j.v..f3.._.y....<
.}..........y.5..l...fk..E.B7].X....%. h...6m...J$O.......!=.P,..$qo..
...]]..8g?....f..Oj......M..b4.$.T$...{...R..^......_.63T-.e..#h7Y.F..
~..}..Q....\..Z.2KKO...on8..%.!.n.."V<Qo.j......0. .o{2..u(uU..M.8.
E..FDs6.y.....7..\..g.....x4.7<.......yg.{f.....>.k/s..V..k....)
....s)..@...$QC.7..\.P*I..uI.E.........U..7.<.]Wy.0.....]..........
..*.2.[.0 @e.1....qXT._... .!8..IO..........L%..}.6.%.u6'"...."*.>.
........[.U]..O.k.p.........C'QwI......*..~(..B.v.g...&.y...@.f....S.9
..........<....8@........r..R..=.y.1..M....D...G..P..O..s.v)/[.....
q.......e.s*.aE3"p[..J.[Xj<}.....u...^^.=.....u.....V....sR....Z...
...Uo....P\........M.!,L..v...[....'.hBd.n.....rr....c..@=.o.N..|A....
C..-.D...ju....E.t....s.......p$.7.HT....S...!.4....]./.X.......C.C.[.
X....~..B.d.../.e.4..O.r*q`.....d.....b...t........../^6.jg:B........'
....x4...w;D...J1.._`.@].s...'*U....&.a.KFD....<.....Y@.7.?U..a...P
..J.V..\%...O'].Q...[.7....Fn...0tgA.2S.#-....._..%....q......f..9...z
Z...l==.R .@..v...."......[.....".".;..YBf....~.....m.$....d42?.9f..K@
........7.Q_..w.<-...;z..|..*..>...D...(?r.....@F.. ..P]...2
>>

GET /r/collect?v=1&_v=j46&a=356611280&t=pageview&_s=1&dl=http://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=&ul=en-us&de=utf-8&dt=add&sd=32-bit&sr=1276x846&vp=679x408&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=555460349&cid=1377690454.1473782234&tid=UA-74694740-5&_r=1&z=1612721500 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 13 Sep 2016 15:57:09 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 13 Sep 2016 15:57:09 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;....


GET /r/collect?v=1&_v=j46&a=607540295&t=pageview&_s=1&dl=http://VVV.govids.net/page-1.htm?lid=937115&ul=en-us&de=utf-8&sd=32-bit&sr=1276x846&vp=850x480&je=0&fl=11.6 r602&_u=AEAAAEAAI~&jid=1916155861&cid=44415039.1473782236&tid=UA-74694740-2&_r=1&z=256026923 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: VVV.google-analytics.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Access-Control-Allow-Origin: *

Date: Tue, 13 Sep 2016 15:57:12 GMT

Pragma: no-cache

Expires: Fri, 01 Jan 1990 00:00:00 GMT

Cache-Control: no-cache, no-store, must-revalidate

Last-Modified: Sun, 17 May 1998 03:00:00 GMT

X-Content-Type-Options: nosniff

Content-Type: image/gif

Server: Golfe2

Content-Length: 35
GIF89a.............,...........D..;HTTP/1.1 200 OK..Access-Control-All
ow-Origin: *..Date: Tue, 13 Sep 2016 15:57:12 GMT..Pragma: no-cache..E
xpires: Fri, 01 Jan 1990 00:00:00 GMT..Cache-Control: no-cache, no-sto
re, must-revalidate..Last-Modified: Sun, 17 May 1998 03:00:00 GMT..X-C
ontent-Type-Options: nosniff..Content-Type: image/gif..Server: Golfe2.
.Content-Length: 35..GIF89a.............,...........D..;..

GET /1.js HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.html?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 14 Sep 2016 00:02:55 GMT

Server: Apache/2.2.15 (CentOS)

X-Powered-By: PHP/5.5.30

Cache-Control: max-age=0

Expires: Wed, 14 Sep 2016 00:02:55 GMT

Content-Length: 0

Connection: close

Content-Type: text/html; charset=UTF-8

GET /10114910/0/757d7213/1/ HTTP/1.1

Accept: */*

Referer: hXXp://VVV.bruindorsett.pw/index5.php?id=18AT7KCfXnrMx8X8r3ZK&date=2016-09-04&p=none&t=

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:09 GMT

Server: Apache/2.2.3 (CentOS)

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1473782229.0; expires=Sun, 12-Sep-2021 15:57:09 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1473782229289162047; expires=Thu, 13-Sep-2018 15:57:09 GMT; path=/; domain=.statcounter.com

Content-Length: 49

Connection: close

Content-Type: image/gif
GIF89a...................!.......,...........T..;..

GET /ova-jw.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/player1.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

Cookie: _ga=GA1.2.44415039.1473782236; _gat=1

HTTP/1.1 200 OK

Date: Wed, 14 Sep 2016 00:02:58 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 14:00:26 GMT

ETag: "4403b3-39741-4fbe0551c3280"

Accept-Ranges: bytes

Content-Length: 235329

Cache-Control: max-age=2592000, public

Expires: Wed, 16 Aug 2017 00:02:58 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..A..x......U.8.!.o.{.l/.B...$.@....Nx......A...Uuw........!AQD.e.q
. ..(...?""..,2:.u.....t.....`....9w.[..u:q....}..~Uu.s.=..........b..
.k[R..l...;../K.........=...|..!O;.M..........3.m6K..[/....-...m."%...
BY..*Xk.....t W2.e.,..Y.3 .....V..h.X)..I-....).P...n.J..r=.fiJ-.T....
S.....k....Q.....jMn...B..Q..;3.9.......y..].K."PX...S....7....b..*92.
q..V..@...X..&...J.p...].o.L...e.Y....y.0QQ'......x.1.e}.e.|..-....l.F
..o.w.......Y......u.g......-% .#.[....:..../x.".....i..d...uuK.K.....
.tF.V.9]K.8.....9isZ/...4.KN.,.0...[...U)....i.,...o../S...,..S-]...&.
.......Q..RZ.....nm&.. ....'.ROz.J.0......_.C....~zG..... ....~C...t..
;=`...t^.....B...48.[3..Sd(.J..D4b.H.....U&&`.;..RE.../..i..X.......u@
..).......{..k.....`.@.7...... i....rI....I]LgL/..z....H.... t...|..Nk
..`...U(..?..u.#w...X"...NK\u...7.\....7.\}...o...wvO....R.d3.&Im..f}V
.....e.T..%c|...:.pQ..j.`...l9=.Zi....q..#...5...0...iw..C..j...|..%.\
)...K..... .............u.`. E2...f.*@.6....NPmJ'......L....(m.c.r.Z.H
W....f.....Y......_...7......p1..a.zx.u...go....O......!.......GNE..J6
a........3.......Mg...........Z.>.*..s.....%..<iX.5ZKlt...0.V..F
.....Ex...Y2.5R...S....J.....q .N2..B.. ..M.Z..O....../..E............
..&`".%.AZ..g3p..$.@.0..&.d....i....~....................&3p4OFb....T.
.O.J....M.....O?...jv..6.........0x.....#..;.....}..i....W....]....&.V
..a.pO...&.f:..V5}.yK.YM.e........4..:.`...].)......2.... ....uD......
p..g./.AC.....bh8.....L..'"...;;/q..-..>:Y2 ........\.D....=.......
...).0..W....69V.H.....O..N.....W.P....."hNdG"cA..........{3.;7.j&
>>

GET /t.php?sc_project=10675947&java=1&security=299981d6&u1=F76D7BABCB714F614E7A5CF7E571261E&sc_random=0.475769053747595&jg=new&rr=1.1.1.1.1.1.1.1.1&resolution=1276&h=846&camefrom=http://VVV.govids.net/page-1.html?lid=937115&u=http://VVV.govids.net/page-1.htm?lid=937115&t=&sc_snum=1&sess=a181b5&p=0&invisible=1 HTTP/1.1

Accept: */*

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

Accept-Language: en-us

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: c.statcounter.com

Connection: Keep-Alive

Cookie: is_unique=sc10114910.1473782229.0; is_visitor_unique=1473782229289162047

HTTP/1.1 200 OK

Date: Tue, 13 Sep 2016 15:57:12 GMT

Server: Apache/2.2.3 (CentOS)

P3P: policyref="hXXp://VVV.statcounter.com/w3c/p3p.xml", CP="ADMa OUR COM NAV NID DSP NOI COR"

Expires: Mon, 26 Jul 1997 05:00:00 GMT

Set-Cookie: is_unique=sc10114910.1473782229.0-10675947.1473782232.0; expires=Sun, 12-Sep-2021 15:57:12 GMT; path=/; domain=.statcounter.com

Set-Cookie: is_visitor_unique=1473782229289162047; expires=Thu, 13-Sep-2018 15:57:12 GMT; path=/; domain=.statcounter.com

Content-Length: 49

Connection: close

Content-Type: image/gif
GIF89a...................!.......,...........T..;..

GET /player1.swf HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://VVV.govids.net/page-1.htm?lid=937115

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: govids.net

Connection: Keep-Alive

HTTP/1.1 200 OK

Date: Wed, 14 Sep 2016 00:02:56 GMT

Server: Apache/2.2.15 (CentOS)

Last-Modified: Sun, 15 Jun 2014 13:46:26 GMT

ETag: "4403c4-1bb61-4fbe0230ad080"

Accept-Ranges: bytes

Content-Length: 113505

Cache-Control: max-age=2592000, public

Expires: Wed, 16 Aug 2017 00:02:56 GMT

Connection: close

Content-Type: application/x-shockwave-flash
CWS..`..x..}.\...x...@).....JCQJ...t.S.:.s..P.M.".."D.=.E."!.G.Q."....
y...~_..|>o.....u?o......."..>...Z}....u......X....^...8\.3..7,V
$.;[Y%%%Y&.Y..1V6NNNV..V...h..a.W.H.........@.L../b...@...........bJ..
...8$.i.p... .Z.X.......<A.C4...s.L...*.B..c.'1...h.C.;.J.....E.d..
...... .........X...%[.x.m2@oK&/../...LtM..P..|.0._..a.c..x17..K.....6
L....z....z...#f. .=..:i...!B.O.s..:..`kmc.-............ xh6).UpWB.6..
..UC.SQ.1^..3.]3x4z.o..>...7F.`s..,.G.K.s.)........ $E..[O..O......
......w.....0.Jw....qCv.........&L..I...0.g...z%...k.s_....B.V....f- .
y>..6.e..v...O..R.4u...J?.q.........o?.........._.8i.........L'._s.
...ug......N..h..[....s/.[X>.G...9....k...O...L;.,X.p......... ....
r&.c..F.>._w.. {.2...b..ri..=.C.N#M..|..(&..8........9..,.S.....KhS
.}.......~..i....W...?....7.S\...eS..*&.S.z.\:....#!cng.}5...I.*I;....
'.M...U..3^s.l....^.7..sp.......Z_..wJ.....O.;0e... ..f\.t..{....5v}..
=..9...1..C..?..4.R.....[G7W..=h|...a..p../s..]......^...K.r..]T..... 
....j..V7.r.9l.........,zf..U.c..$b..n.}...^..B=.-.RP....Y.......aB.f.
...9...Vuzz.M\../b............8n...2..^Y..%u..n,...x.....,.;..s.r..]|8
...v......u.m........=.n..9.&{.B......D_JU.7.<.....>gz.<....O
.4..zQhiWf....aOL.-.bE..2yU.S..)g6Z...m...m..s....ly.....Q.us..ci....[
k?M.7p.e.....yG.'.8...R.....m_/z.>p.......=....B..w..zwQ\P..B...Bn.
2..>K..F....>.xLy..`...%..`.._......'5.9..V../z.....E..;....h)..
_..>...........{^.....p&x.Q....;YH..E.6.<m..8n... a...#U~.5S(wr2
V....h..Y^.'^.....y.8:........Q....^[..nK....hq...5..[...i94$.....
>>

GET /crossdomain.xml HTTP/1.1

Accept: */*

Accept-Language: en-US

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Accept-Ranges: bytes

Content-Type: application/xml

Date: Tue, 13 Sep 2016 15:57:14 GMT

ETag: W/"144-1446501138000"

Last-Modified: Mon, 02 Nov 2015 21:52:18 GMT

Server: Apache-Coyote/1.1

Content-Length: 144

Connection: keep-alive
<?xml version="1.0" ?>.<cross-domain-policy>.    <!-- V
ery Liberal -->.    <allow-access-from domain="*" secure="false"
/>.</cross-domain-policy>....


GET /ad/tag?adCode=we1sb-kg4io&playerWidth=645&playerHeight=380&playerPosition=1&mediaTitle=Home videos, Funny Videos - 1&mediaDesc=Home videos, Funny Videos - 1&mediaId=2&mediaUrl=hXXp://VVV.govids.net/1.html&srcPageUrl=hXXp://VVV.govids.net/1.html&contentLength=300&LR_FORMAT=application/x-shockwave-flash HTTP/1.1

Accept: */*

Accept-Language: en-US

Referer: hXXp://govids.net/ova-jw.swf

x-flash-version: 11,6,602,168

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022; .NET4.0C)

Host: xlf5t.ads.tremorhub.com

Connection: Keep-Alive

HTTP/1.1 200 OK

Cache-Control: no-cache, no-store, must-revalidate

Content-Encoding: gzip

Content-Type: text/xml;charset=ISO-8859-1

Date: Tue, 13 Sep 2016 15:57:15 GMT

P3P: CP='This is not a P3P policy. See hXXp://tremorvideo.com/en/privacy-policy'

Pragma: no-cache

Server: Apache-Coyote/1.1

Set-Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; Domain=.tremorhub.com; Expires=Wed, 13-Sep-2017 21:45:35 GMT; Path=/

Set-Cookie: tvrg_60409="1,1473782235"; Version=1; Domain=.tremorhub.com; Max-Age=60; Expires=Tue, 13-Sep-2016 15:58:15 GMT; Path=/

Vary: Accept-Encoding

x-tremorvideo-status: NO_AD

transfer-encoding: chunked

Connection: keep-alive
1f9.............R.n.0... \..-../q.I...E..A... 0F.H&l........7.r.i....f
.&Z...`..p)b/....E)..u.=../.."..Vi.....2z(...........F.. F.l|c.7....u&
..~[.w^..l.D?4(.....Xl...;.....;.ES.C...!..=/..<}>.).VPC..t[Q..l
.9..X.P`9.Y1..3....x\M(....U.e.E[9...Z......(....d...... .......#.k...
u...)]q.r'..........v.J.<:.q.J..}W.."X ....a.{..B.,...Z.z...ZpK./{.
...Z.....l...Rt&....N.1N~.).@'.8.7......X..........ga...dz3...0.9TSVL.
j....j.//I......R.c.qTpf.....u......_....I.....Q.M..~.-5...h.0.>..@
...rKK|.' .U..n.s.................d........... .....0..HTTP/1.1 200 OK
..Cache-Control: no-cache, no-store, must-revalidate..Content-Encoding
: gzip..Content-Type: text/xml;charset=ISO-8859-1..Date: Tue, 13 Sep 2
016 15:57:15 GMT..P3P: CP='This is not a P3P policy. See hXXp://tremor
video.com/en/privacy-policy'..Pragma: no-cache..Server: Apache-Coyote/
1.1..Set-Cookie: tvid=66c0e761009a4593b3aea4e8af5db5bf; Domain=.tremor
hub.com; Expires=Wed, 13-Sep-2017 21:45:35 GMT; Path=/..Set-Cookie: tv
rg_60409="1,1473782235"; Version=1; Domain=.tremorhub.com; Max-Age=60;
 Expires=Tue, 13-Sep-2016 15:58:15 GMT; Path=/..Vary: Accept-Encoding.
.x-tremorvideo-status: NO_AD..transfer-encoding: chunked..Connection: 
keep-alive..1f9.............R.n.0... \..-../q.I...E..A... 0F.H&l......
..7.r.i....f.&Z...`..p)b/....E)..u.=../.."..Vi.....2z(...........F.. F
.l|c.7....u&..~[.w^..l.D?4(.....Xl...;.....;.ES.C...!..=/..<}>.)
.VPC..t[Q..l.9..X.P`9.Y1..3....x\M(....U.e.E[9...Z......(....d...... .
......#.k...u...)]q.r'..........v.J.<:.q.J..}W.."X ....a.{..B.,
>>

The Dropped connects to the servers at the folowing location(s):

Map

Strings from Dumps

klar.exe_1904:

.text

.text

`.rdata

`.rdata

@.data

@.data

.ndata

.ndata

.rsrc

.rsrc

uDSSh

uDSSh

.DEFAULT\Control Panel\International

.DEFAULT\Control Panel\International

Software\Microsoft\Windows\CurrentVersion

Software\Microsoft\Windows\CurrentVersion

GetWindowsDirectoryA

GetWindowsDirectoryA

KERNEL32.dll

KERNEL32.dll

ExitWindowsEx

ExitWindowsEx

USER32.dll

USER32.dll

GDI32.dll

GDI32.dll

SHFileOperationA

SHFileOperationA

ShellExecuteA

ShellExecuteA

SHELL32.dll

SHELL32.dll

RegEnumKeyA

RegEnumKeyA

RegCreateKeyExA

RegCreateKeyExA

RegCloseKey

RegCloseKey

RegDeleteKeyA

RegDeleteKeyA

RegOpenKeyExA

RegOpenKeyExA

ADVAPI32.dll

ADVAPI32.dll

COMCTL32.dll

COMCTL32.dll

ole32.dll

ole32.dll

VERSION.dll

VERSION.dll

verifying installer: %d%%

verifying installer: %d%%

hXXp://nsis.sf.net/NSIS_Error

hXXp://nsis.sf.net/NSIS_Error

... %d%%

... %d%%

~nsu.tmp

~nsu.tmp

%u.%u%s%s

%u.%u%s%s

RegDeleteKeyExA

RegDeleteKeyExA

%s=%s

%s=%s

*?|/":

*?|/":

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp\ExecCmd.dll

"%Program Files%\ministry\assigned.exe"

"%Program Files%\ministry\assigned.exe"

md.dll

md.dll

.reloc

.reloc

EnumWindows

EnumWindows

ExecCmd.dll

ExecCmd.dll

Kernel32.DLL

Kernel32.DLL

e%uy%u

e%uy%u

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp

nsy7.tmp

nsy7.tmp

rogram Files\ministry\assigned.exe"

rogram Files\ministry\assigned.exe"

q assigned.exe" | %SystemRoot%\System32\find /I "assigned.exe"

q assigned.exe" | %SystemRoot%\System32\find /I "assigned.exe"

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp

\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsy7.tmp

"%Program Files%\crystallization\klar.exe"

"%Program Files%\crystallization\klar.exe"

%Program Files%\crystallization

%Program Files%\crystallization

klar.exe

klar.exe

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb6.tmp

CUME~1\"%CurrentUserName%"\LOCALS~1\Temp\nsb6.tmp

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

C:\DOCUME~1\"%CurrentUserName%"\LOCALS~1\Temp\

%Program Files%\crystallization\klar.exe

%Program Files%\crystallization\klar.exe

Software\Microsoft\Windows\CurrentVersion\Run

Software\Microsoft\Windows\CurrentVersion\Run

Nullsoft Install System v2.46

Nullsoft Install System v2.46

allization\klar.exe"

allization\klar.exe"

istry\assigned.exe"

istry\assigned.exe"