Edit tour

Windows Analysis Report
http://togetherdating.co

Overview

General Information

Sample URL:	http://togetherdating.co
Analysis ID:	1417265
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Stores files to the Windows start menu directory

Classification

Analysis Advice

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Process Tree

System is w10x64_ra

chrome.exe (PID: 3432 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://togetherdating.co/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5876 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1876,i,565024120139352158,7778608482785491264,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.254:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.254:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.53.160.47:443 -> 192.168.2.16:49735 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 23.199.50.2
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 3182X-Amz-Version-Id: WeoPV8OPw8UQocVJiZwVeWZ26II363jNAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: *Content-Encoding: gzipX-Varnish: 833671748 813886745X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrchNBn2MtOPUTRHWbmfU+cVH,aVxMblM8KFG3we5NLvyVc5WyJlrbJlAbjNZAUPlAP/8fbJaKSXYQ/lskq2jK6SGPAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1710879469.3291841655125671678243Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Tue, 19 Mar 2024 20:17:49 GMTCache-Control: public, max-age=7776000, immutableAge: 774246Last-Modified: Tue, 17 Apr 2018 11:38:08 GMTETag: W/"338855569759ca44a0734ec4435bcbd0"Content-Type: text/cssVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-12baf686Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 5b 5b 6f 9b c7 11 7d d7 af f8 e0 bc 24 86 57 da fb c5 79 68 d1 1b 1a 34 49 8b a6 45 d0 c7 bd cc 58 44 29 51 25 3f 59 55 8b fe f7 9e 25 9d 56 49 44 72 69 13 89 fd 40 d8 d6 7a be e5 9e 99 39 e7 cc 7e be 7a 39 f1 ea 76 de 4c d7 b4 7c 4b f3 a2 e6 e9 e5 d5 c5 c5 d5 cb e9 8f eb c5 9b c5 6d 5e 4e ab 65 7b b7 a6 ff e4 97 fd b7 82 73 a5 e9 df 17 13 7e bd fb f3 cd 62 f9 f8 7a 7a f1 fb ff 85 f9 9a ee e9 c5 e7 db 25 9b 75 7d 3d dd af 97 9f be f8 5d 8f 73 55 82 4f 26 47 23 4a f4 4a d8 9c bd 88 8e a4 48 54 d9 07 5f aa 6d fe 92 56 f3 2f 3e 59 10 2f fe f9 e2 33 3c 64 7d 93 e7 4f 5f d0 4d a1 d6 a8 89 d5 1d dd ce 8f 77 f4 e2 b3 57 db 47 3c 8d 5e d9 59 63 8d 68 d2 18 61 15 91 28 a5 05 a1 4b 08 8d 0d 53 28 f9 f2 61 c5 fc 24 ee ee 8f Data Ascii: [[o}$Wyh4IEXD)Q%?YU%VIDri@z9~z9vL\|Km^Ne{s~bzz%u}=]sUO&G#JJHT_mV/>Y/3<d}O_MwWG<^Ycha(KS(a$
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 3182X-Amz-Replication-Status: COMPLETEDX-Amz-Server-Side-Encryption: AES256X-Amz-Version-Id: uNy49GgjqM4oM7dZd5is9haAgpWOjcA3Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: *Content-Encoding: gzipX-Varnish: 791577270 398374267X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrchFrGVShJoPlK53+9NxW1kXWIHlCalF7YnfvOr2cMPpyw==,aVxMblM8KFG3we5NLvyVc2z9EvBCMut9vb7n4CTOBv0ghGES6Jsix+7j8qfOfk1LAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711586538.958115349586938901835Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Thu, 28 Mar 2024 00:42:18 GMTCache-Control: public, max-age=7776000, immutableAge: 89535Last-Modified: Thu, 11 Jan 2024 08:10:27 GMTETag: W/"2ac31066cd3a47ddff3d73f964191357"Content-Type: text/css; charset=utf-8Vary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-12baf686Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 1b 6b af ab b8 f1 af a4 5a 55 7b af 64 72 79 84 3c d5 55 d5 d5 b6 fd d0 f6 43 5b a9 1f aa aa 32 60 12 df 43 30 17 cc 79 dc 28 ff bd 63 63 c0 80 21 24 7b ae ba 95 aa 9c 07 f1 63 3c 2f cf 8c 67 0c 46 38 08 72 84 c3 9c a5 6f 67 84 a3 28 27 45 81 70 96 25 84 23 9c 73 1a 26 04 e1 82 46 f0 b7 8c 28 43 01 0a e8 11 05 09 0b 9f be 94 8c 13 14 b0 e8 0d 85 38 7d c6 05 fc cb 38 65 29 0a 49 ca 49 Data Ascii: kZU{dry<UC[2`C0y(cc!${c</gF8rog('Ep%#s&F(C8}8e)II
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 29312X-Amz-Version-Id: lUzvgAVIkMfC7WkprXuYi7GAU3SremQ_Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: Content-Encoding: gzipX-Varnish: 780149899 551558374X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrcgcO5nwQP/PLP6r6amqJdTd,aVxMblM8KFG3we5NLvyVc4XOEB6lEFVlCCNdmy/LrEQghGES6Jsix+7j8qfOfk1LAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711586529.624115612681551861738Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Thu, 28 Mar 2024 00:42:09 GMTCache-Control: public, max-age=7776000, immutableAge: 73214Last-Modified: Wed, 26 Jul 2017 07:04:55 GMTETag: W/"2f0cbb7f0c5a3c00476a1e7f9500fd9f-1"Content-Type: application/x-javascriptVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-991dec68Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cc 7d 7b 77 db c6 b5 ef ff e7 53 88 a8 0f 03 98 23 8a b2 d3 de 53 30 10 6f 62 3b 4d 5a 3b 76 63 a7 49 4a d1 59 10 09 49 88 49 80 06 40 4b 8a c8 7e f6 bb 7f 7b cf 0c 06 20 68 a7 e7 dc bb d6 6d 6a 11 8f c1 3c f7 ec d7 ec c7 c9 c3 de d1 af 7f df 24 c5 dd d1 87 47 c3 d1 f0 f1 d1 f6 c8 9f 07 47 8f 46 a3 3f 2a fa 7b fa d8 bc fe 3a df 64 8b b8 4a f3 4c 1d 7d 9b cd 87 54 f0 d7 f7 78 33 cc 8b ab 93 65 3a 4f b2 32 f9 8f 93 93 ff 7d 54 e6 9b 62 9e bc 88 d7 eb 34 bb fa e1 fb e7 91 2e b7 4a b3 e1 2a 5e ff c7 c3 93 ff f0 2f 37 d9 1c 75 f9 89 a2 6a 93 cb 34 4b 16 c1 fd 87 b8 38 aa 54 a6 8a a8 ba 5b 27 f9 e5 91 7d a7 d2 28 19 2e f3 b9 74 20 a7 9b 45 3e df ac 92 ac 52 65 94 db 9b 67 Data Ascii: }{wS#S0ob;MZ;vcIJYII@K~{ hmj<$GGF?{:dJL}Tx3e:O2}Tb4.J*^/7uj4K8T['}(.t E>Reg
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 866X-Amz-Version-Id: IeAD7WAYSU8sPS1PorNuCByw2miVzwg4Access-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: *Content-Encoding: gzipX-Varnish: 209572290 1050899814X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrciHgFHgWV8QcCQihqlkMQT/,aVxMblM8KFG3we5NLvyVc/BkWtiB5goMIMj1/gzEluEghGES6Jsix+7j8qfOfk1LAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711586537.893115495703948795352Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Thu, 28 Mar 2024 00:42:17 GMTCache-Control: public, max-age=7776000, immutableAge: 94057Last-Modified: Wed, 26 Jul 2017 06:27:26 GMTETag: W/"3c405f66126816b065d7d4680a6a5105-1"Content-Type: application/x-javascriptVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-12baf686Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 56 db 6e 9b 40 10 7d f7 57 8c 50 1a e3 96 b8 76 db 27 5b 51 e5 3a 38 17 05 63 61 d2 c8 6d a3 68 63 16 1b 09 16 6b 61 49 d2 94 7f ef 2c 17 87 75 1c b5 95 6a 29 0a 73 ce 5c cf 02 43 5b 24 14 92 94 07 cb b4 3d 6c 11 b6 12 21 e1 dd 28 f6 44 48 75 8d ad 2e e3 25 09 a9 66 c0 f7 1b fc d3 0e 36 3c ce 02 4f 02 be 60 cb 34 88 99 5e 63 1d 78 6a 65 84 c3 ec f2 ca 19 5d de 8e 47 ae 79 6a 3b 0b 38 86 a7 6f a6 63 0f 40 fb 49 79 8c 91 f6 d4 44 23 66 32 8b 7b 2d 89 f4 5e e2 13 f3 1a af 7d 7a 8f d7 d6 68 ba 40 23 22 ec 51 46 b8 67 a6 23 63 d2 35 e5 5a 3e 6c d5 c5 61 45 d3 13 ba 0c 22 12 26 3a 93 1d 00 30 ac c8 e0 1d b4 71 20 00 d9 51 20 91 6e c0 3c fa 60 fb 7a bb db ee 48 86 d3 54 70 Data Ascii: Vn@}WPv'[Q:8camhckaI,uj)s\C[$=l!(DHu.%f6<O`4^cxje]Gyj;8oc@IyD#f2{-^}zh@#"QFg#c5Z>laE"&:0q Q n<`zHTp
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 39996X-Amz-Version-Id: Oe.sBBO8HV4DqwAb0sd4TbV82Y5.otAeAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: *Content-Encoding: gzipX-Varnish: 157818950 38572221X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrciKxFU9qNTbx/wnSkqqAmp9,aVxMblM8KFG3we5NLvyVc+rffjTX6sjb3mg81EGkmDwQXT2AyjWfyxKagyd4/pDDAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711305715.8185345623452388753Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Sun, 24 Mar 2024 18:41:55 GMTCache-Control: public, max-age=7776000, immutableAge: 348000Last-Modified: Wed, 26 Jul 2017 06:27:16 GMTETag: W/"f06188602d585283a5e17900d9d76b2f-1"Content-Type: application/x-javascriptVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-12baf686Data Raw: 1f 8b 08 00 00 00 00 00 00 03 b4 bd 79 7f db 46 92 3f fc 3f 5f 85 84 d5 32 40 d8 a2 24 27 9b 9d 01 04 73 25 59 b2 65 5b 96 63 c9 4e 32 14 e3 5f e3 e0 11 92 20 c5 43 47 44 be f7 a7 be d5 dd 40 83 a4 9c 99 d9 7d e2 7c 44 a0 d1 68 f4 51 5d 5d 77 ed 7d 5f d9 3a ca 3a f3 81 9c bc bd da ba 3b a8 bf a8 bf f8 5b 65 cb 8d bd ad 17 fb 07 fb bb f4 e7 c7 ad d7 a3 51 67 90 8a ad f3 2c ae 6f 75 67 b3 b1 bf b7 27 d5 4b 7f 4c eb a3 49 a7 b2 f5 be 17 a7 d9 34 f5 b7 2e ce af 2b df ef 55 dc f6 3c 8b 67 bd 51 e6 fe 22 7e 15 73 ef e9 bb f9 34 dd 9a ce 26 bd 78 f6 5d 60 1e 6e fd e9 46 de d3 24 9d cd 27 d9 56 fe 86 f7 74 27 27 5b 32 94 93 ce 7c 98 66 b3 69 73 bf 25 62 21 43 a7 e9 d4 dc a8 11 d5 1c 9f fe 39 5e 4d d6 9c 96 e9 Data Ascii: yF??_2@$'s%Ye[cN2_ CGD@}\|DhQ]]w}_::;[eQg,oug'KLI4.+U<gQ"~s4&x]`nF$'Vt''[2\|fis%b!C9^M
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 2345X-Amz-Replication-Status: COMPLETEDX-Amz-Server-Side-Encryption: AES256X-Amz-Version-Id: roli2dcfCklU3Fm6kwqiR4WQPOfNS75aAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: Content-Encoding: gzipX-Varnish: 300858421 91351494X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrcjV0TBmJ+uLPQ4OZPC1VSMH,aVxMblM8KFG3we5NLvyVc1XEV11U4uj6EySGMcOeW2gfbJaKSXYQ/lskq2jK6SGPAccept-Ranges: bytesServer: Pepyaka/1.19.0X-Wix-Request-Id: 1709575838.393710854554317540Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Mon, 04 Mar 2024 18:10:38 GMTCache-Control: public, max-age=7776000, immutableAge: 2077877Last-Modified: Thu, 11 Jan 2024 08:07:31 GMTETag: W/"a4d0977836ca8a1c8b6001c029a89b9b"Content-Type: application/x-javascriptVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-12baf686Data Raw: 1f 8b 08 00 00 00 00 00 00 03 a5 59 6d 73 db b8 11 fe 2b 14 c7 a3 00 63 0c cf 77 1f c5 61 54 27 75 ae 99 73 93 4c 9c b6 d3 51 d5 0c 08 82 2f 12 45 c8 04 e5 57 e9 bf 77 97 e0 bb 2c c9 be 7e 48 4c 82 d8 c5 ee 62 f7 d9 07 10 cf a2 4d ca 73 67 a5 82 4d 2a 89 bd e6 5a f0 74 9d 4b 11 17 4e 91 f3 4c a7 bc 90 36 9b d9 59 64 cf a9 93 6f 32 32 b3 cf 3a 5f c2 4d 26 8a 44 65 84 d3 e7 3b 9e 5b be c7 1d 5d a8 9c 47 f2 0f f9 48 28 13 ed 00 a1 ae 98 0a 27 92 05 f1 e9 94 3b 1b 2d 35 a9 df e9 84 57 c6 24 fa Data Ascii: Yms+cwaT'usLQ/EWw,~HLbMsgMZtKNL6Ydo22:_M&De;[]GH(';-5W$
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 1991X-Amz-Replication-Status: COMPLETEDX-Amz-Server-Side-Encryption: AES256X-Amz-Version-Id: ILrmhNbqq2hBSPCUVAlafemjRPhhxsHFAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: Content-Encoding: gzipX-Varnish: 825004559 714990906X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrcg1HuJEe35AYwQVw0AY8Ukj,aVxMblM8KFG3we5NLvyVczMRsXdcDB2rjYGDqVQ0VtUfbJaKSXYQ/lskq2jK6SGPAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711305715.84653560782142586103Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Sun, 24 Mar 2024 18:41:55 GMTCache-Control: public, max-age=7776000, immutableAge: 348000Last-Modified: Thu, 11 Jan 2024 08:10:27 GMTETag: W/"aa8216ef8220a1311703c93fa6e63207"Content-Type: application/javascriptVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-12baf686Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ad 58 ff 6e e3 36 12 7e 15 46 38 6c 62 40 71 7b bd bb 7f bc d9 2c 9c 6c d2 a4 4d 77 83 c6 41 b0 28 0a 83 96 68 8b 8d 44 ea 48 ca 8e ce 30 70 af 71 af 77 4f 72 df 90 92 ad d8 ce 26 05 0e 58 ac 45 72 f8 71 38 f3 cd 0f 26 aa ac 60 d6 19 99 b8 e8 bd 33 f5 92 ab 59 95 73 d3 2f 74 5a e5 e2 28 5a c8 a7 91 e1 ca e6 dc 49 ad 6c d4 5b 25 dc 25 d9 91 e8 bd 2a 1a ff 16 95 dc 26 3c 2f 8d 48 32 d7 77 cd a2 88 7e ef ad 5e 3d a7 9f 68 35 95 b3 a3 df a2 bf ac 37 de 1a 3d 97 a9 Data Ascii: Xn6~F8lb@q{,lMwA(hDH0pqwOr&XErq8&`3Ys/tZ(ZIl[%%&</H2w~^=h57=
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 5932X-Amz-Replication-Status: COMPLETEDX-Amz-Version-Id: 1MZynDtWN.6K_yc1mcTzBaXTOkdCqZYLAccess-Control-Allow-Methods: GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: *X-Amz-Server-Side-Encryption: AES256Content-Encoding: gzipX-Varnish: 154823770 36110421X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrchNBn2MtOPUTRHWbmfU+cVH,aVxMblM8KFG3we5NLvyVc+rffjTX6sjb3mg81EGkmDwQXT2AyjWfyxKagyd4/pDDAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711305715.80152934119692667271Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Sun, 24 Mar 2024 18:41:55 GMTCache-Control: public, max-age=7776000, immutableAge: 348000Last-Modified: Thu, 11 Jan 2024 08:10:27 GMTETag: "79be6f7dffa8e49b2ce5b0c87e84ff0c"Content-Type: application/javascriptVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-12baf686Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 3c 8b 72 9b c8 96 bf 42 a8 29 4b ba 06 04 08 3d 2c 87 71 65 72 73 6b b2 35 99 49 8d 93 5b b5 e5 f1 aa 1a 68 49 24 08 74 01 d9 71 6c fd fb 9e d3 dd bc 04 48 f2 d8 ce 6e 25 46 40 9f 57 9f 57 9f 7e 48 f2 26 a1 52 92 c6 be 9b ca e7 b7 7e e8 45 b7 5a 10 11 ef dd b7 35 8d fd 15 0d d3 4b 37 5a d3 cb bb d0 b5 e7 9b d0 4d fd 28 ec 92 de fd 0d 89 25 c7 96 fb fd db db 5b ed d6 ff a6 b9 d1 aa 3f 23 6b bf 0f 0f 6a 40 9c 28 26 69 14 df a9 09 8d 6f 68 dc 2f de f4 dd 28 f4 36 6e fa Data Ascii: <rB)K=,qersk5I[hI$tqlHn%F@WW~H&R~EZ5K7ZM(%[?#kj@(&ioh/(6n
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 41658X-Amz-Version-Id: W5svUYdYeE8Wa5N08G9xYp0mppomYy9NAccess-Control-Allow-Methods: GET,GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: *Content-Encoding: gzipX-Varnish: 447696940 263198139X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrchNBn2MtOPUTRHWbmfU+cVH,aVxMblM8KFG3we5NLvyVc+/YfOABMhigzhBfrSfQTVQQXT2AyjWfyxKagyd4/pDDAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711120535.3482205968965251678244Via: 1.1 varnish (Varnish/6.0), 1.1 googleAccess-Control-Max-Age: 3000Date: Fri, 22 Mar 2024 15:15:35 GMTCache-Control: public, max-age=7776000, immutableAge: 533181Last-Modified: Tue, 17 Apr 2018 11:11:07 GMTETag: W/"30bfa073c86da82d47b52b7a0b6ad7cd-1"Content-Type: application/x-font-woffVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-991dec68Data Raw: 1f 8b 08 00 00 00 00 00 00 03 64 b5 63 70 66 4f b4 3d fc c4 9a d8 b6 6d 67 62 db b6 6d 73 e2 89 6d db b6 6d db 99 d8 36 df fc ee bd 1f fe 55 6f d7 da 7d 7a ad da e8 3e 75 4e 6f 37 39 51 51 00 10 e0 67 14 b4 02 90 7e 1e 40 e6 b1 ff cb ff ff 43 5a 59 49 fc c7 21 f1 67 19 fc 63 7b ab 95 81 7b 72 4a f4 4c 00 00 30 ce 0f 57 fd 31 7d 93 df 88 e9 aa c2 32 ea 3f 9a 33 00 00 62 08 00 80 ed da 1f ba 1b 18 d9 18 d8 ff ac 57 7f 7c 86 7e ec 61 39 ea 05 de c8 d5 99 00 00 00 cf fd e1 a2 ff 19 a8 15 ac 9c a9 bd 99 cd 8f 76 f2 c3 3f 7f 6a 19 32 c9 38 99 9a 19 38 fd c4 42 fc a7 21 fc 8f a1 01 a0 cc ac 3d 4c 7f Data Ascii: dcpfO=mgbmsmm6Uo}z>uNo79QQg~@CZYI!gc{{rJL0W1}2?3bW\|~a9v?j288B!=L
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 47380Access-Control-Allow-Methods: GET,GET, OPTIONS, POSTAccess-Control-Max-Age: 3000X-Amz-Version-Id: OJ0Lr8qVb_gYiF2kqr6nkCtktnmxiEqEAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: Content-Encoding: gzipX-Varnish: 187107628 31825481X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrchNBn2MtOPUTRHWbmfU+cVH,aVxMblM8KFG3we5NLvyVc5WyJlrbJlAbjNZAUPlAP/8fbJaKSXYQ/lskq2jK6SGPAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711120534.4742205869771471678245Via: 1.1 varnish (Varnish/6.0), 1.1 googleDate: Fri, 22 Mar 2024 15:15:34 GMTCache-Control: public, max-age=7776000, immutableAge: 533182Last-Modified: Tue, 17 Apr 2018 11:11:07 GMTETag: W/"e8c5c50fa92b6d838601de8f617f61e0-1"Content-Type: application/x-font-woffVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-991dec68Data Raw: 1f 8b 08 00 00 00 00 00 00 03 6c b7 03 94 27 4d f0 2d f8 6b db b6 6d 4f 6b da b6 ed 69 db b6 dd d3 b6 3d 6d db b6 6d db e6 f6 f7 7f 6f df d9 3d bb 75 6e 64 dd 1b 95 51 89 53 99 51 e9 2a 27 2a 0a 00 02 fc 5c 6d 41 00 e4 9f 1b 50 46 c3 ff d2 ff df 4b 5a 59 49 fc a7 42 e2 0f f5 fb b1 bd b0 67 3d 53 39 25 06 66 00 00 18 f5 47 ab fe 98 be f1 2f a4 38 55 61 19 f5 1f 9f 15 00 00 62 0a 00 80 ed 38 64 78 90 1a 59 1b d8 fd f0 85 9f 3a 83 3f f6 b0 14 fd 82 60 e4 e2 44 08 00 80 67 fe 68 d1 ff 0c 44 08 fe d8 c4 ce d4 fa c7 77 f0 a3 3f 7f da 32 64 96 71 34 31 35 70 fc 89 85 f8 cf 87 f8 3f 86 05 80 32 b5 72 37 Data Ascii: l'M-kmOki=mmo=undQSQ'*\mAPFKZYIBg=S9%fG/8Uab8dxY:?`DghDw?2dq415p?2r7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 55573X-Amz-Version-Id: KX3EvSnMd16QTK9t_TPMsrktWEqBXWBhAccess-Control-Allow-Methods: GET,GET, OPTIONS, POSTAccess-Control-Allow-Headers: DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Timing-Allow-Origin: Access-Control-Allow-Origin: *Content-Encoding: gzipX-Varnish: 423263349 279958195X-Cache-Status: HITX-Seen-By: zj0K/N8xR7eC1M9gyLLPhec8x6p2CWcEzwFyRVShrcjaMN8m4g6DSmmGg8hxkvR+,aVxMblM8KFG3we5NLvyVc2Vurfrb0bjwTH53EUtny+IQXT2AyjWfyxKagyd4/pDDAccept-Ranges: bytesServer: Pepyaka/1.21.6X-Wix-Request-Id: 1711121688.5062218325658301679266Via: 1.1 varnish (Varnish/6.0), 1.1 googleAccess-Control-Max-Age: 3000Date: Fri, 22 Mar 2024 15:34:48 GMTCache-Control: public, max-age=7776000, immutableAge: 532028Last-Modified: Tue, 17 Apr 2018 11:11:06 GMTETag: W/"6105cf48793c0b601fc2e9796657a77b-1"Content-Type: application/x-font-woffVary: Accept-Encodingx-cache: hitglb-x-seen-by: qhk2IXhXaFW+ScoHjRxEUvX1Zxk6j9wOS6tQMkUbOP0=x-gcp-cdn-pop: LGA-991dec68Data Raw: 1f 8b 08 00 00 00 00 00 00 03 94 ba 03 74 25 5d b7 ef bd 63 a3 63 db b6 9d 8e d9 b1 6d db 76 c7 1d ec 18 1d db b6 3a b6 9d 74 6c 9b 37 cf fb 9e 73 cf b9 e7 de 31 be f1 d5 f8 cd 55 73 fe d7 5c b5 6a d7 a8 5a ab 56 8d ed ae 20 2e 0e 00 01 7c 6d 1b b9 00 94 af 1d c8 9d c7 bf e3 ff 7b 93 55 51 96 fc 4a 48 fa 72 83 bf 6c 67 45 86 b5 44 41 99 91 05 00 00 c5 fa 8a d5 be cc c0 94 0b 29 4a ed bb 9c c6 97 e6 00 00 80 59 01 00 10 db 4e 1c 9e fd c6 b6 86 5f 31 c4 fa 57 ce 9f 2f bb 5b 8c 79 42 32 76 73 21 02 00 20 0b be 62 91 7f 0c 4c 01 6e ca cc c1 dc f6 4b 3b fa 8a df bf fa 32 62 91 73 36 33 37 74 fe 6a Data Ascii: t%]ccmv:tl7s1Us\jZV .\|m{UQJHrlgEDA)JYN_1W/[yB2vs! bLnK;2bs637tj
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 2816Content-Type: image/x-iconLast-Modified: Thu, 07 Sep 2023 20:06:11 GMTETag: "64fa2d33-d95"Strict-Transport-Security: max-age=31536000Server: PepyakaX-Content-Type-Options: nosniffExpires: Thu, 04 Apr 2024 14:53:52 GMTCache-Control: max-age=604800Content-Encoding: gzipAccept-Ranges: bytesDate: Thu, 28 Mar 2024 19:21:56 GMTAge: 16084X-Served-By: cache-iad-kcgs7200031-IADX-Cache: HITVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_gX-Wix-Request-Id: 1711653716.404945444500695402X-Seen-By: yvSunuo/8ld62ehjr5B7kA==Via: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 97 f9 3b d4 eb 1b c7 9f 31 65 2c d9 d7 50 76 21 ca 12 a2 8c 49 d6 a1 d1 19 4e 22 32 12 92 31 ca 90 c2 e8 93 28 24 8c 5d 11 23 73 6c 63 6b 2c 47 a4 e9 50 54 1a b2 0c b2 3b 8e 25 4b 1b 19 63 fb 4e df ff e1 fb fd e9 5c cf 75 3f f7 75 bd af f7 f5 7a ee e7 fe e5 be ee 84 b3 18 5b 21 01 39 01 00 80 90 bd 9d 15 96 9b 19 bf 82 8f 97 7b 63 47 f1 08 6e 82 11 b1 b6 96 a0 8a a9 b0 c0 35 39 d9 5b 9d 72 b9 79 71 39 3f a1 72 e0 b8 6c dc 69 04 6a ef 57 39 5c 19 28 05 57 c0 cd bd 35 46 0c 2c 70 80 a7 50 41 16 2f 24 c0 3d c2 85 31 4d 4f 89 d4 24 4b 8d 84 ee 2f c7 13 aa 99 b5 c7 e4 28 d9 8f d9 5e c8 cd ad 1b 59 ce cd 63 84 c1 3f 87 e1 8f 0e 0e e5 1b 80 47 e4 c6 81 48 11 59 70 28 a6 0e b1 0f 0a 65 07 b5 c0 ae 09 db 45 32 80 dd fd 89 37 f2 60 0e fa 57 fe df ca 5b 66 20 cf e2 76 eb c6 da e2 e0 ed 15 24 89 13 4a fc e7 5d e6 2c 67 6d f1 43 e5 85 46 69 c1 b6 02 8b db 8f 8e 7a b5 1e 53 b4 88 1e dd 7d 19 34 c7 cc 0f 3c e2 f1 67 cd 4b 24 a7 d6 a5 6d 6d a2 e5 56 5f 14 fb 2b 65 63 67 3b f2 ee ed 46 a1 c1 e8 dd 1d d2 f7 de f9 f5 f4 43 4e 3b eb 91 ec d5 8e 14 c5 bb 2f 77 b7 37 c3 89 a1 a1 ab 83 6b 1c 84 0a ef 7c db 8b c8 f5 47 0f 64 8e 6a 6c fe 36 0d 0d 56 7b 7d d9 fe b8 6e bd 3b 1a be 32 1a 80 c1 60 d0 1e 06 61 c9 61 00 3a a5 17 5d aa 0c f3 7a 11 31 a0 a4 e5 d0 90 7d d4 cb 38 45 d1 e2 89 23 8f 87 c8 e0 f6 d6 06 f1 db a2 6a a7 09 61 94 2d b8 55 45 3a 7a b1 65 e8 d0 84 cb e9 e9 b6 7b 14 e3 bd 20 19 e1 61 12 3c 5e ec 91 18 78 32 62 35 de cc 78 ae 90 fb 89 95 4d 9e 82 62 b9 25 ce ea 82 f3 b7 9b 49 1e e1 07 40 6a d2 fa 97 09 c5 fa 17 a1 e2 18 98 09 2b 21 cd 1e 42 71 5f 0b 13 47 a2 4c 8c 36 8b a3 b2 78 70 8d 23 cb e9 c2 74 91 3e f4 a7 89 17 07 fd 9e be cf 3e 9a 22 bc 67 cc c7 29 df ac 5e 71 5f b6 cb 5e Data Ascii: ;1e,Pv!IN"21($]#slck,GPT;%KcN\u?uz[!9{cGn59[ryq9?rlijW9\(W5F,pPA/$=1MO$K/(^Yc?GHYp(eE27`W[f v$J],gmCFizS}4<gK$mmV_+ecg;FCN;/w7k\|Gdjl6V{}n;2`aa:]z1}8E#ja-UE:ze{ a<^x2b5xMb%I@j+!Bq_GL6
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Length: 2816Content-Type: image/x-iconLast-Modified: Thu, 07 Sep 2023 20:06:11 GMTETag: "64fa2d33-d95"Strict-Transport-Security: max-age=31536000Server: PepyakaX-Content-Type-Options: nosniffExpires: Thu, 04 Apr 2024 14:53:52 GMTCache-Control: max-age=604800Content-Encoding: gzipAccept-Ranges: bytesDate: Thu, 28 Mar 2024 19:21:56 GMTAge: 16084X-Served-By: cache-iad-kjyo7100179-IADX-Cache: HITVary: Accept-EncodingServer-Timing: cache;desc=hit, varnish;desc=hit_hit, dc;desc=fastly_gX-Wix-Request-Id: 1711653716.924088797307474220X-Seen-By: yvSunuo/8ld62ehjr5B7kA==Via: 1.1 googleglb-x-seen-by: bS8wRlGzu0Hc+WrYuHB8QIg44yfcdCMJRkBoQ1h6Vjc=Data Raw: 1f 8b 08 00 00 00 00 00 00 03 ed 97 f9 3b d4 eb 1b c7 9f 31 65 2c d9 d7 50 76 21 ca 12 a2 8c 49 d6 a1 d1 19 4e 22 32 12 92 31 ca 90 c2 e8 93 28 24 8c 5d 11 23 73 6c 63 6b 2c 47 a4 e9 50 54 1a b2 0c b2 3b 8e 25 4b 1b 19 63 fb 4e df ff e1 fb fd e9 5c cf 75 3f f7 75 bd af f7 f5 7a ee e7 fe e5 be ee 84 b3 18 5b 21 01 39 01 00 80 90 bd 9d 15 96 9b 19 bf 82 8f 97 7b 63 47 f1 08 6e 82 11 b1 b6 96 a0 8a a9 b0 c0 35 39 d9 5b 9d 72 b9 79 71 39 3f a1 72 e0 b8 6c dc 69 04 6a ef 57 39 5c 19 28 05 57 c0 cd bd 35 46 0c 2c 70 80 a7 50 41 16 2f 24 c0 3d c2 85 31 4d 4f 89 d4 24 4b 8d 84 ee 2f c7 13 aa 99 b5 c7 e4 28 d9 8f d9 5e c8 cd ad 1b 59 ce cd 63 84 c1 3f 87 e1 8f 0e 0e e5 1b 80 47 e4 c6 81 48 11 59 70 28 a6 0e b1 0f 0a 65 07 b5 c0 ae 09 db 45 32 80 dd fd 89 37 f2 60 0e fa 57 fe df ca 5b 66 20 cf e2 76 eb c6 da e2 e0 ed 15 24 89 13 4a fc e7 5d e6 2c 67 6d f1 43 e5 85 46 69 c1 b6 02 8b db 8f 8e 7a b5 1e 53 b4 88 1e dd 7d 19 34 c7 cc 0f 3c e2 f1 67 cd 4b 24 a7 d6 a5 6d 6d a2 e5 56 5f 14 fb 2b 65 63 67 3b f2 ee ed 46 a1 c1 e8 dd 1d d2 f7 de f9 f5 f4 43 4e 3b eb 91 ec d5 8e 14 c5 bb 2f 77 b7 37 c3 89 a1 a1 ab 83 6b 1c 84 0a ef 7c db 8b c8 f5 47 0f 64 8e 6a 6c fe 36 0d 0d 56 7b 7d d9 fe b8 6e bd 3b 1a be 32 1a 80 c1 60 d0 1e 06 61 c9 61 00 3a a5 17 5d aa 0c f3 7a 11 31 a0 a4 e5 d0 90 7d d4 cb 38 45 d1 e2 89 23 8f 87 c8 e0 f6 d6 06 f1 db a2 6a a7 09 61 94 2d b8 55 45 3a 7a b1 65 e8 d0 84 cb e9 e9 b6 7b 14 e3 bd 20 19 e1 61 12 3c 5e ec 91 18 78 32 62 35 de cc 78 ae 90 fb 89 95 4d 9e 82 62 b9 25 ce ea 82 f3 b7 9b 49 1e e1 07 40 6a d2 fa 97 09 c5 fa 17 a1 e2 18 98 09 2b 21 cd 1e 42 71 5f 0b 13 47 a2 4c 8c 36 8b a3 b2 78 70 8d 23 cb e9 c2 74 91 3e f4 a7 89 17 07 fd 9e be cf 3e 9a 22 bc 67 cc c7 29 df ac 5e 71 5f b6 cb 5e Data Ascii: ;1e,Pv!IN"21($]#slck,GPT;%KcN\u?uz[!9{cGn59[ryq9?rlijW9\(W5F,pPA/$=1MO$K/(^Yc?GHYp(eE27`W[f v$J],gmCFizS}4<gK$mmV_+ecg;FCN;/w7k\|Gdjl6V{}n;2`aa:]z1}8E#ja-UE:ze{ a<^x2b5xMb%I@j+!Bq_GL6

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: togetherdating.coConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/fonts/Helvetica/fontFace.css HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/styles/error-pages/styles.css HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/jquery/2.0.3/jquery.min.js HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/angularjs/1.2.28/angular.min.js HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/angularjs/1.2.28/i18n/angular-locale_en.js HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/angular-translate/1.1.1/angular-translate.min.js HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/scripts/error-pages/app.js HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_api/wix-laboratory-server/laboratory/conductAllInScope?scope=error-pages&accept=jsonp&callback=setExperimentsSync HTTP/1.1Host: www.wix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/images/error-pages/logo.png HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/images/error-pages/link-arrow.png HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://static.parastorage.com/services/wix-public/1.719.0/styles/error-pages/styles.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/images/error-pages/cable-spaghetti-bg.jpg HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://static.parastorage.com/services/wix-public/1.719.0/styles/error-pages/styles.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/fonts/Helvetica/Fonts/60be5c39-863e-40cb-9434-6ebafb62ab2b.woff HTTP/1.1Host: static.parastorage.comConnection: keep-aliveOrigin: http://togetherdating.coUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/fonts/Helvetica/Fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff HTTP/1.1Host: static.parastorage.comConnection: keep-aliveOrigin: http://togetherdating.coUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/third-party/fonts/Helvetica/Fonts/530dee22-e3c1-4e9f-bf62-c31d510d9656.woff HTTP/1.1Host: static.parastorage.comConnection: keep-aliveOrigin: http://togetherdating.coUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.cssAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/images/error-pages/logo.png HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/images/error-pages/link-arrow.png HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /services/wix-public/1.719.0/images/error-pages/cable-spaghetti-bg.jpg HTTP/1.1Host: static.parastorage.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.wix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://togetherdating.co/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: www.wix.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: unknown

DNS traffic detected: queries for: togetherdating.co

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 28 Mar 2024 19:21:54 GMTContent-Type: text/html; charset=utf-8Connection: keep-alivex-wix-request-id: 1711653714.844366431591117625Age: 0Server-Timing: cache;desc=miss, varnish;desc=miss, dc;desc=42X-Seen-By: VtqAe8Wu9wvSsl49B/X4+ewfbs+7qUVAqsIx00yI78k=,m0j2EEknGIVUW/liY8BLLsNSikLMYkJJqXV1PzQmZDtGkFvVdT2Nq6f3Hedj7ewB,2d58ifebGbosy5xc+FRaluKPbL6SXoMxuyaR1ydai1GbbG7q5aSLDDQLPykQAgDKhLVOmbA4AgthqopP458CUg==,2UNV7KOq4oGjA5+PKsX47CaOPCbndCqdyYrCBy15MBQfbJaKSXYQ/lskq2jK6SGP,RrVNT7yXPqz6EbhZ/RjN/iaTDUqVJBOGg7yDsG/E810=,TSdO8Ig67iG+3afP/OqlAFBZQQYcwY+pEx2OV/KXaSY=,updaSF0YDozocDRTgMoSRzvV0rSx+mdgRXF42Ohi9ZGORSejP4NS4A5pP4YeNT4wNqsoCX0kf8FpzV29vF0KKg==Vary: Accept-EncodingX-Content-Type-Options: nosniffContent-Encoding: gzipTransfer-Encoding: chunkedData Raw: 34 34 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 56 5b 6f db 36 14 7e cf af 60 f4 a2 16 08 c5 c8 71 ae 93 02 74 59 8a e5 65 28 3a 14 d8 50 14 05 2d 1d 5b 4c 28 52 25 a9 d8 46 d7 ff be 73 24 d9 73 e2 60 8d 13 3f d8 e6 21 cf e5 3b 77 c6 b2 7d ce 19 e3 fc 72 6f 2f db 2f 6d 11 96 0d b0 2a d4 fa 12 cf 9c ef 31 fc d0 6d 46 34 66 66 5c 36 4d 1e cd d5 e2 da 39 eb 3e c8 19 f8 77 4d 13 d1 03 90 e5 25 be cf 6a 08 92 19 59 43 1e dd 2b 98 37 d6 85 88 15 d6 04 30 81 58 cb 50 e5 25 dc ab 02 78 77 38 50 46 05 25 35 f7 85 d4 90 a7 07 ac 96 0b 55 b7 f5 7f 84 d6 83 eb 4e 72 82 2f 8c 45 7d 2b 45 45 25 9d 07 14 dc 86 29 3f db b8 a8 42 68 38 7c 6b d5 7d 1e fd c5 3f bd e3 57 b6 6e 64 50 28 61 c3 9c 9b eb 1c ca 19 f4 7c 41 05 0d 04 72 a2 4c 99 47 71 83 f0 be 76 c4 98 fd c3 82 93 c6 6b 19 f0 71 26 3a ea 63 b8 25 f8 c2 a9 26 28 6b 36 54 6c d8 b4 83 57 b6 b8 9c 9d d8 e0 37 e4 1a 8b 56 c2 e2 80 19 3b b5 5a db 79 cf b2 0e 28 85 2e d3 ca dc 31 0a 6a 1e a9 1a e1 88 c6 cc 22 56 39 98 e6 91 10 f3 f9 3c c1 58 26 85 ad c5 54 62 48 ac 49 f0 2b 62 0e 74 1e f9 0a 43 57 b4 81 11 7d 4b 78 2f 7a 25 c9 07 74 6d 91 34 d2 49 1f ac 43 4d 9d 50 8c 1b 05 da 8b 50 29 57 72 bc 0e 4b 31 c5 5c f0 e2 77 d0 f7 80 3c b2 3b bf 97 05 72 78 c4 d7 ab 0e 4b 0d be 02 c0 d4 e9 ad 0f b0 08 a2 7b 20 3a b7 6f c0 ec 2d d9 e2 7b ae 69 e8 00 de b4 13 ad 0a 91 26 a7 e9 79 72 28 7c a7 5e 00 e5 38 1a 8d 49 3e 90 3a 13 1f ea cf 44 9f f9 d9 c4 96 4b a6 a5 99 e5 11 60 fc 31 8d Data Ascii: 442V[o6~`qtYe(:P-[L(R%Fs$s`?!;w}ro//m*1mF4ff\6M9>wM%jYC+70XP%xw8PF%5UNr/E}+EE%)?Bh8|k}?WndP(a|ArLGqvkq&:c%&(k6TlW7V;Zy(.1j"V9<X&TbHI+btCW}Kx/z%tm4ICMPP)WrK1\w<;rxK{ :o-{i&yr(|^8I>:DK`1

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.16:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.199.50.2:443 -> 192.168.2.16:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.222:443 -> 192.168.2.16:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.6.254:443 -> 192.168.2.16:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.213.254:443 -> 192.168.2.16:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.16:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 51.53.160.47:443 -> 192.168.2.16:49735 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@13/23@12/60

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://togetherdating.co/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1876,i,565024120139352158,7778608482785491264,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1876,i,565024120139352158,7778608482785491264,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	4 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://togetherdating.co	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
togetherdating.co	185.230.63.107	true	false	unknown
td-static-34-49-229-81.parastorage.com	34.49.229.81	true	false	high
www.google.com	142.251.111.99	true	false	high
td-ccm-neg-87-45.wixdns.net	34.149.87.45	true	false	unknown
static.parastorage.com	unknown	unknown	false	high
www.wix.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/530dee22-e3c1-4e9f-bf62-c31d510d9656.woff	false	high
http://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css	false	high
http://togetherdating.co/	false	unknown
http://static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js	false	high
http://static.parastorage.com/services/wix-public/1.719.0/styles/error-pages/styles.css	false	high
http://static.parastorage.com/services/third-party/angularjs/1.2.28/angular.min.js	false	high
http://static.parastorage.com/services/wix-public/1.719.0/images/error-pages/cable-spaghetti-bg.jpg	false	high
http://static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js	false	high
http://static.parastorage.com/services/wix-public/1.719.0/images/error-pages/link-arrow.png	false	high
http://static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js	false	high
http://www.wix.com/favicon.ico	false	high
http://static.parastorage.com/services/third-party/angularjs/1.2.28/i18n/angular-locale_en.js	false	high
http://static.parastorage.com/services/wix-public/1.719.0/images/error-pages/logo.png	false	high
http://static.parastorage.com/services/third-party/jquery/2.0.3/jquery.min.js	false	high
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff	false	high
http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/60be5c39-863e-40cb-9434-6ebafb62ab2b.woff	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.253.122.139	unknown	United States	15169	GOOGLEUS	false
185.230.63.107	togetherdating.co	Israel	58182	WIX_COMIL	false
142.251.111.99	www.google.com	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.253.63.84	unknown	United States	15169	GOOGLEUS	false
34.49.229.81	td-static-34-49-229-81.parastorage.com	United States	2686	ATGS-MMD-ASUS	false
34.149.87.45	td-ccm-neg-87-45.wixdns.net	United States	2686	ATGS-MMD-ASUS	false
172.253.115.94	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.16

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1417265
Start date and time:	2024-03-28 20:21:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	http://togetherdating.co
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@13/23@12/60

Warnings

Exclude process from analysis (whitelisted): svchost.exe
Excluded IPs from analysis (whitelisted): 172.253.115.94, 172.253.122.139, 172.253.122.102, 172.253.122.113, 172.253.122.100, 172.253.122.138, 172.253.122.101, 172.253.63.84, 34.104.35.123
Excluded domains from analysis (whitelisted): clients2.google.com, accounts.google.com, edgedl.me.gvt1.com, clientservices.googleapis.com, clients.l.google.com
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: http://togetherdating.co

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 18:21:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.987885974862312
Encrypted:	false
SSDEEP:
MD5:	CFF46EAEBC2B281D52024D15F46930DD
SHA1:	163AC70184BF4DF83C0844693BD48A814E1563DF
SHA-256:	482EC00EC40582FC76B5173AEE8E17B8FFE88D56ECB3C1D5B832E2708D38596B
SHA-512:	5CC47C95FE79F515AF91555AA30F3B7FF5E8225851F56EE30413BDB26FB64AE75FD92FE46F77D3637C2B8CF759666DE03DEBB28A7651E9EDD9C8147A2D73B6E8
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....31.2E...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\|X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 18:21:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	4.004021224852768
Encrypted:	false
SSDEEP:
MD5:	FF7908111CB864C71EA53C49EF501260
SHA1:	9B3A8A160605C6CB5411D97C86561650FC8CD2D6
SHA-256:	7559908817A321853A8F6E07E22D5780BD6EEA284726A99DD68AF891A6D97403
SHA-512:	95306D31F6B43FE26E6FAE9999610893A1ED5E8C4EED0E2F31DB060C4F7EDB971E16735D6E41E61B01E354D49C5FAE7795E6F972224CB0D84BBEBB6F56F411A3
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....4.2E...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\|X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.012039181325483
Encrypted:	false
SSDEEP:
MD5:	D76BF9B9E734DA5E8048FEDDC3D2715B
SHA1:	613DB3D7FD8992AB8BD8C2937540D5690C6E7249
SHA-256:	6F1B2601F772E424C713F47E091F461AFF9A85ACDEE6D29DC98897ADE9536E51
SHA-512:	9E006BE8CF0C2F3570320C7CD56DA004ABFB4F7EABAABA4B6EFE9563709813598C60BDBB4A359EF536DB78FB9927BE36B8163004B3F2DB1266A2D88D39D6AEBB
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\|X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 18:21:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	4.004795731819987
Encrypted:	false
SSDEEP:
MD5:	528EA3AC5CABB49148BD700764424B98
SHA1:	7486B8181D190AD3669A8CFBA36E9D191DCE30A2
SHA-256:	0C2D201AA1FDA5B17369E8F64D750F014B259B421CD0D638031D48083B613E0F
SHA-512:	0B67CF23298845854B32EA8CFDB3CC9CF3B085A66BC501C4727C0C823474C1246D63ED19FBFA44D8755E60517D9E7F1F9E35DC428819E4D46EF3CF1358F943B6
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....[..2E...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\|X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 18:21:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.991903671201787
Encrypted:	false
SSDEEP:
MD5:	D573F63175990C57288992D923209FBC
SHA1:	81201D1D0531C00AB35CD99ACC3D81F5313B4549
SHA-256:	F52415E984C5ADCC3A1653890647509E2149EAB14EF87CF6C8FE195457A42ACD
SHA-512:	134C7E3CE60EB34335536E7C041351D89B3F2F7B322FAA7620B8EA9D6E51DCD42D1EA49A758008296BE24E17404BF5B624772BBD93C2717511882DEEA5B57965
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,......2E...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\|X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Mar 28 18:21:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	4.000722966526055
Encrypted:	false
SSDEEP:
MD5:	2FE737913C07D4A858184D4A8D093B47
SHA1:	110C7EC8A6518E089E27370AA2521B3C9EDB00BC
SHA-256:	7FD69773C96E769A1CD80C7528588AB97EC21870F05D4C45599D3BA4959D853E
SHA-512:	7FFE64463D0B158BAC938D8D66D2B5ED1767E90771B5E5128BF8EDB324802D8FC01F1961B1414D45ADB3C826196D361C828DCBD68D703E160878107AF38DFF6C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.@.. ...$+.,....l.~2E...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I\|X......B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V\|X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V\|X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V\|X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V\|X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........s........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 13849
Category:	downloaded
Size (bytes):	3182
Entropy (8bit):	7.937996576763573
Encrypted:	false
SSDEEP:
MD5:	138F6948F4F82FDA4D44FAD50F5456BE
SHA1:	002792DD712E5DE8C48D71334CA6E45042D3C992
SHA-256:	2F8100E5B650BCDE60F264ADA67F6B5712E61036260FCBE9173BB33FFC875CFF
SHA-512:	E3C13D66E8B9C666A6D761280B9B4301A80D3320112AEDC71AC5AEE34DAAF7C6B7C4471BE6FC4701AA24B295FB4660CD928D4826C04C1CB8CD9AAC5299947568
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css
Preview:	...........[[o...}...$.W...yh...4I..E...XD)Q%?YU....%.VIDri...@..z..9..~.z9..v.L.\|K.............m^N.e{.......s.....~....b..zz...........%.u}=.....].sU.O&G#J.J.....HT.._.m..V./>Y./...3<d}..O_.M.......w..W.G<.^.Yc.h..a..(...K...S(..a..$..?.%.[e).oY..MD...l......<?.4..i..Z...+!.F4.YDO..+....t.y...O....../.s"8._......{.......\|.7..E.H..2&..NGR.TC.%.....f\)U4nV..Yy..w.}.Z.A.t...%..#.....\.bd^.6X#.q.dd...KD....&.A...e..lq.Yx......y...Z}.:..$S....6y#".l.qN...e...a.e!W....Bf.".jPx.....2....IS.."l3Ed.Ps.jRZk..8v.W.u..8....HE6.A...b..nd..U..!.kq.j.i....:....\|...g..!.!..]...>..CS..P..Y..-...v..XZ..W.....X..u..B.....m(....JUWQ.5..p..m.D3...EJ..@.[.z.A.'.......\|.#.2"'bA*.h.6..6.F.......n}Z...qI.....{.o..f.\.Z.V..6.e..U.2..o..J..C.'..X=.0.$..xz...t.=e<..Z..IJ..........)}.)(..aw..t.M..>..r.1.Hs`......k2F....]....h.........\;^.'G9R.)k.bq.D.;JJN..R.... ...n.j.r...-.pb........5ics)A.%]P..z-[PtL...nG.#.?.._.8.....'.X..t.XTGM...le...zr.#..jgUQ.T..

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 5058
Category:	downloaded
Size (bytes):	1991
Entropy (8bit):	7.911457086427894
Encrypted:	false
SSDEEP:
MD5:	4168BACCD372ABDACB4B1368A5EDF5A4
SHA1:	05DB72505D3623CACE51590F7213C9E6916DCBE8
SHA-256:	92E8A7051A68EC0993B0C01C3EDDDAE3E8BD23534E3E4E790FCE291BD90BA575
SHA-512:	2720472D921D05840ADFDEE0DF41E128A743F69B5F2A5F3140B74679601C85FE7300564439CD78A4C792A1CC87F7C179AA4F7AEA14F750E24C72C39809C8BB31
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/locale/messages_en.js
Preview:	...........X.n.6.~.F8lb@q{.....,.l.Mw..A.(...h..D.H..0p.q.wOr.....&..X.Er.q8...&..`.....3...Y.s./tZ..(Z......I.l.[%.%.......&</.H2.w..~.^=..h5......7..=..0Q<.TB.G...s.&..NX7...(..L..t..D..h..........].....3.(v.(....Q...E=..O.R.;..Vq..........:v).......\|wz).l.al......B#..e...i6.l.G.U..`sajf.V}.r.....%..T..8......6...Ve......y.2>'UJ.'.(.Gv.Y.sk?.6..8..eFL?......&W..Sv...cwa........sXtqxz......B..?.....Q......4.i,..9..]..U....e..%8.+..d...T...,2.h....$..T.A.....<.dd ....R..."..W..... ........Nh..(.o.(......B.......^..S..A..<?.Dg.%.W........L$l.....n.`_a..B......Y...M.{p..!^4...,....;.s6....2x3l.+{...b.~k8....;..R!.U>.m....-.w.Z........k#..ADWg4....G8...:n.5...w4Db9~S.u..X.FD...0{\|u..-.."..L._.`0;...F...~,[M.8....w.......h#...].......'........1..W.TE...R...UP...>;......Y..V.2....jfA..U.SBY.\|.Ie.C~t.H...:..Z..At.&Z._K.y..A.....9.R.....O&. W.j....Q.Q\|}Az8a.....AA.;>.F"...(>..h....Kxh...Q...J.qYMri3..8..V....v....Y...k..ed....+'.U..B^.T{..4..

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 23854
Category:	downloaded
Size (bytes):	5932
Entropy (8bit):	7.972508927462869
Encrypted:	false
SSDEEP:
MD5:	37182E6DB4C0F52A504D1AC8CE13F094
SHA1:	CC57B331AF1FD9C52B0C91DEEA4FB481B1B7BE22
SHA-256:	94B4568DF4962A7D80DA54615C506C2E52D0006B9E77F6B8E6ED3494FADFAA6A
SHA-512:	0BBF6FDD4E8A7B3277146F0D3E8798236FAB76A28D8A9C00D2D592C4BF0D6E2C213A9827EAD278B5B210057D79C1B621608F089FE01891EAB5FA19B5EF7B2E7D
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/wix-public/1.719.0/scripts/error-pages/app.js
Preview:	...........<.r...B.)K....=,.qersk.5.I..[....hI$.t..ql......H...n%F@.W.W.~H.&.R.....~.E.Z....5.....K7Z.....M.(.....%.....[......?#k...j@.(&i....oh./...(.6n.&....E.W[>%...q].N./I..O\...q...M....F>."w...m..y....N.$vm.s.v._...;=E..N..1...p..H..o)...@c.qD.J...n..6..h!......~.ve..Q...&rO...YE.&.]....a?"..ZV.....I@.)..{.....DI.>,5#.OA......SY. ..&.....RhL.......PJ..RW>u4.;.{.*..h.$.3..E..e..c........6...?I.pQ..W.z...z.C..&D.q.q=B......s..v.hE..h1]...._....,.N.DoH..%..A..#.....[...C....6.$..=.tr.h....Le.....!..g.">t.......^q./+...n..0....GK6..t..Z...4\.....P..Ll.v/D...p.v;...\...(..z..]......C....l..(N.`wq._..`....%Dd.M.;.":....t.F7`...I.....%...o... . .....I.F.h..B.U.6.G..\|.~.b...+t(...\| .rN.x..X...:......l z.y.%.O~........X.V..eO.....~...~..j.w.....G.9..=.2.s..p..F..7+..SW.7J....-.7I.&..:.u5.........eOqS.D....9q.\|}.......(.9....f..fa...`do. d.j/...[..V._@.....V>@....z.t.o..h..M.....y..UCXD3..f.h....=J.....h...{9.B...L.,B...Pj.,7`.elnP.g...

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1138x776, components 3
Category:	dropped
Size (bytes):	97019
Entropy (8bit):	7.943790790328998
Encrypted:	false
SSDEEP:
MD5:	39E737C9D79798175E1417105DD3E7B0
SHA1:	B6E64D8979D8D44C414B79091EBEE90428043896
SHA-256:	A2B6A50A669EF311F1FBE6BE6174DE21A6E9CA12D186B6B2F323668C94241438
SHA-512:	DFEB4E02A7C218D81F4F50967A84C759A6D26C6CD88E05D1A76886BEADD4BCBFFD1C8E5B203AA1B4C6D9D6401CA85E04F31B0B258FEC78712DBFE9F9D3045FDD
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.............C...........................#.%$"."!&+7/&)4)!"0A149;>>>%.DIC<H7=>;...C...........;("(;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;........r...................................................................................`..........g.C....M.........I$.A ..... .. ....H..H.........s.*.}.=.........................%.'+..... .....$.I$........ .......H$.@$.........F..^..;..Q ...................Z<....=p.A.....A%D.I ................@$........,.>iK...z.9.I......................p.Y.f..@.....TI$..... .@ .@ ....H$..........@1..5..G.Z..w.....................'.C..G...@.....I$.I........@ .. ..$.A .H$.. ..$.G..%.G.Mz.^@....................y<99.Z:.......I$.H... .@ .......@..H$....@...5....]............................!...Y:.......A$.@... ...........$........$..>Y66._F.....................`.r...t........H$..... .@........H$.....$.By!A..}z.H.......................C.............. .. .............H ....I9..H7.........................<..............@......................

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 6946
Category:	downloaded
Size (bytes):	2345
Entropy (8bit):	7.912974188198186
Encrypted:	false
SSDEEP:
MD5:	9E304F83FB5EF096356B15686E3CBC34
SHA1:	5B6809F40B048B66576B701B193FA71291D9708D
SHA-256:	A27C81F99405B6DDF5F80D764CD86A1C68395EC31BF0B49C381394756D0A54BE
SHA-512:	6F3EFF8750A0AB995C74F84538F10B5F6F27B8FDDEDEC4147F7356D70F5EF4A135D03D9E9D35310FEE893052D920D2C42A7E36A4A3391A2107928959AB036794
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/angular-translate/1.1.1/angular-translate.min.js
Preview:	...........Yms...+...c..w..aT'u..s.L...Q..../.E...W.w..,.~HL....b.....M.sg..M...Z.t.K..N..L...6..Yd..o22..:_.M&.De...;.[...]..G...H(.......'....;.-5...W.$...,"..KB..2....F....h..Y..;..U..S._.....]...b.........W?......c..L..E,f.[.%K.e..)...7..[.vl.{.4..s.....G>.e..3+sa.... .f.....\|(d...i.....V+.._HQ....m..lk.SK.8(.Mu.5.8.;.{F.....e...>x.9.O.........;1._.o.Z.x$...D...9.31.SM".;Be..0...tBB.wR.EE<..s.Y.$#....\N$........X...%E\|.......J11.~.{._&.y.....1.;...$..A{9+.x.\|.......us.._;.a..h......ZC.~R.....4Jj..n...f.v..&...3..%.>..7bt.W..h}Q.'.. RA.{......aQ.....I...p.R\|...q+}..r...V..U.).i.s.<.Yb..m.+..R...n...s..%.)..M.ED...!...;...q..L.[Wy.z....CK.M.d..+L.......SiA.[)...cb.......n.(.s.~....B..y......h......mP^....<.V..<.U0......y......M..OI...'n3.....A.t../=.............#.Q.....G....S{.v/r.mm..>.T....&y8..QS5.....P.?.$...T..:..A......u........q.S....gI..O...+U....r.e.@-..5mW.....+.n;..U.\|.....y._.=r..!....~..*..q..h..I....6$,x.....

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 2278
Category:	downloaded
Size (bytes):	866
Entropy (8bit):	7.744736276564017
Encrypted:	false
SSDEEP:
MD5:	FA365B53F8DDE8376882043301D5EEE3
SHA1:	AA7C46F0FD5EFCE84227FFAE91FC556A9E2CD736
SHA-256:	DDD4FCA2C8C260BB21FC7041CF363F2A73A8101EDD83D087111B79BCD2230544
SHA-512:	C0E4470BD6A4AC44D793F08651A96D4D21F8ADFD5414523CBE276ED0F810D169FA763864A8CD628F88B7E870AB8AF2A04ACAB3A4C2995D51861F44F161813FF6
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/angularjs/1.2.28/i18n/angular-locale_en.js
Preview:	...........V.n.@.}.W.P..v.'[Q.:8..ca..m.hc....kaI...,..u...j).s.\..C[$.....=l...!..(.DHu....%..f......6<..O..`.4..^c.xje......].G.yj;.8..o.c.@.Iy....D#f2.{-..^.....}z...h.@#".QF.g.#c.5.Z>l..aE....".&:...0.....q ..Q .n.<.`.z...H..Tp.:..p...g....C.V...0....V.R.}...x..n8.N....R..R.a....]`y?`..r..!P.X$]w....4.\|,..[U.;..U.o.{..30Q=....3x[.u...:.0..>e........h..u3..<.>r.v...[...v..;..U...Y..^...........4..... ...V.....\S..@.Zp...@...G...eO.f3....y..W.......mx.6..7...6..X.$m4H7)....B.2..`.g;.x...2...v.2+.+.+...r.).ONEJEEE...T.T.S.SdS$S.R..E....b..?\|...<....0f.....Q/.QE....Q4H. .O#..n....d..{..,.....B5.b.\|.HZ.^Y_L..c<.r.s:^.....;.....s._.ss&.n..:..F....\.t....S....<.)..h<c.>0"..N..h.....L..o...f...HS..%.D7qR9.o........>..H?D.G>..`e...+....x...S.mB.I8&........V..a...^zem...Xl.>...s7.F.H.]Z;..].....u^~/..V..1.......oo....

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 56736
Category:	downloaded
Size (bytes):	55573
Entropy (8bit):	7.996148721841648
Encrypted:	true
SSDEEP:
MD5:	C96891789082771FF6793E1C8A949E18
SHA1:	AB216038C98127295B6C6BCCC782DDAC65249198
SHA-256:	58D3A1AA6F5260433A80DD0F5543F582E90767187EAEC193F66E3B38C01D5555
SHA-512:	F2D9092D3630507EE4DF7326EFA0006B830296AE747CC36E4B5EE7800BA73843EE92119226785C95949EF1CEA777B9ACC387B25D204A79572F3807A99D638140
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/530dee22-e3c1-4e9f-bf62-c31d510d9656.woff
Preview:	.............t%]..c.c....m.v......:..tl.7...s...1.....Us..\.j.Z.V.. ....\|m..........{.UQ..JH.r..lgE..DA.............)J......Y....N....._1..W./.[.yB2vs!.. ..b...L.n.....K;....2b.s637t.j...../#....x.}iO.@....0..$ .............4.'K&#.SC..`t....?v..th.%..c._.W..2.Lp,.[...cd_}.}..G7#.......0......hE............}._..`6........T..xD..0.v..._.W..1.....b.`..../.......`qp2.j.~.....Mc.3d.#S......^,...W..F...&B.I.w4;.O.>A......)NxM..4...[.#..-o.f....i.o..]J}...... .d.......FG.I....r....?.............J.j...y.0Bnt.U.G.....YfO.hO......m...X.X.XX.-..iB.........Q .>\|.o.IAy(s..qX.L..-.{.A{.....T.b0......u\.QU.x(,..4n...SvY.n....Y..k.._.M.; @2R..:uk..p..G.......e..%Q.8j\Z.8...w..n.o/.....\.....VS..a....=..:!?.x.:d.SC...HE....:....Fu...Y..e~(....D-5.,@a....DtFZ.....b.i.u...e.V.le.....R..Q8u...%.J......2. .&.'c.l.1.T...J...+..7...l...v#..6bp+..:..3R[K......3!._...<..I.Gd..t...+YUuP.&.iB.mc.w......S.d..}..c.i.......0.;2..!C......c.@4...U.N0tB.?...&.bR

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 41912
Category:	downloaded
Size (bytes):	41658
Entropy (8bit):	7.994762948953937
Encrypted:	true
SSDEEP:
MD5:	BD00A65A3EA09D3CD1FA688794C9EA7D
SHA1:	525296FD3C6AF7AFC58707463C309C630A3AC155
SHA-256:	0552A268DEC918A167FD769F24EB621D606E88EE1B02D8B079E8D7DBE830CE1E
SHA-512:	BD363AB5859C99B60AB2D7F5F671E55E7BC3008C04DEF25F680A0ABAF8089008284C8E2FD9C93628E3D45385486082280A22F9E4BB1643D3EE8BEB693C045633
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/60be5c39-863e-40cb-9434-6ebafb62ab2b.woff
Preview:	..........d.cpfO.=...mgb.ms.m.m..6.....Uo..}z...>uNo79QQ...g....~.@.....CZYI..!.g..c{...{rJ.L..0..W.1}....2.?.3..b..............W.\|.~.a9.....................v..?.j.2.8...8..B..!......=L.....'.......cnl....T...'...v......1..........A%....@...... ....5.q..........}%._......H`......`0p.....Ol.....~to@TO......../..........f...s......[{;..w.......w+.....'6.....z.s...f..g.%..Tf.e.o.E.`...........Mz.h.#..$y.G...R...X..".."QZ.;.....#.~WJ6"=....-%.c..).\|...R".{...oz..$r.t...H`.....>..{...3..M..2{{.{...P.z{wa.0.1"1.00R[..S.........."...y>?....#-...`.2\...0.9HUO.e.......~....w.%...g.6.......#-.v85...=-.Y..8#<....j...j..[.......1.S.......M.._B.$.........m..(YC.._\| ..9...A\|....(..i..nZ.w=..D.z..ZA..8.F.@#..)..%i..L.CJQ.W.j"....Br.)..%.(.FLCc[#......6...ZIA5/.R.D#..).L9....JQg9?.RFF....X.r.s...\ie..w-......ug^..8.z.Z.H..S....&}<.%.....8.ZHj-Y.....k}U.kV.0.#......,m..9Q.../..t....[..>M\.}.....kA.)..t6E.>..w.!.m4...W~.G..#.....x.z..N?.Z.i..~....L._

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3056
Category:	downloaded
Size (bytes):	1090
Entropy (8bit):	7.824751394338817
Encrypted:	false
SSDEEP:
MD5:	21ED64593651F92CBB60591ADFE5FD96
SHA1:	29A5EBDA80C8090188188D6080B21A63B264E0DE
SHA-256:	506EBB4F855DE3B79514082C75DE0BA228AD06407D4BF1D3A99CB7C1A3825B4E
SHA-512:	F2092E75AD80E7B271CC07B7F0546403DC941A3DFF5362101E314F23E578AE885CEE11EF0708B19EEFE225AA0D00EB804E36AA64F8A77D78F71AE2CB649B2286
Malicious:	false
Reputation:	unknown
URL:	http://togetherdating.co/
Preview:	...........V[o.6.~.`......q...tY..e(:..P..-.[L(R%..F...s$.s.`..?..!..;w.}....ro/./m....*.....1..mF4ff\6M.....9.>...wM.....%..j...YC..+.7.....0.X.P.%..xw8PF.%5........U......Nr./.E}+EE%....)?..Bh8\|k.}...?..W.ndP(a.......\|A...r.L.Gq..v.....k..q&:.c.%..&(k6Tl..W......7...V...;.Z.y..(.....1.j......"V9.....<.X&...TbH.I.+b.t...CW...}Kx/z%..tm.4.I..CM.P....P)Wr..K1.\..w...<.;...rx...K..........{ :.o..-..{.i.......&..yr(\|.^..8..I>.:....D....K.....`.1.(....\....jMd.N...Up......VL....o...Pl).Odq7s.5e\|...su....m%O}VS....f._..g).$.%t....T-FI.~Z..Z...=..^...y+......(.%..V./n.......0....d...S..#..f..`D.R.....Qr......g..........#.Q2:......I...niT.Y...R...?...^...u..8'.Z....]].T-w-.a1.(E..Sqo.}...i........M.f...l5......-V.....&...?9..........._v.:..~..T......r.{..........yeK......c.5P..m......A......n'..w"B..\4G.u3d@..../..p#..nJ2$=M...t....G''...<M...1..h..F....(S.....K.'..~P..0.5\|..\|..f.%.8;..n.&.u\X.U.<6....9.m...h....t:.~.I.=...E....#.+q;..l..

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 47748
Category:	downloaded
Size (bytes):	47380
Entropy (8bit):	7.996527765254418
Encrypted:	true
SSDEEP:
MD5:	034AE5CD066D5167A0BBE83DB6B6D385
SHA1:	A90A6EA01B08B4C90A3D314C8C455BD750421DFF
SHA-256:	E379C3E3C4CAA323DF1917DAA7F871C94FCFBE1EE5715EA2288B89AF35208762
SHA-512:	211DB68094ED003542BC7389C0E383626CF885141A18618F0995AC94AB41B73C2D6C1F002EE3A2EEEED5DF8C788195BD87902262AAADF35D85DFE829B55F6D0A
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/fonts/Helvetica/Fonts/bcf54343-d033-41ee-bbd7-2b77df3fe7ba.woff
Preview:	..........l...'M.-.k.mOk..i...=m.m.....o..=.und...Q.S.Q.'....\mA...PF.....KZYI..B.......g=S9%.f....G...../.8Ua.......b....8dx..Y......:.?.....`..D...g.h...D........w.?..2d.q415p......?...2.r7..=...a. .+..a.?.n.@........R>!........J>~.....!&w..'.P.......B4...Y;.......o.)3b.Kc....\.G......1.7V.F?..3?........).....5........gl....\|?..e...ut..]..::....?uP.....`.s0..m.y....m.Q..n.:1L.}..".hI.V.=Q..i.q....1.!Y.. .PS}.T....I.4.RT..-....)6...9...Q.......YO.....=.2.Lv.:I....x..^.jA..~+....I_#F.<.{T.v..eY..2..M..3{z.zz..Q{{zv...1.0'11S[V.S..........#...x>?......\|c1e...[..X..R..d.(.D .pa..v...2v.......kkoo'.........Nu.w%.....J.U.`]1.<\|..R..h..o.D..j.k._..........h...Q..8.#......>w..1`T.0.3].u.....#..I.T&9T.....u.d.(ETd...EQ.b....u..."...I..4J..yu..h.......)leD...se2t..ku.......%.]@..B.#.......X.j..^@d.......j.h7.......[jj0..j6.[I....s..=5$..1ps}.BH....r..;%...."......Ql.3x..w.R..H=.5.$..#...<....w...p...O#....&w3..'.....2r.....(0'.F%.a..3k.8.NcF.......

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 108028
Category:	downloaded
Size (bytes):	39996
Entropy (8bit):	7.99289984908518
Encrypted:	true
SSDEEP:
MD5:	5F1869CC10603261F3C1C773FE2AF60B
SHA1:	AF5BEA1AC50331C1071C806DE28397228A39C8EF
SHA-256:	87880D8B1A2D4DFA00B6BE3D32F36F422CA14D2EAED1E0B3475A8813CD78B6D1
SHA-512:	9CFA9798AA0CCA1C8D03AF4B58C106F2CCE6FF8B19DC9920466ACFFFF69BF8DEA6600C68FBEA84540E9807175ECF17441630F991C9216CE93AED1A51978A799C
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/angularjs/1.2.28/angular.min.js
Preview:	............y..F.?.?_...2@.$'....s%Y.e[.c.N2.._.... .CGD......@.....}.\|D..h.Q]]w.}_.:.:....;.....[e............Qg....,.oug....'.K.L.I.......4....+..U..<.g.Q.."~.s...4..&.x.]`.n..F..$..'.V...t''[2...\|.f.is.%b!C.........9^M...P:..&.z._{j<{.=.Z..M.8<....#.A.uf. ..<.v.=...4....x...B..f.(I?.:?.....w...'.g..t.......M}6....:.W...Swo..y3..j}..'...3......&...3....5.^]~......k?...].W....Jo....Jb.zm7...a.-.oQ.7....Z..L.n.&..2..k.Z.....kzs.x.....\,.l>....6.C...H....V/...L.HH.+PI..T......7...3..f#.F.&....;'.C. .w...>.8.....Z.^-r.......XD.%./H....i5..#.p?H..H.V....S.w...r;.'^~.b...5..]..Z..^.k.~...j.....~x.....].4...t4.....1-I......!..T.....te*.i..I......M(.?...%..En..(....A.P...@Ri3j....D...}..._.M0.Ay...#..?F....Z..G-.x.Q.RzI..z{2...o..v..--.z.M..6..}'..]%..?"...$.Q}g....}.....t.nY..;...Z.I..E1..4.ZT..c.2..B...^.....>[.4..izN.@.`.......n..o.......).~..<,n...j.w.i}......fQ...YB...X...Xu{S.k..@..Xg.........8\|c.?....)..w..8M..Wr..P.X..

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 4 x 8, 8-bit/color RGBA, interlaced
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	6.15402522712922
Encrypted:	false
SSDEEP:
MD5:	B07091E19BB41899BBF382B3594E2243
SHA1:	1FB1B039284C26667F694628B77FD359BD7CB053
SHA-256:	94D2B592EB2933B57771C61BE58EE1DE20D8AE2BAF778657317449A2851C14CE
SHA-512:	ED98665EB6812018A7DF58C5049D9CCBDA4CC142014B64389097086C7EB6B5CEEC7F8F404B6F74A7A3BB2B14EEDB91F9596C4109ED06E13F70BCBB7AA93B502C
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR..............4n.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:F3979E48342711E4B751C0686D6B9679" xmpMM:DocumentID="xmp.did:F3979E49342711E4B751C0686D6B9679"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F3979E46342711E4B751C0686D6B9679" stRef:documentID="xmp.did:F3979E47342711E4B751C0686D6B9679"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......uIDATx.b.]k.. ........@...=..@.@.....)...bw....{..A"...L.X..x ........0....t .ci:s..$.T......\,@.3........d

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 3477
Category:	downloaded
Size (bytes):	2816
Entropy (8bit):	7.932751882190034
Encrypted:	false
SSDEEP:
MD5:	B3EFD449F00BA5ED7A6AA0225424EEB0
SHA1:	3501D94B31537557914D7E993EC508B68E5593CF
SHA-256:	F0D7FC37DCBEBE89AE7A7C2C85D1B0F80F174D84EAEA5517CE40EE8B116DD736
SHA-512:	02C07325B35A256AB93BF98F94B6774C13A558220B480E643A34E00BF8C72EBF1D965C34CA1FE8F37241097237C822B3D52147055AF1E60A2F58BA691A7E1489
Malicious:	false
Reputation:	unknown
URL:	http://www.wix.com/favicon.ico
Preview:	............;....1e,..Pv!....I...N"2..1...($.].#slck,G..PT....;.%K..c.N......\.u?.u....z......[!.9..............{cG..n..........59.[.r.yq9?.r.l.i.j.W9\.(.W..5F.,p..PA./$.=.1MO..$K.../.......(..^...Y..c..?.......G..H.Yp(.....e......E2....7.`..W...[f ..v.......$..J..].,gm.C.Fi......z..S....}.4...<..g.K$..mm..V_..+ecg;...F...........CN;...../w.7.....k....\|...G.d.jl.6..V{}...n.;..2...`...a.a.:..]...z.1....}..8E..#.........j..a.-.UE:z.e.....{.. ..a.<^..x2b5..x.....M..b.%...I...@j............+!..Bq_..G.L.6...xp.#...t.>.........>.".g..).^q_..^s/...O.R......f..f...T...R.<.\...-_........-.o..do9.-.._..x....e ..Y0.z.8.MFi\|..F....P.u......0..K=.....B=.V...j..."..z..."..n.~TF...hk.^.c4..,.4...3 aS....U...W..@..._'O.X..7......Yy..)B......r..8...E.r.;f.G.f..r.@.V..m...B@..m......e..t.r..{..5.RU.k.f..L^0..b.T%i......q."0X..B..I.^...I.d.........)..W.... ^...;...L,..Rh#..I......T..r.%2....V.%B.....bw:....:..a$..>X..]..`5u.....r.B..w..Z.GM.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 15552
Category:	downloaded
Size (bytes):	3182
Entropy (8bit):	7.927316314177515
Encrypted:	false
SSDEEP:
MD5:	4FD82857F2512953AE186CD3F55EBFE2
SHA1:	451D56D1C326D25A836DF52FD2C1A3D7E1601EFB
SHA-256:	5FEC321E2B8736BC43BBE875CEB191FBFFB7822824F3428DFA134BF485D13429
SHA-512:	E5A28CBCA54C7AA81496643634690EEDB539348F5F1336157267B82A60AB356670DD42955C8B43B84B040851D2571EB8F7EA0308CE1D009F5961E06743135063
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/wix-public/1.719.0/styles/error-pages/styles.css
Preview:	............k....ZU{.dry.<.U.....C[....2`..C0..y.(..cc..!${.......c</.g.F8.r...og..('E.p.%.#.s.&..F.(C.................8}....8e).I.I.B..!..Q."../.4)P..(..(.&...~.....$`..kP.X.....1.....N.:...G.5:..A..2C'~N.E4.. z>"...).P..."!G.....8.Bg..(....I..K.+yVr.......2xC..9C...x.g.$..0<.>..GT.....4..l8...\..G..J.?.. .8..y.8G%..s...f..p...>d ....)`9...1K...'.S~x&BL8.pB..>..IhJ.K..d.<g/h..+...`+!1.o......i......S....:.8(XRrr.C-.QIuE..X...."K..^.U0.".......P&.Vp..o...h....E./..{............E5\B."(........%%v..m.,IpV.}...`..C)....bi.....>.....>..,......].,...[..u..#.@u8.....3M...$.3....).?l.Z.....^.knw..ia..1.T..._...b.....+l$h...H.D"+e.B. v...B.!}...Wv.C..j7b..{.........E..s...}.\..J.;W\|:.<.....!..a9.!,}.....B...Y.r~i'8b{i...O..2VL...q].XN.b.;....$Z,O$.,aM....;..fW_h..v."...{..L...h.$.CK.&,,..oD.\.3.L.t....`..<.iI.i...?...9dl...v.C].g ..,.6....X3..2O>,.....A.O..3..NYf..."eVN2...?..."..?.......-.....P,.....2.G.k.....\$...8..NX.8a..s..._$1..\.ze.......

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	gzip compressed data, from Unix, original size modulo 2^32 83606
Category:	downloaded
Size (bytes):	29312
Entropy (8bit):	7.991200829004624
Encrypted:	true
SSDEEP:
MD5:	975B03D7FD857300E0AD13D6769DE319
SHA1:	912DB7E9CADD0E2486D8380B80E0D2DD86E03C56
SHA-256:	424897E5FADB664E036C49AAB9FC96C56E8D4A9A6A7FD6AB27F669BD2611F47A
SHA-512:	FDA6BFEFB1421B988ABA644F87CAA4243037D238FDDB369CFE7B1DC379A06E3CE0B1875774D1A1FE8D9C9724A975DCEFEE05229002B09FCD331391C306EC8602
Malicious:	false
Reputation:	unknown
URL:	http://static.parastorage.com/services/third-party/jquery/2.0.3/jquery.min.js
Preview:	...........}{w.....S.....#....S0.ob;MZ;vc.IJ.Y..I.I..@K..~...{... h....mj...<...........$...G........G.F.?.{...:.d..J.L.}..T...x3...e:O.2.....}T.b.....4.......J..^...../7..u...j..4K.....8.T....['..}..(...t ..E>...Re..g...T@..6t.@-....G.ZG...S..\|8.3.S]..zS^..].........}y.V.rX.......:._.d..\|........r.n#g`Yp_$......vx.Q.i.7..v.":...g..../......b@7..._..68..\|........J..N............,..=.=.......A..D=.r_..7.....L../.O.O.x..^......]trL.....f..U.....0....4.'q..4..u..>.....<.@+.<-.$K..{...<..,....S.U.4PIw.%.2En.H.......v....lD..T.Z...U..Wy...p......T:N/.^...\.%.x%.....K.{z\D...g~.._V.(.....#..$....O.9..O..f.T...3.....d.'....m......J..Wm..PF3..&........Cg\|~e...ZE.QJ..l...N..h.V4....J\|.C7.(.o.x._..:1..E..=......S...Sa.z. PO.URV.Z..;L.W.8.^^...+.RpI=+..GU.._..G..b.L._.NF.W.}....Y...NiW_%fC.u..:.h....O1.z......f..G.....4Pf...r.-.e.....6....7>3.I.f3A..n.L2...v....^.YDf.[..^6...+.U....(.;_....3.....[.HU9...}.G........ij.]R#*.W.o^.......<.:s0Hf

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	64
Entropy (8bit):	4.3686933125951875
Encrypted:	false
SSDEEP:
MD5:	0E84E84CEFE7EC71D48BB27DE0622273
SHA1:	CB0B26F61FC7549730E7B7997EEC82F886A2E71F
SHA-256:	CEF5B6D7128FE5E4DDBA4F17D651AE7F2028731E55D344460096693F82A57DB0
SHA-512:	A30C6051B0F7926F23E9864CC039674C902BF5A30BA59B892A34A1B993622B9B3FCCD77FEECB356A6756FAB99CC721BEF9322907354E7B883CE89F1CE8DE4B08
Malicious:	false
Reputation:	unknown
URL:	http://www.wix.com/_api/wix-laboratory-server/laboratory/conductAllInScope?scope=error-pages&accept=jsonp&callback=setExperimentsSync
Preview:	setExperimentsSync({"action":"", "type":"", "callerId":""}, {});

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 121 x 33, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2906
Entropy (8bit):	7.440976393846884
Encrypted:	false
SSDEEP:
MD5:	2366E2603CEFFBB40899C84FDD580C5B
SHA1:	676C16652F4F7510D53C4074AE677F0B3B036E66
SHA-256:	695BCD07565A83117E56FE384126D53CB925B94207EAF2433107E8A08ACCB498
SHA-512:	E6A07157B0969751E2B86D381A8B3C4921EED2F15A4542CA15078F7E3592211CB43568AB83F157164398BE925F8C707285A1D1CD855F7C443B99A977ADEC2237
Malicious:	false
Reputation:	unknown
Preview:	.PNG........IHDR...y...!.............tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c021 79.155772, 2014/01/13-19:44:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2014 (Macintosh)" xmpMM:InstanceID="xmp.iid:4C0D1DFD244C11E4B0FBA1D97AE2F082" xmpMM:DocumentID="xmp.did:4C0D1DFE244C11E4B0FBA1D97AE2F082"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4C0D1DFB244C11E4B0FBA1D97AE2F082" stRef:documentID="xmp.did:4C0D1DFC244C11E4B0FBA1D97AE2F082"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;.....^PLTE666......hhhNNN...888............BBBeee{{{[[[...RRR<<<.............CCC.........KKK...???......JJJ...

Static File Info

⊘No static file info

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://togetherdating.co

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Static File Info

Windows Analysis Report
http://togetherdating.co