Edit tour

Windows Analysis Report
https://keepass.info/news/n240601_2.57.html#v1

Overview

General Information

Sample URL:	https://keepass.info/news/n240601_2.57.html#v1
Analysis ID:	1529342
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

HTML page contains hidden javascript code

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3964 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3948 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2304,i,15239335394185772079,13387942860162009976,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6632 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://keepass.info/news/n240601_2.57.html#v1" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /el/AGSKWxXMW0cH5TYYnAcRkrdyBV2OcBHnMwbeskidexRCJyAGO_z-LMnpGGrDzVo6N55R1it_UQur4_h2-zQtWBRfoCGWMzJleZjHdny9EqObLQiXIx69qdc2vDl2TTZndzdy8Xz0hhb_6w== HTTP/1.1Host: fundingchoicesmessages.google.comConnection: keep-aliveContent-Length: 155sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plainAccept: */*Origin: https://keepass.infoX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://keepass.info/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: https://keepass.info/news/n240601_2.57.html#v1	HTTP Parser: No favicon
Source: https://keepass.info/news/n240601_2.57.html#v1	HTTP Parser: No favicon
Source: https://keepass.info/news/n240601_2.57.html#v1	HTTP Parser: No favicon
Source: https://keepass.info/news/n240601_2.57.html#v1	HTTP Parser: No favicon
Source: https://keepass.info/news/n240601_2.57.html#v1	HTTP Parser: No favicon
Source: https://keepass.info/help/base/pwgenerator.html	HTTP Parser: No favicon
Source: https://keepass.info/help/base/pwgenerator.html	HTTP Parser: No favicon
Source: https://keepass.info/help/base/pwgenerator.html	HTTP Parser: No favicon
Source: https://keepass.info/help/base/pwgenerator.html	HTTP Parser: No favicon
Source: https://keepass.info/help/base/pwgenerator.html	HTTP Parser: No favicon
Source: https://www.virustotal.com/gui/file/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c	HTTP Parser: No favicon
Source: https://keepass.info/help/kb/faq.html#smartscreen	HTTP Parser: No favicon
Source: https://keepass.info/help/kb/faq.html#smartscreen	HTTP Parser: No favicon
Source: https://keepass.info/help/kb/faq.html#smartscreen	HTTP Parser: No favicon
Source: https://keepass.info/help/kb/faq.html#smartscreen	HTTP Parser: No favicon
Source: https://keepass.info/compare.html	HTTP Parser: No favicon
Source: https://keepass.info/compare.html	HTTP Parser: No favicon
Source: https://keepass.info/compare.html	HTTP Parser: No favicon
Source: https://keepass.info/compare.html	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49823 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: chromecache_342.2.dr	String found in binary or memory: DF_Mk([DF_Ms({type:Boolean,K:!0}),DF_Ml("design:type",Object)],DF_M1f.prototype,"isBot",void 0);DF_Mk([DF_Ms(),DF_Ml("design:type",Object)],DF_M1f.prototype,"screenReaderTextKey",void 0);DF_M1f=DF_Mk([DF_Mp("df-text-message"),DF_Ml("design:paramtypes",[String,String])],DF_M1f);var DF_M2f=DF_Mq([":host(:only-child) .wrapper{padding:var(--df-messenger-video-inner-padding,0)}:host(:not(.markdown):not(:only-child)) .embed,:host(:not(:only-child)) .link,:host(:not(:only-child)) .video{border:var(--df-messenger-video-inner-border,none);border-radius:var(--df-messenger-video-inner-border-radius,0);overflow:hidden}:host(:not(:only-child)) .wrapper{padding:var(--df-messenger-card-padding,16px)}:host(.markdown) .wrapper{display:inline-block;padding:var(--df-messenger-card-padding,16px);padding-left:0;padding-right:0}:host(.markdown:first-child) .wrapper{padding-top:0}:host(.markdown:last-child) .wrapper{padding-bottom:0}:host(.markdown) .embed,:host(:not(:only-child)) .embed,:host(:not(:only-child)) .link,:host(:not(:only-child)) .video{border:var(--df-messenger-video-inner-border,var(--df-messenger-video-border,var(--df-messenger-default-border)\n )\n );border-radius:var(--df-messenger-video-inner-border-radius,var(--df-messenger-video-border-radius,var(--df-messenger-default-border-radius)\n )\n );overflow:hidden}.link{display:inline-block;position:relative;text-decoration:none}.thumbnail,video{height:var(--df-messenger-video-height,auto);width:var(--df-messenger-video-width,auto)}.thumbnail,iframe,video{display:block;max-width:100%}iframe{height:var(--df-messenger-video-embed-height,var(--df-messenger-video-height,315px)\n );width:var(--df-messenger-video-embed-width,var(--df-messenger-video-width,560px)\n )}.title{align-items:center;color:var(--df-messenger-font-color,var(--df-messenger-default-font-color)\n );display:flex;font-family:var(--df-messenger-font-family,var(--df-messenger-default-font-family)\n );font-size:var(--df-messenger-font-size,var(--df-messenger-default-font-size)\n );padding:12px 16px}.youtube svg{height:24px;margin-right:8px;width:24px}.play{background:#000;border-radius:999px;height:36px;left:50%;opacity:.8;padding:8px;pointer-events:none;position:absolute;top:50%;transform:translate(-50%,-50%);width:36px}.play svg{fill:#fff;height:inherit;width:inherit}"]);function DF_M3f(a){var b,c=(b=a.anchor)!=null?b:a.actionLink?{href:a.actionLink}:null;return c?new DF_M4f(c):null}function DF_M5f(a){var b,c=(b=a.anchor)!=null?b:a.actionLink?{href:a.actionLink}:null;return c?new DF_M4f(c):null}function DF_M4f(a){this.href=(a==null?void 0:a.href)\|\|"";this.target=(a==null?void 0:a.target)\|\|"_blank";this.rel=(a==null?void 0:a.rel)\|\|"noopener noreferrer"};var DF_M6f=DF_Mc([' <div class="wrapper">\n <div class="video">\n <video src="','" controls>',"</video>\n ","\n </div>\n </div>"]),DF_M7f=DF_Mc(["https://www.youtube.com/embed"]),DF_M8f=DF_Mc([' <div class="wrapper">\n <d
Source: chromecache_605.2.dr, chromecache_331.2.dr, chromecache_293.2.dr, chromecache_410.2.dr, chromecache_356.2.dr, chromecache_577.2.dr	String found in binary or memory: return b}JC.F="internal.enableAutoEventOnTimer";var gc=la(["data-gtm-yt-inspected-"]),LC=["www.youtube.com","www.youtube-nocookie.com"],MC,NC=!1; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: keepass.info
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: googleads.g.doubleclick.net
Source: global traffic	DNS traffic detected: DNS query: fundingchoicesmessages.google.com
Source: global traffic	DNS traffic detected: DNS query: virusscan.jotti.org
Source: global traffic	DNS traffic detected: DNS query: www.virustotal.com
Source: global traffic	DNS traffic detected: DNS query: www.recaptcha.net
Source: global traffic	DNS traffic detected: DNS query: recaptcha.net

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2304,i,15239335394185772079,13387942860162009976,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://keepass.info/news/n240601_2.57.html#v1"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2304,i,15239335394185772079,13387942860162009976,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: https://www.virustotal.com/gui/file/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c	LLM: Page contains button: 'Click here to view document' Source: '0.29.pages.csv'
Source: https://www.virustotal.com/gui/file/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c	LLM: Page contains button: 'Click here to view document' Source: '0.30.pages.csv'

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://stats.g.doubleclick.net/g/collect	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#localhost_support	0%	URL Reputation	safe
https://ampcid.google.com/v1/publisher:getClientId	0%	URL Reputation	safe
https://support.google.com/recaptcha/#6175971	0%	URL Reputation	safe
https://stats.g.doubleclick.net/j/collect	0%	URL Reputation	safe
https://cdn.ampproject.org/amp4ads-host-v0.js	0%	URL Reputation	safe
https://support.google.com/recaptcha	0%	URL Reputation	safe
http://mathiasbynens.be/	0%	URL Reputation	safe
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	0%	URL Reputation	safe
http://www.gimp.org/xmp/	0%	URL Reputation	safe
http://google.com	100%	URL Reputation	malware
https://cloud.google.com/contact	0%	URL Reputation	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://stats.g.doubleclick.net/g/collect	chromecache_605.2.dr, chromecache_331.2.dr, chromecache_293.2.dr, chromecache_356.2.dr	false	URL Reputation: safe	unknown
https://storage.mtls.cloud.google.com/	chromecache_469.2.dr, chromecache_342.2.dr	false		unknown
https://developers.google.com/recaptcha/docs/faq#localhost_support	chromecache_326.2.dr, chromecache_377.2.dr, chromecache_647.2.dr	false	URL Reputation: safe	unknown
https://ep2.adtrafficquality.google	chromecache_656.2.dr	false		unknown
https://ampcid.google.com/v1/publisher:getClientId	chromecache_284.2.dr, chromecache_460.2.dr	false	URL Reputation: safe	unknown
https://dialogflow.cloud.google.com/v1/cx/integrations/messenger/webhook	chromecache_469.2.dr, chromecache_342.2.dr	false		unknown
https://www.virustotal.com/ui/votes/f-96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c	chromecache_533.2.dr	false		unknown
https://d30y9cdsu7xlg0.cloudfront.net/png/29715-200.png	chromecache_342.2.dr	false		unknown
https://fundingchoicesmessages.google.com/i/$	chromecache_657.2.dr, chromecache_536.2.dr	false		unknown
https://support.google.com/recaptcha/#6175971	chromecache_326.2.dr, chromecache_377.2.dr, chromecache_647.2.dr	false	URL Reputation: safe	unknown
http://getbootstrap.com)	chromecache_311.2.dr, chromecache_289.2.dr	false		unknown
https://stats.g.doubleclick.net/j/collect	chromecache_460.2.dr	false	URL Reputation: safe	unknown
https://cdn.ampproject.org/amp4ads-host-v0.js	chromecache_657.2.dr, chromecache_536.2.dr	false	URL Reputation: safe	unknown
https://support.google.com/recaptcha	chromecache_647.2.dr	false	URL Reputation: safe	unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=231	chromecache_308.2.dr	false		unknown
https://ep1.adtrafficquality.google/pagead/gen_204?id=sodar2&v=232	chromecache_607.2.dr, chromecache_656.2.dr	false		unknown
https://keepass.info/	chromecache_632.2.dr, chromecache_516.2.dr, chromecache_621.2.dr	false		unknown
https://www.bsi.bund.de/	chromecache_516.2.dr	false		unknown
https://www.bsi.bund.de/DE/Service-Navi/Publikationen/Studien/Projekt_P486/projekt_P486.html	chromecache_516.2.dr	false		unknown
http://mathiasbynens.be/	chromecache_657.2.dr, chromecache_536.2.dr	false	URL Reputation: safe	unknown
https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que	chromecache_326.2.dr, chromecache_377.2.dr, chromecache_647.2.dr	false	URL Reputation: safe	unknown
https://www.google.com/adsense/search/async-ads.js	chromecache_657.2.dr, chromecache_536.2.dr	false		unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_311.2.dr, chromecache_289.2.dr	false		unknown
http://googleads.g.doubleclick.net	chromecache_657.2.dr, chromecache_536.2.dr	false		unknown
https://cloud.google.com/dialogflow/cx/docs/concept/integration/dialogflow-messenger/fulfillment.	chromecache_469.2.dr, chromecache_342.2.dr	false		unknown
https://ep2.adtrafficquality.google/sodar/$	chromecache_657.2.dr, chromecache_536.2.dr	false		unknown
http://www.gimp.org/xmp/	chromecache_485.2.dr, chromecache_451.2.dr	false	URL Reputation: safe	unknown
https://github.com/markedjs/marked.	chromecache_469.2.dr, chromecache_342.2.dr	false		unknown
https://cloud.google.com/terms/service-terms	chromecache_469.2.dr, chromecache_342.2.dr	false		unknown
http://google.com	chromecache_657.2.dr, chromecache_536.2.dr	true	URL Reputation: malware	unknown
https://cloud.google.com/contact	chromecache_326.2.dr, chromecache_377.2.dr, chromecache_647.2.dr	false	URL Reputation: safe	unknown
https://www.youtube.com/embed	chromecache_469.2.dr, chromecache_342.2.dr	false		unknown

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.34.46	ghs-svc-https-c46.ghs-ssl.googlehosted.com	United States	15169	GOOGLEUS	false
92.205.48.200	keepass.info	Germany	8972	GD-EMEA-DC-SXB1DE	false
142.250.186.131	unknown	United States	15169	GOOGLEUS	false
172.217.16.142	www3.l.google.com	United States	15169	GOOGLEUS	false
49.12.134.143	pegasus.jotti.org	Germany	24940	HETZNER-ASDE	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
172.217.16.206	unknown	United States	15169	GOOGLEUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
216.58.206.46	unknown	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.185.174	unknown	United States	15169	GOOGLEUS	false
142.250.185.196	unknown	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1529342
Start date and time:	2024-10-08 21:44:20 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://keepass.info/news/n240601_2.57.html#v1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal52.win@27/656@44/13
Cookbook Comments:	Browse: https://virusscan.jotti.org/en-US/filescanjob/okh286u1n8 Browse: https://www.virustotal.com/gui/file/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c Browse: https://keepass.info/help/kb/faq.html#smartscreen Browse: https://keepass.info/compare.html

Name	Malicious	Reputation
https://keepass.info/help/images/b16x16_window_list.png	false	unknown
https://www.virustotal.com/gui/70520.2084d2d63c64ac00d8ff.js	false	unknown
https://keepass.info/help/images/b64x64_tar.png	false	unknown
https://keepass.info/favicon.ico	false	unknown
https://virusscan.jotti.org/img/logo/logo-jotti_white.png	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/contacted_urls	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/pe_resource_parents	false	unknown
https://virusscan.jotti.org/js/sprintf.js	false	unknown
https://keepass.info/help/images/b64x64_kgpg.png	false	unknown
https://keepass.info/help/images/b16x16_kmultiple.png	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxUtIByhZkGeNTRe194-sEgwc4K6krQseSPy_RVg0cxyIY_bvHB2qHbqKcrF-O2HJ3dK_fLFC0p151IRT51U-VDwnkYMEW7pWawd2F6h_fgdL8bm7fo8D8UQJqCem6aVBwZA4KHFIA==?fccs=W1siQUtzUm9sOUdURnN6eldRVUdnZno1S2Y5NHd5RUdEYzFTWmUtRDM2MjdLQUtMX1hQQ2xrNTFQN2ZVbFhWeFRRUzhremVHR3FvZWlzM1Y3SUNBWHhxYk5IWVpqQXVKa3hrYWFiU0hUUXdZR0I2MVFld05uU1ZSMEMzOWpCVkhGM1RuQUJNMUswWUR1aVlHSm1OSE1NbVhtdUk3dUxCeHlFWTl3PT0iXSxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsWzE3Mjg0MTY3ODYsNDk2MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL2tlZXBhc3MuaW5mby9jb21wYXJlLmh0bWwiLG51bGwsW1s4LCJQV3Fob2hRR0VwZyJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaT4-pl_nUmyBHuYMy9EdEe_kaFNzxkHcRyjQZ0lg9qcku5s31VgoXkWNDWb2fLmeMRznHmp	false	unknown
https://keepass.info/images/icons/keepass_80x15.png	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/contacted_ips	false	unknown
https://keepass.info/help/images/b16x16_enhanced_browsing.png	false	unknown
https://www.virustotal.com/gui/58686.e43f75fcd3216c74cafe.js	false	unknown
https://www.virustotal.com/gui/1402accbefdec6a25762.woff2	false	unknown
https://www.virustotal.com/gui/5796.a9e8212a1628cbdb8bce.js	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/dropped_files	false	unknown
https://keepass.info/images/il_main_v02.png	false	unknown
https://keepass.info/default.js	false	unknown
https://virusscan.jotti.org/img/logo/filescanner/avast-logo.png	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/bundled_files	false	unknown
https://virusscan.jotti.org/img/logo/filescanner/kaspersky-logo.png	false	unknown
https://www.virustotal.com/gui/88687.cca6b938f5ec6b221b34.js	false	unknown
https://keepass.info/help/images/b16x16_rotate_cw.png	false	unknown
https://keepass.info/help/images/folder_open.png	false	unknown
https://www.virustotal.com/gui/22232.071dcfa8690a5cc65de2.js	false	unknown
https://www.virustotal.com/gui/13420.2099364bebdd02277cf9.js	false	unknown
https://virusscan.jotti.org/img/logo/filescanner/fsecure_logo.gif	false	unknown
https://www.google.com/ads/measurement/l?ebcid=ALh7CaRSOi8QMxXheO3aL31GZnit6RtxlyEKRNvko7fXlWzSU6FbzVUIZYxlvGMgIBzE_Kq8OASl	false	unknown
https://keepass.info/help/images/b64x64_help.png	false	unknown
https://virusscan.jotti.org/js/jsenhance.js	false	unknown
https://keepass.info/help/images/b16x16_vcard.png	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/dropped_files?limit=10&cursor=eyJsaW1pdCI6IDEwLCAib2Zmc2V0IjogMTB9	false	unknown
https://virusscan.jotti.org/css/bootstrap-theme.css	false	unknown
https://www.virustotal.com/ui/user_notifications	false	unknown
https://keepass.info/help/images/b16x16_password.png	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/behaviours?limit=40	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c	false	unknown
https://virusscan.jotti.org/img/logo/filescanner/escan_logo.gif	false	unknown
https://keepass.info/images/button_accept.png	false	unknown
https://www.virustotal.com/ui/cookie_disclaimer	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxXbFLofahza67m6StI5_Gcfs_oepjE5hSyRImY9ncFQV-BqEXw-uYF1bXrX-QTxfcRJkjQkYUHsrDgQ_OLEKFXB8JUSGYK82FAQHZj3_bZNEATxxKmzeGfjT8RGYR8Zmpqizym32A==?fccs=W1siQUtzUm9sLVhXZG9GWTdHSklEY2VDSDhPYjVvNGRlVjk3dGRyN210aWxLTzBJSDRXY1BHWUpscDVkaGlCcy0zVDBvRTc1Rk4tcmNHbFBremY2c05Sc0ZhaUFtS0ZxZjFjRWhaeWNaZGhuRnpYenBkWE5tU3Z2aUpsVXdhLU1oVjJRSnpCOXNVV1paM3Q2ZmVURVlMZXhNRllXX0thbllKSmhRPT0iXSxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsWzE3Mjg0MTY3NzMsMzc1MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbN11dLCJodHRwczovL2tlZXBhc3MuaW5mby9oZWxwL2tiL2ZhcS5odG1sIixudWxsLFtbOCwiUFdxaG9oUUdFcGciXSxbOSwiZW4tVVMiXSxbMTgsIltbWzBdXV0iXSxbMTksIjIiXSxbMTcsIlswXSJdXV0	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/behaviour_mbc_trees	false	unknown
https://keepass.info/help/images/b16x16_blockdevice.png	false	unknown
https://keepass.info/images/flagger_small.gif	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxVW3k0OmQKhtKA0sSBeW0X8eio-n0X4_Ar8HEG-uUyae6oX30p6p2t20aDmcysUOxgP0FER7XwUrvJ-SXeJQ8H3k0xzfEKxaO8ajn7m8Ang1pfvNcgIZeme9Z5_-2LIbX2Bf9a3mw==?fccs=W1siQUtzUm9sOWg5NEJZRkhUZVhSeEJiSHUtOFdZZ2R4SnBZaElRYVB3TlpybHRadElfbE1UUDY3X2w2V3R1UHBtSGp0OUgyTjgtYUJ4NjdFOUxfNnRCX294cWJiTzI2RUw0N0NMTk5QM21tVml2eXJRcVdnUGVmMEp5Q1ZvOTJRTkQyREgtNkV0cTVaUnJua0xfeTR1SGFhNUZ1MTViVkhjSGh3PT0iXSxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsWzE3Mjg0MTY3NDAsMzkyMDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5XSxudWxsLDIsbnVsbCwiZW4iXSwiaHR0cHM6Ly9rZWVwYXNzLmluZm8vaGVscC9iYXNlL3B3Z2VuZXJhdG9yLmh0bWwiLG51bGwsW1s4LCJQV3Fob2hRR0VwZyJdLFs5LCJlbi1VUyJdLFsxOCwiW1tbMF1dXSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ	false	unknown
https://keepass.info/help/images/pwgen_adv_excltab.png	false	unknown
https://www.virustotal.com/gui/icon.types-peexe.d2868179402000c6d4c8.js	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/bundled_files?limit=10&cursor=MTB8fHYzfHwxNzI4NDE2NzYyfHw0ZWI5NTJhNTg1YzY1ZmU0ZDU3NmU1MWExYWQxMGVmMjUxMzRhYzM2MWYyODIzZTEzNDQ0YTZlNDg0Y2QyMzE5	false	unknown
https://keepass.info/help/images/pwgen_adv_redbtn.png	false	unknown
https://keepass.info/default.css	false	unknown
https://www.virustotal.com/gui/main.dd0c54e4ad67727c582b.js	false	unknown
https://virusscan.jotti.org/img/logo/filescanner/gdata-logo.png	false	unknown
https://keepass.info/compare.html	false	unknown
https://fundingchoicesmessages.google.com/el/AGSKWxWQEzISLigEpE6D6oiiINLv2B6Kx46dIkRYp4zkGuG8px76dLoHmboDH6zVGwG9PyfV8gdhzSUm3YfjR1MA0sqtjCnUN226F_oztjx29zgWfflX41HnKa5N3ilCy9yIU-O78nCW6g==	false	unknown
https://fundingchoicesmessages.google.com/f/AGSKWxVr7QL62ofqpmmaGeieuqfk3HhfNYsyR3s0CBCYmmXC__pu4YhhvFWp6fjp9e4maWZkrxbXzDaDBbVlTPM6mlqDPY_dPUIfWoR4qC2vkqZGExnKDv2Qe4XtUbrPN3LQQzwuufQrBA==?fccs=W1siQUtzUm9sLVhXZG9GWTdHSklEY2VDSDhPYjVvNGRlVjk3dGRyN210aWxLTzBJSDRXY1BHWUpscDVkaGlCcy0zVDBvRTc1Rk4tcmNHbFBremY2c05Sc0ZhaUFtS0ZxZjFjRWhaeWNaZGhuRnpYenBkWE5tU3Z2aUpsVXdhLU1oVjJRSnpCOXNVV1paM3Q2ZmVURVlMZXhNRllXX0thbllKSmhRPT0iXSxudWxsLG51bGwsbnVsbCxudWxsLG51bGwsWzE3Mjg0MTY3NzQsNTE5MDAwMDAwXSxudWxsLG51bGwsbnVsbCxbbnVsbCxbNyw5XSxudWxsLDIsbnVsbCwiZW4iXSwiaHR0cHM6Ly9rZWVwYXNzLmluZm8vaGVscC9rYi9mYXEuaHRtbCIsbnVsbCxbWzgsIlBXcWhvaFFHRXBnIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzE5LCIyIl0sWzE3LCJbMF0iXV1d	false	unknown
https://virusscan.jotti.org/img/logo/filescanner/ikarus_logo.gif	false	unknown
https://www.virustotal.com/gui/88292.a814e2f9bbd53eb184a3.js	false	unknown
https://keepass.info/help/images/b16x16_message.png	false	unknown
https://www.virustotal.com/ui/files/96b4fca5e148b44af908c5b0d98daa526cb4106c68950eac1c2ce3e40eb44c9c/execution_parents	false	unknown
https://virusscan.jotti.org/js/bootstrap.min.js	false	unknown
https://keepass.info/help/images/b16x16_kfm_home.png	false	unknown
https://keepass.info/help/images/b16x16_make_kdevelop.png	false	unknown
https://www.virustotal.com/gui/2121f4aabac6fbe523ec.woff2	false	unknown
https://virusscan.jotti.org/css/virusscan.css	false	unknown
https://www.virustotal.com/gui/vt-ui-sw-installer.3166763520a2b299ee12.js	false	unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Oct 8 18:45:15 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.983295052811734
Encrypted:	false
SSDEEP:	48:84d3TvnlHpeidAKZdA19ehwiZUklqeh9y+3:8Mrkey
MD5:	238F6FBFBA37685CDDF15A7A670C4E74
SHA1:	9C52F944874F982CDF03B493AB84214C24DBA562
SHA-256:	A526898AF898D38C826C69B37BB826922EDBC0497964D6FDB152B2D158C6758D
SHA-512:	420BB53425C552047118436F9CB2A95F55A3B8C15D747C5A31B903623351429F99D502F96D0D59AE5FFDD08CDD82A100C0F30FE7E3E357830B8660C49AAF1891
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,..........N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IHY......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VHY......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VHY......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VHY............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VHY.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...................C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 8, 2024 21:45:13.810421944 CEST	192.168.2.5	1.1.1.1	0xbba9	Standard query (0)	keepass.info	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:13.810801029 CEST	192.168.2.5	1.1.1.1	0x7de6	Standard query (0)	keepass.info	65	IN (0x0001)	false
Oct 8, 2024 21:45:15.646790028 CEST	192.168.2.5	1.1.1.1	0x19b7	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:15.646945000 CEST	192.168.2.5	1.1.1.1	0xc515	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 8, 2024 21:45:15.884265900 CEST	192.168.2.5	1.1.1.1	0x426	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:15.884397984 CEST	192.168.2.5	1.1.1.1	0x3448	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:16.144747019 CEST	192.168.2.5	1.1.1.1	0xbb63	Standard query (0)	keepass.info	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:16.145273924 CEST	192.168.2.5	1.1.1.1	0x6350	Standard query (0)	keepass.info	65	IN (0x0001)	false
Oct 8, 2024 21:45:19.233942032 CEST	192.168.2.5	1.1.1.1	0xeadd	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:19.233942032 CEST	192.168.2.5	1.1.1.1	0xb9d9	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:20.611757040 CEST	192.168.2.5	1.1.1.1	0x76e9	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:20.612519979 CEST	192.168.2.5	1.1.1.1	0x577e	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Oct 8, 2024 21:45:24.215440035 CEST	192.168.2.5	1.1.1.1	0xefa0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:24.215609074 CEST	192.168.2.5	1.1.1.1	0x2721	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 8, 2024 21:45:25.810990095 CEST	192.168.2.5	1.1.1.1	0x875c	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:25.811285973 CEST	192.168.2.5	1.1.1.1	0x683f	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Oct 8, 2024 21:45:26.512198925 CEST	192.168.2.5	1.1.1.1	0x2c2b	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:26.512677908 CEST	192.168.2.5	1.1.1.1	0x7144	Standard query (0)	googleads.g.doubleclick.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:41.879081011 CEST	192.168.2.5	1.1.1.1	0x1b4	Standard query (0)	virusscan.jotti.org	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:41.879443884 CEST	192.168.2.5	1.1.1.1	0xa98a	Standard query (0)	virusscan.jotti.org	65	IN (0x0001)	false
Oct 8, 2024 21:45:44.155293941 CEST	192.168.2.5	1.1.1.1	0xe3cf	Standard query (0)	virusscan.jotti.org	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:44.155293941 CEST	192.168.2.5	1.1.1.1	0x494d	Standard query (0)	virusscan.jotti.org	65	IN (0x0001)	false
Oct 8, 2024 21:45:50.096700907 CEST	192.168.2.5	1.1.1.1	0x9a31	Standard query (0)	www.virustotal.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:50.096900940 CEST	192.168.2.5	1.1.1.1	0xf7e6	Standard query (0)	www.virustotal.com	65	IN (0x0001)	false
Oct 8, 2024 21:45:50.871741056 CEST	192.168.2.5	1.1.1.1	0x9c0	Standard query (0)	www.recaptcha.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:50.871881962 CEST	192.168.2.5	1.1.1.1	0x79e1	Standard query (0)	www.recaptcha.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:52.059767008 CEST	192.168.2.5	1.1.1.1	0x593	Standard query (0)	www.recaptcha.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:52.060165882 CEST	192.168.2.5	1.1.1.1	0xf03f	Standard query (0)	www.recaptcha.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:52.399554014 CEST	192.168.2.5	1.1.1.1	0x1642	Standard query (0)	www.virustotal.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:52.399554014 CEST	192.168.2.5	1.1.1.1	0x58ed	Standard query (0)	www.virustotal.com	65	IN (0x0001)	false
Oct 8, 2024 21:45:53.556488991 CEST	192.168.2.5	1.1.1.1	0x823a	Standard query (0)	recaptcha.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:53.556761980 CEST	192.168.2.5	1.1.1.1	0xba6	Standard query (0)	recaptcha.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:54.759907007 CEST	192.168.2.5	1.1.1.1	0x34bd	Standard query (0)	recaptcha.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:54.760411024 CEST	192.168.2.5	1.1.1.1	0x7352	Standard query (0)	recaptcha.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:56.363213062 CEST	192.168.2.5	1.1.1.1	0xee11	Standard query (0)	recaptcha.net	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:56.363481998 CEST	192.168.2.5	1.1.1.1	0x3863	Standard query (0)	recaptcha.net	65	IN (0x0001)	false
Oct 8, 2024 21:45:58.403686047 CEST	192.168.2.5	1.1.1.1	0x2cb8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:58.403686047 CEST	192.168.2.5	1.1.1.1	0x5444	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 8, 2024 21:45:59.949606895 CEST	192.168.2.5	1.1.1.1	0x150	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:59.949733973 CEST	192.168.2.5	1.1.1.1	0x538c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 8, 2024 21:46:25.600452900 CEST	192.168.2.5	1.1.1.1	0x5039	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:46:25.600958109 CEST	192.168.2.5	1.1.1.1	0x60da	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false
Oct 8, 2024 21:46:30.029424906 CEST	192.168.2.5	1.1.1.1	0x9d20	Standard query (0)	fundingchoicesmessages.google.com	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:46:30.029648066 CEST	192.168.2.5	1.1.1.1	0x7450	Standard query (0)	fundingchoicesmessages.google.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 8, 2024 21:45:13.818432093 CEST	1.1.1.1	192.168.2.5	0xbba9	No error (0)	keepass.info		92.205.48.200	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:15.655298948 CEST	1.1.1.1	192.168.2.5	0xc515	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 8, 2024 21:45:15.655934095 CEST	1.1.1.1	192.168.2.5	0x19b7	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:15.891623974 CEST	1.1.1.1	192.168.2.5	0x426	No error (0)	googleads.g.doubleclick.net		142.250.186.66	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:15.891658068 CEST	1.1.1.1	192.168.2.5	0x3448	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Oct 8, 2024 21:45:16.156656981 CEST	1.1.1.1	192.168.2.5	0xbb63	No error (0)	keepass.info		92.205.48.200	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:19.241059065 CEST	1.1.1.1	192.168.2.5	0xeadd	No error (0)	googleads.g.doubleclick.net		142.250.185.162	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:19.241509914 CEST	1.1.1.1	192.168.2.5	0xb9d9	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Oct 8, 2024 21:45:20.619807959 CEST	1.1.1.1	192.168.2.5	0x76e9	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:20.619807959 CEST	1.1.1.1	192.168.2.5	0x76e9	No error (0)	www3.l.google.com		172.217.16.142	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:20.621248960 CEST	1.1.1.1	192.168.2.5	0x577e	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:24.222600937 CEST	1.1.1.1	192.168.2.5	0xefa0	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:24.222841024 CEST	1.1.1.1	192.168.2.5	0x2721	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 8, 2024 21:45:25.819102049 CEST	1.1.1.1	192.168.2.5	0x875c	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:25.819102049 CEST	1.1.1.1	192.168.2.5	0x875c	No error (0)	www3.l.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:25.819509983 CEST	1.1.1.1	192.168.2.5	0x683f	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:26.284888983 CEST	1.1.1.1	192.168.2.5	0xeb6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:26.284888983 CEST	1.1.1.1	192.168.2.5	0xeb6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:26.519660950 CEST	1.1.1.1	192.168.2.5	0x7144	No error (0)	googleads.g.doubleclick.net			65	IN (0x0001)	false
Oct 8, 2024 21:45:26.520337105 CEST	1.1.1.1	192.168.2.5	0x2c2b	No error (0)	googleads.g.doubleclick.net		142.250.186.66	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:26.953285933 CEST	1.1.1.1	192.168.2.5	0x634	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:26.953285933 CEST	1.1.1.1	192.168.2.5	0x634	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:31.530867100 CEST	1.1.1.1	192.168.2.5	0x2ded	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:31.530867100 CEST	1.1.1.1	192.168.2.5	0x2ded	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:41.924871922 CEST	1.1.1.1	192.168.2.5	0x1b4	No error (0)	virusscan.jotti.org	pegasus.jotti.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:41.924871922 CEST	1.1.1.1	192.168.2.5	0x1b4	No error (0)	pegasus.jotti.org		49.12.134.143	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:41.932682037 CEST	1.1.1.1	192.168.2.5	0xa98a	No error (0)	virusscan.jotti.org	pegasus.jotti.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:44.194854975 CEST	1.1.1.1	192.168.2.5	0xe3cf	No error (0)	virusscan.jotti.org	pegasus.jotti.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:44.194854975 CEST	1.1.1.1	192.168.2.5	0xe3cf	No error (0)	pegasus.jotti.org		49.12.134.143	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:44.198020935 CEST	1.1.1.1	192.168.2.5	0x494d	No error (0)	virusscan.jotti.org	pegasus.jotti.org		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:49.997589111 CEST	1.1.1.1	192.168.2.5	0x45c2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:49.997589111 CEST	1.1.1.1	192.168.2.5	0x45c2	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:50.104167938 CEST	1.1.1.1	192.168.2.5	0x9a31	No error (0)	www.virustotal.com	ghs-svc-https-c46.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:50.104167938 CEST	1.1.1.1	192.168.2.5	0x9a31	No error (0)	ghs-svc-https-c46.ghs-ssl.googlehosted.com		74.125.34.46	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:50.126785994 CEST	1.1.1.1	192.168.2.5	0xf7e6	No error (0)	www.virustotal.com	ghs-svc-https-c46.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:50.880970955 CEST	1.1.1.1	192.168.2.5	0x9c0	No error (0)	www.recaptcha.net		216.58.206.35	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:52.067974091 CEST	1.1.1.1	192.168.2.5	0x593	No error (0)	www.recaptcha.net		142.250.186.67	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:52.408797979 CEST	1.1.1.1	192.168.2.5	0x1642	No error (0)	www.virustotal.com	ghs-svc-https-c46.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:52.408797979 CEST	1.1.1.1	192.168.2.5	0x1642	No error (0)	ghs-svc-https-c46.ghs-ssl.googlehosted.com		74.125.34.46	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:52.413469076 CEST	1.1.1.1	192.168.2.5	0x58ed	No error (0)	www.virustotal.com	ghs-svc-https-c46.ghs-ssl.googlehosted.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:45:53.563378096 CEST	1.1.1.1	192.168.2.5	0x823a	No error (0)	recaptcha.net		142.250.185.163	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:54.767416000 CEST	1.1.1.1	192.168.2.5	0x34bd	No error (0)	recaptcha.net		142.250.186.131	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:56.370909929 CEST	1.1.1.1	192.168.2.5	0xee11	No error (0)	recaptcha.net		142.250.186.67	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:58.748884916 CEST	1.1.1.1	192.168.2.5	0x5444	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 8, 2024 21:45:58.749694109 CEST	1.1.1.1	192.168.2.5	0x2cb8	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:59.956790924 CEST	1.1.1.1	192.168.2.5	0x150	No error (0)	www.google.com		142.250.185.196	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:45:59.957248926 CEST	1.1.1.1	192.168.2.5	0x538c	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 8, 2024 21:46:10.135746956 CEST	1.1.1.1	192.168.2.5	0xfa51	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:46:10.135746956 CEST	1.1.1.1	192.168.2.5	0xfa51	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:46:25.609180927 CEST	1.1.1.1	192.168.2.5	0x5039	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:46:25.609180927 CEST	1.1.1.1	192.168.2.5	0x5039	No error (0)	www3.l.google.com		172.217.16.206	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:46:25.610263109 CEST	1.1.1.1	192.168.2.5	0x60da	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:46:27.216505051 CEST	1.1.1.1	192.168.2.5	0xf19d	No error (0)	shed.dual-low.s-part-0032.t-0009.t-msedge.net	s-part-0032.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:46:27.216505051 CEST	1.1.1.1	192.168.2.5	0xf19d	No error (0)	s-part-0032.t-0009.t-msedge.net		13.107.246.60	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:46:30.037193060 CEST	1.1.1.1	192.168.2.5	0x9d20	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 8, 2024 21:46:30.037193060 CEST	1.1.1.1	192.168.2.5	0x9d20	No error (0)	www3.l.google.com		216.58.206.46	A (IP address)	IN (0x0001)	false
Oct 8, 2024 21:46:30.039921045 CEST	1.1.1.1	192.168.2.5	0x7450	No error (0)	fundingchoicesmessages.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:14 UTC	677	OUT	GET /news/n240601_2.57.html HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:14 UTC	370	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:14 GMT Content-Type: text/html Content-Length: 15186 Connection: close Vary: Accept-Encoding Last-Modified: Tue, 08 Oct 2024 13:29:43 GMT ETag: "3b52-623f7214f3fc0" Cache-Control: max-age=120 Expires: Tue, 08 Oct 2024 19:47:14 GMT Vary: Accept-Encoding X-Cache-Status: MISS Accept-Ranges: bytes
2024-10-08 19:45:14 UTC	15186	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 44 6f 6d 69 6e 69 6b 20 52 65 69 63 68 6c 22 20 2f 3e 0d 0a 0d 0a 09 0d 0a 09 0d 0a 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 44 43 2e 74 69 74 6c 65 22 20 63 6f 6e 74 Data Ascii: <!DOCTYPE html><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta name="author" content="Dominik Reichl" /><meta name="DC.title" cont

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:15 UTC	556	OUT	GET /default.css HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://keepass.info/news/n240601_2.57.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:15 UTC	371	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:15 GMT Content-Type: text/css Content-Length: 11702 Connection: close Vary: Accept-Encoding Last-Modified: Tue, 08 Oct 2024 13:29:41 GMT ETag: "2db6-623f72130bb40" Cache-Control: max-age=172800 Expires: Thu, 10 Oct 2024 19:44:51 GMT Vary: Accept-Encoding X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:15 UTC	11702	IN	Data Raw: 2f 2a 0d 0a 09 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 30 33 2d 32 30 32 34 20 44 6f 6d 69 6e 69 6b 20 52 65 69 63 68 6c 2e 0d 0a 09 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2a 2f 0d 0a 0d 0a 62 6f 64 79 2c 20 6b 62 64 20 6b 62 64 20 7b 0d 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0d 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 33 70 78 3b 0d 0a 7d 0d 0a 0d 0a 62 6f 64 79 20 7b 0d 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 30 30 30 30 3b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 46 46 46 46 46 46 3b 0d 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 22 69 6d 61 67 65 73 2f 62 61 63 6b 2e 70 6e 67 22 29 Data Ascii: /Copyright (C) 2003-2024 Dominik Reichl.All rights reserved./body, kbd kbd {font-family: Verdana, Arial, sans-serif;font-size: 13px;}body {color: #000000;background-color: #FFFFFF;background-image: url("images/back.png")

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:15 UTC	541	OUT	GET /default.js HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://keepass.info/news/n240601_2.57.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:15 UTC	383	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:15 GMT Content-Type: application/javascript Content-Length: 1724 Connection: close Vary: Accept-Encoding Last-Modified: Mon, 01 Jan 2024 13:51:32 GMT ETag: "6bc-60de2adeca100" Cache-Control: max-age=172800 Expires: Thu, 10 Oct 2024 19:36:07 GMT Vary: Accept-Encoding X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:15 UTC	1724	IN	Data Raw: 2f 2f 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 32 30 30 33 2d 32 30 32 34 20 44 6f 6d 69 6e 69 6b 20 52 65 69 63 68 6c 2e 0d 0a 2f 2f 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 5f 72 77 6c 54 6f 6f 6c 74 69 70 53 68 6f 77 28 69 64 54 2c 20 62 53 68 6f 77 29 20 7b 0d 0a 09 76 61 72 20 65 54 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 69 64 54 29 3b 0d 0a 09 69 66 28 65 54 20 21 3d 20 6e 75 6c 6c 29 20 65 54 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 20 3d 20 28 62 53 68 6f 77 20 3f 20 22 62 6c 6f 63 6b 22 20 3a 20 22 6e 6f 6e 65 22 29 3b 0d 0a 7d 0d 0a 0d 0a 66 75 6e 63 74 69 6f 6e 20 5f 72 77 6c 54 6f 6f 6c 74 69 70 55 70 64 61 74 65 28 69 64 54 2c 20 65 76 Data Ascii: // Copyright (C) 2003-2024 Dominik Reichl.// All rights reserved.function _rwlTooltipShow(idT, bShow) {var eT = document.getElementById(idT);if(eT != null) eT.style.display = (bShow ? "block" : "none");}function _rwlTooltipUpdate(idT, ev

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:15 UTC	612	OUT	GET /help/images/trans.png HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://keepass.info/news/n240601_2.57.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:15 UTC	322	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:15 GMT Content-Type: image/png Content-Length: 88 Connection: close Last-Modified: Wed, 20 Mar 2013 13:59:36 GMT ETag: "58-4d85ba1dbc200" Cache-Control: max-age=1814400 Expires: Tue, 29 Oct 2024 19:38:48 GMT X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:15 UTC	88	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 01 00 00 00 01 08 06 00 00 00 1f 15 c4 89 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 0d 49 44 41 54 08 d7 63 f8 ff ff 3f 03 00 08 fc 02 fe 5c 9f cf da 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDRbKGDIDATc?\IENDB`

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:16 UTC	617	OUT	GET /help/images/b64x64_tar.png HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://keepass.info/news/n240601_2.57.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:16 UTC	326	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:16 GMT Content-Type: image/png Content-Length: 5854 Connection: close Last-Modified: Sun, 03 Oct 2004 14:32:32 GMT ETag: "16de-3e58be5fe6000" Cache-Control: max-age=1814400 Expires: Tue, 29 Oct 2024 19:38:48 GMT X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:16 UTC	5854	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 16 70 49 44 41 54 78 da 62 fc ff ff 3f c3 48 06 00 01 c4 c4 30 c2 01 40 00 8d f8 00 00 08 20 16 64 0e 23 23 23 5d 2c dd 57 c4 28 0b a4 82 99 18 fe 87 fc fd c7 c0 fa fe 3b e3 be 6b cf 19 36 d6 6d fa 7f 11 28 fe 03 88 e9 92 2f 41 d9 1f 20 80 18 91 cb 00 5a 06 c0 91 52 26 de 9f 7f 18 3c 98 18 ff 47 32 fd ff ef c2 f8 97 81 97 99 93 15 2c f7 f7 fb 6f 86 ff cc 0c bf 3e fd 62 b8 f0 ee 1b d3 96 eb cf ff af ef d8 f1 ff 36 50 ea 17 2d 03 03 e4 77 80 00 a2 69 00 1c 2a 61 66 f9 f5 f7 bf 39 d0 aa 48 16 c6 ff Data Ascii: PNGIHDR@@iqgAMA7tEXtSoftwareAdobe ImageReadyqe<pIDATxb?H0@ d###],W(;k6m(/A ZR&<G2,o>b6P-wi*af9H

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:16 UTC	622	OUT	GET /screenshots/keepass_2x/main.jpg HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://keepass.info/news/n240601_2.57.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:17 UTC	328	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:16 GMT Content-Type: image/jpeg Content-Length: 54092 Connection: close Last-Modified: Sat, 07 Jan 2023 10:21:29 GMT ETag: "d34c-5f1a9e5b27c40" Cache-Control: max-age=1814400 Expires: Tue, 29 Oct 2024 19:38:48 GMT X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:17 UTC	16056	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 02 01 01 01 01 01 02 01 01 01 02 02 02 02 02 02 02 02 02 03 03 04 03 03 03 03 03 02 02 03 04 03 03 04 04 04 04 04 02 03 05 05 04 04 05 04 04 04 04 ff db 00 43 01 01 01 01 01 01 01 02 01 01 02 04 03 02 03 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 04 ff c0 00 11 08 00 e5 01 2c 03 01 11 00 02 11 01 03 11 01 ff c4 00 1f 00 00 02 03 00 03 01 01 01 01 00 00 00 00 00 00 00 00 07 05 06 08 04 09 0a 03 02 01 0b ff c4 00 5f 10 00 01 05 00 01 03 02 02 03 05 13 09 04 06 07 09 03 01 02 04 05 06 07 00 08 11 12 13 14 21 09 15 31 16 22 51 b5 d1 17 18 Data Ascii: JFIFHHCC,_!1"Q
2024-10-08 19:45:17 UTC	16384	IN	Data Raw: 35 be 5a 92 c8 be 80 ab 91 fe 0a f4 18 0d f2 4e 1b 2a 38 4d 3a 16 70 4e 09 70 e6 54 63 15 ee 14 ad 9a 67 ea e9 e8 59 2b 5e 24 ad 9f 2b 84 b2 08 5a 0e ae 28 7f 89 24 ce 8c 5d ad cc 46 c5 a2 87 03 8f 16 15 9a 41 50 23 82 1f e2 65 02 ee 94 b4 8b 46 d0 76 76 c7 7e 6b 0c a0 ed 49 4d 87 69 bc 9d 55 c4 3a d7 62 34 d9 58 dc a3 b7 df 71 ed 96 8e 8f 8e 6c a4 71 e6 51 f4 39 8d 35 54 db a8 8d 94 b2 84 7b 09 b2 eb a3 ca 8e 69 12 8b 15 87 08 81 15 a2 8c 24 22 17 51 ea 69 ea 6f c2 7a 9b b4 10 68 86 17 59 35 64 cf ca 65 9a 40 e6 87 b8 17 ba ed 8c b9 e1 97 7c 92 38 9c c5 c7 30 04 e5 6b 5a 32 ba 71 a7 8e d3 1a 98 c9 19 62 8c bc b7 33 c3 de 4b c8 26 ee b3 40 68 b0 0d 60 16 1b 49 2e 73 89 57 ad e4 6f a4 1a 45 95 08 30 5b 0e 17 81 5c fd 3d ff 00 d7 76 16 72 62 18 a1 a1 38 80 Data Ascii: 5ZN*8M:pNpTcgY+^$+Z($]FAP#eFvv~kIMiU:b4XqlqQ95T{i$"QiozhY5de@\|80kZ2qb3K&@h`I.sWoE0[\=vrb8
2024-10-08 19:45:17 UTC	16384	IN	Data Raw: 9f 34 e8 8a f8 ea ad 2b 3c fa f4 af 67 87 2b 17 d7 94 8a cf 0e 4f b5 ab e5 df 6a 79 4f 29 f6 a7 94 e8 8a 0a ea cd b9 b4 ad 5d 17 24 d2 50 a5 cd a0 a9 29 fe b9 ab ad ad 5b 69 a6 5f 01 89 15 08 54 52 99 ff 00 b4 36 79 77 fb 3a 22 e5 b5 f3 9d 6d 1e 85 bb a8 0e bd 99 54 b7 b0 e9 5b 45 01 d6 d2 e0 b4 c2 8e b3 45 1b dc f7 1f 1d 0a 60 89 4c d4 56 7a cc c6 fa bc b9 11 48 b8 95 76 8c bc 23 83 49 c9 54 57 25 6c 44 b0 70 aa 6b 6b 2c 48 d0 2c 99 30 90 ea d1 95 55 06 b2 21 4c 02 3d 7e f5 4b 10 ec f3 ea 1b d1 a4 53 5f 56 e8 7f d6 a4 ff 00 a5 e1 ff 00 fe fd 11 2d f3 6f 7c 1e eb 29 19 69 6a 19 46 77 6f d3 dc d9 05 8c 1a bf 2d fb a3 0f 86 a0 da ef 4a f8 f0 bf 7d f6 af 9e a6 c8 a4 92 fa b6 93 e4 17 54 24 0d e9 ed a3 54 5b 25 54 54 54 70 1a e4 54 5f 28 a8 ae 7a a2 a7 49 41 Data Ascii: 4+<g+OjyO)]$P)[i_TR6yw:"mT[EE`LVzHv#ITW%lDpkk,H,0U!L=~KS_V-o\|)ijFwo-J}T$T[%TTTpT_(zIA
2024-10-08 19:45:17 UTC	5268	IN	Data Raw: 3f 9f 4d c5 79 fb 5c ef 29 dd 53 70 8f 1c c9 e2 5e 2b ae b8 e7 1d 1c e8 98 ac fc 92 34 8e 85 08 7e f2 35 85 12 b0 68 1b 06 a2 4f 0a 08 2a c9 68 f0 46 78 48 98 7a 4e c1 3b 5a d7 07 29 17 43 83 b8 b0 83 86 df 6d 39 37 27 5f f7 77 6f 12 15 1d c7 20 e9 a0 ec 35 86 13 44 66 b9 45 36 d6 bc 47 f6 1e e7 30 6c 91 2c 0d 4f 66 41 44 e2 24 f8 fe 88 ce c2 01 9b 7e 5a 2f 0f dc c3 ad fa a0 94 71 24 c5 e4 cb e1 5c d4 47 95 56 6a 4b 4f 82 99 f1 0a 41 12 ce 09 96 34 d2 27 95 3b 04 15 4f 6d cc 47 74 45 33 41 f4 56 76 47 96 91 91 9d 41 c6 7a 5a db 1c 0c b8 96 98 9b 21 72 75 e1 67 e5 a7 57 24 75 ae b0 86 e7 99 cd 49 31 5f 12 31 84 42 35 ed 42 85 ae 73 1f f3 6a 91 72 74 3f 45 cf 65 fa eb 5d 95 de b3 8f b6 1a 7b 4e 41 e4 09 3c 97 b4 99 a0 e5 dd 25 c9 b4 76 33 0b 94 3c 90 48 79 Data Ascii: ?My\)Sp^+4~5hO*hFxHzN;Z)Cm97'_wo 5DfE6G0l,OfAD$~Z/q$\GVjKOA4';OmGtE3AVvGAzZ!rugW$uI1_1B5Bsjrt?Ee]{NA<%v3<Hy

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://keepass.info/news/n240601_2.57.html#v1

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Chrome Cache Entry: 264

Chrome Cache Entry: 265

Chrome Cache Entry: 266

Chrome Cache Entry: 267

Chrome Cache Entry: 268

Chrome Cache Entry: 269

Chrome Cache Entry: 270

Chrome Cache Entry: 271

Chrome Cache Entry: 272

Chrome Cache Entry: 273

Chrome Cache Entry: 274

Chrome Cache Entry: 275

Chrome Cache Entry: 276

Windows Analysis Report
https://keepass.info/news/n240601_2.57.html#v1

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:16 UTC	615	OUT	GET /images/flagger_small.gif HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://keepass.info/news/n240601_2.57.html Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:17 UTC	322	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:16 GMT Content-Type: image/gif Content-Length: 83 Connection: close Last-Modified: Fri, 07 May 2004 14:50:44 GMT ETag: "53-3d9d6c8ba1900" Cache-Control: max-age=1814400 Expires: Tue, 29 Oct 2024 19:38:48 GMT X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:17 UTC	83	IN	Data Raw: 47 49 46 38 39 61 10 00 0b 00 91 00 00 00 00 00 ff 00 00 ff ff 00 00 00 00 2c 00 00 00 00 10 00 0b 00 40 08 2c 00 01 08 1c 48 b0 20 00 01 08 13 2a 5c 28 20 80 c3 87 10 23 06 30 48 71 a0 c4 8b 0f 19 6a 4c 58 b1 a3 c7 82 18 31 6e 1c 49 72 61 40 00 3b Data Ascii: GIF89a,@,H *\( #0HqjLX1nIra@;

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:16 UTC	595	OUT	GET /images/back.png HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://keepass.info/default.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:17 UTC	323	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:16 GMT Content-Type: image/png Content-Length: 246 Connection: close Last-Modified: Thu, 26 Oct 2023 17:09:20 GMT ETag: "f6-608a1a1f1d000" Cache-Control: max-age=1814400 Expires: Tue, 29 Oct 2024 19:38:48 GMT X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:17 UTC	246	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 40 00 00 00 40 08 02 00 00 00 e4 85 39 49 00 00 00 bd 49 44 41 54 78 da ed d7 c1 09 00 30 08 04 c1 18 d2 7f bd fe 4c 0f fe 0e 66 4a 10 84 db 9a 99 03 64 ba 4e 00 b9 5e 77 bb 02 84 2a 13 1a 4c 68 c0 03 03 1a 18 34 30 60 42 03 1e 18 d0 c0 a0 81 01 13 1a f0 c0 a0 81 01 0d 0c 98 d0 80 07 06 0d 0c 68 60 c0 84 06 3c 30 68 60 40 03 03 26 34 78 60 40 03 03 1a 18 30 a1 c1 03 03 1a 18 d0 c0 80 09 0d 1e 18 d0 c0 80 06 06 13 1a f0 c0 80 06 06 34 30 98 d0 80 07 06 34 30 68 60 0d 0c 26 34 e0 81 01 0d 0c 1a 18 30 a1 01 0f 0c 68 60 d0 c0 80 09 0d 78 60 d0 c0 80 06 06 4c 68 c0 03 83 06 06 34 30 60 42 03 1e 18 34 30 a0 81 81 9d 0f 74 a4 61 dd cc 83 1f ce 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: PNGIHDR@@9IIDATx0LfJdN^w*Lh40`Bh`<0h`@&4x`@04040h`&40h`x`Lh40`B40taIENDB`

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:16 UTC	602	OUT	GET /images/il_main_v02.png HTTP/1.1 Host: keepass.info Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://keepass.info/default.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:17 UTC	327	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:16 GMT Content-Type: image/png Content-Length: 24760 Connection: close Last-Modified: Fri, 16 Mar 2018 11:40:04 GMT ETag: "60b8-5678611b66d00" Cache-Control: max-age=1814400 Expires: Tue, 29 Oct 2024 19:38:48 GMT X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:17 UTC	16057	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 00 00 00 01 00 08 06 00 00 00 5c 72 a8 66 00 00 20 00 49 44 41 54 78 da ec 9d 77 7c 14 55 d7 c7 bf 33 3b db 93 4d ef a1 86 00 21 f4 00 d2 54 8a 20 08 08 82 58 b1 a1 8f bd 61 79 ac e8 a3 62 c7 ae a8 0f 56 2c 28 28 22 4d 11 a9 02 8a f4 0e 09 04 08 e9 bd 6d df 99 fb fe b1 21 24 14 09 b0 41 79 5e 0e 9f fd 84 d9 72 e7 ce 9d f9 fd ee b9 e7 9c 7b 8e 24 84 e0 9c 9c 93 73 72 76 8b 24 49 a7 f4 3b e5 74 7e fc ff 51 0e 11 e6 df 39 66 e7 fa 70 f6 f6 e1 d9 31 7a 5a c4 87 53 ee 54 b8 e7 a3 1c f4 49 4f e0 75 57 d0 4e dd cd 8e bc 45 4c b9 25 11 b3 e2 65 fb be 02 26 2f 3c b9 3e 9c 32 01 fc 4d 12 05 f4 00 da d5 bc 52 81 08 c0 00 58 eb 7c cf 0e 78 80 12 60 1b b0 13 d8 0e fc 09 14 9f a3 a4 73 d2 50 b9 2d 3e 1e b3 d5 4a Data Ascii: PNGIHDR\rf IDATxw\|U3;M!T XaybV,(("Mm!$Ay^r{$srv$I;t~Q9fp1zZSTIOuWNEL%e&/<>2MRX\|x`sP->J
2024-10-08 19:45:17 UTC	8703	IN	Data Raw: be 57 59 5e c6 dc 1f bf e6 f3 8f 5e a7 20 ff 98 a5 5f 4b 81 9b 81 d9 81 00 df 39 e1 ac 20 00 45 1f b2 e1 93 89 b6 2e d7 0e 2b 66 65 f1 2b 38 a4 6e 1c dc bf 95 94 94 ce 04 07 9b 29 2e ce 27 31 b1 09 d1 31 4d d9 95 9e 85 27 fb 4d 42 9c df 32 f6 09 03 7b 0e 14 df 0b ea 3b ff cb 04 10 a8 80 8f ef f1 5b 94 9f c1 bf 89 48 57 6b 65 cb cd e6 99 89 13 78 f1 b9 47 e9 3f 70 28 23 46 5d 45 9f f3 07 62 0d b2 9d 36 f8 ab aa 2a 58 bd f2 57 7e 9a f3 2d 2b 57 2c c4 e3 39 66 06 27 1f fe 2c 3b 4f 11 20 4b ff d9 7c c3 ff bf 89 41 a7 85 d9 f4 a5 78 ec 12 c2 91 4b 66 ee 16 c2 c2 42 d9 b5 6b 33 8a a2 90 9c 9c 8c c5 62 21 2c d4 4c 52 ab 96 14 16 e4 61 b0 97 61 56 c2 00 39 ec 0c 16 e9 39 ab 09 00 fc f5 df ee 03 a6 03 af 00 e7 d7 fd d0 e3 71 b3 f0 a7 d9 2c fc 69 36 3a 9d 8e d4 0e Data Ascii: WY^^ _K9 E.+fe+8n).'11M'MB2{;[HWkexG?p(#F]Eb6*XW~-+W,9f',;O K\|AxKfBk3b!,LRaaV99q,i6:

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:18 UTC	362	OUT	GET /help/images/b64x64_tar.png HTTP/1.1 Host: keepass.info Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:18 UTC	326	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 08 Oct 2024 19:45:18 GMT Content-Type: image/png Content-Length: 5854 Connection: close Last-Modified: Sun, 03 Oct 2004 14:32:32 GMT ETag: "16de-3e58be5fe6000" Cache-Control: max-age=1814400 Expires: Tue, 29 Oct 2024 19:38:48 GMT X-Cache-Status: HIT Accept-Ranges: bytes
2024-10-08 19:45:18 UTC	5854	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 04 67 41 4d 41 00 00 af c8 37 05 8a e9 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 16 70 49 44 41 54 78 da 62 fc ff ff 3f c3 48 06 00 01 c4 c4 30 c2 01 40 00 8d f8 00 00 08 20 16 64 0e 23 23 23 5d 2c dd 57 c4 28 0b a4 82 99 18 fe 87 fc fd c7 c0 fa fe 3b e3 be 6b cf 19 36 d6 6d fa 7f 11 28 fe 03 88 e9 92 2f 41 d9 1f 20 80 18 91 cb 00 5a 06 c0 91 52 26 de 9f 7f 18 3c 98 18 ff 47 32 fd ff ef c2 f8 97 81 97 99 93 15 2c f7 f7 fb 6f 86 ff cc 0c bf 3e fd 62 b8 f0 ee 1b d3 96 eb cf ff af ef d8 f1 ff 36 50 ea 17 2d 03 03 e4 77 80 00 a2 69 00 1c 2a 61 66 f9 f5 f7 bf 39 d0 aa 48 16 c6 ff Data Ascii: PNGIHDR@@iqgAMA7tEXtSoftwareAdobe ImageReadyqe<pIDATxb?H0@ d###],W(;k6m(/A ZR&<G2,o>b6P-wi*af9H

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:19 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-08 19:45:19 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF45) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=75623 Date: Tue, 08 Oct 2024 19:45:19 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-10-08 19:45:20 UTC	514	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=75558 Date: Tue, 08 Oct 2024 19:45:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-10-08 19:45:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:21 UTC	716	OUT	GET /i/ca-pub-4717770029130736?href=https%3A%2F%2Fkeepass.info%2Fnews%2Fn240601_2.57.html&ers=2 HTTP/1.1 Host: fundingchoicesmessages.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://keepass.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:21 UTC	1966	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Timing-Allow-Origin: * Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 08 Oct 2024 19:45:21 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UpPkT3oj5Ar7W_1UZLZWMA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorServingWebSwitchboardHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorServingWebSwitchboardHttp/cspreport/allowlist Cross-Origin-Resource-Policy: cross-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version reporting-endpoints: default="/_/ContributorServingWebSwitchboardHttp/web-reports?context=eJzjamDU4pJi8NGQYjhx6zbTBSA-73SH6ToQS3x9yaQFxE7pM1hDgLj15jnW6UCc9O88awkQu2tdZPUHYkOFS6zOQOxYdInVE4hVey6xmgPx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1hYgvt10hfUxEAvxcFycPm0Hm8CFEy1zmJQ0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDA0MzPUMDOMLDAC4I09Y" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 36 66 30 61 0d 0a 69 66 20 28 74 79 70 65 6f 66 20 5f 5f 67 6f 6f 67 6c 65 66 63 20 3d 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 20 7c 7c 20 74 79 70 65 6f 66 20 5f 5f 67 6f 6f 67 6c 65 66 63 2e 66 63 4b 65 72 6e 65 6c 4d 61 6e 61 67 65 72 20 3d 3d 3d 20 27 75 6e 64 65 66 69 6e 65 64 27 29 20 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 43 6f 6e 74 72 69 62 75 74 6f 72 53 65 72 76 69 6e 67 52 65 73 70 6f 6e 73 65 43 6c 69 65 6e 74 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 43 6f 6e 74 72 69 62 75 74 6f 72 53 65 72 76 69 6e 67 52 65 73 70 6f 6e 73 65 43 6c 69 65 6e 74 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 5f 2e 5f 46 5f 74 6f 67 Data Ascii: 6f0aif (typeof __googlefc === 'undefined' \|\| typeof __googlefc.fcKernelManager === 'undefined') {"use strict";this.default_ContributorServingResponseClientJs=this.default_ContributorServingResponseClientJs\|\|{};(function(_){var window=this;try{_._F_tog
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 66 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 72 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 62 61 28 61 29 7d 3b 74 Data Ascii: s))}})}return a});fa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.r=function(a){var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:ba(a)};t
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 62 6a 65 63 74 22 3a 76 61 72 20 68 3d 67 21 3d 6e 75 6c 6c 3b 62 72 65 61 6b 20 61 3b 63 61 73 65 20 22 66 75 6e 63 74 69 6f 6e 22 3a 68 3d 21 30 3b 62 72 65 61 6b 20 61 3b 64 65 66 61 75 6c 74 3a 68 3d 21 31 7d 68 3f 74 68 69 73 2e 4b 28 67 29 3a 74 68 69 73 2e 41 28 67 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 4b 3d 0a 66 75 6e 63 74 69 6f 6e 28 67 29 7b 76 61 72 20 68 3d 76 6f 69 64 20 30 3b 74 72 79 7b 68 3d 67 2e 74 68 65 6e 7d 63 61 74 63 68 28 6b 29 7b 74 68 69 73 2e 75 28 6b 29 3b 72 65 74 75 72 6e 7d 74 79 70 65 6f 66 20 68 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 3f 74 68 69 73 2e 6c 61 28 68 2c 67 29 3a 74 68 69 73 2e 41 28 67 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 75 3d 66 75 6e 63 74 69 6f 6e 28 67 29 7b 74 68 69 73 2e 44 28 32 2c 67 Data Ascii: bject":var h=g!=null;break a;case "function":h=!0;break a;default:h=!1}h?this.K(g):this.A(g)}};e.prototype.K=function(g){var h=void 0;try{h=g.then}catch(k){this.u(k);return}typeof h=="function"?this.la(h,g):this.A(g)};e.prototype.u=function(g){this.D(2,g
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 4a 29 7b 71 5b 42 5d 3d 4a 3b 79 2d 2d 3b 79 3d 3d 30 26 26 6d 28 71 29 7d 7d 76 61 72 20 71 3d 5b 5d 2c 79 3d 30 3b 64 6f 20 71 2e 70 75 73 68 28 76 6f 69 64 20 30 29 2c 79 2b 2b 2c 63 28 6b 2e 76 61 6c 75 65 29 2e 6d 62 28 77 28 71 2e 6c 65 6e 67 74 68 2d 31 29 2c 6e 29 2c 6b 3d 68 2e 6e 65 78 74 28 29 3b 77 68 69 6c 65 28 21 6b 2e 64 6f 6e 65 29 7d 29 7d 3b 72 65 74 75 72 6e 20 65 7d 29 3b 0a 76 61 72 20 72 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 6e 75 6c 6c 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 6b 60 22 2b 63 29 3b 69 66 28 62 20 69 6e 73 74 61 6e 63 65 6f 66 20 52 65 67 45 78 70 29 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 22 6c 60 22 2b 63 29 3b 72 65 74 75 72 6e 20 61 2b Data Ascii: J){q[B]=J;y--;y==0&&m(q)}}var q=[],y=0;do q.push(void 0),y++,c(k.value).mb(w(q.length-1),n),k=h.next();while(!k.done)})};return e});var ra=function(a,b,c){if(a==null)throw new TypeError("k`"+c);if(b instanceof RegExp)throw new TypeError("l`"+c);return a+
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 68 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 6b 3d 6e 65 77 20 61 28 5f 2e 72 28 5b 5b 68 2c 22 73 22 5d 5d 29 29 3b 69 66 28 6b 2e 67 65 74 28 68 29 21 3d 22 73 22 7c 7c 6b 2e 73 69 7a 65 21 3d 31 7c 7c 6b 2e 67 65 74 28 7b 78 3a 34 7d 29 7c 7c 6b 2e 73 65 74 28 7b 78 3a 34 7d 2c 22 74 22 29 21 3d 6b 7c 7c 6b 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 6d 3d 6b 2e 65 6e 74 72 69 65 73 28 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 69 66 28 6e 2e 64 6f 6e 65 7c 7c 6e 2e 76 61 6c 75 65 5b 30 5d 21 3d 68 7c 7c 6e 2e 76 61 6c 75 65 5b 31 5d 21 3d 22 73 22 29 72 65 74 75 72 6e 21 31 3b 6e 3d 6d 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6e 2e Data Ascii: function")return!1;try{var h=Object.seal({x:4}),k=new a(_.r([[h,"s"]]));if(k.get(h)!="s"\|\|k.size!=1\|\|k.get({x:4})\|\|k.set({x:4},"t")!=k\|\|k.size!=2)return!1;var m=k.entries(),n=m.next();if(n.done\|\|n.value[0]!=h\|\|n.value[1]!="s")return!1;n=m.next();return n.
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 76 61 6c 75 65 3a 76 6f 69 64 20 30 7d 7d 29 7d 2c 66 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 7b 7d 3b 72 65 74 75 72 6e 20 68 2e 71 61 3d 68 2e 6e 65 78 74 3d 68 2e 68 65 61 64 3d 68 7d 2c 67 3d 30 3b 72 65 74 75 72 6e 20 63 7d 29 3b 0a 70 28 22 53 65 74 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 21 61 7c 7c 74 79 70 65 6f 66 20 61 21 3d 22 66 75 6e 63 74 69 6f 6e 22 7c 7c 21 61 2e 70 72 6f 74 6f 74 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 28 5b 63 5d 29 29 Data Ascii: value:void 0}})},f=function(){var h={};return h.qa=h.next=h.head=h},g=0;return c});p("Set",function(a){if(function(){if(!a\|\|typeof a!="function"\|\|!a.prototype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.r([c]))
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 61 74 6f 72 5d 3b 69 66 28 74 79 70 65 6f 66 20 66 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 7b 62 3d 66 2e 63 61 6c 6c 28 62 29 3b 66 6f 72 28 76 61 72 20 67 3d 30 3b 21 28 66 3d 62 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 66 2e 76 61 6c 75 65 2c 67 2b 2b 29 29 7d 65 6c 73 65 20 66 6f 72 28 66 3d 62 2e 6c 65 6e 67 74 68 2c 67 3d 30 3b 67 3c 66 3b 67 2b 2b 29 65 2e 70 75 73 68 28 63 2e 63 61 6c 6c 28 64 2c 62 5b 67 5d 2c 67 29 29 3b 72 65 74 75 72 6e 20 65 7d 7d 29 3b 70 28 22 4f 62 6a 65 63 74 2e 65 6e 74 72 69 65 73 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 5b 5d 2c 64 3b 66 6f 72 28 64 20 69 6e 20 62 29 69 61 28 62 2c Data Ascii: ator];if(typeof f=="function"){b=f.call(b);for(var g=0;!(f=b.next()).done;)e.push(c.call(d,f.value,g++))}else for(f=b.length,g=0;g<f;g++)e.push(c.call(d,b[g],g));return e}});p("Object.entries",function(a){return a?a:function(b){var c=[],d;for(d in b)ia(b,
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 70 28 22 55 69 6e 74 38 43 6c 61 6d 70 65 64 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 22 2c 74 61 29 3b 70 28 22 49 6e 74 31 36 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 22 2c 74 61 29 3b 70 28 22 55 69 6e 74 31 36 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 22 2c 74 61 29 3b 70 28 22 49 6e 74 33 32 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 22 2c 74 61 29 3b 0a 70 28 22 55 69 6e 74 33 32 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 22 2c 74 61 29 3b 70 28 22 46 6c 6f 61 74 33 32 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 22 2c 74 61 29 3b 70 28 22 46 6c 6f 61 74 36 34 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 66 69 6c 6c 22 2c 74 61 29 3b 70 28 22 Data Ascii: p("Uint8ClampedArray.prototype.fill",ta);p("Int16Array.prototype.fill",ta);p("Uint16Array.prototype.fill",ta);p("Int32Array.prototype.fill",ta);p("Uint32Array.prototype.fill",ta);p("Float32Array.prototype.fill",ta);p("Float64Array.prototype.fill",ta);p("
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 72 65 74 75 72 6e 20 49 61 28 29 3f 47 61 28 22 43 68 72 6f 6d 69 75 6d 22 29 3a 28 5f 2e 75 28 22 43 68 72 6f 6d 65 22 29 7c 7c 5f 2e 75 28 22 43 72 69 4f 53 22 29 29 26 26 21 28 49 61 28 29 3f 30 3a 5f 2e 75 28 22 45 64 67 65 22 29 29 7c 7c 5f 2e 75 28 22 53 69 6c 6b 22 29 7d 3b 5f 2e 4c 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 4b 61 26 26 61 21 3d 6e 75 6c 6c 26 26 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 55 69 6e 74 38 41 72 72 61 79 7d 3b 4f 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 61 3d 45 72 72 6f 72 28 29 3b 4d 61 28 61 2c 22 69 6e 63 69 64 65 6e 74 22 29 3b 5f 2e 42 61 28 61 29 7d 3b 5f 2e 50 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 45 72 72 6f 72 28 61 29 3b 4d 61 28 61 2c 22 77 61 72 6e 69 6e 67 22 29 3b 72 Data Ascii: return Ia()?Ga("Chromium"):(_.u("Chrome")\|\|_.u("CriOS"))&&!(Ia()?0:_.u("Edge"))\|\|_.u("Silk")};_.La=function(a){return Ka&&a!=null&&a instanceof Uint8Array};Oa=function(){var a=Error();Ma(a,"incident");_.Ba(a)};_.Pa=function(a){a=Error(a);Ma(a,"warning");r
2024-10-08 19:45:21 UTC	1966	IN	Data Raw: 69 66 28 77 62 3d 3d 3d 76 6f 69 64 20 30 29 7b 76 61 72 20 62 3d 6e 65 77 20 78 62 28 5b 5d 2c 7b 7d 29 3b 77 62 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6f 6e 63 61 74 2e 63 61 6c 6c 28 5b 5d 2c 62 29 2e 6c 65 6e 67 74 68 3d 3d 3d 31 7d 77 62 26 26 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 26 26 53 79 6d 62 6f 6c 2e 69 73 43 6f 6e 63 61 74 53 70 72 65 61 64 61 62 6c 65 26 26 28 61 5b 53 79 6d 62 6f 6c 2e 69 73 43 6f 6e 63 61 74 53 70 72 65 61 64 61 62 6c 65 5d 3d 21 30 29 7d 3b 7a 62 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 2e 6c 65 6e 67 74 68 21 3d 3d 62 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 31 3b 66 6f 72 28 76 61 72 20 63 20 69 6e 20 62 29 7b 76 61 72 20 64 3d 4e 75 6d 62 65 72 Data Ascii: if(wb===void 0){var b=new xb([],{});wb=Array.prototype.concat.call([],b).length===1}wb&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};zb=function(a,b){if(a.length!==b.length)return!1;for(var c in b){var d=Number

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:24 UTC	798	OUT	GET /pagead/drt/ui HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://googleads.g.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:25 UTC	426	IN	HTTP/1.1 302 Found Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA Cache-Control: private Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 08 Oct 2024 19:45:25 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:25 UTC	1092	OUT	GET /f/AGSKWxUZylESW6h_tjG6lCaPnUAID9bWUspnQXxr4NVFistEhh3FiLBC9jaKXXPwcpXvtNDMrd-X5jWCHHdoftVtSmxuwKJ_A00kI9t7ubByVfqxw1fvSLRptBSEO_YwzGBMSaucJR4ynQ==?fccs=W251bGwsbnVsbCxudWxsLG51bGwsbnVsbCxudWxsLFsxNzI4NDE2NzIxLDYzOTAwMDAwMF0sbnVsbCxudWxsLG51bGwsW251bGwsWzddXSwiaHR0cHM6Ly9rZWVwYXNzLmluZm8vbmV3cy9uMjQwNjAxXzIuNTcuaHRtbCIsbnVsbCxbWzgsIlBXcWhvaFFHRXBnIl0sWzksImVuLVVTIl0sWzE4LCJbW1swXV1dIl0sWzIwLCJbbnVsbCxudWxsLFszMTA4MjI1M10sbnVsbCw3XSJdLFsxOSwiMiJdLFsxNywiWzBdIl1dXQ HTTP/1.1 Host: fundingchoicesmessages.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://keepass.info/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:25 UTC	1930	IN	HTTP/1.1 200 OK Content-Type: application/javascript; charset=utf-8 Timing-Allow-Origin: * Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 08 Oct 2024 19:45:25 GMT Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-kC-j9A37Z9v3vOO0ratG5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/ContributorGlobalRouterHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/ContributorGlobalRouterHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/ContributorGlobalRouterHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* reporting-endpoints: default="/_/ContributorGlobalRouterHttp/web-reports?context=eJzjamDU4pJiCNCQYjhx6zbTBSA-73SH6ToQS3x9yaQFxE7pM1hDgLj15jnW6UCc9O88awkQu2tdZPUHYkOFS6zOQOxYdInVE4hVey6xmgPx_XWXWJ8D8dc9l1j_AvHej5dYjwJxkcQV1hYgvt10hfUxEAvxcFydPm0Hm0DDnufnmJQ0kvIL45Pz80qKMpNKS_KL0pLTUotTi8pSi-KNDIxMDA0MzPUMDOMLDADE7k-Z" Server: ESF X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-10-08 19:45:25 UTC	1930	IN	Data Raw: 62 31 65 0d 0a 69 66 20 28 74 79 70 65 6f 66 20 5f 5f 67 6f 6f 67 6c 65 66 63 2e 66 63 4b 65 72 6e 65 6c 4d 61 6e 61 67 65 72 2e 72 75 6e 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 20 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 43 6f 6e 74 72 69 62 75 74 6f 72 53 65 72 76 69 6e 67 52 65 73 70 6f 6e 73 65 43 6c 69 65 6e 74 4a 73 3d 74 68 69 73 2e 64 65 66 61 75 6c 74 5f 43 6f 6e 74 72 69 62 75 74 6f 72 53 65 72 76 69 6e 67 52 65 73 70 6f 6e 73 65 43 6c 69 65 6e 74 4a 73 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 74 72 79 7b 0a 76 61 72 20 44 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 74 68 69 73 2e 6c 3d 5f 2e 76 28 61 29 7d 3b 5f 2e 7a 28 44 44 2c 5f 2e Data Ascii: b1eif (typeof __googlefc.fcKernelManager.run === 'function') {"use strict";this.default_ContributorServingResponseClientJs=this.default_ContributorServingResponseClientJs\|\|{};(function(_){var window=this;try{var DD=function(a){this.l=_.v(a)};_.z(DD,_.
2024-10-08 19:45:25 UTC	923	IN	Data Raw: 4f 36 70 72 79 4b 62 48 51 66 76 57 37 37 31 55 38 47 71 7a 42 68 4f 62 6d 55 42 76 6f 36 63 6b 74 55 55 52 73 62 70 75 6f 44 76 76 6f 57 42 43 4a 36 43 32 36 6a 37 43 37 76 41 73 2d 6d 76 46 6e 69 61 31 55 44 61 7a 65 76 6e 4b 77 6d 55 51 76 2d 74 66 32 30 59 66 65 62 51 53 75 6a 77 47 53 55 78 36 6d 65 4e 56 41 6d 66 59 74 4c 47 35 68 39 6f 6f 67 5c 5c 5c 5c 75 30 30 33 64 5c 5c 5c 5c 75 30 30 33 64 5c 5c 5c 78 32 32 5c 78 35 64 2c 5c 78 35 62 6e 75 6c 6c 2c 5c 78 35 62 37 5c 78 35 64 5c 78 35 64 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 5c 5c 78 32 32 35 62 66 31 34 30 35 35 66 32 65 61 38 33 33 31 5c 5c 5c 78 32 32 2c 6e 75 6c 6c 2c 5c 78 35 62 6e 75 6c 6c 2c 6e 75 6c 6c 2c 6e 75 6c 6c 2c 5c 5c 5c 78 32 32 68 74 Data Ascii: O6pryKbHQfvW771U8GqzBhObmUBvo6cktUURsbpuoDvvoWBCJ6C26j7C7vAs-mvFnia1UDazevnKwmUQv-tf20YfebQSujwGSUx6meNVAmfYtLG5h9oog\\\\u003d\\\\u003d\\\x22\x5d,\x5bnull,\x5b7\x5d\x5d,null,null,null,null,null,\\\x225bf14055f2ea8331\\\x22,null,\x5bnull,null,null,\\\x22ht
2024-10-08 19:45:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-10-08 19:45:26 UTC	798	OUT	GET /pagead/drt/ui HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCOnFzQEIucrNAQiK080BGI/OzQEYwtjNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: https://googleads.g.doubleclick.net/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-08 19:45:26 UTC	426	IN	HTTP/1.1 302 Found Timing-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Location: https://googleads.g.doubleclick.net/pagead/drt/si?st=NO_DATA Cache-Control: private Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 08 Oct 2024 19:45:26 GMT Server: cafe Content-Length: 0 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close