Windows Analysis Report
https://maliyecezasorgu.org/sorgu

Overview

General Information

Sample URL:	https://maliyecezasorgu.org/sorgu
Analysis ID:	1522067
Tags:	openphish
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

HTML body contains low number of good links

HTML body contains password input but no form action

HTML title does not match URL

Stores files to the Windows start menu directory

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://maliyecezasorgu.org/sorgu

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

HTML body contains low number of good links

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: Title: e-Devlet Kaps does not match URL

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/jquery.jcryption.js

HTTP Parser: "use strict";function _typeof(t){return(_typeof="function"==typeof symbol&&"symbol"==typeof symbol.iterator?function(t){return typeof t}:function(t){return t&&"function"==typeof symbol&&t.constructor===symbol&&t!==symbol.prototype?"symbol":typeof t})(t)}!function(s){s.jcryption=function(t,e){var r=this;r.$el=s(t),r.el=t,r.$el.data("jcryption",r),r.$el.data("key",null),r.init=function(){r.options=s.extend({},s.jcryption.defaultoptions,e),$encryptedelement=s("<input />",{type:"hidden",name:r.options.postvariable}),($submitelement=!1!==r.options.submitelement?r.options.submitelement:r.$el.find(":input:submit")).bind(r.options.submitevent,function(){return s(this).attr("disabled",!0),r.options.beforeencryption()&&r.authenticate(function(t){var e=r.$el.serialize();$submitelement.is(":submit")&&(e=e+"&"+$submitelement.attr("name")+"="+$submitelement.val()),$encryptedelement.val(s.jcryption.encrypt(e,t)),s(r.$el).find(r.options.formfieldselector).attr("disabled",!0).end().append($encryptedelement).submit()},function...

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: <input type="password" .../> found

Source: https://maliyecezasorgu.org/sorgu	HTTP Parser: No <meta name="copyright".. found
Source: https://maliyecezasorgu.org/sorgu	HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49762 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49740 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 36MB

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49762 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /sorgu HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/css/login-main.css HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.4.2/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://maliyecezasorgu.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://maliyecezasorgu.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/fonts/arimo/P5sCzZCDf9_T_10c9C1kiL2t2dkPJA.143.woff2 HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://maliyecezasorgu.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://maliyecezasorgu.org/path/css/login-main.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/common.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/jquery.jcryption.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/edk-giris.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/common_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/login_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/img/edk.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/DDO-logo.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/999.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /CryptoServlet?generateKeyPair=true&pn=%2Fsorgu&ajax=1&token= HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, /; q=0.01X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /path/img/favicon-196x196.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/edk.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/DDO-logo.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/edk-giris.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/img/999.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/login_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/common_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/jquery.jcryption.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/common.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/img/favicon-196x196.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D

Source: global traffic	DNS traffic detected: DNS query: maliyecezasorgu.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.e-devlet.gov.tr

Source: unknown

HTTP traffic detected: POST /report/v4?s=qEIxNlZleFTyWUB7CwJwBPEU1Ea2dzgKjxmL5S0Siw1SxyCpXpaAlOuzhZ88uWkFeiw65i78xsrrsIJSgyQV6b5QJkuaFHnZVQ9CZwO9JDasgK3G2AMfpvptjbTg4cWp%2Frk%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 465Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 06:06:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.3.11Cache-Control: no-cache, privatepragma: no-cacheexpires: -1CF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DFLPbXCsIqu5dOaMeX6WF0SQwOHwcB5R75NE7UprpjbKhvAJyikS76bJrEHiXftpBrWnoolowLwVV76LS0u37i8hXQwCR9J4hiiqpDJsfEOue3Y0w%2FJ2B2QtDqVB%2B4LgtaMXqpsx"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8ca9c9e18c4c6a5e-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 06:06:43 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.3.11Cache-Control: no-cache, privateCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6crtplpzI4IJ3ZccE3IVpxCDwhyuwMZCuAg%2B1mnq7rFLpm2cChpwkDUlmqCMiUXbGecoLAr6DBZVreXPFKfEIylcl2njAlPxrUUqrNJ6O7OBImR31pt3zOlNkW2GQPiHtvZAhgCa"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ca9c9ec4b61c34e-EWR

Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/common.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/common_messages_tr.1.9.4.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/edk-giris.1.9.4.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/jquery.jcryption.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/login_messages_tr.1.9.4.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: chromecache_77.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css
Source: chromecache_79.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_79.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_73.2.dr, chromecache_94.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_73.2.dr, chromecache_94.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_73.2.dr, chromecache_94.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49740 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@16/46@18/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2004,i,17148620096188146584,7392402470115323412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://maliyecezasorgu.org/sorgu"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2004,i,17148620096188146584,7392402470115323412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.17.24.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
31.3.2.116	img-edevlet.mncdn.com	Turkey	21245	NETSA-ASTR	false
31.3.2.127	unknown	Turkey	21245	NETSA-ASTR	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
188.114.97.3	unknown	European Union	13335	CLOUDFLARENETUS	false
188.114.96.3	maliyecezasorgu.org	European Union	13335	CLOUDFLARENETUS	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
192.168.2.5

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
a.nel.cloudflare.com	35.190.80.1	true
cdnjs.cloudflare.com	104.17.24.14	true
www.google.com	172.217.18.4	true
img-edevlet.mncdn.com	31.3.2.116	true
maliyecezasorgu.org	188.114.96.3	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
cdn.jsdelivr.net	unknown	unknown
cdn.e-devlet.gov.tr	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://cdn.e-devlet.gov.tr/themes/izmir/js/es/common_messages_tr.1.9.4.js	false	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2	false	unknown
https://cdn.e-devlet.gov.tr/themes/izmir/js/common.js	false	unknown
https://cdn.e-devlet.gov.tr/themes/izmir/js/es/edk-giris.1.9.4.js	false	unknown
https://cdn.e-devlet.gov.tr/themes/izmir/js/es/login_messages_tr.1.9.4.js	false	unknown
https://maliyecezasorgu.org/path/img/edk.png	false	unknown
https://maliyecezasorgu.org/path/img/DDO-logo.png	false	unknown
https://maliyecezasorgu.org/path/img/999.png	false	unknown
https://a.nel.cloudflare.com/report/v4?s=kYjZuns3azSZHGQnrQF9qXExjEXbpi7ot7DX6CH05OLkbb3sFW59b7qfb4EPRl91fV8jTFuKB8pgkmdGiaZHDcD%2FEcfK7xXeZoRv7st6XHzqbHzKnynOiz1zRtmrMxb4Q1Cmyyf1	false	unknown
https://maliyecezasorgu.org/CryptoServlet?generateKeyPair=true&pn=%2Fsorgu&ajax=1&token=	false	unknown
https://maliyecezasorgu.org/themes/izmir/fonts/arimo/P5sCzZCDf9_T_10c9C1kiL2t2dkPJA.143.woff2	false	unknown
https://maliyecezasorgu.org/sorgu	true	unknown
https://maliyecezasorgu.org/path/css/login-main.css	false	unknown
https://cdn.e-devlet.gov.tr/themes/izmir/js/es/jquery.jcryption.js	false	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css	false	unknown
https://maliyecezasorgu.org/path/img/favicon-196x196.png	false	unknown
https://a.nel.cloudflare.com/report/v4?s=HYS0nucMAH99aiqLwoc4S6nwZ8aruodZlMExC6xE6%2FLWld3e1wLuFaLlq9kzgLDPspNBwxONprTyveyL73sivzQmvcKhFvtgN7weoVpXe0aQRnCps9Ld2OP%2FDhrFAuvBiewfc%2Fjk	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 05:06:36 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	EADDB1D3A21C3F644B1C2AF687E294C2	70BB6AA37E1191039350E761414D627A1711FB75	E72D03374E8D77C82B21A752B8B05289329342A9FF58F3FAEF496603D5E396CA
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 05:06:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	4AD593DC3A40BBF6CE4E679F8B326F4A	83E5DEC756C71903CC77E7C5B902B994082548E5	B328176D9F626ED810DEFB43F4BA7A9A538F6D44FEAAA8838B4BF82BE732EE4B
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	BD25D7F3CCF1D56C0AA61272F1A6BB97	43A7B28FBF50D7246B104EDD80F99283FD8A39B3	10FEDC282179C4675BA6F64A37E2014A934FF627DDD7CF5D9E526E3FFAC0CD57
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 05:06:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	03124BCBACC4B0C0650D0593EA98F509	1CFAC53EB053735230AC296FBFDBBC6F6D9A3AC8	9030C1928B3E6334B2B43A7B37B3AE84F8BEB24BD64A2F5EC912E04ADA3ECBA9
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 05:06:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	FEA318174A057415A23927A6C777730B	7126A8DA562656F31416FE46F7DAB2153A1A1A4D	359D5B89896274DD026D2083ADE4D1D306F1B519E824DE572480C6EAE7CEE806
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sun Sep 29 05:06:35 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6A4000D9C79EC078DBF4D983C7E97153	D14CF10BD029F65962D326E260FC2FBA1F372F59	B0B5966B3ED08AF784ACBAA26803A514609A0010C33806BEADF55002DBC09AE5
Chrome Cache Entry: 73	ASCII text, with very long lines (65299)	E2B09C06F0E714B6144A6788A28E3950	CE54F85F278FBCD5CB2292F9C186EEDF63CDCF88	D2EA6C1E0CABCA20D18E924B25A1CD0187C38BA7C33F60AB06E1B0402B9BCDB5
Chrome Cache Entry: 74	PNG image data, 490 x 128, 8-bit colormap, interlaced	41519B372A5CA2D953F4F9893BD254E7	FDD6DE81C7F472AD89866D4AD1F5570C2F20D3DB	1A2132F93BBD29CF21FB0417D75C3D9366C63CBCA622D2E14F24EC9B4D2505F3
Chrome Cache Entry: 75	ASCII text, with no line terminators	487D38DF6791206F6A7893487BD7929D	F68A7D59C3D4DC87A4A23F69BC53B97035543B86	9D97CE62231A1F8D9BFF6395F66EFDE39FA49938D7BFF439AABD769EB8448AE4
Chrome Cache Entry: 76	Unicode text, UTF-8 text, with very long lines (65533), with no line terminators	4413E6E8C3A706F35E73F0B0B9458D25	23BC2A869DAAE3D611D84EB2CFF296D33DA9B1F8	4A3D446E4B564336E831876B326BB9E7B1888ECE2526D5210FEA9F25260E664F
Chrome Cache Entry: 77	HTML document, Unicode text, UTF-8 text, with very long lines (1981)	CBB6A4AB5EA0B3584CCE5AD02E7CE379	85A8275CD1E8DD61C21730D951B5DC6FA60C72E8	34006DF3FD03D42D25B075BA07139C29DEC254F60EE79EA073E7B44F4A7E1F91
Chrome Cache Entry: 78	JSON data	D85D85D698F4167ED3D4D62C7E37E324	511D5ED3081CE52027D0C1CE3C6F65ABDDE76A05	F23793F0037EF4421FA170968082BAF9EAF3D5EC064D26172F53DF6F1D1E5C03
Chrome Cache Entry: 79	ASCII text, with very long lines (52276)	5222E06B77A1692FA2520A219840E6BE	8B4236206A8B86AF3761A244277663046D7FF7EE	0934B1FC0D3A766D41D3ADF5E7A115875E66E98EBBA408D965A41CF3D2CB4AB5
Chrome Cache Entry: 80	Web Open Font Format (Version 2), TrueType, length 150020, version 772.1280	D5E647388E2415268B700D3DF2E30A0D	97F0942C6627DDD89FB62170E5CAC9A2CBD6C98C	886C86112A804EF1DDD1CB206AF4C8C40E34B73C26652CA231404AA35A6B30D9
Chrome Cache Entry: 81	PNG image data, 332 x 48, 8-bit/color RGBA, interlaced	EF1E980A4E37FD0DCCAECCF8E1DFB151	DCADDB3C1491D04A8727AFB8428BBFD59360116E	ED4E9BEDD4E75018F23BCA9DD5660F11ECFB45BBB486985FACA51D324B83CD98
Chrome Cache Entry: 82	PNG image data, 490 x 128, 8-bit colormap, interlaced	41519B372A5CA2D953F4F9893BD254E7	FDD6DE81C7F472AD89866D4AD1F5570C2F20D3DB	1A2132F93BBD29CF21FB0417D75C3D9366C63CBCA622D2E14F24EC9B4D2505F3
Chrome Cache Entry: 83	PNG image data, 196 x 196, 8-bit/color RGBA, interlaced	7527E21754F0A10C13F080C7EE0A59E3	28E269850E012E0B754BD72DABFD28589230BA64	EA8F542C812F2A6D2E9F3D9ACFA06044A783C589B268AA3513A35F50C46C4BC0
Chrome Cache Entry: 84	Unicode text, UTF-8 text, with very long lines (65533), with no line terminators	4413E6E8C3A706F35E73F0B0B9458D25	23BC2A869DAAE3D611D84EB2CFF296D33DA9B1F8	4A3D446E4B564336E831876B326BB9E7B1888ECE2526D5210FEA9F25260E664F
Chrome Cache Entry: 85	Unicode text, UTF-8 text, with very long lines (7914), with no line terminators	A36F624CB3B71F17C75785A924FE0A3B	4ADAA7C6C48712A97ED8D5CFA6566E6233214FC7	E36AE23AD2061185E1AFEC83801772DD62209A32B6120F892E9AD0657845C46F
Chrome Cache Entry: 86	Unicode text, UTF-8 text, with no line terminators	8E4440A732C762C50E3388A71F5C81D9	92515DCF9AB19531B9FD1AC1E7D24FE8279EDE9B	9B2AB8F873829D41477544D55A7BD1C4582488F027192BEC5975FF694ED5102D
Chrome Cache Entry: 87	gzip compressed data, from Unix, original size modulo 2^32 17941	558D02B22A648CB092D625DCD4D04F2B	57C398319E11A1C2F62852E2F574AA43CFE61CCF	B9DAF43F099E3589689DD78D01276B822965285B4C7F1F6F524AA1D656E3256A
Chrome Cache Entry: 88	Unicode text, UTF-8 text, with no line terminators	8E4440A732C762C50E3388A71F5C81D9	92515DCF9AB19531B9FD1AC1E7D24FE8279EDE9B	9B2AB8F873829D41477544D55A7BD1C4582488F027192BEC5975FF694ED5102D
Chrome Cache Entry: 89	Unicode text, UTF-8 text, with very long lines (899), with CRLF line terminators	D5F4CB17790065B2A9135EF5DE744AB1	42B83A10A68555744C1B204948BC35F67C140632	DAFDD1DAE7ED4C6D91BD36C1601C5B204B306B16CA4F96005D597BD44DE9BB37
Chrome Cache Entry: 90	gzip compressed data, from Unix, original size modulo 2^32 66550	49C2B17D9F3EBE2E17F611912654893B	1DFC5B8F6FC549F334E4232BAAA7CB9EA9AC7562	07234093CFCB014EF6E7C84C3F34D5627755C87C18160FB65FF5371D34471B18
Chrome Cache Entry: 91	gzip compressed data, from Unix, original size modulo 2^32 66550	49C2B17D9F3EBE2E17F611912654893B	1DFC5B8F6FC549F334E4232BAAA7CB9EA9AC7562	07234093CFCB014EF6E7C84C3F34D5627755C87C18160FB65FF5371D34471B18
Chrome Cache Entry: 92	PNG image data, 196 x 196, 8-bit/color RGBA, interlaced	7527E21754F0A10C13F080C7EE0A59E3	28E269850E012E0B754BD72DABFD28589230BA64	EA8F542C812F2A6D2E9F3D9ACFA06044A783C589B268AA3513A35F50C46C4BC0
Chrome Cache Entry: 93	Unicode text, UTF-8 text, with very long lines (7914), with no line terminators	A36F624CB3B71F17C75785A924FE0A3B	4ADAA7C6C48712A97ED8D5CFA6566E6233214FC7	E36AE23AD2061185E1AFEC83801772DD62209A32B6120F892E9AD0657845C46F
Chrome Cache Entry: 94	ASCII text, with very long lines (65299)	E2B09C06F0E714B6144A6788A28E3950	CE54F85F278FBCD5CB2292F9C186EEDF63CDCF88	D2EA6C1E0CABCA20D18E924B25A1CD0187C38BA7C33F60AB06E1B0402B9BCDB5
Chrome Cache Entry: 95	PNG image data, 165 x 40, 8-bit colormap, interlaced	E9376B824F929EADE9071DFE64A2EBA8	10E446B111A6572F9850DAF937E1828E31C3BD6A	1F4E685C04EF0A07552FD5EAFE0A504110D8439DE7B4CCA98EDEBD7CFF3A5661
Chrome Cache Entry: 96	PNG image data, 165 x 40, 8-bit colormap, interlaced	E9376B824F929EADE9071DFE64A2EBA8	10E446B111A6572F9850DAF937E1828E31C3BD6A	1F4E685C04EF0A07552FD5EAFE0A504110D8439DE7B4CCA98EDEBD7CFF3A5661
Chrome Cache Entry: 97	PNG image data, 332 x 48, 8-bit/color RGBA, interlaced	EF1E980A4E37FD0DCCAECCF8E1DFB151	DCADDB3C1491D04A8727AFB8428BBFD59360116E	ED4E9BEDD4E75018F23BCA9DD5660F11ECFB45BBB486985FACA51D324B83CD98

AV Detection

Antivirus / Scanner detection for submitted sample

Source: https://maliyecezasorgu.org/sorgu

SlashNext: detection malicious, Label: Credential Stealing type: Phishing & Social Engineering

HTML body contains low number of good links

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: Number of links: 0

HTML body contains password input but no form action

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: <input type="password" .../> found but no <form action="...

HTML title does not match URL

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: Title: e-Devlet Kaps does not match URL

Uses Javascript AES encryption / decryption (likely to hide suspicious Javascript code)

Source: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/jquery.jcryption.js

Source: https://maliyecezasorgu.org/sorgu

HTTP Parser: <input type="password" .../> found

Source: https://maliyecezasorgu.org/sorgu	HTTP Parser: No <meta name="copyright".. found
Source: https://maliyecezasorgu.org/sorgu	HTTP Parser: No <meta name="copyright".. found

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49762 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49740 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 36MB

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49762 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /sorgu HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/css/login-main.css HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.4.2/css/all.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://maliyecezasorgu.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/font-awesome/6.4.2/webfonts/fa-solid-900.woff2 HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://maliyecezasorgu.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/fonts/arimo/P5sCzZCDf9_T_10c9C1kiL2t2dkPJA.143.woff2 HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://maliyecezasorgu.orgsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://maliyecezasorgu.org/path/css/login-main.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/common.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/jquery.jcryption.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/edk-giris.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/common_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/login_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://maliyecezasorgu.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/img/edk.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/DDO-logo.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/999.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /CryptoServlet?generateKeyPair=true&pn=%2Fsorgu&ajax=1&token= HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/javascript, /; q=0.01X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /path/img/favicon-196x196.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://maliyecezasorgu.org/sorguAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/edk.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /path/img/DDO-logo.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/edk-giris.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/img/999.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/login_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/common_messages_tr.1.9.4.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/es/jquery.jcryption.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /themes/izmir/js/common.js HTTP/1.1Host: cdn.e-devlet.gov.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /path/img/favicon-196x196.png HTTP/1.1Host: maliyecezasorgu.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: XSRF-TOKEN=eyJpdiI6Ilovbnl3aE1kaURsRDNBU1NJODcxVHc9PSIsInZhbHVlIjoiMmpRNlFjVVdoNWtrM2R6b3lyNHhSRFZDVGRwdnBuSUdyR0dHNTArQ0dMRkVxa2JRYjNiOUVCL083eEpoK3puS0ZrZFcxaHZsQmpRYUFoZFk5cVJPZnJUY1RZTDA0RWVwc2lGNG55dXRQZWlJVlJxZEZNVFRURldlZU5PTUVSTGEiLCJtYWMiOiI1ZjVjODY0YTQ3NDAwNjFmZTQxZjk4ZDA4ZDA0ZTkzZWE5ODliNTY0OTNlODhkODJkOTA4N2E5NGRiYzgyZjFmIiwidGFnIjoiIn0%3D; laravel_session=eyJpdiI6IlJDL2tRQU5VaFpXTWpiRllLaGl0Znc9PSIsInZhbHVlIjoiMzdENEdxUjU2cGJMTEZaQ0ZBS2hpTWxraUVXZ0lkdnQ3bzJuaVc4Mzd4V0lLU2xOcjA3a0ROaFMwcVZlNFBud1QyTEVJS1E5aEFGVTdLa1dLeFlFaXRLOTZHeWlzbmFQUitMNDQyd2FPY3FOUTRaZU1mR1puMEduNGdvUWp3dC8iLCJtYWMiOiIzODZjMTM3ODU3YTYyZGVlMTVkMjc1MjA5NjUzYWRmOTFhOWZlM2UyNzU5YWIwYzMxMDIwOTc0ZGM1MTgwOGQwIiwidGFnIjoiIn0%3D

Source: global traffic	DNS traffic detected: DNS query: maliyecezasorgu.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.jsdelivr.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: cdn.e-devlet.gov.tr

Source: unknown

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 06:06:41 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.3.11Cache-Control: no-cache, privatepragma: no-cacheexpires: -1CF-Cache-Status: BYPASSReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DFLPbXCsIqu5dOaMeX6WF0SQwOHwcB5R75NE7UprpjbKhvAJyikS76bJrEHiXftpBrWnoolowLwVV76LS0u37i8hXQwCR9J4hiiqpDJsfEOue3Y0w%2FJ2B2QtDqVB%2B4LgtaMXqpsx"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8ca9c9e18c4c6a5e-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sun, 29 Sep 2024 06:06:43 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: closex-powered-by: PHP/8.3.11Cache-Control: no-cache, privateCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6crtplpzI4IJ3ZccE3IVpxCDwhyuwMZCuAg%2B1mnq7rFLpm2cChpwkDUlmqCMiUXbGecoLAr6DBZVreXPFKfEIylcl2njAlPxrUUqrNJ6O7OBImR31pt3zOlNkW2GQPiHtvZAhgCa"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8ca9c9ec4b61c34e-EWR

Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/common.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/common_messages_tr.1.9.4.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/edk-giris.1.9.4.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/jquery.jcryption.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.e-devlet.gov.tr/themes/izmir/js/es/login_messages_tr.1.9.4.js
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap
Source: chromecache_77.2.dr	String found in binary or memory: https://cdn.jsdelivr.net/npm/bootstrap-icons
Source: chromecache_77.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css
Source: chromecache_79.2.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_79.2.dr	String found in binary or memory: https://fontawesome.com/license/free
Source: chromecache_73.2.dr, chromecache_94.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: chromecache_73.2.dr, chromecache_94.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: chromecache_73.2.dr, chromecache_94.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49740 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@16/46@18/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2004,i,17148620096188146584,7392402470115323412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://maliyecezasorgu.org/sorgu"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=2004,i,17148620096188146584,7392402470115323412,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1522067
Product:	CloudBasic
Start time:	08:05:42
Start date:	29.09.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://maliyecezasorgu.org/sorgu

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://maliyecezasorgu.org/sorgu

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://maliyecezasorgu.org/sorgu