Windows Analysis Report
http://bitopluluk.com.tr/

Overview

General Information

Sample URL: http://bitopluluk.com.tr/
Analysis ID: 1541592
Tags: urlscan
Infos:

Detection

Score: 1
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected non-DNS traffic on DNS port
Stores files to the Windows start menu directory
Uses insecure TLS / SSL version for HTTPS connection

Classification

Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.42:443 -> 192.168.2.11:49731 version: TLS 1.0
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.11:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.11:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.11:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.11:58793 version: TLS 1.2
Detected non-DNS traffic on DNS port
Source: global traffic TCP traffic: 192.168.2.11:58780 -> 1.1.1.1:53
Source: global traffic TCP traffic: 192.168.2.11:53341 -> 1.1.1.1:53
Uses insecure TLS / SSL version for HTTPS connection
Source: unknown HTTPS traffic detected: 173.222.162.42:443 -> 192.168.2.11:49731 version: TLS 1.0
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: global traffic HTTP traffic detected: GET / HTTP/1.1Host: bitopluluk.com.trConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic HTTP traffic detected: GET /css.php?css=public%3Anormalize.css%2Cpublic%3Afa.css%2Cpublic%3Avariations.less%2Cpublic%3Acore.less%2Cpublic%3Aapp.less&s=2&l=3&d=1725621669&k=8a38a786ef7f9637d045426c8453ece34dc5a218 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /css.php?css=public%3ACMTV_Badges.less%2Cpublic%3Anode_list.less%2Cpublic%3Ashare_controls.less%2Cpublic%3Astructured_list.less%2Cpublic%3Atb_hizli_arama.less%2Cpublic%3Axgt_forum_istatistik.less%2Cpublic%3Aextra.less&s=2&l=3&d=1725621669&k=235a687d201a9ff7b2ab4529dfbb5a60551f9c88 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /js/xf/preamble.min.js?_v=c431ca1c HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /js/xf/preamble.min.js?_v=c431ca1c HTTP/1.1Host: bitopluluk.com.trConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: */*Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YU5vawyek4RKHyv&MD=LxZynKAU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic HTTP traffic detected: GET /js/vendor/vendor-compiled.js?_v=c431ca1c HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /js/xf/core-compiled.js?_v=c431ca1c HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /data/local/icons/regular.svg?v=1725621669 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: imageReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /data/local/icons/light.svg?v=1725621669 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: imageReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /data/local/icons/solid.svg?v=1725621669 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: imageReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /data/local/icons/brands.svg?v=1725621669 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: imageReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /login/ HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://bitopluluk.com.tr/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r
Source: global traffic HTTP traffic detected: GET /css.php?css=public%3Anormalize.css%2Cpublic%3Afa.css%2Cpublic%3Avariations.less%2Cpublic%3Acore.less%2Cpublic%3Aapp.less&s=2&l=3&d=1725621669&k=8a38a786ef7f9637d045426c8453ece34dc5a218 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://bitopluluk.com.tr/login/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r; xf_session=pqQwkuagmDBhRAcdTP6v4SkS0zLt6PyA
Source: global traffic HTTP traffic detected: GET /css.php?css=public%3ACMTV_Badges.less%2Cpublic%3Ashare_controls.less%2Cpublic%3Astructured_list.less%2Cpublic%3Atb_hizli_arama.less%2Cpublic%3Aextra.less&s=2&l=3&d=1725621669&k=7409d0a36a9d6f25e5c0de7b64772a6707bce829 HTTP/1.1Host: bitopluluk.com.trConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,*/*;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://bitopluluk.com.tr/login/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: xf_csrf=iNrmuDglvRnoZP9r; xf_session=pqQwkuagmDBhRAcdTP6v4SkS0zLt6PyA
Source: global traffic HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=YU5vawyek4RKHyv&MD=LxZynKAU HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: chromecache_128.2.dr String found in binary or memory: <a class="shareButtons-button shareButtons-button--brand shareButtons-button--facebook" href="#_xfUid-1-1729809273" data-href="https://www.facebook.com/sharer.php?u={url}"> equals www.facebook.com (Facebook)
Source: chromecache_126.2.dr String found in binary or memory: <a class="shareButtons-button shareButtons-button--brand shareButtons-button--facebook" href="#_xfUid-3-1729809321" data-href="https://www.facebook.com/sharer.php?u={url}"> equals www.facebook.com (Facebook)
Source: chromecache_128.2.dr String found in binary or memory: <a class="shareButtons-button shareButtons-button--brand shareButtons-button--facebook" href="#_xfUid-4-1729809273" data-href="https://www.facebook.com/sharer.php?u={url}"> equals www.facebook.com (Facebook)
Source: chromecache_128.2.dr String found in binary or memory: <a class="shareButtons-button shareButtons-button--brand shareButtons-button--linkedin" href="#_xfUid-1-1729809273" data-href="https://www.linkedin.com/sharing/share-offsite/?url={url}"> equals www.linkedin.com (Linkedin)
Source: chromecache_126.2.dr String found in binary or memory: <a class="shareButtons-button shareButtons-button--brand shareButtons-button--linkedin" href="#_xfUid-3-1729809321" data-href="https://www.linkedin.com/sharing/share-offsite/?url={url}"> equals www.linkedin.com (Linkedin)
Source: chromecache_128.2.dr String found in binary or memory: <a class="shareButtons-button shareButtons-button--brand shareButtons-button--linkedin" href="#_xfUid-4-1729809273" data-href="https://www.linkedin.com/sharing/share-offsite/?url={url}"> equals www.linkedin.com (Linkedin)
Source: global traffic DNS traffic detected: DNS query: bitopluluk.com.tr
Source: global traffic DNS traffic detected: DNS query: www.google.com
Source: global traffic DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: unknown HTTP traffic detected: POST /report/v4?s=PUtDCfzjU8Lki1p0u5qfaiRMAiz4e7CcdFO8VBvrRyjSh9Ftef9m2NloWG0YymxgHHO1ecVEFmv5XAjSVcDUKwG0y1ku3bwaLLnSfAaEVT4PeTSeVx3%2BO0cgKm0Q8bYVm02ZXw%3D%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 421Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: chromecache_128.2.dr String found in binary or memory: http://schema.org/Person
Source: chromecache_128.2.dr String found in binary or memory: https://api.whatsapp.com/send?text=
Source: chromecache_128.2.dr String found in binary or memory: https://bitopluluk.com.tr
Source: chromecache_128.2.dr String found in binary or memory: https://bitopluluk.com.tr/
Source: chromecache_128.2.dr String found in binary or memory: https://bitopluluk.com.tr/arama/search?keywords=
Source: chromecache_126.2.dr, chromecache_128.2.dr String found in binary or memory: https://bitopluluk.com.tr/data/assets/logo/_67b851cb-3943-49da-9a54-0221b673569f.jpeg
Source: chromecache_126.2.dr String found in binary or memory: https://bitopluluk.com.tr/login/
Source: chromecache_126.2.dr, chromecache_128.2.dr String found in binary or memory: https://bitopluluk.com.tr/styles/default/xenforo/bell.png
Source: chromecache_126.2.dr, chromecache_128.2.dr String found in binary or memory: https://fonts.googleapis.com/css2?family=Jost:wght
Source: chromecache_126.2.dr, chromecache_128.2.dr String found in binary or memory: https://fonts.gstatic.com
Source: chromecache_125.2.dr String found in binary or memory: https://fonts.gstatic.com/s/jost/v18/92zatBhPNqw73oDd4iYl.woff2)
Source: chromecache_125.2.dr String found in binary or memory: https://fonts.gstatic.com/s/jost/v18/92zatBhPNqw73oTd4g.woff2)
Source: chromecache_125.2.dr String found in binary or memory: https://fonts.gstatic.com/s/jost/v18/92zatBhPNqw73ord4iYl.woff2)
Source: chromecache_128.2.dr String found in binary or memory: https://pinterest.com/pin/create/bookmarklet/?url=
Source: chromecache_128.2.dr String found in binary or memory: https://reddit.com/submit?url=
Source: chromecache_128.2.dr String found in binary or memory: https://schema.org
Source: chromecache_126.2.dr String found in binary or memory: https://schema.org/BreadcrumbList
Source: chromecache_126.2.dr String found in binary or memory: https://schema.org/ListItem
Source: chromecache_126.2.dr, chromecache_128.2.dr String found in binary or memory: https://siberup.com.tr
Source: chromecache_128.2.dr String found in binary or memory: https://twitter.com/intent/tweet?url=
Source: chromecache_126.2.dr, chromecache_128.2.dr String found in binary or memory: https://www.google.com/chrome/
Source: chromecache_128.2.dr String found in binary or memory: https://www.linkedin.com/sharing/share-offsite/?url=
Source: chromecache_128.2.dr String found in binary or memory: https://www.tumblr.com/widgets/share/tool?canonicalUrl=
Source: chromecache_126.2.dr, chromecache_128.2.dr String found in binary or memory: https://xenforo.com
Source: unknown Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58786 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58782 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58784
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58783
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58786
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58785
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58782
Source: unknown Network traffic detected: HTTP traffic on port 58792 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58789 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58785 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58788
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58787
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58789
Source: unknown Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58795
Source: unknown Network traffic detected: HTTP traffic on port 58795 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58791
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58790
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58793
Source: unknown Network traffic detected: HTTP traffic on port 58791 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 58792
Source: unknown Network traffic detected: HTTP traffic on port 58788 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown Network traffic detected: HTTP traffic on port 58784 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58790 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58787 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58783 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 58793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.11:49723 version: TLS 1.2
Source: unknown HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.11:49724 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.11:49725 version: TLS 1.2
Source: unknown HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.11:58793 version: TLS 1.2
Source: classification engine Classification label: clean1.win@22/14@10/6
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2236,i,17664272902337260405,6308631327659289975,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://bitopluluk.com.tr/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 --field-trial-handle=2236,i,17664272902337260405,6308631327659289975,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe Process created: unknown unknown Jump to behavior
Source: Google Drive.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Stores files to the Windows start menu directory
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 process2 2 Behavior Graph ID: 1541592 URL: http://bitopluluk.com.tr/ Startdate: 25/10/2024 Architecture: WINDOWS Score: 1 5 chrome.exe 9 2->5         started        8 chrome.exe 2->8         started        dnsIp3 13 192.168.2.11, 138, 443, 49704 unknown unknown 5->13 15 239.255.255.250 unknown Reserved 5->15 10 chrome.exe 5->10         started        process4 dnsIp5 17 www.google.com 172.217.18.4, 443, 49712, 58795 GOOGLEUS United States 10->17 19 a.nel.cloudflare.com 35.190.80.1, 443, 58782, 58783 GOOGLEUS United States 10->19 21 2 other IPs or domains 10->21
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.217.18.4
 www.google.com United States
15169 GOOGLEUS false
239.255.255.250
 unknown Reserved
unknown unknown false
188.114.97.3
 bitopluluk.com.tr European Union
13335 CLOUDFLARENETUS false
188.114.96.3
 unknown European Union
13335 CLOUDFLARENETUS false
35.190.80.1
 a.nel.cloudflare.com United States
15169 GOOGLEUS false

Private

IP
192.168.2.11

Contacted Domains

Name IP Active
a.nel.cloudflare.com 35.190.80.1 true
bitopluluk.com.tr 188.114.97.3 true
www.google.com 172.217.18.4 true
fp2e7a.wpc.phicdn.net 192.229.221.95 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
https://bitopluluk.com.tr/js/vendor/vendor-compiled.js?_v=c431ca1c false
    		unknown
    https://a.nel.cloudflare.com/report/v4?s=PUtDCfzjU8Lki1p0u5qfaiRMAiz4e7CcdFO8VBvrRyjSh9Ftef9m2NloWG0YymxgHHO1ecVEFmv5XAjSVcDUKwG0y1ku3bwaLLnSfAaEVT4PeTSeVx3%2BO0cgKm0Q8bYVm02ZXw%3D%3D false
      		unknown
      https://bitopluluk.com.tr/data/local/icons/regular.svg?v=1725621669 false
        		unknown
        https://bitopluluk.com.tr/data/local/icons/brands.svg?v=1725621669 false
          		unknown
          https://bitopluluk.com.tr/ false
            		unknown
            https://bitopluluk.com.tr/css.php?css=public%3ACMTV_Badges.less%2Cpublic%3Ashare_controls.less%2Cpublic%3Astructured_list.less%2Cpublic%3Atb_hizli_arama.less%2Cpublic%3Aextra.less&s=2&l=3&d=1725621669&k=7409d0a36a9d6f25e5c0de7b64772a6707bce829 false
              		unknown
              https://bitopluluk.com.tr/js/xf/preamble.min.js?_v=c431ca1c false
                		unknown
                https://bitopluluk.com.tr/login/ false
                  		unknown
                  https://bitopluluk.com.tr/css.php?css=public%3ACMTV_Badges.less%2Cpublic%3Anode_list.less%2Cpublic%3Ashare_controls.less%2Cpublic%3Astructured_list.less%2Cpublic%3Atb_hizli_arama.less%2Cpublic%3Axgt_forum_istatistik.less%2Cpublic%3Aextra.less&s=2&l=3&d=1725621669&k=235a687d201a9ff7b2ab4529dfbb5a60551f9c88 false
                    		unknown
                    https://bitopluluk.com.tr/data/local/icons/solid.svg?v=1725621669 false
                      		unknown
                      https://bitopluluk.com.tr/data/local/icons/light.svg?v=1725621669 false
                        		unknown
                        https://bitopluluk.com.tr/css.php?css=public%3Anormalize.css%2Cpublic%3Afa.css%2Cpublic%3Avariations.less%2Cpublic%3Acore.less%2Cpublic%3Aapp.less&s=2&l=3&d=1725621669&k=8a38a786ef7f9637d045426c8453ece34dc5a218 false
                          		unknown
                          https://bitopluluk.com.tr/js/xf/core-compiled.js?_v=c431ca1c false
                            		unknown