URL:

https://www.nriz.sepa.gov.rs/TeamsRegistrationPortal/WebLogin.aspx

Full analysis: https://app.any.run/tasks/106fa3c9-f08a-44c8-af5b-257aa4d7f278
Verdict: Malicious activity
Analysis date: February 20, 2024, 11:24:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5AE673F18D357B5463161B0CBA781D89

SHA1:

0E78BA7680D02F90050DEC5CEDE3FDFF39FCCE89

SHA256:

B5A133F1A77A36FEF52F81FB7B493422CA0917C3006BB5AE4F3F02E07E4088A3

SSDEEP:

3:N8DSLjMi2ILX9nMWXBQyREJUin:2OLXjavCgUin

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Silverlight_x32.exe (PID: 2904)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3700)
      • Silverlight_x32.exe (PID: 2904)
      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

    • Executable content was dropped or overwritten

      • Silverlight_x32.exe (PID: 2904)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 1696)

    • Reads the Internet Settings

      • install.exe (PID: 3404)
      • microsoft_defaults.exe (PID: 3680)

    • Reads security settings of Internet Explorer

      • install.exe (PID: 3404)
      • microsoft_defaults.exe (PID: 3680)

    • Uses RUNDLL32.EXE to load library

      • install.exe (PID: 3404)

  • INFO

    • The process uses the downloaded file

      • iexplore.exe (PID: 3700)

    • Application launched itself

      • iexplore.exe (PID: 3700)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3700)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3700)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3700)

    • Checks supported languages

      • Silverlight_x32.exe (PID: 2904)
      • install.exe (PID: 3404)
      • microsoft_defaults.exe (PID: 3680)
      • coregen.exe (PID: 3260)
      • Silverlight.Configuration.exe (PID: 2656)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

    • Reads the computer name

      • Silverlight_x32.exe (PID: 2904)
      • install.exe (PID: 3404)
      • microsoft_defaults.exe (PID: 3680)
      • Silverlight.Configuration.exe (PID: 2656)

    • Reads Environment values

      • Silverlight_x32.exe (PID: 2904)

    • Reads the machine GUID from the registry

      • Silverlight_x32.exe (PID: 2904)
      • microsoft_defaults.exe (PID: 3680)
      • install.exe (PID: 3404)
      • coregen.exe (PID: 3260)
      • Silverlight.Configuration.exe (PID: 2656)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

    • Create files in a temporary directory

      • install.exe (PID: 3404)

    • Checks proxy server information

      • microsoft_defaults.exe (PID: 3680)

    • Creates files in the program directory

      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
84
Monitored processes
24
Malicious processes
3
Suspicious processes
16

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe silverlight_x32.exe install.exe no specs install.exe microsoft_defaults.exe rundll32.exe no specs coregen.exe agcp.exe no specs silverlight.configuration.exe no specs coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Windows.Xna.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1696"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Windows.Browser.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1808c:\872824aa0f1236021f8dc0befb025b8d\install.exeC:\872824aa0f1236021f8dc0befb025b8d\install.exe—Silverlight_x32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
External Installer
Exit code:
3221226540
Version:
VER_DOTPRODUCTVERSION
Modules
Images
c:\872824aa0f1236021f8dc0befb025b8d\install.exe
c:\windows\system32\ntdll.dll
1932"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" Microsoft.Xna.Framework.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2032"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.ServiceModel.Web.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2380"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Runtime.Serialization.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2424"C:\Windows\System32\rundll32.exe" "C:\Program Files\Microsoft Silverlight\5.1.50918.0\SLMSPRBootstrap.dll",SetupPlayReadyDataC:\Windows\System32\rundll32.exe—install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2492"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Xml.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2656"C:\Program Files\Microsoft Silverlight\5.1.50918.0\silverlight.configuration.exe" -enableUpdaterC:\Program Files\Microsoft Silverlight\5.1.50918.0\Silverlight.Configuration.exe—install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Silverlight Configuration Utility
Exit code:
2147943458
Version:
5.1.50918.0
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\silverlight.configuration.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2904"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Silverlight_x32.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Silverlight_x32.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Self-Extracting Cabinet
Exit code:
0
Version:
5.1.50918.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\silverlight_x32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
27 084
Read events
26 854
Write events
175
Delete events
55

Modification events

(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31089647
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31089647
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
22
Suspicious files
9
Text files
19
Unknown types
5

Dropped files

PID
Process
Filename
Type
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\WebResource[1].jstext
MD5:B3D7A123BE5203A1A3F0F10233ED373F
SHA256:EF9453F74B2617D43DCEF4242CF5845101FCFB57289C81BCEB20042B0023A192
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\zastava_logo[1].pngimage
MD5:F54D0F3216A2BC179DF7C0BBD7A80A14
SHA256:44A2E69B1F96F500A4C9B3EF4CB7CDE9E11B0B29CB6F510759B28BE1AF27F642
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\WebResource[1].jstext
MD5:90EA7274F19755002360945D54C2A0D7
SHA256:40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:37EB041B977831004A5CE5F22B0C530B
SHA256:A218D69F5B7FEA7C83F49CC623E029F6FEA5C3C94CE11ACCB28C317C4698C95A
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\Silverlight[1].jstext
MD5:C10FB0E83E7CA41F885C26EA8B03BC87
SHA256:FF4B8F068A7D5965FB215120968BE883B69333B9DBD62C4149F441B872B381AD
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\DownloadSilverlight[1].htmhtml
MD5:BC5E8579BEF535C171A5AC2DE47CD12A
SHA256:E194A21A49EF50765A34B221D140A97A7C99568A206F586BAA2C92743A3165C0
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\InstallSilverlight[1].pngimage
MD5:39808CC46BC8D34E2BCF98148157CC32
SHA256:65BCE17118E6BB50903EFC35D5681A1DB4542B4774187AF11C58B13B9D8D85D0
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2920
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
2920
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3700
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
2920
iexplore.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3700
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b23edf5cfbe16fd7
unknown
—
—
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
23.32.238.193:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?624d1ab720bef5f8
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2920
iexplore.exe
77.46.150.211:443
www.nriz.sepa.gov.rs
TELEKOM SRBIJA a.d.
RS
unknown
2920
iexplore.exe
23.32.238.208:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2920
iexplore.exe
23.192.153.142:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown
3700
iexplore.exe
77.46.150.211:443
www.nriz.sepa.gov.rs
TELEKOM SRBIJA a.d.
RS
unknown
3700
iexplore.exe
23.32.238.208:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3700
iexplore.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
unknown
3700
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.nriz.sepa.gov.rs
  • 77.46.150.211
unknown
ctldl.windowsupdate.com
  • 23.32.238.208
  • 23.32.238.224
  • 23.32.238.200
  • 23.32.238.201
  • 23.32.238.218
  • 23.32.238.226
  • 23.32.238.216
  • 23.32.238.209
  • 23.32.238.217
  • 23.32.238.193
  • 23.32.238.234
  • 23.32.238.227
  • 23.32.238.225
whitelisted
x1.c.lencr.org
  • 23.192.153.142
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.130
  • 104.126.37.171
  • 104.126.37.128
  • 104.126.37.136
  • 104.126.37.169
  • 104.126.37.184
  • 104.126.37.131
  • 104.126.37.178
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
g.msn.com
  • 68.219.88.225
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.nriz.sepa.gov.rs/TeamsRegistrationPortal/WebLogin.aspx