URL:

https://www.nriz.sepa.gov.rs/TeamsRegistrationPortal/WebLogin.aspx

Full analysis: https://app.any.run/tasks/106fa3c9-f08a-44c8-af5b-257aa4d7f278
Verdict: Malicious activity
Analysis date: February 20, 2024, 11:24:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5AE673F18D357B5463161B0CBA781D89

SHA1:

0E78BA7680D02F90050DEC5CEDE3FDFF39FCCE89

SHA256:

B5A133F1A77A36FEF52F81FB7B493422CA0917C3006BB5AE4F3F02E07E4088A3

SSDEEP:

3:N8DSLjMi2ILX9nMWXBQyREJUin:2OLXjavCgUin

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Silverlight_x32.exe (PID: 2904)
      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3700)
      • Silverlight_x32.exe (PID: 2904)
      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

    • Executable content was dropped or overwritten

      • Silverlight_x32.exe (PID: 2904)
      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

    • Reads the Internet Settings

      • install.exe (PID: 3404)
      • microsoft_defaults.exe (PID: 3680)

    • Reads security settings of Internet Explorer

      • microsoft_defaults.exe (PID: 3680)
      • install.exe (PID: 3404)

    • Uses RUNDLL32.EXE to load library

      • install.exe (PID: 3404)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3700)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3700)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3700)

    • Checks supported languages

      • Silverlight_x32.exe (PID: 2904)
      • install.exe (PID: 3404)
      • microsoft_defaults.exe (PID: 3680)
      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 4084)
      • Silverlight.Configuration.exe (PID: 2656)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2920)
      • iexplore.exe (PID: 3700)

    • Reads the computer name

      • Silverlight_x32.exe (PID: 2904)
      • install.exe (PID: 3404)
      • microsoft_defaults.exe (PID: 3680)
      • Silverlight.Configuration.exe (PID: 2656)

    • Reads the machine GUID from the registry

      • Silverlight_x32.exe (PID: 2904)
      • microsoft_defaults.exe (PID: 3680)
      • install.exe (PID: 3404)
      • coregen.exe (PID: 3260)
      • Silverlight.Configuration.exe (PID: 2656)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3700)

    • Reads Environment values

      • Silverlight_x32.exe (PID: 2904)

    • Create files in a temporary directory

      • install.exe (PID: 3404)

    • Checks proxy server information

      • microsoft_defaults.exe (PID: 3680)

    • Creates files in the program directory

      • coregen.exe (PID: 3260)
      • coregen.exe (PID: 4084)
      • coregen.exe (PID: 3792)
      • coregen.exe (PID: 3456)
      • coregen.exe (PID: 2380)
      • coregen.exe (PID: 2032)
      • coregen.exe (PID: 1932)
      • coregen.exe (PID: 2492)
      • coregen.exe (PID: 3584)
      • coregen.exe (PID: 3320)
      • coregen.exe (PID: 3636)
      • coregen.exe (PID: 292)
      • coregen.exe (PID: 3300)
      • coregen.exe (PID: 3348)
      • coregen.exe (PID: 1696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
84
Monitored processes
24
Malicious processes
3
Suspicious processes
16

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe silverlight_x32.exe install.exe no specs install.exe microsoft_defaults.exe rundll32.exe no specs coregen.exe agcp.exe no specs silverlight.configuration.exe no specs coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe coregen.exe

Process information

PID
CMD
Path
Indicators
Parent process
292"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Windows.Xna.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1696"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Windows.Browser.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1808c:\872824aa0f1236021f8dc0befb025b8d\install.exeC:\872824aa0f1236021f8dc0befb025b8d\install.exe—Silverlight_x32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
External Installer
Exit code:
3221226540
Version:
VER_DOTPRODUCTVERSION
Modules
Images
c:\872824aa0f1236021f8dc0befb025b8d\install.exe
c:\windows\system32\ntdll.dll
1932"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" Microsoft.Xna.Framework.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2032"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.ServiceModel.Web.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2380"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Runtime.Serialization.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2424"C:\Windows\System32\rundll32.exe" "C:\Program Files\Microsoft Silverlight\5.1.50918.0\SLMSPRBootstrap.dll",SetupPlayReadyDataC:\Windows\System32\rundll32.exe—install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
2492"C:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe" System.Xml.dllC:\Program Files\Microsoft Silverlight\5.1.50918.0\coregen.exe
install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
5.1.50918.0 built by: SL_V5_SVC
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\coregen.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft silverlight\5.1.50918.0\coreclr.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2656"C:\Program Files\Microsoft Silverlight\5.1.50918.0\silverlight.configuration.exe" -enableUpdaterC:\Program Files\Microsoft Silverlight\5.1.50918.0\Silverlight.Configuration.exe—install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Silverlight Configuration Utility
Exit code:
2147943458
Version:
5.1.50918.0
Modules
Images
c:\program files\microsoft silverlight\5.1.50918.0\silverlight.configuration.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2904"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Silverlight_x32.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\Silverlight_x32.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Self-Extracting Cabinet
Exit code:
0
Version:
5.1.50918.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\silverlight_x32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
27 084
Read events
26 854
Write events
175
Delete events
55

Modification events

(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31089647
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31089647
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3700) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
22
Suspicious files
9
Text files
19
Unknown types
5

Dropped files

PID
Process
Filename
Type
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\WebLogin[1].htmhtml
MD5:B641018839E5E5D5F895F7D4EA9F5E93
SHA256:4FACF96425F22A75692A6F9EEC73CCDD67561F0EFA1BACA689D9621CD7428583
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:37EB041B977831004A5CE5F22B0C530B
SHA256:A218D69F5B7FEA7C83F49CC623E029F6FEA5C3C94CE11ACCB28C317C4698C95A
3700iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751der
MD5:822467B728B7A66B081C91795373789A
SHA256:AF2343382B88335EEA72251AD84949E244FF54B6995063E24459A7216E9576B9
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YTOWV792\WebResource[1].jstext
MD5:B3D7A123BE5203A1A3F0F10233ED373F
SHA256:EF9453F74B2617D43DCEF4242CF5845101FCFB57289C81BCEB20042B0023A192
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\Sponzori[1].pngimage
MD5:E6463B932F4CD66EDE3D56E805111A04
SHA256:EBBD0C25DEC4A9A48770D9BDA9AE6CB35AFC4624E79E22366FA0674E9A23FDC4
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\WebResource[1].jstext
MD5:90EA7274F19755002360945D54C2A0D7
SHA256:40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
3700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:6A38D1DC35006AF835BE0358D10947DF
SHA256:726572A5C1A8ADDA8D4A80794C42A80FB3CAA345AEA71D0B189CDEE3910902CC
3700iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\TeamsSR[1].htmhtml
MD5:B5890AD7DB05A8211FD59575E37267AE
SHA256:AD5BC351225EB803B111A81478482D375439D3C6B062D6E1F2747CDBBC7C38B9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2920
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
2920
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3700
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?76ad697231f9b13b
unknown
—
—
unknown
2920
iexplore.exe
GET
200
23.192.153.142:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3700
iexplore.exe
GET
304
23.32.238.208:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b23edf5cfbe16fd7
unknown
—
—
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
312 b
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
1080
svchost.exe
GET
200
23.32.238.193:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?624d1ab720bef5f8
unknown
compressed
65.2 Kb
unknown
3700
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAxq6XzO1ZmDhpCgCp6lMhQ%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2920
iexplore.exe
77.46.150.211:443
www.nriz.sepa.gov.rs
TELEKOM SRBIJA a.d.
RS
unknown
2920
iexplore.exe
23.32.238.208:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
2920
iexplore.exe
23.192.153.142:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown
3700
iexplore.exe
77.46.150.211:443
www.nriz.sepa.gov.rs
TELEKOM SRBIJA a.d.
RS
unknown
3700
iexplore.exe
23.32.238.208:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3700
iexplore.exe
104.126.37.186:443
www.bing.com
Akamai International B.V.
DE
unknown
3700
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
www.nriz.sepa.gov.rs
  • 77.46.150.211
unknown
ctldl.windowsupdate.com
  • 23.32.238.208
  • 23.32.238.224
  • 23.32.238.200
  • 23.32.238.201
  • 23.32.238.218
  • 23.32.238.226
  • 23.32.238.216
  • 23.32.238.209
  • 23.32.238.217
  • 23.32.238.193
  • 23.32.238.234
  • 23.32.238.227
  • 23.32.238.225
whitelisted
x1.c.lencr.org
  • 23.192.153.142
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 104.126.37.186
  • 104.126.37.130
  • 104.126.37.171
  • 104.126.37.128
  • 104.126.37.136
  • 104.126.37.169
  • 104.126.37.184
  • 104.126.37.131
  • 104.126.37.178
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
g.msn.com
  • 68.219.88.225
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.nriz.sepa.gov.rs/TeamsRegistrationPortal/WebLogin.aspx