File name:

DHLDeliveryNotification-Scheduledfor19thMay.exe

Full analysis: https://app.any.run/tasks/ff37a371-15db-40ce-a8a1-960ab0d8f69a
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 06:48:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
stealer
evasion
ultravnc
rmm-tool
auto-reg
netreactor
agenttesla
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

3618ECCED03FAA136AAFD2EAB8998C7F

SHA1:

ED45CDD9E242BD7FDAAFC61F8637C404920B44F9

SHA256:

98F027A2BABD99ADFB7ED9F4AAF8309BADA26DE5823C5BACCE3FFCB979039463

SSDEEP:

49152:xRnuBD7tSq0QcNj+NM2bm5JcxboHf2ZIfDdLc3LVd4Z/c5GdgCB2hgvRzpg5fVBX:3uBftSXNj+NM2bm5JcxboHf2ZCDdLc3w

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 5596)

    • AGENTTESLA has been detected (YARA)

      • RegSvcs.exe (PID: 5596)

    • Changes the autorun value in the registry

      • RegSvcs.exe (PID: 5596)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 5596)

    • Create files in the Startup directory

      • underbalance.exe (PID: 976)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)
      • RegSvcs.exe (PID: 5596)

    • Application launched itself

      • underbalance.exe (PID: 976)

    • Starts itself from another location

      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)

    • Potential Corporate Privacy Violation

      • RegSvcs.exe (PID: 5596)

    • Process drops legitimate windows executable

      • RegSvcs.exe (PID: 5596)

    • Checks for external IP

      • RegSvcs.exe (PID: 5596)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5256)

    • Connects to FTP

      • RegSvcs.exe (PID: 5596)

  • INFO

    • Reads the machine GUID from the registry

      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)
      • RegSvcs.exe (PID: 4452)
      • RegSvcs.exe (PID: 5596)

    • Create files in a temporary directory

      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)
      • underbalance.exe (PID: 976)
      • underbalance.exe (PID: 5164)
      • underbalance.exe (PID: 4164)

    • Reads mouse settings

      • underbalance.exe (PID: 976)
      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)
      • underbalance.exe (PID: 4164)
      • underbalance.exe (PID: 5164)

    • Creates files or folders in the user directory

      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)
      • underbalance.exe (PID: 976)
      • RegSvcs.exe (PID: 5596)

    • Checks supported languages

      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)
      • underbalance.exe (PID: 976)
      • underbalance.exe (PID: 5164)
      • RegSvcs.exe (PID: 4452)
      • underbalance.exe (PID: 4164)
      • RegSvcs.exe (PID: 5596)
      • sgxIb.exe (PID: 6944)

    • The sample compiled with english language support

      • DHLDeliveryNotification-Scheduledfor19thMay.exe (PID: 1196)
      • RegSvcs.exe (PID: 5596)

    • Auto-launch of the file from Startup directory

      • underbalance.exe (PID: 976)

    • Reads the computer name

      • RegSvcs.exe (PID: 4452)
      • RegSvcs.exe (PID: 5596)
      • sgxIb.exe (PID: 6944)

    • Manual execution by a user

      • wscript.exe (PID: 5256)
      • sgxIb.exe (PID: 6944)

    • Disables trace logs

      • RegSvcs.exe (PID: 5596)

    • Checks proxy server information

      • RegSvcs.exe (PID: 5596)
      • slui.exe (PID: 2852)

    • Reads the software policy settings

      • RegSvcs.exe (PID: 5596)
      • slui.exe (PID: 2852)

    • ULTRAVNC has been detected

      • RegSvcs.exe (PID: 5596)

    • .NET Reactor protector has been detected

      • RegSvcs.exe (PID: 5596)

    • Auto-launch of the file from Registry key

      • RegSvcs.exe (PID: 5596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:15 23:57:55+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 570880
InitializedDataSize: 612352
UninitializedDataSize: -
EntryPoint: 0x25f74
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
135
Monitored processes
11
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dhldeliverynotification-scheduledfor19thmay.exe underbalance.exe regsvcs.exe no specs underbalance.exe no specs regsvcs.exe no specs wscript.exe no specs underbalance.exe no specs #AGENTTESLA regsvcs.exe sgxib.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
976"C:\Users\admin\Desktop\DHLDeliveryNotification-Scheduledfor19thMay.exe" C:\Users\admin\AppData\Local\savagenesses\underbalance.exe
DHLDeliveryNotification-Scheduledfor19thMay.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\savagenesses\underbalance.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1196"C:\Users\admin\Desktop\DHLDeliveryNotification-Scheduledfor19thMay.exe" C:\Users\admin\Desktop\DHLDeliveryNotification-Scheduledfor19thMay.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\dhldeliverynotification-scheduledfor19thmay.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
2852C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4164"C:\Users\admin\AppData\Local\savagenesses\underbalance.exe" C:\Users\admin\AppData\Local\savagenesses\underbalance.exe—wscript.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\savagenesses\underbalance.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
4452"C:\Users\admin\AppData\Local\savagenesses\underbalance.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—underbalance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
4608"C:\Users\admin\Desktop\DHLDeliveryNotification-Scheduledfor19thMay.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—underbalance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5164"C:\Users\admin\AppData\Local\savagenesses\underbalance.exe"C:\Users\admin\AppData\Local\savagenesses\underbalance.exe—underbalance.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\savagenesses\underbalance.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
5256wscript "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\underbalance.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5596"C:\Users\admin\AppData\Local\savagenesses\underbalance.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
underbalance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
5868\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sgxIb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
8 045
Read events
8 029
Write events
16
Delete events
0

Modification events

(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5596) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
1196DHLDeliveryNotification-Scheduledfor19thMay.exeC:\Users\admin\AppData\Local\savagenesses\underbalance.exeexecutable
MD5:3618ECCED03FAA136AAFD2EAB8998C7F
SHA256:98F027A2BABD99ADFB7ED9F4AAF8309BADA26DE5823C5BACCE3FFCB979039463
976underbalance.exeC:\Users\admin\AppData\Local\Temp\autC7D6.tmpbinary
MD5:BB96C13908B1B558A140A7EBB358B69C
SHA256:B12544FA5914E2E542E29A609399B8B6C7D9565F6F8A73668936E92DFC1B88B3
1196DHLDeliveryNotification-Scheduledfor19thMay.exeC:\Users\admin\AppData\Local\Temp\autC44C.tmpbinary
MD5:BB96C13908B1B558A140A7EBB358B69C
SHA256:B12544FA5914E2E542E29A609399B8B6C7D9565F6F8A73668936E92DFC1B88B3
1196DHLDeliveryNotification-Scheduledfor19thMay.exeC:\Users\admin\AppData\Local\Temp\preinheredbinary
MD5:BB96C13908B1B558A140A7EBB358B69C
SHA256:B12544FA5914E2E542E29A609399B8B6C7D9565F6F8A73668936E92DFC1B88B3
4164underbalance.exeC:\Users\admin\AppData\Local\Temp\autD5A1.tmpbinary
MD5:BB96C13908B1B558A140A7EBB358B69C
SHA256:B12544FA5914E2E542E29A609399B8B6C7D9565F6F8A73668936E92DFC1B88B3
5596RegSvcs.exeC:\Users\admin\AppData\Roaming\sgxIb\sgxIb.exeexecutable
MD5:6279D136310C22894F605938B4CB93D8
SHA256:FB7D514B3322810463655473D2D7C704D3405C1C9DD81F0D4D423518EF416987
5164underbalance.exeC:\Users\admin\AppData\Local\Temp\autCB51.tmpbinary
MD5:BB96C13908B1B558A140A7EBB358B69C
SHA256:B12544FA5914E2E542E29A609399B8B6C7D9565F6F8A73668936E92DFC1B88B3
976underbalance.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\underbalance.vbsbinary
MD5:0E57643963B23D86E582319F0B760A0E
SHA256:BD0EBDB9DEC4835615D0B8197D0FC142911CA5823678CDE2E28C242402ECC449
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
52
DNS requests
19
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.3
  • 40.126.32.76
  • 20.190.160.131
  • 40.126.32.74
  • 20.190.160.17
  • 40.126.32.133
  • 40.126.32.140
whitelisted
api.ipify.org
  • 172.67.74.152
  • 104.26.13.205
  • 104.26.12.205
shared
ftp.haliza.com.my
  • 110.4.45.197
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
5596
RegSvcs.exe
Potential Corporate Privacy Violation
ET INFO Possible IP Check api.ipify.org
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
5596
RegSvcs.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup api.ipify.org
—
—
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DHLDeliveryNotification-Scheduledfor19thMay.exe