File name:

DHL Shipment CDE Awb 7213976346.exe

Full analysis: https://app.any.run/tasks/37cff143-e96f-44ed-8152-e636648854fa
Verdict: Malicious activity
Analysis date: September 11, 2025, 07:03:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

556E30114BC7AA48E41C38B172570E49

SHA1:

91D2376F4A119E1857F4186B61C7A05118FC62E9

SHA256:

CF347CAB91CE92ECB2550184E8F369BD9F13490E73B1676F0B97247B58CD449A

SSDEEP:

24576:mNZzhjWHydDmfKVfwzUHCqC0F6m2qjxF651:mnVjWHydDqKVfwzUHCqC0F6m/jxF651

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

    • Starts POWERSHELL.EXE for commands execution

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

    • There is functionality for taking screenshot (YARA)

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

  • INFO

    • Checks supported languages

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

    • Create files in a temporary directory

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

    • Reads the computer name

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3760)

    • Process checks computer location settings

      • DHL Shipment CDE Awb 7213976346.exe (PID: 2320)

    • Checks proxy server information

      • slui.exe (PID: 4024)

    • Reads the software policy settings

      • slui.exe (PID: 4024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:08:01 02:44:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 162816
UninitializedDataSize: 1024
EntryPoint: 0x3348
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
4
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dhl shipment cde awb 7213976346.exe no specs powershell.exe no specs conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2320"C:\Users\admin\AppData\Local\Temp\DHL Shipment CDE Awb 7213976346.exe" C:\Users\admin\AppData\Local\Temp\DHL Shipment CDE Awb 7213976346.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\dhl shipment cde awb 7213976346.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3760"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "AZZ ZZ ZZZ ZZZ .Z Z ZZ ZZ ZZ ZZZZ ZZ Z222 22222222.22222C:\Users\admin\AppData\Local\Temp\nonchangeableness\Sidewinder.Ove';$lictorian=$Pepsinated.SubString(52034,3); .$lictorian($Pepsinated)"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—DHL Shipment CDE Awb 7213976346.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4024C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6004\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 313
Read events
5 021
Write events
292
Delete events
0

Modification events

(PID) Process:(2320) DHL Shipment CDE Awb 7213976346.exeKey:HKEY_CURRENT_USER\samariterkursus\decaesarize\Eksekverbar
Operation:writeName:predeparture
Value:
FFC920B2
(PID) Process:(2320) DHL Shipment CDE Awb 7213976346.exeKey:HKEY_CURRENT_USER\Nasch\Uninstall\Delegeretmde\tricarpellary
Operation:writeName:lauder
Value:
0
Executable files
0
Suspicious files
8
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
2320DHL Shipment CDE Awb 7213976346.exeC:\Users\admin\AppData\Local\Temp\nonchangeableness\Sidewinder.Ovetext
MD5:917D8E9EEFF524B8678E2620A26FDFB7
SHA256:CAFB46A6DF2F4DDD288A53074FBE9BA3D870103FE9C86690BC74609690FA0999
3760powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IWEQ0R5XWATUJUNLV7U5.tempbinary
MD5:C3E88B5BB380E4D4562F8502A505E8D9
SHA256:DE55EEB3E918EA7CA9892196A1FD30582DB512B1AC4E92D028569D44EEC8C8B9
2320DHL Shipment CDE Awb 7213976346.exeC:\Users\admin\AppData\Local\Temp\nonchangeableness\renderers.dipbinary
MD5:1CDD3D3052AF1B719BA8FB75C0214550
SHA256:A3932E3AE6019EF00C84277D1E8211FBECFF7C39CD1E9D9DE16BF2338542E112
2320DHL Shipment CDE Awb 7213976346.exeC:\Users\admin\AppData\Local\Temp\nonchangeableness\exophthalmic.udsbinary
MD5:6A8AC9F80988E729C5250E1960174E1D
SHA256:8612EA5F37D083DF20E3FC31585BDEFD3FF5F843F66A6AE790C4912FCFB9F0F7
3760powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_vphmyl2t.vmt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3760powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ak2mabki.pig.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3760powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msbinary
MD5:C3E88B5BB380E4D4562F8502A505E8D9
SHA256:DE55EEB3E918EA7CA9892196A1FD30582DB512B1AC4E92D028569D44EEC8C8B9
2320DHL Shipment CDE Awb 7213976346.exeC:\Users\admin\AppData\Local\Temp\nonchangeableness\Legemshjdernes.Svebinary
MD5:0A385B7B4B16457766CD1EE517933DC9
SHA256:0D0614B518AC7055E42979896B079F00BCB59476CFF3D25C1AE56F0C9CBBE283
2320DHL Shipment CDE Awb 7213976346.exeC:\Users\admin\AppData\Local\Temp\nonchangeableness\liturgy.snibinary
MD5:B31F77A7A6512F47459707E7C1F24BC7
SHA256:1E422126F269FAC49C8957BEB80D93E96249D427D0A6FB4A47FB530BA4F2FE08
3760powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:C25384F68340327861D890D37EA7C457
SHA256:5E667002ADF932AAC99F0041C06085401D953F1EB128A9B25550ECBAD7712336
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
26
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.20:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1872
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.3.109.48:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3624
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3624
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2288
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1872
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1872
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.216.77.20:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 216.58.212.174
whitelisted
login.live.com
  • 40.126.31.130
  • 20.190.159.68
  • 40.126.31.128
  • 20.190.159.73
  • 20.190.159.129
  • 40.126.31.69
  • 20.190.159.130
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 23.216.77.20
  • 23.216.77.19
  • 23.216.77.28
  • 23.216.77.29
  • 23.216.77.37
  • 23.216.77.25
  • 23.216.77.32
  • 23.216.77.33
  • 23.216.77.22
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
slscr.update.microsoft.com
  • 74.179.77.204
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
self.events.data.microsoft.com
  • 20.42.72.131
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DHL Shipment CDE Awb 7213976346.exe