File name:

dive.exe

Full analysis: https://app.any.run/tasks/b88d5c33-3bc4-4283-a150-0c3cdab6d99b
Verdict: Malicious activity
Analysis date: June 22, 2025, 00:03:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
snojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

FCE3FA5D2B4AAA74507A82E67433B4E3

SHA1:

52378943D25A02BEFC0B1EFE8A91424212A6BC24

SHA256:

3CEBB88691A10231A10EDAD0D84179B48FFD115904F8D23C2448621DF80A069A

SSDEEP:

3072:/3BOxcTRe/bAp4CQoAOUBSgkelKM3pNzmKaSI7yFpceNRckl2yp89FHp5qwar+SO:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SNOJAN has been detected (SURICATA)

      • el.exe (PID: 6124)
      • el.exe (PID: 6016)
      • el.exe (PID: 4232)
      • el.exe (PID: 6980)
      • el.exe (PID: 6772)
      • el.exe (PID: 4888)
      • el.exe (PID: 6260)
      • el.exe (PID: 1232)
      • el.exe (PID: 3844)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • dive.exe (PID: 2044)
      • el.exe (PID: 6124)
      • el.exe (PID: 6016)
      • el.exe (PID: 3844)
      • el.exe (PID: 4232)
      • el.exe (PID: 6980)
      • el.exe (PID: 6172)
      • el.exe (PID: 4888)
      • el.exe (PID: 1232)
      • el.exe (PID: 6772)
      • el.exe (PID: 6260)

  • INFO

    • Reads the computer name

      • dive.exe (PID: 2044)
      • el.exe (PID: 4888)
      • el.exe (PID: 6016)
      • el.exe (PID: 3844)
      • el.exe (PID: 6980)
      • el.exe (PID: 4232)
      • el.exe (PID: 1232)
      • el.exe (PID: 6124)
      • el.exe (PID: 6772)
      • el.exe (PID: 6172)
      • el.exe (PID: 6260)

    • Checks supported languages

      • dive.exe (PID: 2044)
      • el.exe (PID: 4232)
      • el.exe (PID: 6172)
      • el.exe (PID: 6124)
      • el.exe (PID: 1232)
      • el.exe (PID: 6260)
      • el.exe (PID: 4888)
      • el.exe (PID: 6016)
      • el.exe (PID: 6772)
      • el.exe (PID: 3844)
      • el.exe (PID: 6980)

    • Disables trace logs

      • dive.exe (PID: 2044)

    • Reads the software policy settings

      • dive.exe (PID: 2044)
      • slui.exe (PID: 4172)

    • Checks proxy server information

      • dive.exe (PID: 2044)
      • slui.exe (PID: 4172)

    • Reads the machine GUID from the registry

      • dive.exe (PID: 2044)

    • Reads Environment values

      • dive.exe (PID: 2044)

    • Create files in a temporary directory

      • dive.exe (PID: 2044)
      • el.exe (PID: 6980)
      • el.exe (PID: 6260)
      • el.exe (PID: 6124)
      • el.exe (PID: 3844)
      • el.exe (PID: 6172)
      • el.exe (PID: 6016)
      • el.exe (PID: 4888)
      • el.exe (PID: 4232)
      • el.exe (PID: 6772)
      • el.exe (PID: 1232)

    • UPX packer has been detected

      • el.exe (PID: 4232)
      • el.exe (PID: 6124)
      • el.exe (PID: 6260)
      • el.exe (PID: 4888)
      • el.exe (PID: 6772)
      • el.exe (PID: 1232)
      • el.exe (PID: 6980)
      • el.exe (PID: 6172)
      • el.exe (PID: 6016)
      • el.exe (PID: 3844)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:21 23:58:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 683008
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2bee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: ConsoleApplication2
FileVersion: 1.0.0.0
InternalName: ConsoleApplication2.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: ConsoleApplication2.exe
ProductName: ConsoleApplication2
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
15
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dive.exe conhost.exe no specs #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe slui.exe ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1232"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2044"C:\Users\admin\AppData\Local\Temp\dive.exe" C:\Users\admin\AppData\Local\Temp\dive.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ConsoleApplication2
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3584"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3844"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4172C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4232"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4676\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—dive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4888"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6016"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6124"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
4 024
Read events
4 010
Write events
14
Delete events
0

Modification events

(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2044) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
93
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2044dive.exeC:\Users\admin\AppData\Local\Temp\el.exeexecutable
MD5:21C970E3442CB4F8F06E57F1D0E9A86B
SHA256:215CADF63ED1F6689265DB0069DF84D39859730E4608C345784864122CB12A7D
6172el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-iTqvk4TYGuAd3Bjx.exeexecutable
MD5:2DBECD99119982A759A90D590811888A
SHA256:E78E7391E7967DACE8C302B8B70C11DB58D26FCF63E18C5835A63C1530AA2F23
4888el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-mnffdyGq84KQU2vn.exeexecutable
MD5:496D798695BC6A2AB5AC8A265CD30304
SHA256:516390E5D748A4D4E09539EE9B2FBA29155869E1EC9E5F772384A6E83E638DD1
4232el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-2tVL7RnmZfbzvuz5.exeexecutable
MD5:326AE26C49463B8313282A2D5BBE78E4
SHA256:DFA1EA17141114233D282DCFC14D0BC87DAE9751A266F8E7E0EF8D7FA8567CD4
6124el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-LllTO8RXh9ricWK2.exeexecutable
MD5:2FC96A7BA32CF42B94E34AA155869B01
SHA256:AB5D872C13C65ECE7969D5DA91274A2DFAEE1E273282638191F20291B52DA710
1232el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-scU2V4e3glL5AWmF.exeexecutable
MD5:0BB15E37F5360755C15F9990C171BB73
SHA256:A6F04A0AC0C7B1586818CADF944A325E4C3A520B3689AB0E9FED8C358D7F6A7B
4888el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-k49w15OUD6h5ldJA.exeexecutable
MD5:D3215DC904EA3B2A73EC8A8C52F9A44F
SHA256:F05C940E36894ED1EBBD2D8F461AF85F3F3B4C01A4CBD5B5FCF0C05935A194FB
4232el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-6l1wA40IQPQQksSd.exeexecutable
MD5:9F1E774743535314E4C604BDF42ADBB9
SHA256:EDCF13CBD1C6959422BF1AB397614CD4B56A8634A981A022983F327BC6DCC995
6124el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-bjpx1Y2JmCRuqdVa.exeexecutable
MD5:62400F5218EEA7A70E10E098DB059C8F
SHA256:EBC517345A2F3016E8938E7B4B5EF5F6382CA36DC8AD98BEFD9F797B60F9ED48
6772el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-nIlxTB6Svv2DcA32.exeexecutable
MD5:C525620F33EA845391447318837D2492
SHA256:755571C4882AC3F0F29A6A964C3ED2B1720EAB5FFB068FFAFC9F7AEC7E88F191
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
135
DNS requests
26
Threats
184

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1352
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1352
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2596
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7052
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5556
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
472
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2044
dive.exe
104.26.2.158:443
computernewb.com
CLOUDFLARENET
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 142.250.186.110
whitelisted
computernewb.com
  • 104.26.2.158
  • 172.67.74.244
  • 104.26.3.158
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
wecan.hasthe.technology
  • 104.21.59.199
  • 172.67.183.40
malicious
login.live.com
  • 40.126.31.73
  • 40.126.31.128
  • 40.126.31.131
  • 40.126.31.129
  • 20.190.159.68
  • 20.190.159.131
  • 20.190.159.4
  • 40.126.31.0
  • 20.190.160.132
  • 20.190.160.14
  • 40.126.32.74
  • 20.190.160.128
  • 20.190.160.67
  • 20.190.160.17
  • 40.126.32.136
  • 20.190.160.131
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted

Threats

PID
Process
Class
Message
6124
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
6124
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
6124
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
6124
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
6124
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
6124
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
6124
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
6124
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
6124
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
6124
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dive.exe