File name:

dive.exe

Full analysis: https://app.any.run/tasks/c7fc13e6-bfd8-402b-ab47-f935b8871090
Verdict: Malicious activity
Analysis date: June 22, 2025, 00:02:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
snojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

FCE3FA5D2B4AAA74507A82E67433B4E3

SHA1:

52378943D25A02BEFC0B1EFE8A91424212A6BC24

SHA256:

3CEBB88691A10231A10EDAD0D84179B48FFD115904F8D23C2448621DF80A069A

SSDEEP:

3072:/3BOxcTRe/bAp4CQoAOUBSgkelKM3pNzmKaSI7yFpceNRckl2yp89FHp5qwar+SO:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SNOJAN has been detected (SURICATA)

      • el.exe (PID: 6684)
      • el.exe (PID: 4380)
      • el.exe (PID: 6700)
      • el.exe (PID: 4892)
      • el.exe (PID: 5808)
      • el.exe (PID: 1296)
      • el.exe (PID: 4412)
      • el.exe (PID: 2076)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • dive.exe (PID: 3752)
      • el.exe (PID: 4412)
      • el.exe (PID: 6684)
      • el.exe (PID: 5616)
      • el.exe (PID: 4380)
      • el.exe (PID: 6212)
      • el.exe (PID: 1296)
      • el.exe (PID: 4892)
      • el.exe (PID: 2076)
      • el.exe (PID: 5808)
      • el.exe (PID: 6700)

  • INFO

    • Disables trace logs

      • dive.exe (PID: 3752)

    • Checks supported languages

      • dive.exe (PID: 3752)
      • el.exe (PID: 4412)
      • el.exe (PID: 5616)
      • el.exe (PID: 6684)
      • el.exe (PID: 1296)
      • el.exe (PID: 4892)
      • el.exe (PID: 5808)
      • el.exe (PID: 6212)
      • el.exe (PID: 2076)
      • el.exe (PID: 6700)
      • el.exe (PID: 4380)

    • Reads Environment values

      • dive.exe (PID: 3752)

    • Checks proxy server information

      • dive.exe (PID: 3752)
      • slui.exe (PID: 7072)

    • Reads the software policy settings

      • dive.exe (PID: 3752)
      • slui.exe (PID: 7072)

    • Reads the machine GUID from the registry

      • dive.exe (PID: 3752)

    • Reads the computer name

      • dive.exe (PID: 3752)
      • el.exe (PID: 4412)
      • el.exe (PID: 6684)
      • el.exe (PID: 5616)
      • el.exe (PID: 2076)
      • el.exe (PID: 4380)
      • el.exe (PID: 6212)
      • el.exe (PID: 4892)
      • el.exe (PID: 5808)
      • el.exe (PID: 1296)
      • el.exe (PID: 6700)

    • Create files in a temporary directory

      • dive.exe (PID: 3752)
      • el.exe (PID: 4412)
      • el.exe (PID: 6684)
      • el.exe (PID: 5616)
      • el.exe (PID: 4892)
      • el.exe (PID: 4380)
      • el.exe (PID: 2076)
      • el.exe (PID: 6212)
      • el.exe (PID: 5808)
      • el.exe (PID: 1296)
      • el.exe (PID: 6700)

    • UPX packer has been detected

      • el.exe (PID: 6684)
      • el.exe (PID: 5616)
      • el.exe (PID: 5808)
      • el.exe (PID: 1296)
      • el.exe (PID: 6212)
      • el.exe (PID: 4892)
      • el.exe (PID: 2076)
      • el.exe (PID: 4380)
      • el.exe (PID: 6700)
      • el.exe (PID: 4412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:21 23:58:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 683008
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2bee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: ConsoleApplication2
FileVersion: 1.0.0.0
InternalName: ConsoleApplication2.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: ConsoleApplication2.exe
ProductName: ConsoleApplication2
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
13
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dive.exe conhost.exe no specs #SNOJAN el.exe #SNOJAN el.exe el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1296"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2076"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3752"C:\Users\admin\AppData\Local\Temp\dive.exe" C:\Users\admin\AppData\Local\Temp\dive.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ConsoleApplication2
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4380"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4412"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4892"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5616"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5808"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6212"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—dive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 990
Read events
3 976
Write events
14
Delete events
0

Modification events

(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
41
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3752dive.exeC:\Users\admin\AppData\Local\Temp\el.exeexecutable
MD5:21C970E3442CB4F8F06E57F1D0E9A86B
SHA256:215CADF63ED1F6689265DB0069DF84D39859730E4608C345784864122CB12A7D
6212el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-GipCtkDcpyp5tVIy.exeexecutable
MD5:DB110857BEC3586848D1BDFA658948EF
SHA256:106657F68DEB326CCE7CCADF9D7F60ADEFCA11E531B988B44D7832037055FAB5
4892el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-k8pXSJMlfek86r6c.exeexecutable
MD5:92A37846B678B1A7CBE09CB320199F69
SHA256:4F8A5D3993006B1E931F8AB2524D399B7D0A44A4FF3F4093C0E3B99735CF129D
6700el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-MNRQBy4fWKxCv4iu.exeexecutable
MD5:6E03DE9B44BCA4BBF059B7BC5A153C75
SHA256:199C715AD4BA6F0FCFCA64084310ED795183864E28869105FBA56A33C8476429
1296el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-nSMUATKONyLhnW2m.exeexecutable
MD5:7F3C1219525527C871E808BD4643011C
SHA256:BC6A8348ADDE7F6A1DBE73D939E04BC7AF423D0B41B090C4EBE4350AD2785FFC
4892el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-IhAwad4NTNGlcnIr.exeexecutable
MD5:0A84FE0ABB90BD1E4D4261DFF6CF0C4B
SHA256:569703142452C19DC6916F9B5F6DA6CF6929715ADF23D4320F111CC452FCADBD
5808el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-SnkMuXzBli9cG7N7.exeexecutable
MD5:E07F7DCA8B7BA0EA28848808F8F77CF8
SHA256:5F0195A7A00647D23DDD30FA26ED0E4AE05EBD95392F43A3D1DC45EC1C4EF094
6212el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-AOW90KrlGIdnqEIk.exeexecutable
MD5:91EC78D82D08489318CD581312176B56
SHA256:953648CA41D5FFD9BFF23D16EA293E67AE5FBCE12E7CA2B0F8249DCF11D65742
1296el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-jkALfuA0F0MrCTJv.exeexecutable
MD5:983EC6FF0F7FA536ACE597EC87AB78CF
SHA256:B501762187AF4382CD61FDEF66C26CAAAC524517429E46B1BD2B0F35D9149533
4380el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-WH6ZNpOfVD4oXNO2.exeexecutable
MD5:47EC5900CC22F93565AB6A62C382356F
SHA256:F6A400B8CAE4870E6AF3B2E44C420CC79AEF45E693D69EEF3E8904243A4AF991
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
62
DNS requests
18
Threats
80

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2668
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
724
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
724
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2664
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3752
dive.exe
104.26.3.158:443
computernewb.com
CLOUDFLARENET
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2668
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2668
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.142
whitelisted
computernewb.com
  • 104.26.3.158
  • 104.26.2.158
  • 172.67.74.244
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.140
  • 20.190.160.2
  • 20.190.160.132
  • 20.190.160.130
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dive.exe