File name:

dive.exe

Full analysis: https://app.any.run/tasks/c7fc13e6-bfd8-402b-ab47-f935b8871090
Verdict: Malicious activity
Analysis date: June 22, 2025, 00:02:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
snojan
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

FCE3FA5D2B4AAA74507A82E67433B4E3

SHA1:

52378943D25A02BEFC0B1EFE8A91424212A6BC24

SHA256:

3CEBB88691A10231A10EDAD0D84179B48FFD115904F8D23C2448621DF80A069A

SSDEEP:

3072:/3BOxcTRe/bAp4CQoAOUBSgkelKM3pNzmKaSI7yFpceNRckl2yp89FHp5qwar+SO:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SNOJAN has been detected (SURICATA)

      • el.exe (PID: 6700)
      • el.exe (PID: 5808)
      • el.exe (PID: 4380)
      • el.exe (PID: 4892)
      • el.exe (PID: 1296)
      • el.exe (PID: 4412)
      • el.exe (PID: 6684)
      • el.exe (PID: 2076)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • dive.exe (PID: 3752)
      • el.exe (PID: 4412)
      • el.exe (PID: 6684)
      • el.exe (PID: 5616)
      • el.exe (PID: 4380)
      • el.exe (PID: 4892)
      • el.exe (PID: 6212)
      • el.exe (PID: 5808)
      • el.exe (PID: 1296)
      • el.exe (PID: 6700)
      • el.exe (PID: 2076)

  • INFO

    • Reads the machine GUID from the registry

      • dive.exe (PID: 3752)

    • Checks supported languages

      • dive.exe (PID: 3752)
      • el.exe (PID: 4412)
      • el.exe (PID: 5616)
      • el.exe (PID: 6684)
      • el.exe (PID: 1296)
      • el.exe (PID: 4892)
      • el.exe (PID: 6212)
      • el.exe (PID: 5808)
      • el.exe (PID: 2076)
      • el.exe (PID: 6700)
      • el.exe (PID: 4380)

    • Disables trace logs

      • dive.exe (PID: 3752)

    • Checks proxy server information

      • dive.exe (PID: 3752)
      • slui.exe (PID: 7072)

    • Reads the software policy settings

      • dive.exe (PID: 3752)
      • slui.exe (PID: 7072)

    • Reads the computer name

      • dive.exe (PID: 3752)
      • el.exe (PID: 5616)
      • el.exe (PID: 6684)
      • el.exe (PID: 4412)
      • el.exe (PID: 5808)
      • el.exe (PID: 4380)
      • el.exe (PID: 6212)
      • el.exe (PID: 2076)
      • el.exe (PID: 4892)
      • el.exe (PID: 1296)
      • el.exe (PID: 6700)

    • Reads Environment values

      • dive.exe (PID: 3752)

    • Create files in a temporary directory

      • dive.exe (PID: 3752)
      • el.exe (PID: 6684)
      • el.exe (PID: 4412)
      • el.exe (PID: 5616)
      • el.exe (PID: 6212)
      • el.exe (PID: 4892)
      • el.exe (PID: 2076)
      • el.exe (PID: 4380)
      • el.exe (PID: 5808)
      • el.exe (PID: 1296)
      • el.exe (PID: 6700)

    • UPX packer has been detected

      • el.exe (PID: 6684)
      • el.exe (PID: 4412)
      • el.exe (PID: 1296)
      • el.exe (PID: 5808)
      • el.exe (PID: 4892)
      • el.exe (PID: 6212)
      • el.exe (PID: 6700)
      • el.exe (PID: 4380)
      • el.exe (PID: 5616)
      • el.exe (PID: 2076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:21 23:58:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 683008
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x2bee
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: ConsoleApplication2
FileVersion: 1.0.0.0
InternalName: ConsoleApplication2.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: ConsoleApplication2.exe
ProductName: ConsoleApplication2
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
13
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dive.exe conhost.exe no specs #SNOJAN el.exe #SNOJAN el.exe el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe el.exe #SNOJAN el.exe #SNOJAN el.exe #SNOJAN el.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1296"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2076"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
3752"C:\Users\admin\AppData\Local\Temp\dive.exe" C:\Users\admin\AppData\Local\Temp\dive.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
ConsoleApplication2
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dive.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4380"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4412"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4892"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5616"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
5808"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6212"el.exe"C:\Users\admin\AppData\Local\Temp\el.exe
dive.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\el.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—dive.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 990
Read events
3 976
Write events
14
Delete events
0

Modification events

(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3752) dive.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dive_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
41
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3752dive.exeC:\Users\admin\AppData\Local\Temp\el.exeexecutable
MD5:21C970E3442CB4F8F06E57F1D0E9A86B
SHA256:215CADF63ED1F6689265DB0069DF84D39859730E4608C345784864122CB12A7D
2076el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-BteRe3N3fHZtJC2I.exeexecutable
MD5:5363456ABAEC56C79EB6D8455C067115
SHA256:2300DAFAC190293034130BF49038D34C975996BCB5BAED4812BC25A20F3C7AE2
4892el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-k8pXSJMlfek86r6c.exeexecutable
MD5:92A37846B678B1A7CBE09CB320199F69
SHA256:4F8A5D3993006B1E931F8AB2524D399B7D0A44A4FF3F4093C0E3B99735CF129D
5808el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-FBgP2O4OY90F3mdY.exeexecutable
MD5:2DF4A1EFB2C0D27D43767B16C1AFBE42
SHA256:F61589F30A7E4EFD1020DD3350479D50775F5EA04812A938CD9D4BA25B75685D
4892el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-IhAwad4NTNGlcnIr.exeexecutable
MD5:0A84FE0ABB90BD1E4D4261DFF6CF0C4B
SHA256:569703142452C19DC6916F9B5F6DA6CF6929715ADF23D4320F111CC452FCADBD
5616el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-hU2A8tQWtc95z40U.exeexecutable
MD5:27A9FC453F9656E3CBAB987DA3E5413D
SHA256:41F3D56FE00FC4818FE0D81BF0E5A4E7E0D1A88EFDC217E01061BFD662EC76D1
5616el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-TUidzmWyf6urmvRH.exeexecutable
MD5:B551E7A89D33501F34C22A5CEDA6E5D5
SHA256:CAD588C9358E8DF01CDED904D8654B1F8E5FF72EAB0230AB079452FA96A52A81
6684el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-0miGoTzkXCqDn1hT.exeexecutable
MD5:599CC669511E4BF66825E7AF700B7A12
SHA256:653C7ADB71FCBE91829A1E97494F8B5A3E11E8F2A6CC58EA6FE98A1EBAD7E2D3
5808el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-SnkMuXzBli9cG7N7.exeexecutable
MD5:E07F7DCA8B7BA0EA28848808F8F77CF8
SHA256:5F0195A7A00647D23DDD30FA26ED0E4AE05EBD95392F43A3D1DC45EC1C4EF094
6684el.exeC:\Users\admin\AppData\Local\Temp\rifaien2-V9SP7t1quwza2dPi.exeexecutable
MD5:ABF80FA33755825F02A98FCDAB292012
SHA256:7D59A0FABC5D23E61B4516B19CAC53F1ADF46EFADC9B779FDF357BC0E386CCC4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
62
DNS requests
18
Threats
80

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2668
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
724
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
724
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2664
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3752
dive.exe
104.26.3.158:443
computernewb.com
CLOUDFLARENET
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2668
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2668
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.142
whitelisted
computernewb.com
  • 104.26.3.158
  • 104.26.2.158
  • 172.67.74.244
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.140
  • 20.190.160.2
  • 20.190.160.132
  • 20.190.160.130
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
4412
el.exe
Misc activity
ET INFO Generic HTTP EXE Upload Outbound
4412
el.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Snojan malware uploading .exe
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dive.exe