File name:	2025-06-21_2c539a0eaf3efa5eb539aa18980df80f_elex_mafia
Full analysis:	https://app.any.run/tasks/2b4a4b36-a5e4-40a7-bf53-8bc9c43f12e9
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 01:56:08
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	2C539A0EAF3EFA5EB539AA18980DF80F
SHA1:	28BE984BA8C7C4DA32856FBE2B7816BD900FDEFE
SHA256:	06B41330A6320571F4C52CDEA70498E60811A7319C66AFD42D5B272904645320
SSDEEP:	24576:GEY89WxCAQLXTJ4LtS5Prw8DYzB6MJsSphhHXQi4Yyz:GEY89WxCAQLXTaLtS5Prw8DYzB6MJsSc

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1560	2025-06-21_2c539a0eaf3efa5eb539aa18980df80f_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\6C08.tmp		executable
		MD5:065914A08E771CA77B65553A5861ECCB	SHA256:7766CF2D086E0CD7F663B78B17C651F253E56AEA8D48302B886E3D004391C74A
2276	7000.tmp	C:\Users\admin\AppData\Local\Temp\709C.tmp		executable
		MD5:30679D96E8089B616AC09D1B8DDED8B7	SHA256:5E88FFD014FF5868D505F985EAB242F7064113DEE6E77BAA9D7CB1E285A7EF9D
6380	6E4A.tmp	C:\Users\admin\AppData\Local\Temp\6E98.tmp		executable
		MD5:548DB9F2D083D1D2F82087A353EF89E5	SHA256:DE1BBB40CC6782028767A6BEA91ECEF0420B60DEBC2BB6DDCD713241CF7B31E6
6892	6C08.tmp	C:\Users\admin\AppData\Local\Temp\6C75.tmp		executable
		MD5:FE9583E4466A46E4DA24DC9481CEE5C6	SHA256:146208D53E0F8B07D3D790C485356BBDB1A53D3FF7E8B2832E18C96F53151010
6180	6EF6.tmp	C:\Users\admin\AppData\Local\Temp\6F63.tmp		executable
		MD5:FF8CC5B34444687569715D3DA0646BAC	SHA256:1879668D0192ACB0922AA771941AFE8EB50FFEC4544A94D97BF76BB089945107
516	6CD3.tmp	C:\Users\admin\AppData\Local\Temp\6D31.tmp		executable
		MD5:D60FFDEFEDC95FB89F26F21E6EF5D93E	SHA256:BF65554DFF920EE822D9FE2A82DB4899FD88FF1AB708E9EBC03B1B324CFAD19A
2632	6E98.tmp	C:\Users\admin\AppData\Local\Temp\6EF6.tmp		executable
		MD5:E0EB350C913B4544875AE279573BEACE	SHA256:5293ED07A3DE45CCD5144F507DC114308554FDEF646643F1CBDEBF076FB64783
5020	6C75.tmp	C:\Users\admin\AppData\Local\Temp\6CD3.tmp		executable
		MD5:E681ECAB5D1F7B18AA3EE4677C375EBA	SHA256:EC052C4B7A4BF048C832F0979C1EF4014C9F189E9D7473A30A521E0FB19C79CD
2696	6DEC.tmp	C:\Users\admin\AppData\Local\Temp\6E4A.tmp		executable
		MD5:3ACE95707C2F8EC2A77A8455A8744BBE	SHA256:7C453594B90E9C3DA4A10E0D5890D4E6545C7961083134A43AD9F9F15528C36F
5780	732C.tmp	C:\Users\admin\AppData\Local\Temp\7399.tmp		executable
		MD5:AFBD499CCF49F6C262CDCA072C4AAFEB	SHA256:29E98E7C9342DC6635ADE608814BA51C1F0741AF917ADB7B5CDDA087B1FAC24F

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.53.40.176:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5008	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.53.40.176:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208	whitelisted
google.com	142.250.186.46	whitelisted
crl.microsoft.com	23.53.40.176 23.53.40.178	whitelisted
www.microsoft.com	23.35.229.160	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
self.events.data.microsoft.com	13.89.179.9	whitelisted

General Info

2025-06-21_2c539a0eaf3efa5eb539aa18980df80f_elex_mafia

2C539A0EAF3EFA5EB539AA18980DF80F

28BE984BA8C7C4DA32856FBE2B7816BD900FDEFE

06B41330A6320571F4C52CDEA70498E60811A7319C66AFD42D5B272904645320

24576:GEY89WxCAQLXTJ4LtS5Prw8DYzB6MJsSphhHXQi4Yyz:GEY89WxCAQLXTaLtS5Prw8DYzB6MJsSc

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Executable content was dropped or overwritten

Starts application with an unusual extension

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings