File name:	2025-06-21_2c539a0eaf3efa5eb539aa18980df80f_elex_mafia
Full analysis:	https://app.any.run/tasks/2b4a4b36-a5e4-40a7-bf53-8bc9c43f12e9
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 01:56:08
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	2C539A0EAF3EFA5EB539AA18980DF80F
SHA1:	28BE984BA8C7C4DA32856FBE2B7816BD900FDEFE
SHA256:	06B41330A6320571F4C52CDEA70498E60811A7319C66AFD42D5B272904645320
SSDEEP:	24576:GEY89WxCAQLXTJ4LtS5Prw8DYzB6MJsSphhHXQi4Yyz:GEY89WxCAQLXTaLtS5Prw8DYzB6MJsSc

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1044	6D31.tmp	C:\Users\admin\AppData\Local\Temp\6D8F.tmp		executable
		MD5:12E618CB04D21FEAC3D7F50326452538	SHA256:9B89DA32BA94790D7A7E7D8CE34575D4276133D9E398BC3893978D583CA3664E
516	6CD3.tmp	C:\Users\admin\AppData\Local\Temp\6D31.tmp		executable
		MD5:D60FFDEFEDC95FB89F26F21E6EF5D93E	SHA256:BF65554DFF920EE822D9FE2A82DB4899FD88FF1AB708E9EBC03B1B324CFAD19A
2696	6DEC.tmp	C:\Users\admin\AppData\Local\Temp\6E4A.tmp		executable
		MD5:3ACE95707C2F8EC2A77A8455A8744BBE	SHA256:7C453594B90E9C3DA4A10E0D5890D4E6545C7961083134A43AD9F9F15528C36F
6652	6D8F.tmp	C:\Users\admin\AppData\Local\Temp\6DEC.tmp		executable
		MD5:87826DA51A7F869484E477987DF3ABC8	SHA256:526E76AC853CB400FECC9EE47370DC93B387907C1E05F5E751A8F1E5FDCE08A5
6380	6E4A.tmp	C:\Users\admin\AppData\Local\Temp\6E98.tmp		executable
		MD5:548DB9F2D083D1D2F82087A353EF89E5	SHA256:DE1BBB40CC6782028767A6BEA91ECEF0420B60DEBC2BB6DDCD713241CF7B31E6
1560	2025-06-21_2c539a0eaf3efa5eb539aa18980df80f_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\6C08.tmp		executable
		MD5:065914A08E771CA77B65553A5861ECCB	SHA256:7766CF2D086E0CD7F663B78B17C651F253E56AEA8D48302B886E3D004391C74A
6892	6C08.tmp	C:\Users\admin\AppData\Local\Temp\6C75.tmp		executable
		MD5:FE9583E4466A46E4DA24DC9481CEE5C6	SHA256:146208D53E0F8B07D3D790C485356BBDB1A53D3FF7E8B2832E18C96F53151010
6232	70FA.tmp	C:\Users\admin\AppData\Local\Temp\7167.tmp		executable
		MD5:3C32263EFA35B2F194B047C0D2376FE6	SHA256:0E4B17726D529CEDE2C9D294726B2E2BD1DD8C855722DB2AF98EBCE71A603310
4832	7167.tmp	C:\Users\admin\AppData\Local\Temp\71C5.tmp		executable
		MD5:829279A08882C5680744825099C1C587	SHA256:093E37FA5FD8DF90CEC3626C579603D64AAC03576F7930AF3164D758684A9DE4
5244	709C.tmp	C:\Users\admin\AppData\Local\Temp\70FA.tmp		executable
		MD5:9846569B69B6003BC171C2684C897816	SHA256:054D825D4838978734B8004A8F9B079189153CBEBE675E7F29F1D165B64234D3

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.53.40.176:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5008	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.53.40.176:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208	whitelisted
google.com	142.250.186.46	whitelisted
crl.microsoft.com	23.53.40.176 23.53.40.178	whitelisted
www.microsoft.com	23.35.229.160	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
self.events.data.microsoft.com	13.89.179.9	whitelisted

General Info

2025-06-21_2c539a0eaf3efa5eb539aa18980df80f_elex_mafia

2C539A0EAF3EFA5EB539AA18980DF80F

28BE984BA8C7C4DA32856FBE2B7816BD900FDEFE

06B41330A6320571F4C52CDEA70498E60811A7319C66AFD42D5B272904645320

24576:GEY89WxCAQLXTJ4LtS5Prw8DYzB6MJsSphhHXQi4Yyz:GEY89WxCAQLXTaLtS5Prw8DYzB6MJsSc

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings