File name:	2025-07-06_11d3d150864fe3865755039dc2cb7805_elex_mafia
Full analysis:	https://app.any.run/tasks/bc028bf5-63a4-491b-accf-637783233782
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 00:55:03
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	11D3D150864FE3865755039DC2CB7805
SHA1:	FF3A697B75DF55FA7F11819EDA5D5CF582E02E41
SHA256:	119358BF26E1769664B332DA14E7F6FB74472F78B4CA934F0325B790FD6A240D
SSDEEP:	24576:cbY7DncC6xIIAlo6DBczvJMKHFQYo/yz:cbY7DncC6xILlo6DBczvJMKHFQYo/yz

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4024	5C68.tmp	C:\Users\admin\AppData\Local\Temp\5CB6.tmp		executable
		MD5:BAA7333A913883FD5FDC64AE7F558F0C	SHA256:26AD7E4C845F4FD1421B5C984990D1BE063085750EB91DB8232FAE41E56C3F28
4456	5D62.tmp	C:\Users\admin\AppData\Local\Temp\5DB0.tmp		executable
		MD5:981C6EDEFA8492A39E694AAE9C38B75C	SHA256:74634B3C5E19EE081CDF0B5B738A6E9DA82DA6963E530584D2C800CCFFD54553
6652	5BAC.tmp	C:\Users\admin\AppData\Local\Temp\5C0A.tmp		executable
		MD5:BD44F54719B81BB2E65BA188AA8E99F5	SHA256:04809F2F2D1FB7A976E516C7B408B27A83839E3EC0E271CA7AC53A00C0841EBD
3540	2025-07-06_11d3d150864fe3865755039dc2cb7805_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\5BAC.tmp		executable
		MD5:139A77094B1D3613A36DC62BF3FD9D30	SHA256:B3184E364EA28A53E1D291D37A5AAE565A3FEA97786571BCD196572D153E4E81
2040	5C0A.tmp	C:\Users\admin\AppData\Local\Temp\5C68.tmp		executable
		MD5:B44DBE8601965AC391F3713DBEDB322C	SHA256:0F3044A2F42E01FF0268531903CFC8447599C0FFC73BFD4C580FDAEBF0AA06A0
6528	5CB6.tmp	C:\Users\admin\AppData\Local\Temp\5D14.tmp		executable
		MD5:E05CCDD4226B4BFA5B85361A5DFE37AB	SHA256:B656EFE6FF4F94E60E34EA8235E1CFBCC7CCDF3671344EFCA11DDC1E3A8F1CB1
984	5D14.tmp	C:\Users\admin\AppData\Local\Temp\5D62.tmp		executable
		MD5:49DE9FFE004C060B05256DE9056586AE	SHA256:7E4682293D29EAEFF0C9D9C7D6BC68DBE79C7FD4DD342C953F429946EA20F677
4960	5E1D.tmp	C:\Users\admin\AppData\Local\Temp\5E9A.tmp		executable
		MD5:D20025194720394A8D5A8ED503617A33	SHA256:CDEA870B296C954DE5C7EC2D315C9D4F995E9AC93BFB3E6D304624EF4F10F66E
3924	5E9A.tmp	C:\Users\admin\AppData\Local\Temp\5EF8.tmp		executable
		MD5:57FDA46317AE579026FF3BBB15F6848D	SHA256:46D3FC40DB140B466CCBDF3357FD4D7AC822EEE8DE4CA0CA107E72879B364988
6256	5DB0.tmp	C:\Users\admin\AppData\Local\Temp\5E1D.tmp		executable
		MD5:75881915647E4CF7ABB90F6FB4D331AB	SHA256:FE6BA46A85CAE001E66DD7FD1D75F96D03F36FD73BA8A1895F5E3248CCAD904D

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	2.20.245.136:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
6404	RUXIMICS.exe	GET	200	2.20.245.136:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
6404	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.20.245.136:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	US	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	US	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6404	RUXIMICS.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	4.231.128.59:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	2.20.245.136:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	2.20.245.136:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
6404	RUXIMICS.exe	2.20.245.136:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
google.com	142.250.186.174	whitelisted
crl.microsoft.com	2.20.245.136 2.20.245.139	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
settings-win.data.microsoft.com	20.73.194.208	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	52.182.143.209	whitelisted

General Info

2025-07-06_11d3d150864fe3865755039dc2cb7805_elex_mafia

11D3D150864FE3865755039DC2CB7805

FF3A697B75DF55FA7F11819EDA5D5CF582E02E41

119358BF26E1769664B332DA14E7F6FB74472F78B4CA934F0325B790FD6A240D

24576:cbY7DncC6xIIAlo6DBczvJMKHFQYo/yz:cbY7DncC6xILlo6DBczvJMKHFQYo/yz

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Starts itself from another location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts application with an unusual extension

INFO

Reads the computer name

Reads the machine GUID from the registry

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings