File name:	2025-06-21_dd5cd9b79f83d90f397cef8542b0aba0_elex_mafia
Full analysis:	https://app.any.run/tasks/51ed3d2e-16f8-4556-9cbf-73d518d697ae
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 18:33:44
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	DD5CD9B79F83D90F397CEF8542B0ABA0
SHA1:	1650FC847CAB583A84860C670113A4EAC3DA2B09
SHA256:	241110A88C4FAF518158F8716C67961A2C60FA642D70F4D958EF7702DF579ABC
SSDEEP:	12288:cbY1ZDn6GOEtcgjnUCa1fHOndFz3/wpfqOhfGVBkZbxShVVh6yzDc:cbY7DncCuOndFz3/wx5hfuBkZbxSeyzY

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4192	6AB0.tmp	C:\Users\admin\AppData\Local\Temp\6B0E.tmp		executable
		MD5:B93FDDCA6B03A9F31CB679F04C7CF9B8	SHA256:017FBC38077A89DB0C93E68B268C2EE9ABDB599B28AE8C1210083A0AEB3E2121
6012	6E2B.tmp	C:\Users\admin\AppData\Local\Temp\6E89.tmp		executable
		MD5:39B0525C0248BFA5D58D1F30C8CB1971	SHA256:8054D24F15A184F39E31EE06943296AE0152788F4C75808461A9462206AC06DB
6892	69C6.tmp	C:\Users\admin\AppData\Local\Temp\6A43.tmp		executable
		MD5:499401C92405464F2C957C298E88C8DF	SHA256:3E740048FB77176FA4C56F7110010905FE22CD69063ADCC64041BFB0D7291ED6
4892	6B6C.tmp	C:\Users\admin\AppData\Local\Temp\6BC9.tmp		executable
		MD5:F3DC25FADE90011CEFA166567C6B5D80	SHA256:D87AEA1539DBD0E086B00397A81C53F4C6007C9C55DB59CF816D7BBDA100AC73
4544	6D6F.tmp	C:\Users\admin\AppData\Local\Temp\6DBD.tmp		executable
		MD5:2747E7A29B1A2B6C32125912BD36D6C6	SHA256:330EB03524B5AAC12CB17725CA47AC428A3786E8458486E7C5DE40BAB24BC0F4
5712	6BC9.tmp	C:\Users\admin\AppData\Local\Temp\6C46.tmp		executable
		MD5:B6DC048D88658954CD4AA3870B18BDDE	SHA256:81F2FFC6B49149E53AF4B432697F462281625FC01D03BE6927E09C703A470374
1720	6A43.tmp	C:\Users\admin\AppData\Local\Temp\6AB0.tmp		executable
		MD5:3554853A88EB1E0A32FC16D8F630DA34	SHA256:2ED0CECF48AF00226BFD69390AA097F39F53F6A07F3372E4DD246FE4175EFFF0
1520	6B0E.tmp	C:\Users\admin\AppData\Local\Temp\6B6C.tmp		executable
		MD5:2F8FB940BC7ADF00C9F4426EB5BD2A28	SHA256:3039D8B5E639BBBC64518AF78479E959791BB9B45044A2ECCF055ACBE3CB5A97
2192	6D02.tmp	C:\Users\admin\AppData\Local\Temp\6D6F.tmp		executable
		MD5:D0B7E6640907C70AB9A62DD8EBB25C43	SHA256:09B30E309D57EC4AE6EC7FCB307EBBC51A3BA73C324F17DF5EAD5ABE2F1E5940
3520	2025-06-21_dd5cd9b79f83d90f397cef8542b0aba0_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\69C6.tmp		executable
		MD5:7595690EEEE9EB2AE59F66DD025A5551	SHA256:64BDE2B532B8D6E63D75A69F24061FD8E2361DFA92444A4B71D4A59689762FAA

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4816	RUXIMICS.exe	GET	200	184.25.51.82:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	184.25.51.82:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4816	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
4816	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
4816	RUXIMICS.exe	184.25.51.82:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	184.25.51.82:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
4816	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
2468	slui.exe	40.91.76.224:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	184.25.51.82 184.25.51.59	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	20.189.173.27	whitelisted

General Info

2025-06-21_dd5cd9b79f83d90f397cef8542b0aba0_elex_mafia

DD5CD9B79F83D90F397CEF8542B0ABA0

1650FC847CAB583A84860C670113A4EAC3DA2B09

241110A88C4FAF518158F8716C67961A2C60FA642D70F4D958EF7702DF579ABC

12288:cbY1ZDn6GOEtcgjnUCa1fHOndFz3/wpfqOhfGVBkZbxShVVh6yzDc:cbY7DncCuOndFz3/wx5hfuBkZbxSeyzY

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Reads the computer name

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings