File name:	2025-08-01_1d48556db7faefb9dab78dae89f1eace_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/9d1c8520-b349-49c0-a111-3560c9842073
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 04:07:44
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	1D48556DB7FAEFB9DAB78DAE89F1EACE
SHA1:	86878DD825ABD70C86663DC9D36584960EB4A255
SHA256:	4748DC370DEF8BA45FF4558071E6C51A4A9D310E70828F582C283B82416F0E48
SSDEEP:	12288:GEY859yqwTEvcPdZnCXnpglISPdzgrgnfVfUn58TkVVh6yzD3:GEY89WxC3pglISZgUnfVfU58Ttyzr

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4844	D954.tmp	C:\Users\admin\AppData\Local\Temp\D9D1.tmp		executable
		MD5:7D3512F0FE55D192CE1F34B8F90C4C33	SHA256:7E72F21D8D2B1A93499FC1BC92F55D7776ACF27615F00C37D1EB0E2FA218F3E0
1644	D8F6.tmp	C:\Users\admin\AppData\Local\Temp\D954.tmp		executable
		MD5:C4DFAE4C482FBE42A2B96B04AE8644B3	SHA256:B1E4D9A211FF37742CD7C16EBFC66218C1FB2BC2FD87D7AF6E5DE1DCBA39228A
1096	D9D1.tmp	C:\Users\admin\AppData\Local\Temp\DA4E.tmp		executable
		MD5:67534F43B5C6E9EC806D528E43A6C490	SHA256:3DBD35C48EB4538A7392CD112A274C9C8622320D26FCF9BB8BDEE20206D7882F
3732	DA4E.tmp	C:\Users\admin\AppData\Local\Temp\DAAB.tmp		executable
		MD5:73B21002255AF411745D4D576558CBEE	SHA256:E25B31A2F8FF53F2A540A7D538D45453A05B10AD48E1BA8EECBE6D1825E4E5ED
4724	DAAB.tmp	C:\Users\admin\AppData\Local\Temp\DB09.tmp		executable
		MD5:C272B34A7CB04732CDDF05427A519C90	SHA256:EAF06C13EB6FF03C97EF4103E23EE519E55559CFCDDB23A54145EE48958048E6
4036	DB09.tmp	C:\Users\admin\AppData\Local\Temp\DB67.tmp		executable
		MD5:32C22156BD38DD7FAE29A3102EAC36FE	SHA256:ECEA5D2AE719C198C5BAD3C827559178A55A9974F1CDC9A4EAB4C59B6F69ABCF
4648	DBD4.tmp	C:\Users\admin\AppData\Local\Temp\DC42.tmp		executable
		MD5:FC860F42B6A11F535D94F6AA3AD2CA47	SHA256:F8D1F009AD543B7A4CFCCE966DA654F4E2FD1C2AEDC3571C23FB715CB03CB830
6876	DB67.tmp	C:\Users\admin\AppData\Local\Temp\DBD4.tmp		executable
		MD5:4ABA489FE7717A1A51A619C179A0F2FA	SHA256:A341EF12BF6DD489B0E3C23F7527199CACD30A8ABAAA0DD204C3438D50589D97
6820	D7CD.tmp	C:\Users\admin\AppData\Local\Temp\D83A.tmp		executable
		MD5:23664390D5CDB78D7DF162A34340F264	SHA256:855888FAF68D04967DEE7915DA92A5977862A1E460AD0F23E0C85B75585726CD
6948	D83A.tmp	C:\Users\admin\AppData\Local\Temp\D898.tmp		executable
		MD5:9E625F2F8D38AF023F2BC26A64256E38	SHA256:18A7458513E35A8A9E0A50A89246587F61678945EE2E0347BCA95A6DA8EBD68D

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2992	RUXIMICS.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.3.109.244:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.3.109.244:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2992	RUXIMICS.exe	GET	200	23.3.109.244:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2992	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2992	RUXIMICS.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.3.109.244:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	23.3.109.244:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146	whitelisted
google.com	142.250.185.110	whitelisted
crl.microsoft.com	23.216.77.6 23.216.77.28	whitelisted
www.microsoft.com	23.3.109.244	whitelisted
self.events.data.microsoft.com	51.11.192.50	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-08-01_1d48556db7faefb9dab78dae89f1eace_elex_mafia.exe

1D48556DB7FAEFB9DAB78DAE89F1EACE

86878DD825ABD70C86663DC9D36584960EB4A255

4748DC370DEF8BA45FF4558071E6C51A4A9D310E70828F582C283B82416F0E48

12288:GEY859yqwTEvcPdZnCXnpglISPdzgrgnfVfUn58TkVVh6yzD3:GEY89WxC3pglISZgUnfVfU58Ttyzr

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings