File name:	2025-08-01_1d48556db7faefb9dab78dae89f1eace_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/9d1c8520-b349-49c0-a111-3560c9842073
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 04:07:44
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	1D48556DB7FAEFB9DAB78DAE89F1EACE
SHA1:	86878DD825ABD70C86663DC9D36584960EB4A255
SHA256:	4748DC370DEF8BA45FF4558071E6C51A4A9D310E70828F582C283B82416F0E48
SSDEEP:	12288:GEY859yqwTEvcPdZnCXnpglISPdzgrgnfVfUn58TkVVh6yzD3:GEY89WxC3pglISZgUnfVfU58Ttyzr

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3788	D898.tmp	C:\Users\admin\AppData\Local\Temp\D8F6.tmp		executable
		MD5:763AEF0B4D6D76C094620E7FA3965B13	SHA256:D68767D17C4B1E716CE850E8E92ECFE1875D5D5B433AA095AC7C4905488B0F45
1096	D9D1.tmp	C:\Users\admin\AppData\Local\Temp\DA4E.tmp		executable
		MD5:67534F43B5C6E9EC806D528E43A6C490	SHA256:3DBD35C48EB4538A7392CD112A274C9C8622320D26FCF9BB8BDEE20206D7882F
4036	DB09.tmp	C:\Users\admin\AppData\Local\Temp\DB67.tmp		executable
		MD5:32C22156BD38DD7FAE29A3102EAC36FE	SHA256:ECEA5D2AE719C198C5BAD3C827559178A55A9974F1CDC9A4EAB4C59B6F69ABCF
4648	DBD4.tmp	C:\Users\admin\AppData\Local\Temp\DC42.tmp		executable
		MD5:FC860F42B6A11F535D94F6AA3AD2CA47	SHA256:F8D1F009AD543B7A4CFCCE966DA654F4E2FD1C2AEDC3571C23FB715CB03CB830
6720	2025-08-01_1d48556db7faefb9dab78dae89f1eace_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\D7CD.tmp		executable
		MD5:2925ED43BEA5BA16AA0B41C60BAD21B6	SHA256:B6A94B3477435059E4E3752353A96E22559220BF1E544883900C0FE4C04A0799
6948	D83A.tmp	C:\Users\admin\AppData\Local\Temp\D898.tmp		executable
		MD5:9E625F2F8D38AF023F2BC26A64256E38	SHA256:18A7458513E35A8A9E0A50A89246587F61678945EE2E0347BCA95A6DA8EBD68D
4724	DAAB.tmp	C:\Users\admin\AppData\Local\Temp\DB09.tmp		executable
		MD5:C272B34A7CB04732CDDF05427A519C90	SHA256:EAF06C13EB6FF03C97EF4103E23EE519E55559CFCDDB23A54145EE48958048E6
6820	D7CD.tmp	C:\Users\admin\AppData\Local\Temp\D83A.tmp		executable
		MD5:23664390D5CDB78D7DF162A34340F264	SHA256:855888FAF68D04967DEE7915DA92A5977862A1E460AD0F23E0C85B75585726CD
6876	DB67.tmp	C:\Users\admin\AppData\Local\Temp\DBD4.tmp		executable
		MD5:4ABA489FE7717A1A51A619C179A0F2FA	SHA256:A341EF12BF6DD489B0E3C23F7527199CACD30A8ABAAA0DD204C3438D50589D97
3584	DC42.tmp	C:\Users\admin\AppData\Local\Temp\DCAF.tmp		executable
		MD5:BC6B7560F21CA873A68ACE26FA9FD8D3	SHA256:0C77EF794C5AC75DDA882FD6EE152E9082B6D82210E7E91C9372FFDBAC417839

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
2992	RUXIMICS.exe	GET	200	23.216.77.6:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	23.3.109.244:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
2992	RUXIMICS.exe	GET	200	23.3.109.244:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.3.109.244:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	US	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	US	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2992	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2992	RUXIMICS.exe	23.216.77.6:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.3.109.244:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	23.3.109.244:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 51.124.78.146	whitelisted
google.com	142.250.185.110	whitelisted
crl.microsoft.com	23.216.77.6 23.216.77.28	whitelisted
www.microsoft.com	23.3.109.244	whitelisted
self.events.data.microsoft.com	51.11.192.50	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-08-01_1d48556db7faefb9dab78dae89f1eace_elex_mafia.exe

1D48556DB7FAEFB9DAB78DAE89F1EACE

86878DD825ABD70C86663DC9D36584960EB4A255

4748DC370DEF8BA45FF4558071E6C51A4A9D310E70828F582C283B82416F0E48

12288:GEY859yqwTEvcPdZnCXnpglISPdzgrgnfVfUn58TkVVh6yzD3:GEY89WxC3pglISZgUnfVfU58Ttyzr

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts application with an unusual extension

Starts itself from another location

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings