File name:	2025-06-17_fe5ba63c7aaae5931b9aebda6b4500f3_elex_mafia
Full analysis:	https://app.any.run/tasks/9421afc7-4f11-41e0-862f-1cc97e1a6014
Verdict:	Malicious activity
Analysis date:	June 17, 2025, 22:54:15
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	FE5BA63C7AAAE5931B9AEBDA6B4500F3
SHA1:	B826CE9C8EFA70F6FC66476BCBD57786985AF4FA
SHA256:	50F2337FA85DEB71831816A7EBA774894E8B97E6B9107D2DF283C8F2EE8B8379
SSDEEP:	24576:GEY89WxCAk6juyUEft2lJNpfy6RK0Ayzr:GEY89WxCAk6juyUEft2lvpy6RK0Ayzr

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3884	2025-06-17_fe5ba63c7aaae5931b9aebda6b4500f3_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\735B.tmp		executable
		MD5:21E43C39DCC1249AC85E925A3B54FAD0	SHA256:6BFE8C02B58D04481D6C0925DE2ECB7E21FE05A29A1941B33E2FBC991568FA06
1520	73C8.tmp	C:\Users\admin\AppData\Local\Temp\7426.tmp		executable
		MD5:AF4E7FE061444E86815BE9AA39C45A65	SHA256:FE5FCA58F6C43BE158CFED076E9423AA3BC67BAC582480C4F33123C44C236B5C
4216	735B.tmp	C:\Users\admin\AppData\Local\Temp\73C8.tmp		executable
		MD5:2FF698D6C7E4FA685D73FF28A2DEC260	SHA256:662281C7C4921808128D9B5F1F787DE06531B371C4085CB3621944A16E8736BC
6808	74F1.tmp	C:\Users\admin\AppData\Local\Temp\754F.tmp		executable
		MD5:0CDA7C44C20CDC39EBFD4592264DCF64	SHA256:8F9EBAEAE4D73F25BD9D30BC6E8917FEC7D910F6C6AD320C9692E0D3DCD780E5
5708	7966.tmp	C:\Users\admin\AppData\Local\Temp\79C4.tmp		executable
		MD5:FF39FF8F32A7A33C14C2F86F447D5E58	SHA256:77B9D2E5A332BB491DDCA566A3DCD4B074F86474A36D410CEBB6DE9AC6335ADC
1964	77D0.tmp	C:\Users\admin\AppData\Local\Temp\783D.tmp		executable
		MD5:BB7505050D4D97C0FC4530BB88D038D6	SHA256:1C07CEB7F11BA9666B26B7589E97A406B005C8C8C34DD5979D1496765FEF1B05
6520	7484.tmp	C:\Users\admin\AppData\Local\Temp\74F1.tmp		executable
		MD5:3D5E405F9F8A6372224F7028F7F516EC	SHA256:E64C4360CC872CD57A6DE3410B68D7B9629F2B104031D75C940FC0A7059F2BD4
6684	7426.tmp	C:\Users\admin\AppData\Local\Temp\7484.tmp		executable
		MD5:7202E12CDE44CD00B7930F7BC22FAF6E	SHA256:4B6754158857BC7498D9B84ECDDEE98699E23DAB733D17CF0824D9695BBC24CC
1688	788B.tmp	C:\Users\admin\AppData\Local\Temp\78E9.tmp		executable
		MD5:3BEA71CC151CF375DA3118D63A531F4E	SHA256:386AD1EAB3BB5CD13510D07AE276302378942F4F3CCAB6E1FF017BE0F8816907
2976	783D.tmp	C:\Users\admin\AppData\Local\Temp\788B.tmp		executable
		MD5:4B789EF4425C8CAA3B0A20E015E4B5F8	SHA256:1567A5243493EA1DBA0295CA121AF52552DBBE28836A691F6659E44453944466

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5244	RUXIMICS.exe	GET	200	2.16.168.124:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.16.168.124:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.16.168.124:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5244	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5244	RUXIMICS.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5244	RUXIMICS.exe	2.16.168.124:80	crl.microsoft.com	Akamai International B.V.	RU	whitelisted
5944	MoUsoCoreWorker.exe	2.16.168.124:80	crl.microsoft.com	Akamai International B.V.	RU	whitelisted
1268	svchost.exe	2.16.168.124:80	crl.microsoft.com	Akamai International B.V.	RU	whitelisted
5244	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	20.73.194.208 40.127.240.158	whitelisted
google.com	142.250.185.238	whitelisted
crl.microsoft.com	2.16.168.124 2.16.168.114	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
self.events.data.microsoft.com	20.189.173.14	whitelisted

General Info

2025-06-17_fe5ba63c7aaae5931b9aebda6b4500f3_elex_mafia

FE5BA63C7AAAE5931B9AEBDA6B4500F3

B826CE9C8EFA70F6FC66476BCBD57786985AF4FA

50F2337FA85DEB71831816A7EBA774894E8B97E6B9107D2DF283C8F2EE8B8379

24576:GEY89WxCAk6juyUEft2lJNpfy6RK0Ayzr:GEY89WxCAk6juyUEft2lvpy6RK0Ayzr

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Executable content was dropped or overwritten

Starts application with an unusual extension

Starts itself from another location

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings