File name:	2025-07-06_f9ecf057673f497d5828f67678757437_elex_mafia
Full analysis:	https://app.any.run/tasks/8ae97b65-4821-4ff2-a006-85b0a4bf7637
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 04:09:20
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	F9ECF057673F497D5828F67678757437
SHA1:	7DC9B549421E0230093CB2608874C49C86EBB26F
SHA256:	66983B0FB25CEB57DE877D9B8C3CB659C7599F1703326ACE7A759A551B075C38
SSDEEP:	12288:cbY1ZDn6GOEtcgjnUCw7JRTDVYD5StblU2Y6EZDuzgIseTXhGqVVh6yzDc:cbY7DncCw7jTkSVlhkQzzseTXhGjyzY

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6648	2025-07-06_f9ecf057673f497d5828f67678757437_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\5AB2.tmp		executable
		MD5:1CC8CA2A46178B45AF0F086A7E20E610	SHA256:5D48E8246663EB08766B8EE7BBAAEA947819CF8DDAF1702FC8490255F7FB875C
6808	5AB2.tmp	C:\Users\admin\AppData\Local\Temp\5B20.tmp		executable
		MD5:F06BA09E21318E1EEFAA8F1147768C7F	SHA256:1AD4BAEAD0B09E644B396C0C1C16C9AD411981FCEAA4796D679D9380DF6D0844
2976	5B7E.tmp	C:\Users\admin\AppData\Local\Temp\5BDB.tmp		executable
		MD5:ECCDB180671AD0DA63BF6DA69A8E23C2	SHA256:C1442322D0E0038814FC32B3FE464AD4B09E9B05177F7073D2F1899CF4AE9E7B
2708	5B20.tmp	C:\Users\admin\AppData\Local\Temp\5B7E.tmp		executable
		MD5:38813FEC2BEB529F8231C9D33BB619A6	SHA256:57B10E8081DFF9CF861B3F740DA8F647D8556F19AADCE42B852817F881D3FB6C
6540	5BDB.tmp	C:\Users\admin\AppData\Local\Temp\5C39.tmp		executable
		MD5:4E68568E273E751246E27ECDC2BA0799	SHA256:477F8A110C6196009573C5DE9288C04C336896607B0637EA1E94173D1633BEBA
1208	5C39.tmp	C:\Users\admin\AppData\Local\Temp\5C97.tmp		executable
		MD5:CF68C3B0557AA2E567590B8135CC5761	SHA256:E22A6B483A71AA83FC25CD00F91CF4422C542D4424BB68822FE35E510920A00A
5340	5CF5.tmp	C:\Users\admin\AppData\Local\Temp\5D52.tmp		executable
		MD5:4BC169C7C9D843A3C9D66492D016DD2C	SHA256:A8095F9A402D65ED1BA9D5671D95BD762582AD4AF8957A754A0CF231A20E5197
2076	5C97.tmp	C:\Users\admin\AppData\Local\Temp\5CF5.tmp		executable
		MD5:80130E4825270CC45C45FF58B1B0E33A	SHA256:24F79D7DD18AA1520AB60B8B053A8110AA53D5323FE5C079CBA0B2663DCA57B2
3780	5D52.tmp	C:\Users\admin\AppData\Local\Temp\5DB0.tmp		executable
		MD5:EBEBEDF19264E83DD35F66B5AA5D98B3	SHA256:370464F21BE91402D21C6D107AF3B5BF791B11B5BC39CFF12204977954A4B43E
2716	5DB0.tmp	C:\Users\admin\AppData\Local\Temp\5E1D.tmp		executable
		MD5:8B980EEC7840D6294CB725E5191A9214	SHA256:E10070B9B237DC04A57274C8799979014DBE997136C0F27CE645D0A826F993E2

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
4860	RUXIMICS.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
4860	RUXIMICS.exe	GET	200	23.53.40.178:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5944	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4860	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
4860	RUXIMICS.exe	23.53.40.178:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	184.30.21.171:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59 20.73.194.208	whitelisted
google.com	172.217.18.14	whitelisted
crl.microsoft.com	23.53.40.178 23.53.40.176	whitelisted
www.microsoft.com	184.30.21.171	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted
self.events.data.microsoft.com	52.182.143.213	whitelisted

General Info

2025-07-06_f9ecf057673f497d5828f67678757437_elex_mafia

F9ECF057673F497D5828F67678757437

7DC9B549421E0230093CB2608874C49C86EBB26F

66983B0FB25CEB57DE877D9B8C3CB659C7599F1703326ACE7A759A551B075C38

12288:cbY1ZDn6GOEtcgjnUCw7JRTDVYD5StblU2Y6EZDuzgIseTXhGqVVh6yzDc:cbY7DncCw7jTkSVlhkQzzseTXhGjyzY

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the computer name

Checks supported languages

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings