File name:	2025-08-01_871ac7d9556ef19adae961e2e87faa6c_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/c3e5a328-d60e-4163-b5d4-0cc2a1e3551b
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 02:05:17
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	871AC7D9556EF19ADAE961E2E87FAA6C
SHA1:	0A135B43A49DA2DD3B569F5B8709791F2BBB0EA5
SHA256:	A0C108660C9B5F697932E9A3112F916875AEFD76CEC9C5667077EF3E80FED317
SSDEEP:	12288:cbY1ZDn6GOEtcgjnUCBokD4kDNSynaTpENcLnc+zwy5lVVh6yzDc:cbY7DncCBokn5vnaTpqSnc+zwy5SyzY

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4544	DC13.tmp	C:\Users\admin\AppData\Local\Temp\DC80.tmp		executable
		MD5:5E471ECDB35659E364DAF53A1CFB9D0F	SHA256:295621EE8E2B949F7806BE3435C7B70CE5422191F26EC9EB0D4BF736D5C03A5F
2524	DBB5.tmp	C:\Users\admin\AppData\Local\Temp\DC13.tmp		executable
		MD5:5595868610F8E05823B48577E28229F4	SHA256:8F82C845A2E59B6B1D1A0DFAEA48D5873777785A55DAB3B6E9BA7BA0547C61BB
2992	DCED.tmp	C:\Users\admin\AppData\Local\Temp\DD4B.tmp		executable
		MD5:6E804FA0876C5C3A7D32A2FA95D3B9A4	SHA256:3D4AB514A6644BF18D4A668B38324260AAD371CECFAAE25CBFF374A0BA61034D
2128	DC80.tmp	C:\Users\admin\AppData\Local\Temp\DCED.tmp		executable
		MD5:5E5DAA6CB12EC0FBE804952561566447	SHA256:BDF2775E15FBC150C3FFE65B7173D3C76B516095F2AF12A1088242AE658C896A
3092	DE16.tmp	C:\Users\admin\AppData\Local\Temp\DE74.tmp		executable
		MD5:0234671D0CDC949DCFB091E2EB3B8E4F	SHA256:27E0A5900C3030B6C25EC5F2B39E5037A2E2F6601E9AFEF71A2FF48155111755
888	DDA9.tmp	C:\Users\admin\AppData\Local\Temp\DE16.tmp		executable
		MD5:B839862B10E85D214346A4398A8A5835	SHA256:C50096560ADD326090119B404C23E8F482D579749A0EDA314866B408B9F183D4
4528	DD4B.tmp	C:\Users\admin\AppData\Local\Temp\DDA9.tmp		executable
		MD5:3A53FED2FD643E5497C02C90C2CDDDC9	SHA256:381CEA92E51AFE7D51EBDAD7B597140ED0855A19329CF857DEFB8A72788E56A2
2288	DE74.tmp	C:\Users\admin\AppData\Local\Temp\DEE1.tmp		executable
		MD5:DF35A9812842D5741B10BFB2BCCCFB7E	SHA256:21AD41FD2DC45376415040E40CB185E100AD29359637A8A550A112869F36B745
5724	DEE1.tmp	C:\Users\admin\AppData\Local\Temp\DF3F.tmp		executable
		MD5:F0E1F1456FF2BC81ED993532DAD9A505	SHA256:95E4AC8DB87630D75DBB4C5BC4790BB3F21921AD58ECFE41BC5A080E7EF201FF
4820	E0B6.tmp	C:\Users\admin\AppData\Local\Temp\E104.tmp		executable
		MD5:72261A8536DE76A06EBAD529A8FDA4CC	SHA256:70160B2A90BDB58D24671F5429E37B7155CBE180BABFA2E8628861508848E685

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1300	RUXIMICS.exe	GET	200	23.216.77.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1300	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1300	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1300	RUXIMICS.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1300	RUXIMICS.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208	whitelisted
google.com	142.250.185.78	whitelisted
crl.microsoft.com	23.216.77.42 23.216.77.28 23.216.77.6	whitelisted
www.microsoft.com	23.35.229.160	whitelisted
self.events.data.microsoft.com	104.208.16.88	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224 20.83.72.98	whitelisted

General Info

2025-08-01_871ac7d9556ef19adae961e2e87faa6c_elex_mafia.exe

871AC7D9556EF19ADAE961E2E87FAA6C

0A135B43A49DA2DD3B569F5B8709791F2BBB0EA5

A0C108660C9B5F697932E9A3112F916875AEFD76CEC9C5667077EF3E80FED317

12288:cbY1ZDn6GOEtcgjnUCBokD4kDNSynaTpENcLnc+zwy5lVVh6yzDc:cbY7DncCBokn5vnaTpqSnc+zwy5SyzY

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Executable content was dropped or overwritten

Starts application with an unusual extension

INFO

Reads the computer name

Checks supported languages

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings