File name:	2025-08-01_f1e349c7f51b49b85be16df433f16a17_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/957d1b9d-1f38-443f-be52-18c8ad8132e5
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 01:48:56
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	F1E349C7F51B49B85BE16DF433F16A17
SHA1:	DE6015DA1C71F7AB09E34E1122222BAD3FDD70C1
SHA256:	B87F951A05D90ECB057510AC40A12F5B468A4CC3A6A73475BA4BA518DCA61724
SSDEEP:	24576:cbY7DncC1EwZ4OdL3wa/OLe4ycpYVHStyzY:cbY7DncC1rZ4OdL3wa/OLetcpYVHStyE

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3788	D76F.tmp	C:\Users\admin\AppData\Local\Temp\D7CD.tmp		executable
		MD5:3DC92EC0DDFC0D6409D519583D31D7D3	SHA256:FCA9F1C10E527AEEA3BB7FAA0D186777572F1803DC9CD71A3C8A19C855C16AB1
5764	2025-08-01_f1e349c7f51b49b85be16df433f16a17_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\D702.tmp		executable
		MD5:09CDC4223B6113C780FDEEAA639A8401	SHA256:EC96EEC2ACFB640F4C7CCB33A16B99412D94772EFD557D67FC669A5BC66AEE3F
1604	D702.tmp	C:\Users\admin\AppData\Local\Temp\D76F.tmp		executable
		MD5:68B6A172FBFE2F629B988E5D04D8FE21	SHA256:3868264D7698690C4B4BA0EC8FBA1DD8410160B11A3DBC01E9E4416CA88B8CE8
6460	D7CD.tmp	C:\Users\admin\AppData\Local\Temp\D83A.tmp		executable
		MD5:7BE6EBE72E5BBE282FAE0769DC87AAAF	SHA256:EA6C56CD8ED069E3324B6C2E7BEAE59D76CEDAF42B1E85F4BC54E22D5D8865BD
6408	D8A8.tmp	C:\Users\admin\AppData\Local\Temp\D905.tmp		executable
		MD5:C40DD792BE9284661DF134CB7B5A3B1E	SHA256:86155F3753B33568CA918ADB583B6BD50BDF812F17BAE5A5AEE41F6D655F4E53
3400	D83A.tmp	C:\Users\admin\AppData\Local\Temp\D8A8.tmp		executable
		MD5:978D51B16F801F08DF2F636DFACA69BB	SHA256:4E37BD2078C95012503BFE8C9864323C14461CF633879CF0D35641A6E1ADCCBD
4196	DADA.tmp	C:\Users\admin\AppData\Local\Temp\DB38.tmp		executable
		MD5:DFE04F562D7C23F8C62AB5CE8AF58DF2	SHA256:2C4DEA43F8CC2159B255A7035849E7BD7BF119BEAFB79FC714ECB5125E34FE13
5824	DBA5.tmp	C:\Users\admin\AppData\Local\Temp\DC03.tmp		executable
		MD5:1861EDC0B1EB8B87A9EF4018C2B34597	SHA256:29A5126F480B0B7485B7F356E01499A6FF7A1FC29149BFFBF98CB9C64FD65F63
7032	DB38.tmp	C:\Users\admin\AppData\Local\Temp\DBA5.tmp		executable
		MD5:98A0B50A69C5AE329C7AC5BEFE0FFA2C	SHA256:9AB30314EB88B5727C27324A8E18F556D65588B9BFE889010B5873C4609764F8
5084	DC03.tmp	C:\Users\admin\AppData\Local\Temp\DC61.tmp		executable
		MD5:FA539D1CFA6FF782EC570A4AF5EAB356	SHA256:41459E3199FD346412E8A8991A432658D03EF8C1A1C97A1F2635B1D1AB0D347D

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
2168	RUXIMICS.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2168	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
2168	RUXIMICS.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 4.231.128.59	whitelisted
google.com	142.250.186.174	whitelisted
crl.microsoft.com	2.16.241.12 2.16.241.14	whitelisted
www.microsoft.com	104.79.89.142	whitelisted
self.events.data.microsoft.com	20.52.64.200	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-08-01_f1e349c7f51b49b85be16df433f16a17_elex_mafia.exe

F1E349C7F51B49B85BE16DF433F16A17

DE6015DA1C71F7AB09E34E1122222BAD3FDD70C1

B87F951A05D90ECB057510AC40A12F5B468A4CC3A6A73475BA4BA518DCA61724

24576:cbY7DncC1EwZ4OdL3wa/OLe4ycpYVHStyzY:cbY7DncC1rZ4OdL3wa/OLetcpYVHStyE

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts itself from another location

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Reads the machine GUID from the registry

Reads the computer name

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings