File name:	2025-08-01_f1e349c7f51b49b85be16df433f16a17_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/957d1b9d-1f38-443f-be52-18c8ad8132e5
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 01:48:56
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	F1E349C7F51B49B85BE16DF433F16A17
SHA1:	DE6015DA1C71F7AB09E34E1122222BAD3FDD70C1
SHA256:	B87F951A05D90ECB057510AC40A12F5B468A4CC3A6A73475BA4BA518DCA61724
SSDEEP:	24576:cbY7DncC1EwZ4OdL3wa/OLe4ycpYVHStyzY:cbY7DncC1rZ4OdL3wa/OLetcpYVHStyE

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3788	D76F.tmp	C:\Users\admin\AppData\Local\Temp\D7CD.tmp		executable
		MD5:3DC92EC0DDFC0D6409D519583D31D7D3	SHA256:FCA9F1C10E527AEEA3BB7FAA0D186777572F1803DC9CD71A3C8A19C855C16AB1
3400	D83A.tmp	C:\Users\admin\AppData\Local\Temp\D8A8.tmp		executable
		MD5:978D51B16F801F08DF2F636DFACA69BB	SHA256:4E37BD2078C95012503BFE8C9864323C14461CF633879CF0D35641A6E1ADCCBD
6460	D7CD.tmp	C:\Users\admin\AppData\Local\Temp\D83A.tmp		executable
		MD5:7BE6EBE72E5BBE282FAE0769DC87AAAF	SHA256:EA6C56CD8ED069E3324B6C2E7BEAE59D76CEDAF42B1E85F4BC54E22D5D8865BD
5552	DA1F.tmp	C:\Users\admin\AppData\Local\Temp\DA7C.tmp		executable
		MD5:D68B42D6431FC36F97B0E4F83509698C	SHA256:E95A0B69E837DACD080E06A89E77A16AB9C26BF2B52D6573E5CC45293F8A98A9
4836	DA7C.tmp	C:\Users\admin\AppData\Local\Temp\DADA.tmp		executable
		MD5:42230710CB05099EBF25CFD9070D7DCD	SHA256:9C331A6AEAF62CBF00CCB0FFC0A113194BF4532143A0238A99D7633DB46367BA
7032	DB38.tmp	C:\Users\admin\AppData\Local\Temp\DBA5.tmp		executable
		MD5:98A0B50A69C5AE329C7AC5BEFE0FFA2C	SHA256:9AB30314EB88B5727C27324A8E18F556D65588B9BFE889010B5873C4609764F8
5824	DBA5.tmp	C:\Users\admin\AppData\Local\Temp\DC03.tmp		executable
		MD5:1861EDC0B1EB8B87A9EF4018C2B34597	SHA256:29A5126F480B0B7485B7F356E01499A6FF7A1FC29149BFFBF98CB9C64FD65F63
1044	DC61.tmp	C:\Users\admin\AppData\Local\Temp\DCAF.tmp		executable
		MD5:87403D8EC0E36F46DFA5D6173580E41C	SHA256:0DC18A36452CC9814BD0B5CC4B947E7630DAAC313B47FA4BA003BD2D644D5EE2
6344	DCAF.tmp	C:\Users\admin\AppData\Local\Temp\DCFD.tmp		executable
		MD5:277C32B817486391A78FC6675690C76B	SHA256:EBE320792609FBEE21DFC202C44E367BD3C476CE4BCE06E9F62B2875EA45DFC5
1604	D702.tmp	C:\Users\admin\AppData\Local\Temp\D76F.tmp		executable
		MD5:68B6A172FBFE2F629B988E5D04D8FE21	SHA256:3868264D7698690C4B4BA0EC8FBA1DD8410160B11A3DBC01E9E4416CA88B8CE8

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.16.241.12:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2168	RUXIMICS.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	104.79.89.142:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	40.91.76.224:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2168	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	2.16.241.12:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
2168	RUXIMICS.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
1268	svchost.exe	104.79.89.142:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 4.231.128.59	whitelisted
google.com	142.250.186.174	whitelisted
crl.microsoft.com	2.16.241.12 2.16.241.14	whitelisted
www.microsoft.com	104.79.89.142	whitelisted
self.events.data.microsoft.com	20.52.64.200	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224	whitelisted

General Info

2025-08-01_f1e349c7f51b49b85be16df433f16a17_elex_mafia.exe

F1E349C7F51B49B85BE16DF433F16A17

DE6015DA1C71F7AB09E34E1122222BAD3FDD70C1

B87F951A05D90ECB057510AC40A12F5B468A4CC3A6A73475BA4BA518DCA61724

24576:cbY7DncC1EwZ4OdL3wa/OLe4ycpYVHStyzY:cbY7DncC1rZ4OdL3wa/OLetcpYVHStyE

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts itself from another location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings