File name:	2025-07-06_e0fa6271e1b3d329194ab15f7a8289d6_elex_mafia
Full analysis:	https://app.any.run/tasks/57e3df21-9cfe-4773-8913-f1dd2ad730de
Verdict:	Malicious activity
Analysis date:	July 06, 2025, 04:10:41
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	E0FA6271E1B3D329194AB15F7A8289D6
SHA1:	1ED0565DAC07E1D366DFBBF004B8E4941826C9D0
SHA256:	E0BE747BFE7604F76A79F727D929D277A6EA3DC9F2134E95A77613F86B465F3B
SSDEEP:	24576:cbY7DncCSimjHnahb3l5tG+CEUB0TG0VyzY:cbY7DncCSimjH6b3l5tG+CES0TG0VyzY

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
4692	5D91.tmp	C:\Users\admin\AppData\Local\Temp\5DEF.tmp		executable
		MD5:BFC6C582796EF1316CEFE468D922F2F4	SHA256:BC1DD423677D75C60CC7C12E7A2D67A50B751796DCBF1BAD33F3E428BCAD7C05
6716	5CC6.tmp	C:\Users\admin\AppData\Local\Temp\5D23.tmp		executable
		MD5:879097C1CCCA30F8055872F185752C40	SHA256:DCA657EB36805428618915D26BC7A83FB9438B1772BE7AB000B648A0A07D9B0A
5980	2025-07-06_e0fa6271e1b3d329194ab15f7a8289d6_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\5C68.tmp		executable
		MD5:15F835E293CC15930D1D8A57E7BDE5E1	SHA256:26FFBDA79E908133BC169F50DAE95E4748F6445E9F15DC4F40376C250FEE13E1
984	5E5C.tmp	C:\Users\admin\AppData\Local\Temp\5EBA.tmp		executable
		MD5:A466BBE16779914885592F343CAB8915	SHA256:FF4A8D654A9638C072BE77B15F9A65A0AC2AEEFEE1E410A74ADC995E6212B1AD
4224	5D23.tmp	C:\Users\admin\AppData\Local\Temp\5D91.tmp		executable
		MD5:2E483068DCDCFD0CE5BDB03566CC19A3	SHA256:42D9D5E5D4444B0BF3781E99874AD3B9F33DFCDD258DD5CBD250CE19B2511F5A
6648	5C68.tmp	C:\Users\admin\AppData\Local\Temp\5CC6.tmp		executable
		MD5:F23F3ABD1E123D977E2D45D31BE7387B	SHA256:23ABF8225A367538A5F196453ACF3379788540CD7DD88DECDB92CEB9152412D1
2668	5FC3.tmp	C:\Users\admin\AppData\Local\Temp\6011.tmp		executable
		MD5:0BC1254FE1B725CDB0D72371B36A3EF7	SHA256:7CF4C18BBA69D51EA46573167C3B7BE63AA6795716213FC1EEC5EE263B90C37B
3836	6726.tmp	C:\Users\admin\AppData\Local\Temp\6784.tmp		executable
		MD5:E862DB739CDC57BB8679CDAEA3D4877E	SHA256:3A60307D328FF58AD1384239C5C36A9FDD10FDDF6DDAB975942E0B23E33269E3
728	668A.tmp	C:\Users\admin\AppData\Local\Temp\66D8.tmp		executable
		MD5:6E926CCCC39B7654FABABCF0304DB846	SHA256:70134F5D19F6188B072D7C3F6E11D5E379DF7756992A9E8F9906453184A78CC6
2428	66D8.tmp	C:\Users\admin\AppData\Local\Temp\6726.tmp		executable
		MD5:4E93256A08FE8C7168E1BBF427B3416B	SHA256:DA45FF8F7020F017A81FB64A0F7A1B5A59A3C70F6D88E6DE20ABEF4C36B546A8

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
6732	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted
—	—	POST	500	20.83.72.98:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	unknown	xml	512 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5944	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
6732	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	2.20.245.139:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted
5944	MoUsoCoreWorker.exe	2.20.245.139:80	crl.microsoft.com	Akamai International B.V.	SE	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
6732	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.124.78.146	whitelisted
google.com	142.250.186.78	whitelisted
crl.microsoft.com	2.20.245.139 2.20.245.137	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
self.events.data.microsoft.com	20.189.173.12	whitelisted

General Info

2025-07-06_e0fa6271e1b3d329194ab15f7a8289d6_elex_mafia

E0FA6271E1B3D329194AB15F7A8289D6

1ED0565DAC07E1D366DFBBF004B8E4941826C9D0

E0BE747BFE7604F76A79F727D929D277A6EA3DC9F2134E95A77613F86B465F3B

24576:cbY7DncCSimjHnahb3l5tG+CEUB0TG0VyzY:cbY7DncCSimjH6b3l5tG+CES0TG0VyzY

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Starts itself from another location

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Checks supported languages

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings