File name:	2025-08-01_54ef74909c2e8c9a1dfbc42489ddcad0_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/c0b34518-efe7-48b2-92b7-cd6f5be6a7e3
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 02:05:18
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	54EF74909C2E8C9A1DFBC42489DDCAD0
SHA1:	637CE220BE441C14A00D9A4BDB7573AEE044E71B
SHA256:	FEC407978B93B7D66169BA677B7FE2CF0BA90659C32A52C84343F6875474F753
SSDEEP:	24576:cbY7DncCuOLg1XSLQ9xfQr4iWWt9usHlUmyzY:cbY7DncCuOLg1XSLQzfQr4iWWt9usFU4

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
5764	D905.tmp	C:\Users\admin\AppData\Local\Temp\D963.tmp		executable
		MD5:CBCE89B6DA8B263B0A2D472B4C859FC7	SHA256:77EAE1ACF414C0D2D6F077DE14D9D59D5D8D84EBE7039B4297540665B91C07A9
1668	D963.tmp	C:\Users\admin\AppData\Local\Temp\D9D1.tmp		executable
		MD5:3A857C1C66052A91B5C9C9CDB8C1C2DE	SHA256:955E616D41F566259A2EAD2D1425596A5436D8305459C030CA62CD80761E2C63
2492	2025-08-01_54ef74909c2e8c9a1dfbc42489ddcad0_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\D905.tmp		executable
		MD5:1BF6BEF949A8D4326DC8B292EC8F01D3	SHA256:78D57D24F032CBB81908CB89515E90A36CD24795ABF40443AEC2CC116E55B999
4012	D9D1.tmp	C:\Users\admin\AppData\Local\Temp\DA2E.tmp		executable
		MD5:8C033E1BAB9723A99326ED9A80AD0EBB	SHA256:E02A85B75A12D2CFC48EEB3E674B30C54B84010827427401241651CC905DE4BB
4156	DB67.tmp	C:\Users\admin\AppData\Local\Temp\DBC5.tmp		executable
		MD5:5C3A299F4B08C042E1C5063E202AA43B	SHA256:1BA1DBBCDCD7B7A0F4D05970DCC93766CA1928EA0A3A5784077426E1D7274A21
5504	DA2E.tmp	C:\Users\admin\AppData\Local\Temp\DA9C.tmp		executable
		MD5:E82DEF7C7D5D2709DA7612D47C1D2FE3	SHA256:1DE505B81F4AE2012CE30B233B544D6F847C595A89C0FF3AB0199EE3E452E6F1
3460	DBC5.tmp	C:\Users\admin\AppData\Local\Temp\DC22.tmp		executable
		MD5:9D2E23A70DFC01B9F1B2875F4FB7FFA6	SHA256:465BC7923489D820D38FF797D6BE514EC0EBC3B3F6920B0F9CA26FB295C527F9
5236	DFDB.tmp	C:\Users\admin\AppData\Local\Temp\E039.tmp		executable
		MD5:EADA29CC8749A5184B349C22397BD611	SHA256:B36A7288EBA6F7B2DBE5DEEEBE261CDD80C486CB458AAA32F84CA6CDBB8FA4D2
3572	DDA9.tmp	C:\Users\admin\AppData\Local\Temp\DE26.tmp		executable
		MD5:A55CE100B1414DB1D2AE31467F1050C8	SHA256:9EA2C12A9E052339978C850A6830B9C40EA7465C681806E0169EFD46CA75E3E6
7040	DE26.tmp	C:\Users\admin\AppData\Local\Temp\DE93.tmp		executable
		MD5:DBD99656B58842172FBC3F0578444132	SHA256:52BE6576C7BB5A2D3573BF44DC5480D50A6ECE0F7F2C5509DF93F41703B80068

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5944	MoUsoCoreWorker.exe	GET	200	23.216.77.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	23.216.77.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
1268	svchost.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
5288	RUXIMICS.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	DE	binary	814 b	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	200	20.190.160.14:443	https://login.live.com/RST2.srf	US	xml	1.24 Kb	whitelisted
—	—	POST	400	40.126.32.76:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	40.126.32.138:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
—	—	POST	400	20.190.160.22:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5288	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5288	RUXIMICS.exe	23.216.77.42:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted
5944	MoUsoCoreWorker.exe	23.35.229.160:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208 40.127.240.158 51.124.78.146 20.49.150.241	whitelisted
google.com	142.250.185.78	whitelisted
crl.microsoft.com	23.216.77.42 23.216.77.28 23.216.77.6	whitelisted
www.microsoft.com	23.35.229.160 23.3.109.244	whitelisted
login.live.com	20.190.159.2 20.190.159.75 20.190.159.0 20.190.159.128 40.126.31.128 40.126.31.3 40.126.31.0 20.190.159.130	whitelisted
slscr.update.microsoft.com	74.178.240.61	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
self.events.data.microsoft.com	104.208.16.88	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224 20.83.72.98	whitelisted
x1.c.lencr.org	23.192.153.142	whitelisted

General Info

2025-08-01_54ef74909c2e8c9a1dfbc42489ddcad0_elex_mafia.exe

54EF74909C2E8C9A1DFBC42489DDCAD0

637CE220BE441C14A00D9A4BDB7573AEE044E71B

FEC407978B93B7D66169BA677B7FE2CF0BA90659C32A52C84343F6875474F753

24576:cbY7DncCuOLg1XSLQ9xfQr4iWWt9usHlUmyzY:cbY7DncCuOLg1XSLQzfQr4iWWt9usFU4

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts itself from another location

Executable content was dropped or overwritten

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts application with an unusual extension

INFO

Reads the machine GUID from the registry

Reads the computer name

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings