File name:	2025-05-31_fc010f3769876910d513418de77b1a93_elex_mafia
Full analysis:	https://app.any.run/tasks/6ed023c9-27a4-4b6d-8190-8fca62409e50
Verdict:	Malicious activity
Analysis date:	May 31, 2025, 13:05:20
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	FC010F3769876910D513418DE77B1A93
SHA1:	A5E16F0151CDD153F9F03E00D23A7FE24D7E0F00
SHA256:	21F7F041EC2D2ADF2871CEEBD099CC253D9F47EFA4F9D48F273D6D1B2703AE24
SSDEEP:	24576:cbY7DncCJSFzG++B9LJILWb6a9DAqgyzY:cbY7DncCJSFzG++B9LJILWb6a9DAqgyE

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
6620	A49.tmp	C:\Users\admin\AppData\Local\Temp\AD5.tmp		executable
		MD5:A963D517A0EB974AAA6E830AE6C76B81	SHA256:7C486496A0ECBA94888BD06E3E9C4FB1771E8D69729FDAE463D270A79641A86D
6044	48C.tmp	C:\Users\admin\AppData\Local\Temp\4F9.tmp		executable
		MD5:AA52C8B3CE71C38545AB9C9E3B77351B	SHA256:6414B3FD342E233C8214BA9D1D4E86FBDA9BCCA4EBCB6E799C834E1F02F3E13E
716	7B9.tmp	C:\Users\admin\AppData\Local\Temp\826.tmp		executable
		MD5:91A9AF0947D42A81DD882A8391AD1AD6	SHA256:795ABEA6006FD6F42D6953BFD5D030DC32071D8C2988B29DB51220DD97E5DCB8
2644	3D1.tmp	C:\Users\admin\AppData\Local\Temp\42E.tmp		executable
		MD5:B34FAC019D612420B7952F28E64D7445	SHA256:6A1CAFF4E7F6369A69296B98B76F144EFBCEB8959485843A23F5A371B56EAA85
660	826.tmp	C:\Users\admin\AppData\Local\Temp\884.tmp		executable
		MD5:526A882329055C5228849B8BFE6F6204	SHA256:6539DE80167100F1C0CEDC3695972E811E97659D2CB4B0149543CF7558F60926
2084	2025-05-31_fc010f3769876910d513418de77b1a93_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\2F6.tmp		executable
		MD5:BE7F129B3F75600983F8A9B970BDC398	SHA256:447AE7724F894F25BBA39679FC7B3B3F788597675C43927439922DEBB1598154
5064	74B.tmp	C:\Users\admin\AppData\Local\Temp\7B9.tmp		executable
		MD5:FF00D94C952C0BFE0D2BF3A3164481A8	SHA256:096A754CB5103D33613B3127E3172C91C4C5369089961907C54D375B4A1C65E2
7284	2F6.tmp	C:\Users\admin\AppData\Local\Temp\363.tmp		executable
		MD5:49F9396386C5291EA3A0EEB20CC4C26A	SHA256:D2CFBE4BAC46E356264008780289F3445D7780E2DE6922F0C2D9A5B5ED176436
4220	632.tmp	C:\Users\admin\AppData\Local\Temp\690.tmp		executable
		MD5:51DB45011CC0C6B94BCD48CD3E726194	SHA256:92AF07EF8B3747D8C3778548E107C0321D59CE2A98CF35310D75C6F33208D20F
5552	5B5.tmp	C:\Users\admin\AppData\Local\Temp\632.tmp		executable
		MD5:37228A8309A867D912EDE0D74DB2724C	SHA256:61811F0EBD2303D466A1AA602DFE9AD866E92A6CAE8D8AEC478521019C5504AA

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
—	—	GET	304	172.202.163.200:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	unknown
—	—	POST	200	40.126.31.1:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
5864	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5124	SIHClient.exe	GET	200	2.20.245.139:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl	unknown	—	—	whitelisted
5124	SIHClient.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
5124	SIHClient.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	unknown	—	—	whitelisted
—	—	GET	200	172.202.163.200:443	https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL	unknown	—	—	unknown
5124	SIHClient.exe	GET	200	2.23.181.156:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl	unknown	—	—	whitelisted
—	—	POST	200	40.126.31.1:443	https://login.live.com/RST2.srf	unknown	xml	11.0 Kb	whitelisted
—	—	GET	200	40.69.42.241:443	https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping	unknown	—	—	unknown

PID	Process	IP	Domain	ASN	CN	Reputation
5864	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5864	RUXIMICS.exe	2.20.245.137:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
5864	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
8124	slui.exe	20.83.72.98:443	activation-v2.sls.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
5124	SIHClient.exe	172.202.163.200:443	slscr.update.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	GB	whitelisted
6544	svchost.exe	40.126.32.74:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5124	SIHClient.exe	2.23.181.156:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158	whitelisted
google.com	142.250.185.142	whitelisted
crl.microsoft.com	2.20.245.137 2.20.245.139	whitelisted
www.microsoft.com	95.101.149.131 2.23.181.156	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98	whitelisted
slscr.update.microsoft.com	172.202.163.200	whitelisted
login.live.com	40.126.32.74 20.190.160.17 40.126.32.72 20.190.160.128 40.126.32.136 20.190.160.65 20.190.160.130 20.190.160.14	whitelisted
client.wns.windows.com	172.211.123.249 172.211.123.248	whitelisted
fe3cr.delivery.mp.microsoft.com	40.69.42.241	whitelisted
self.events.data.microsoft.com	13.89.179.13	whitelisted

General Info

2025-05-31_fc010f3769876910d513418de77b1a93_elex_mafia

FC010F3769876910D513418DE77B1A93

A5E16F0151CDD153F9F03E00D23A7FE24D7E0F00

21F7F041EC2D2ADF2871CEEBD099CC253D9F47EFA4F9D48F273D6D1B2703AE24

24576:cbY7DncCJSFzG++B9LJILWb6a9DAqgyzY:cbY7DncCJSFzG++B9LJILWb6a9DAqgyE

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Executable content was dropped or overwritten

Starts application with an unusual extension

Starts itself from another location

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

INFO

Reads the machine GUID from the registry

Reads the computer name

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings