File name:	2025-06-21_a03d11ac4e52fa569ecffd7dd6907eac_elex_mafia
Full analysis:	https://app.any.run/tasks/d36e9327-cc4a-4b97-99fe-71d399d35fe2
Verdict:	Malicious activity
Analysis date:	June 21, 2025, 03:22:45
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	A03D11AC4E52FA569ECFFD7DD6907EAC
SHA1:	76C68BD3084EB67EF3D2515916353AC8D3AB32FB
SHA256:	5230D865E48E83E320097546BDC37D20056E3D4235AA9A19FB0AA7E3C4C2A1C0
SSDEEP:	24576:GEY89WxCzzPtY5LPp+EseeMK7++frh4s9paiyxQTnExyz:GEY89WxCzzPtY5LPp+EseeMW++frh4s1

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
1080	757E.tmp	C:\Users\admin\AppData\Local\Temp\75DC.tmp		executable
		MD5:72894B23F586620EA98B200464300B0B	SHA256:6309568EA3B857137F40D40FC385C2AA520528015F29FC91ED1D7F75CD40F976
2288	70EA.tmp	C:\Users\admin\AppData\Local\Temp\7157.tmp		executable
		MD5:D8B36EDE7B0E9F050B83351C320CF074	SHA256:918720F25AACE25BA227D2C4C122C6B59535CF8A9F6E46286059A9AAB01D6EBF
6264	7649.tmp	C:\Users\admin\AppData\Local\Temp\7697.tmp		executable
		MD5:AEDDF0BCFE968A4BE117373145E5066B	SHA256:CD8CB0B0B9143C84ACB42A1E10958FC8A17DEA5FD4232C4F81B31954B6F027A9
6356	6FC1.tmp	C:\Users\admin\AppData\Local\Temp\702E.tmp		executable
		MD5:EECAB0B6F56E1AC152AF1917FBAD80F0	SHA256:01D39F34AD2FAD394BAAE029ABF948F157663DC565CC4467FFBAC1C3B10B7E70
4880	7A02.tmp	C:\Users\admin\AppData\Local\Temp\7A50.tmp		executable
		MD5:D8C9BA6B12E4E283F96FD3F86C9B4984	SHA256:38B101DDB5BA92ABB0FD6B8BDA79E615C0F2E28EFC16306E94EC5B719200EB53
4012	7697.tmp	C:\Users\admin\AppData\Local\Temp\76F5.tmp		executable
		MD5:3CE8E019D2CBA15DB2F4169765C345E7	SHA256:1735C47EEF9E914147DDFDA0D053E4B9FE049BA7EB1459A76A34B401132089CD
4520	78D9.tmp	C:\Users\admin\AppData\Local\Temp\7947.tmp		executable
		MD5:DCCF74FD5F3D8181552A90989C70A781	SHA256:F252182E248C3883F1A3EECA27B4247033038FC888C4671ACFCB9A855C82F5C0
5168	2025-06-21_a03d11ac4e52fa569ecffd7dd6907eac_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\6FC1.tmp		executable
		MD5:346F7A539EC46356FA2EA1D5E0AD64E7	SHA256:547F5E54792FEDB577FC352724408A535AB89F0D58AE332687B7A5D1CB31BFB1
4456	7A50.tmp	C:\Users\admin\AppData\Local\Temp\7D6D.tmp		executable
		MD5:0C518925288F328B624987D09B27BC2D	SHA256:B6059021D09A545198518CC64339CB6D4D073BFE512793FD0A257BA5DA0070CA
4172	702E.tmp	C:\Users\admin\AppData\Local\Temp\708C.tmp		executable
		MD5:09D46D89915ABFB8043F53670517E0C3	SHA256:C9871762B03DABE888D78FF8C464E45E4283CAFB3CAC88C2C74BB675D95F2DD9

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
4236	RUXIMICS.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	400	20.190.160.3:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
1268	svchost.exe	GET	200	23.55.104.172:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.160.65:443	https://login.live.com/RST2.srf	unknown	xml	11.1 Kb	whitelisted
—	—	POST	200	40.126.32.134:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	16.7 Kb	whitelisted
—	—	POST	200	20.190.160.66:443	https://login.live.com/RST2.srf	unknown	xml	10.3 Kb	whitelisted
4236	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	40.126.32.76:443	https://login.live.com/RST2.srf	unknown	xml	11.0 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4236	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1268	svchost.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
4236	RUXIMICS.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
5944	MoUsoCoreWorker.exe	23.55.104.172:80	crl.microsoft.com	Akamai International B.V.	US	whitelisted
1268	svchost.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
4236	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 4.231.128.59 40.127.240.158	whitelisted
google.com	142.250.184.238	whitelisted
crl.microsoft.com	23.55.104.172 23.55.104.190	whitelisted
www.microsoft.com	95.101.149.131	whitelisted
login.live.com	40.126.32.140 20.190.160.5 20.190.160.20 40.126.32.68 40.126.32.72 20.190.160.2 20.190.160.67 40.126.32.76	whitelisted
client.wns.windows.com	172.211.123.249 172.211.123.250	whitelisted
nexusrules.officeapps.live.com	52.111.229.43	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	13.95.31.18	whitelisted
activation-v2.sls.microsoft.com	20.83.72.98 40.91.76.224	whitelisted

General Info

2025-06-21_a03d11ac4e52fa569ecffd7dd6907eac_elex_mafia

A03D11AC4E52FA569ECFFD7DD6907EAC

76C68BD3084EB67EF3D2515916353AC8D3AB32FB

5230D865E48E83E320097546BDC37D20056E3D4235AA9A19FB0AA7E3C4C2A1C0

24576:GEY89WxCzzPtY5LPp+EseeMK7++frh4s9paiyxQTnExyz:GEY89WxCzzPtY5LPp+EseeMW++frh4s1

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings