File name:	2025-08-01_fa7f1b80e57b45e2ede7eb60ee23fe78_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/4e3e10bf-ac08-4e72-89ce-7a5b6de69a43
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 02:06:39
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	FA7F1B80E57B45E2EDE7EB60EE23FE78
SHA1:	67F024479E1B5A8FB15DA953CCA684BE14064A11
SHA256:	8B618DD44C25ACA9292FFC0EC1295AAC9A3593E1BC60FB8A3352928C661E7F23
SSDEEP:	12288:cbY1ZDn6GOEtcgjnUCosQgxjXg4mM7weZNS3wxes+VVh6yzDc:cbY7DncCosQcXgRKwuS3yesXyzY

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
640	D9B1.tmp	C:\Users\admin\AppData\Local\Temp\DA1F.tmp		executable
		MD5:7296CC8671BBE623A2FF0B6D3037AA2B	SHA256:F2B4F240C850AA575C4F5C711426229F8E4F0B5592285D868D673BACEEB514E2
5764	DCAF.tmp	C:\Users\admin\AppData\Local\Temp\DD0D.tmp		executable
		MD5:F61CBC458F33143DF01A3B469B9EA183	SHA256:9F23E84B2A2ED9E85F5400ECE49F7187DB9C62526A3597FECE4905FB23A58AAA
2168	DADA.tmp	C:\Users\admin\AppData\Local\Temp\DB38.tmp		executable
		MD5:80565892C1FC0F168AA5C8D2F1B29338	SHA256:66338AB04CFDBC6CEB005D01C39022594004CDC721518908BFA188A8C63F8B0D
3788	DA7C.tmp	C:\Users\admin\AppData\Local\Temp\DADA.tmp		executable
		MD5:0B4D7914BF9CEB3B75F65DA52D601494	SHA256:676A35EEBBB3CCAFB9614E0C9E5842D890799F3897D32D6CB3C6929C77377A21
984	DB96.tmp	C:\Users\admin\AppData\Local\Temp\DBF3.tmp		executable
		MD5:9C5873BB6A7C6E8421006FC2073CB169	SHA256:F7D1027501335564E3FC8D6E0EF907A91C6126687744E3FC6721008618E250B1
2388	DB38.tmp	C:\Users\admin\AppData\Local\Temp\DB96.tmp		executable
		MD5:F3E7DE7DEEF9D85185D917B1CF94AC5B	SHA256:BD8560F306941B06C4F626CE580F2DE47F4FA08CCEFCB647D197A0ADBCC71CAA
2468	2025-08-01_fa7f1b80e57b45e2ede7eb60ee23fe78_elex_mafia.exe	C:\Users\admin\AppData\Local\Temp\D9B1.tmp		executable
		MD5:76DE2DE7A5C7B6E555819744FDA222C4	SHA256:6FE6C6670DBA837084AA857AF97FB5A3ED3BE434C3BD92F7385C5D21A2AE31F4
5436	DA1F.tmp	C:\Users\admin\AppData\Local\Temp\DA7C.tmp		executable
		MD5:8769DF6F9ACF2151AB5D704B1F2099A6	SHA256:17B46E0CDD5AAB730A8DA22B633AB3770469DF5B68B445C7677EC5DFC54EB50B
6012	DBF3.tmp	C:\Users\admin\AppData\Local\Temp\DC51.tmp		executable
		MD5:9975DB6E327A32A1832B89FC1819BE67	SHA256:5F11D1573C24D9F86FD396CBD44D548E6094C3C141B0CCB7A1BB1015C2495964
3580	DD0D.tmp	C:\Users\admin\AppData\Local\Temp\DD6A.tmp		executable
		MD5:4680BA665E24C7F9BAA7C7326F846796	SHA256:0190BE1A2736527E99F751121A2DD5714225E5C39704AB55614571547D9DDBE2

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2040	RUXIMICS.exe	GET	200	2.16.241.14:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.16.241.14:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	2.16.241.14:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
2040	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
—	—	POST	200	20.190.160.17:443	https://login.live.com/RST2.srf	unknown	xml	1.24 Kb	whitelisted
—	—	POST	400	20.190.160.65:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	—	—	whitelisted
—	—	POST	400	40.126.32.136:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted
—	—	POST	400	20.190.160.5:443	https://login.live.com/ppsecure/deviceaddcredential.srf	unknown	text	203 b	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2040	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	2.16.241.14:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2040	RUXIMICS.exe	2.16.241.14:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	2.16.241.14:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
2040	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59	whitelisted
google.com	142.250.185.206	whitelisted
crl.microsoft.com	2.16.241.14 2.16.241.12 23.216.77.6 23.216.77.28	whitelisted
www.microsoft.com	95.101.149.131 23.35.229.160	whitelisted
login.live.com	20.190.160.14 20.190.160.128 20.190.160.65 20.190.160.2 20.190.160.3 40.126.32.138 20.190.160.64 20.190.160.132	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198	whitelisted
self.events.data.microsoft.com	52.182.141.63	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224 20.83.72.98	whitelisted

General Info

2025-08-01_fa7f1b80e57b45e2ede7eb60ee23fe78_elex_mafia.exe

FA7F1B80E57B45E2EDE7EB60EE23FE78

67F024479E1B5A8FB15DA953CCA684BE14064A11

8B618DD44C25ACA9292FFC0EC1295AAC9A3593E1BC60FB8A3352928C661E7F23

12288:cbY1ZDn6GOEtcgjnUCosQgxjXg4mM7weZNS3wxes+VVh6yzDc:cbY7DncCosQcXgRKwuS3yesXyzY

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Process drops legitimate windows executable

Starts itself from another location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Checks supported languages

Reads the machine GUID from the registry

Reads the computer name

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings