File name:	2025-08-01_fa7f1b80e57b45e2ede7eb60ee23fe78_elex_mafia.exe
Full analysis:	https://app.any.run/tasks/4e3e10bf-ac08-4e72-89ce-7a5b6de69a43
Verdict:	Malicious activity
Analysis date:	August 01, 2025, 02:06:39
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:	FA7F1B80E57B45E2EDE7EB60EE23FE78
SHA1:	67F024479E1B5A8FB15DA953CCA684BE14064A11
SHA256:	8B618DD44C25ACA9292FFC0EC1295AAC9A3593E1BC60FB8A3352928C661E7F23
SSDEEP:	12288:cbY1ZDn6GOEtcgjnUCosQgxjXg4mM7weZNS3wxes+VVh6yzDc:cbY7DncCosQcXgRKwuS3yesXyzY

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2003:11:11 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
3580	DD0D.tmp	C:\Users\admin\AppData\Local\Temp\DD6A.tmp		executable
		MD5:4680BA665E24C7F9BAA7C7326F846796	SHA256:0190BE1A2736527E99F751121A2DD5714225E5C39704AB55614571547D9DDBE2
2220	DC51.tmp	C:\Users\admin\AppData\Local\Temp\DCAF.tmp		executable
		MD5:71AB76DA015E261FBFE9D6DEC6DBAEF3	SHA256:F02F0A103106CD975418E9B71A1CCF654AB316332564C963F6E0DEF1C82F2668
2388	DB38.tmp	C:\Users\admin\AppData\Local\Temp\DB96.tmp		executable
		MD5:F3E7DE7DEEF9D85185D917B1CF94AC5B	SHA256:BD8560F306941B06C4F626CE580F2DE47F4FA08CCEFCB647D197A0ADBCC71CAA
1964	DD6A.tmp	C:\Users\admin\AppData\Local\Temp\DDC8.tmp		executable
		MD5:21B736849BAEC653730CC83A9C08A328	SHA256:74D30BFF8063DB20BA85F6113418E7F2CD31AD90FA94A669C4DE34679D609D30
7084	DEF1.tmp	C:\Users\admin\AppData\Local\Temp\DF4F.tmp		executable
		MD5:C17A64B5B22F337F4E655936BD819E97	SHA256:8AC11A0861C7AF7FEFCC977ECD1CA1C3ED2D35BB0204436D38F1227A22913D97
3108	DEA3.tmp	C:\Users\admin\AppData\Local\Temp\DEF1.tmp		executable
		MD5:305810856033F8177E08D068930BE270	SHA256:06EE935AF8DD0D10EE02B839D19DAF28343F1C520A8F29CCA0290F0B5F552A12
4200	DDC8.tmp	C:\Users\admin\AppData\Local\Temp\DE36.tmp		executable
		MD5:CEAAF9BB90AE4339FFA11B7CC90EBBBC	SHA256:8321F296542E6FF6BD87114688DAD850E1FA5C70BB0491F07C50B4EC874310E3
3288	DE36.tmp	C:\Users\admin\AppData\Local\Temp\DEA3.tmp		executable
		MD5:1F1EFACE8344B6A5790DDFAE79FBF352	SHA256:6A2FE27D96FBBAAF8D09041C3835299DB76F2015C9611CC475A0B67D7932E53F
1872	DFCC.tmp	C:\Users\admin\AppData\Local\Temp\E049.tmp		executable
		MD5:FBAD1AEF40FE3154CC33201864F8EF34	SHA256:2C36E0B8D6148232BA908DA2F64B2F362B805D12D9CF15B021B1867A8D205D3D
4912	DF4F.tmp	C:\Users\admin\AppData\Local\Temp\DFCC.tmp		executable
		MD5:5A1C542E825E18B98AB0BE354866288B	SHA256:D50D3AB2851160A7DD80D599403758276898332866ECBD6F825E79DDBD115396

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
2040	RUXIMICS.exe	GET	200	2.16.241.14:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	2.16.241.14:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
2040	RUXIMICS.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
5944	MoUsoCoreWorker.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
—	—	POST	400	20.190.160.65:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	—	—	whitelisted
1268	svchost.exe	GET	200	95.101.149.131:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	NL	binary	814 b	whitelisted
1268	svchost.exe	GET	200	2.16.241.14:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	DE	binary	825 b	whitelisted
—	—	POST	400	40.126.32.136:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	203 b	whitelisted
6180	SIHClient.exe	GET	200	23.35.229.160:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl	DE	binary	813 b	whitelisted
—	—	POST	200	40.126.32.136:443	https://login.live.com/ppsecure/deviceaddcredential.srf	US	text	16.7 Kb	whitelisted

PID	Process	IP	Domain	ASN	CN	Reputation
5944	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
1268	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2040	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	2.16.241.14:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
2040	RUXIMICS.exe	2.16.241.14:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	2.16.241.14:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
5944	MoUsoCoreWorker.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted
2040	RUXIMICS.exe	95.101.149.131:80	www.microsoft.com	Akamai International B.V.	NL	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 4.231.128.59	whitelisted
google.com	142.250.185.206	whitelisted
crl.microsoft.com	2.16.241.14 2.16.241.12 23.216.77.6 23.216.77.28	whitelisted
www.microsoft.com	95.101.149.131 23.35.229.160	whitelisted
login.live.com	20.190.160.14 20.190.160.128 20.190.160.65 20.190.160.2 20.190.160.3 40.126.32.138 20.190.160.64 20.190.160.132	whitelisted
client.wns.windows.com	172.211.123.249	whitelisted
slscr.update.microsoft.com	20.12.23.50	whitelisted
fe3cr.delivery.mp.microsoft.com	20.3.187.198	whitelisted
self.events.data.microsoft.com	52.182.141.63	whitelisted
activation-v2.sls.microsoft.com	40.91.76.224 20.83.72.98	whitelisted

General Info

2025-08-01_fa7f1b80e57b45e2ede7eb60ee23fe78_elex_mafia.exe

FA7F1B80E57B45E2EDE7EB60EE23FE78

67F024479E1B5A8FB15DA953CCA684BE14064A11

8B618DD44C25ACA9292FFC0EC1295AAC9A3593E1BC60FB8A3352928C661E7F23

12288:cbY1ZDn6GOEtcgjnUCosQgxjXg4mM7weZNS3wxes+VVh6yzDc:cbY7DncCosQcXgRKwuS3yesXyzY

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Starts itself from another location

Starts application with an unusual extension

Executable content was dropped or overwritten

INFO

Checks supported languages

Reads the computer name

Reads the machine GUID from the registry

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings