File name:	6b6bc4c99440c31c2d3284e5f007ca802fb0bdcc01f61dd3e714ab3f49f3fb3f.exe
Full analysis:	https://app.any.run/tasks/3aef1997-d861-4be1-8d87-f9d989a04e1e
Verdict:	Malicious activity
Analysis date:	November 18, 2025, 06:05:04
OS:	Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:	11C1F2EB1F5648774FCC1548F4AA7842
SHA1:	451B821565BB2750B7015E8A0FF6C946C33835D5
SHA256:	6B6BC4C99440C31C2D3284E5F007CA802FB0BDCC01F61DD3E714AB3F49F3FB3F
SSDEEP:	24576:msYXjV7IC34cU7tfv6NxhdXNcdJFyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVEC34cKt36NxhdXNcdJFyzSoq55

.exe	\|	Win32 Executable MS Visual C++ (generic) (42.2)
.exe	\|	Win64 Executable (generic) (37.3)
.dll	\|	Win32 Dynamic Link Library (generic) (8.8)
.exe	\|	Win32 Executable (generic) (6)
.exe	\|	Generic Win/DOS Executable (2.7)

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	1999:10:03 14:39:16+00:00
ImageFileCharacteristics:	Executable, 32-bit
PEType:	PE32
LinkerVersion:	10
CodeSize:	140288
InitializedDataSize:	356352
UninitializedDataSize:	-
EntryPoint:	0x113b6
OSVersion:	5.1
ImageVersion:	-
SubsystemVersion:	5.1
Subsystem:	Windows GUI
FileVersionNumber:	12.0.4518.1014
ProductVersionNumber:	12.0.4518.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Windows, Latin1
CompanyName:	Microsoft Corporation
FileDescription:	Microsoft Office Word
FileVersion:	12.0.4518.1014
InternalName:	WinWord
LegalCopyright:	© 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1:	Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2:	Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName:	WinWord.exe
ProductName:	2007 Microsoft Office system
ProductVersion:	12.0.4518.1014

PID	Process	Filename		Type
7524	2EA6.tmp	C:\Users\admin\AppData\Local\Temp\2F13.tmp		executable
		MD5:CE33B4D8FFD5D3C1E5E58778B0ECA9E8	SHA256:402F2BAD6D1D3A615A9B44DCF79F35ABCC956B7BE518DEE6151675FD75EECEE5
7452	2D8D.tmp	C:\Users\admin\AppData\Local\Temp\2DEA.tmp		executable
		MD5:5E38D5A0ACA1FC05C377C65F090006AA	SHA256:CB72A0718B85671EAB5479F33F89AD49A1A0FD34AA5FED7B1211FE4D9B92F0F0
7476	2DEA.tmp	C:\Users\admin\AppData\Local\Temp\2E48.tmp		executable
		MD5:6B329DA842E30874DE94E08C0C3CB1BF	SHA256:CC8F2D9E550C16F2032E99198B91298FE4CC1E916171660F7CE5EEA288B159DD
7548	2F13.tmp	C:\Users\admin\AppData\Local\Temp\2F81.tmp		executable
		MD5:875FB2001792E1308B0E5D2E228B79BA	SHA256:875FD9E619DA2F4C992C3FF981B29DABD9197E7EFBCA2EE994F664CD1B3FD292
7744	3127.tmp	C:\Users\admin\AppData\Local\Temp\3184.tmp		executable
		MD5:00EFC54BA2A54CD44275096F64B2B241	SHA256:17746B79E23EC14FD82DC1A6A60BDF8A46F3F8D5E83AFE0AD9F034AC46FBE362
7624	2FDE.tmp	C:\Users\admin\AppData\Local\Temp\304C.tmp		executable
		MD5:BE22BCF98E504EEB8A497D121A69528F	SHA256:2EA4A740E6F67AF30E19A085EE89E358239A8BB453FE24ABDD885D3A8E2AE84D
7432	6b6bc4c99440c31c2d3284e5f007ca802fb0bdcc01f61dd3e714ab3f49f3fb3f.exe	C:\Users\admin\AppData\Local\Temp\2D8D.tmp		executable
		MD5:47483CF086F2252AE2B90B20191E6CC7	SHA256:2F430C3B885E5547EBC991FA41446DE21E45EFC374D193739C2BDF06B8017A26
7500	2E48.tmp	C:\Users\admin\AppData\Local\Temp\2EA6.tmp		executable
		MD5:3F66337B7C6B833E5B8234B780206863	SHA256:114EF26228E767AABBFFC310DC35994041912FF54E41605CABAC75AC87D23757
7592	2F81.tmp	C:\Users\admin\AppData\Local\Temp\2FDE.tmp		executable
		MD5:306C86C98B3A241E32693E3F108AFDB5	SHA256:921B4D4CBAC92A13A5D4A34100EFFBE05F7B9C00B930663B9DCAD25B8ED957FC
7656	304C.tmp	C:\Users\admin\AppData\Local\Temp\30B9.tmp		executable
		MD5:6E4FB42EDAD071DBD7A09895F61ED623	SHA256:CE500CBAEE4B82BACBA0F39E4032F7950E509BDD50A248824B6AEC7DA1EC8357

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
5596	MoUsoCoreWorker.exe	GET	200	95.101.78.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
1284	svchost.exe	GET	200	95.101.78.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
4900	RUXIMICS.exe	GET	200	95.101.78.42:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	NL	binary	825 b	whitelisted
—	—	POST	500	4.154.185.43:443	https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail	US	xml	512 b	unknown

PID	Process	IP	Domain	ASN	CN	Reputation
1284	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
5596	MoUsoCoreWorker.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4900	RUXIMICS.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
—	—	2.16.204.161:443	www.bing.com	Akamai International B.V.	DE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
5596	MoUsoCoreWorker.exe	95.101.78.42:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
1284	svchost.exe	95.101.78.42:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
4900	RUXIMICS.exe	95.101.78.42:80	crl.microsoft.com	Akamai International B.V.	NL	whitelisted
5524	svchost.exe	4.231.128.59:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted

Domain	IP	Reputation
settings-win.data.microsoft.com	4.231.128.59	whitelisted
www.bing.com	2.16.204.161 2.16.204.155 2.16.204.134 2.16.204.146 2.16.204.135	whitelisted
google.com	142.250.181.238	whitelisted
crl.microsoft.com	95.101.78.42 95.101.78.32	whitelisted
activation-v2.sls.microsoft.com	4.154.185.43	whitelisted

General Info

6b6bc4c99440c31c2d3284e5f007ca802fb0bdcc01f61dd3e714ab3f49f3fb3f.exe

11C1F2EB1F5648774FCC1548F4AA7842

451B821565BB2750B7015E8A0FF6C946C33835D5

6B6BC4C99440C31C2D3284E5F007CA802FB0BDCC01F61DD3E714AB3F49F3FB3F

24576:msYXjV7IC34cU7tfv6NxhdXNcdJFyzSCvq5TJLCvY90D8/LVBlVk736Y79GWzNbA:msYXjVEC34cKt36NxhdXNcdJFyzSoq55

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

SUSPICIOUS

Starts a Microsoft application from unusual location

Starts application with an unusual extension

Process drops legitimate windows executable

Executable content was dropped or overwritten

Starts itself from another location

INFO

Reads the machine GUID from the registry

Reads the computer name

Checks supported languages

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings