File name:

zamówienie_115295 1X40HC.docx

Full analysis: https://app.any.run/tasks/857f40f4-2317-4da1-930d-f6eb22b64166
Verdict: Malicious activity
Analysis date: October 22, 2025, 09:03:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
qrcode
qr-redirect
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

5BFBFE8380FED6B81AF7E1A2C51D5FB4

SHA1:

07399729D3533A76936C6101918797765F9716EF

SHA256:

51AAA8846BD3BCB529CFC6F868ADD40C19839D692D9ED218C97FB58BE39FCC7B

SSDEEP:

6144:620BTmNalef+haJrFVzzyTeyZvREVFoVLqCq7+/MuvyZmmHysUkoN4:B0BTmNzf+YJrFRzV1YMnuvy1ysUkoN4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Detected QR code with redirect chain

      • WINWORD.EXE (PID: 7472)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0002
ZipCompression: Deflated
ZipModifyDate: 2025:10:22 12:06:52
ZipCRC: 0x29502273
ZipCompressedSize: 425
ZipUncompressedSize: 2492
ZipFileName: [Content_Types].xml

XML

Template: Normal.dotm
TotalEditTime: 1 minute
Pages: 1
Words: -
Characters: -
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: Grizli777
LinksUpToDate: No
CharactersWithSpaces: -
SharedDoc: No
HyperlinksChanged: No
AppVersion: 12
Keywords: -
LastModifiedBy: 91974
RevisionNumber: 3
CreateDate: 2025:10:21 12:50:00Z
ModifyDate: 2025:10:21 12:51:00Z

XMP

Title: -
Subject: -
Creator: 91974
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
3
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winword.exe ai.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2548C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7472"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\zamówienie_115295 1X40HC.docx" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
8024"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "57FB5304-0511-448A-AF77-318BA7961A04" "6E6DA4F2-7AC7-4FFC-B936-1CD6D17D8572" "7472"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\rpcrt4.dll
Total events
11 131
Read events
10 872
Write events
240
Delete events
19

Modification events

(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7472
Operation:writeName:0
Value:
0B0E108D91B7A9CDA3154A8AAC15C33C213D1F230046FFD2EEFAABE690EE016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511B03AD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(7472) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
33
Suspicious files
129
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
7472WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:813EBEB0AEC1D5C225FE1F1EB6FEDFA0
SHA256:51F6ABF0FAE0F89174AD893D9825D1C287ED038DDF6A9EDAEBE4D410CCC25C3A
7472WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
7472WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbresbinary
MD5:2F10EDB3A6F77E67BEC5272A2532304F
SHA256:2FED662B587EA9A78270A398F049C36AB8F47B86E7F24DADEBDDA81453AAC462
7472WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\ResourceInfoCache\data.jsonbinary
MD5:172C4C4BA25D4D9E50EDE7FF4808AD90
SHA256:D292F4A02038EA2827177C7B7CDC252B22E7C709637E73D39BE3A4ED713DEC93
7472WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\91FEC90C.emfbinary
MD5:EBF4E8A0C6DA09BA161131F7EFBF2D0D
SHA256:14A270FC8CD95D39DA9CA97F8190B16F432DC353DC55D29829C537E1D56F65B0
7472WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:AF7195BC522D11522D353374938AC4E2
SHA256:9EF96C95E0382092F7333791760CE87FCC055334E3CFFB9A07E6962818D5FF42
7472WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\ResourceInfoCache\07fc2a8c43a1d1f16572d21e959a4847e306edae.tempbinary
MD5:172C4C4BA25D4D9E50EDE7FF4808AD90
SHA256:D292F4A02038EA2827177C7B7CDC252B22E7C709637E73D39BE3A4ED713DEC93
7472WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
7472WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C0E5238609191CF60F46D128FEEF9BF4
SHA256:0F71708DBFEE304A55C01245E2E13067D295D1BCBECC1089D2077AACBA83FD5A
7472WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:733AC63FAA562ADA9A6D0BCC91850BCE
SHA256:A3EEF2CF8C2D5CC7260A5CA041EBE79D6CA16633D6118708E5C4ACC235029752
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
20
TCP/UDP connections
87
DNS requests
27
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7472
WINWORD.EXE
GET
200
216.58.206.35:80
http://c.pki.goog/r/r4.crl
US
binary
530 b
whitelisted
7472
WINWORD.EXE
GET
200
216.58.206.35:80
http://c.pki.goog/r/gsr1.crl
US
binary
1.70 Kb
whitelisted
7472
WINWORD.EXE
HEAD
200
23.95.117.246:80
http://23.95.117.246/90/cvd3dd0ok0s0/sdo09ewsdf023jfkjsdxc0vxc90sd9f3f9df90cxv9x0vsfjsdkfj090xc00sfsd399sdf00xcv0xv0e90w.doc
US
—
—
unknown
7472
WINWORD.EXE
GET
200
23.95.117.246:80
http://23.95.117.246/90/cvd3dd0ok0s0/sdo09ewsdf023jfkjsdxc0vxc90sd9f3f9df90cxv9x0vsfjsdkfj090xc00sfsd399sdf00xcv0xv0e90w.doc
US
text
57.2 Kb
unknown
7472
WINWORD.EXE
HEAD
200
23.95.117.246:80
http://23.95.117.246/90/cvd3dd0ok0s0/sdo09ewsdf023jfkjsdxc0vxc90sd9f3f9df90cxv9x0vsfjsdkfj090xc00sfsd399sdf00xcv0xv0e90w.doc
US
text
57.2 Kb
unknown
7472
WINWORD.EXE
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
US
binary
471 b
whitelisted
7088
SearchApp.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
2336
svchost.exe
GET
304
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
—
—
whitelisted
2336
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
5308
backgroundTaskHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2388
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5596
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5280
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7472
WINWORD.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7472
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7472
WINWORD.EXE
23.50.131.85:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted
7472
WINWORD.EXE
104.21.66.222:443
u.els.re
CLOUDFLARENET
—
unknown
7472
WINWORD.EXE
216.58.206.35:80
c.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
omex.cdn.office.net
  • 23.50.131.85
  • 23.50.131.74
  • 23.50.131.71
  • 23.50.131.79
whitelisted
u.els.re
  • 104.21.66.222
  • 172.67.164.180
unknown
c.pki.goog
  • 216.58.206.35
whitelisted
messaging.lifecycle.office.com
  • 52.111.243.12
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
self.events.data.microsoft.com
  • 20.42.72.131
  • 40.79.150.122
whitelisted
ocsp.digicert.com
  • 172.66.2.5
  • 162.159.142.9
whitelisted
www.bing.com
  • 2.16.241.218
  • 2.16.241.214
  • 2.16.241.212
  • 2.16.241.209
  • 2.16.241.217
  • 2.16.241.215
  • 2.16.241.211
  • 2.16.241.208
  • 2.16.241.210
whitelisted

Threats

PID
Process
Class
Message
7472
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
7472
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
7472
WINWORD.EXE
Misc activity
ET INFO Observed UA-CPU Header
7472
WINWORD.EXE
Potentially Bad Traffic
ET HUNTING Microsoft Office User-Agent Requesting A Doc File
7472
WINWORD.EXE
Potentially Bad Traffic
ET INFO Dotted Quad Host DOC Request
7472
WINWORD.EXE
Misc activity
ET USER_AGENTS Microsoft Office Existence Discovery User-Agent
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
zamówienie_115295 1X40HC.docx