| Name | f19e69db644e61a9_g8ibcj9y.txt |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Cookies\G8IBCJ9Y.txt |
| Size | 81.0B |
| Processes | 544 (WINWORD.EXE) |
| Type | ASCII text |
| MD5 | f91c4c43f560881dc58eb74d184fe4bf |
| SHA1 | 3daf5105a5264f7fa1626b9e2a6b451730d12d7e |
| SHA256 | f19e69db644e61a90280db7c8769b27407031833b31dce97a1a7c5e9839a82ac |
| CRC32 | 1B9DB00B |
| ssdeep | 3:iw6SKBAnlKLIu1SvGcVXWG3vqp9X:54kuS3v49X |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 51fcdf3a76b6692e_~wrs{31c4a93f-3f20-4715-a4c3-b71bd4c8caec}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{31C4A93F-3F20-4715-A4C3-B71BD4C8CAEC}.tmp |
| Size | 1.5KB |
| Processes | 544 (WINWORD.EXE) |
| Type | data |
| MD5 | fb055c389208800f928b3502a6615abe |
| SHA1 | 14564d6e0e4ec0f9717c16471b75e44b5868290a |
| SHA256 | 51fcdf3a76b6692eaa84d280b39bdc081cf6e4808171e0ec0484229648400ae9 |
| CRC32 | 640E2478 |
| ssdeep | 6:IiiiiiiiiiE/bYflo30XOnySySkssqA1+tKfn:S/XkeySpk1j1+tKfn |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 64945e24d8dde382_~$normal.dotm |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| Size | 162.0B |
| Processes | 544 (WINWORD.EXE) |
| Type | data |
| MD5 | 797c7420742d78d0fd110487ec24e23f |
| SHA1 | 147b40c75c6511449cd7ac2d520f5b68c7b4c7c3 |
| SHA256 | 64945e24d8dde38214db0bd81dde27d1962c3c2dd5d32c5d158ddcde9ac791c1 |
| CRC32 | 516D8F88 |
| ssdeep | 3:yW2lWRdvL7YMlbK7g7lxIt50iSjlVt9n99K:y1lWnlxK7ghqqFdS |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4ec749c6690e81af_~$cument 896885.doc |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Temp\~$cument 896885.doc |
| Size | 162.0B |
| Processes | 544 (WINWORD.EXE) |
| Type | data |
| MD5 | b955ba1e76257f68b1587fad5c5c3178 |
| SHA1 | 71fc1bcea141219a941c8bd4a586744684fe6511 |
| SHA256 | 4ec749c6690e81afa64d764f6d6819d9df8cfd6c235acd76a4c373a7c4ac76cf |
| CRC32 | 95C2C0A8 |
| ssdeep | 3:yW2lWRdvL7YMlbK7g7lxIt50iSjlVtSllXK:y1lWnlxK7ghqqFSy |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4826c0d860af884d_~wrs{9cbd44f1-30e6-4ba2-a6f0-5968d632b94a}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9CBD44F1-30E6-4BA2-A6F0-5968D632B94A}.tmp |
| Size | 1.0KB |
| Processes | 544 (WINWORD.EXE) |
| Type | data |
| MD5 | 5d4d94ee7e06bbb0af9584119797b23a |
| SHA1 | dbb111419c704f116efa8e72471dd83e86e49677 |
| SHA256 | 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1 |
| CRC32 | 23C03491 |
| ssdeep | 3:ol3lYdn:4Wn |
| Yara | None matched |
| VirusTotal | Search for analysis |