| Name | bc606b151f4e3409_~$diplo.doc |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$diplo.doc |
| Size | 162.0B |
| Processes | 2396 (WINWORD.EXE) |
| Type | data |
| MD5 | 0234714037ec47490aca9abb10846661 |
| SHA1 | b790ebdfc505cad904a22039e9e57c33add91478 |
| SHA256 | bc606b151f4e3409802512c34291d5d7f84e5e50ab9bf5089a74472572a3f27b |
| CRC32 | AEDF88DB |
| ssdeep | 3:yW2lWRdR/SloW6L7BaTK77h/MHItS/1RNX:y1lWV/SloWmUK71/M4k |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | e36ceb61d157fc14_~$23_4173005610193.doc |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Temp\~$23_4173005610193.doc |
| Size | 162.0B |
| Processes | 2396 (WINWORD.EXE) |
| Type | data |
| MD5 | 3e020d94f1a2c97baa5253837a124dfa |
| SHA1 | 56eca382797f3ac3b183eb25899f6dc912e3eeb8 |
| SHA256 | e36ceb61d157fc14b264de285bb8e0e8ad7e88484bc549901de745f6d8ee292b |
| CRC32 | 742CCA33 |
| ssdeep | 3:yW2lWRdR/SloW6L7BaTK77h/MHItS/1RCJ/:y1lWV/SloWmUK71/M4z |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 5dfd38c9a84532be_~wrs{e278515f-f312-4b8c-a98d-8fd2b6b138c3}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E278515F-F312-4B8C-A98D-8FD2B6B138C3}.tmp |
| Size | 1.5KB |
| Processes | 2396 (WINWORD.EXE) |
| Type | data |
| MD5 | 1dfcb583ef2101158eef11169713fe5f |
| SHA1 | 09344e18c17fd18284e77b37ba568c675ff01f35 |
| SHA256 | 5dfd38c9a84532bec35b04abf049e43716b93aca205e3c437e70cff852acf0b2 |
| CRC32 | EAEBCB40 |
| ssdeep | 3:FlgAg7NNKElClDK/ldl5vWGePllHl3lldfZl/BAlVzNZmElGwPxZlhRt3POD7jlF:fgFpUElClDK/CGePlIv54wPxZfODwi |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 0f9614b15c1d4679_index.dat |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\index.dat |
| Size | 120.0B |
| Processes | 2396 (WINWORD.EXE) |
| Type | ASCII text, with CRLF line terminators |
| MD5 | 7455090d1d76ef1ab9c632c91be5c116 |
| SHA1 | 3426135fbf05ffed4ea64720bc915777c1faea81 |
| SHA256 | 0f9614b15c1d4679fc17aee32f11b06d9e72adc78013beea9318415f2fed6d44 |
| CRC32 | 6F214E83 |
| ssdeep | 3:bDuMJlwcXAlWCZUJK1nzCmxWqJHp6rp2mX1621nzCv:bCkAkgUJUnzK9sgnzs |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4826c0d860af884d_~wrs{bcd817bf-0401-4125-8ed4-d0142b1340a0}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BCD817BF-0401-4125-8ED4-D0142B1340A0}.tmp |
| Size | 1.0KB |
| Processes | 2396 (WINWORD.EXE) |
| Type | data |
| MD5 | 5d4d94ee7e06bbb0af9584119797b23a |
| SHA1 | dbb111419c704f116efa8e72471dd83e86e49677 |
| SHA256 | 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1 |
| CRC32 | 23C03491 |
| ssdeep | 3:ol3lYdn:4Wn |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 168d0bc23f25018d_~$normal.dotm |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| Size | 162.0B |
| Processes | 2396 (WINWORD.EXE) |
| Type | data |
| MD5 | 0ba5da38c043c6630f4618c287f6b3bd |
| SHA1 | 8d0dcaa1693687ee4a0d755c0f522e658595ad5e |
| SHA256 | 168d0bc23f25018d7505471067f613f8f75b9884d1baf65e320bf28c783a1401 |
| CRC32 | 236E48D5 |
| ssdeep | 3:yW2lWRdR/SloW6L7BaTK77h/MHItS/1Rrtl:y1lWV/SloWmUK71/M4q |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | e545d395bb3fd971_~wrs{5432c525-704a-4080-a6c9-7c9149f86ced}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5432C525-704A-4080-A6C9-7C9149F86CED}.tmp |
| Size | 2.0B |
| Processes | 2396 (WINWORD.EXE) |
| Type | data |
| MD5 | 32649384730b2d61c9e79d46de589115 |
| SHA1 | 053d8d6ceeba9453c97d0ee5374db863e6f77ad4 |
| SHA256 | e545d395bb3fd971f91bf9a2b6722831df704efae6c1aa9da0989ed0970b77bb |
| CRC32 | 890098F7 |
| ssdeep | 3:X:X |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 8936df26e375204b_diplo.doc.lnk |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Office\Recent\diplo.doc.LNK |
| Size | 1.2KB |
| Processes | 2396 (WINWORD.EXE) |
| Type | MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Thu Sep 23 18:03:34 2021, mtime=Thu Sep 23 18:03:34 2021, atime=Thu Sep 23 18:03:34 2021, length=172544, window=hide |
| MD5 | a69f2ce61899e8a0b94e0824ffa0de4c |
| SHA1 | 4bb73f4844fb4b5d115ad57e8767cf03f0b93696 |
| SHA256 | 8936df26e375204b6cb9d825acbcc00831ff876019f48ff2fc81dd351ec8b761 |
| CRC32 | 943E7628 |
| ssdeep | 24:8yphvyuvqVRdxzIopvVxzNYuTKqDCLPyh:8yHvy4KXHxpYuTKHyh |
| Yara |
|
| VirusTotal | Search for analysis |
| Name | ef10b60ebe0d8db3_81130745.emf |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\81130745.emf |
| Size | 4.9KB |
| Processes | 2396 (WINWORD.EXE) |
| Type | Windows Enhanced Metafile (EMF) image data version 0x10000 |
| MD5 | 710e4d91678c5ae9dbf0aed585dc0554 |
| SHA1 | a1b682a2c5ee2b8ceed8a84f5943a2981abcbb01 |
| SHA256 | ef10b60ebe0d8db31064509384853b941f833c7c94816e55a62e98f72567f54b |
| CRC32 | F17482A5 |
| ssdeep | 96:QzOhv2+tgPk7mS+Dan9MYpnY9GumWB6VR237gO4xwgnamn:QzOhe+tH7ADa9MsnYoMB6VR2Lwugnh |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | bd338b6d0bed22d7_b1a3f754.emf |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\B1A3F754.emf |
| Size | 4.9KB |
| Processes | 2396 (WINWORD.EXE) |
| Type | Windows Enhanced Metafile (EMF) image data version 0x10000 |
| MD5 | bb7722a0184f576e9d9f1f42d260cb43 |
| SHA1 | 5679a52893aeb47774f47c9c3b352794bc6bee42 |
| SHA256 | bd338b6d0bed22d71d6232c4e20f610fc46a47721a9eeb2e57ad236b453462a8 |
| CRC32 | 5678CC33 |
| ssdeep | 48:OMDLvNfGYQ6dsdBg6qjpLkwOEG6kpYjdHkpaayN:bnVfT9MBFq9gVU5EfyN |
| Yara | None matched |
| VirusTotal | Search for analysis |