| Name | 5ec1ff15f26c3959_~$normal.dotm |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| Size | 162.0B |
| Processes | 2548 (WINWORD.EXE) |
| Type | data |
| MD5 | 5ea4e48efa6f5719d6f5ee02bdc4aac4 |
| SHA1 | af4f005be42f8127ba439208ad5f5379ebc92f93 |
| SHA256 | 5ec1ff15f26c39591cc112f5884f624cea464ccf3f915056a71659ed46a56e44 |
| CRC32 | 42980862 |
| ssdeep | 3:yW2lWRdvL7YMlbK7lYt:y1lWnlxK7O |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | b3d510ef04275ca8_excludedictionaryen0409.lex |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex |
| Size | 2.0B |
| Processes | 2548 (WINWORD.EXE) |
| Type | Little-endian UTF-16 Unicode text, with no line terminators |
| MD5 | f3b25701fe362ec84616a93a45ce9998 |
| SHA1 | d62636d8caec13f04e28442a0a6fa1afeb024bbb |
| SHA256 | b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209 |
| CRC32 | 88F83096 |
| ssdeep | 3:Qn:Qn |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | b01ecf599c40aaae_~$foj2betk-anlznaabgmxyuiss28.docx |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Temp\~$FOJ2betk-ANLZNAABGmXYUiss28.docx |
| Size | 162.0B |
| Processes | 2548 (WINWORD.EXE) |
| Type | data |
| MD5 | 2c6f5682e49491ab406b1b6d8f6ac53e |
| SHA1 | 3bcb124938e75b7b74ac7988dcb9507de51434a8 |
| SHA256 | b01ecf599c40aaae4dd3b2f07d39cd82206ca79eb600d1155abaa9a04cf12218 |
| CRC32 | 416DDE5C |
| ssdeep | 3:yW2lWRdvL7YMlbK7lhZrnrnt:y1lWnlxK7Rrnrn |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 87b8bf0f0210a0ad_~wrs{e89d5ee4-8f4b-42b1-9755-0520fa4bd3cb}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{E89D5EE4-8F4B-42B1-9755-0520FA4BD3CB}.tmp |
| Size | 11.0KB |
| Processes | 2548 (WINWORD.EXE) |
| Type | data |
| MD5 | 3b214bb7e0d8c0515b640368e72abcc3 |
| SHA1 | bd028cc3cd15c6e792dfe0d6c2af0ce5d8544971 |
| SHA256 | 87b8bf0f0210a0ad46a0d782f0deb6a777ffd2954bd50b1154893ae9216e8eb8 |
| CRC32 | 9E474CE5 |
| ssdeep | 96:yHN2z//+GlN1PpHTHWUXxDCXgZFKUtZOEVk1AutpgxlhWkQjkcKKNcJ:z110gZFBIiu3gjlQjkcKL |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4826c0d860af884d_~wrs{bfb6cb33-d795-45a3-83f9-e6d7f4190124}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{BFB6CB33-D795-45A3-83F9-E6D7F4190124}.tmp |
| Size | 1.0KB |
| Processes | 2548 (WINWORD.EXE) |
| Type | data |
| MD5 | 5d4d94ee7e06bbb0af9584119797b23a |
| SHA1 | dbb111419c704f116efa8e72471dd83e86e49677 |
| SHA256 | 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1 |
| CRC32 | 23C03491 |
| ssdeep | 3:ol3lYdn:4Wn |
| Yara | None matched |
| VirusTotal | Search for analysis |