| Name | 818ac9d3621dd802_~$normal.dotm |
|---|---|
| Filepath | C:\Users\test22\AppData\Roaming\Microsoft\Templates\~$Normal.dotm |
| Size | 162.0B |
| Processes | 1016 (WINWORD.EXE) |
| Type | data |
| MD5 | ee32490f318ff4e444547a5f83870e80 |
| SHA1 | 09f2ae32c5f293e2ad8ab9eef34b353b0f27362c |
| SHA256 | 818ac9d3621dd80293562e5769e503579c6e9fe996e67c6145f7984c532d2f9b |
| CRC32 | 1A78502A |
| ssdeep | 3:yW2lWRdvL7YMlbK7lznXl:y1lWnlxK7 |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 594f1fd4d0ed6060_~$nk transfer confirmation receipt in attachment.docx |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Temp\~$NK TRANSFER CONFIRMATION RECEIPT IN ATTACHMENT.docx |
| Size | 162.0B |
| Processes | 1016 (WINWORD.EXE) |
| Type | data |
| MD5 | f4b8e5e7ed68cdd478bbfe992d552f0b |
| SHA1 | f105a7755e725aec184252a6e517ec6a9f677aaa |
| SHA256 | 594f1fd4d0ed60604bbf677604227d30e42dbde9173c5364d10bc1456713ec86 |
| CRC32 | ED137E7A |
| ssdeep | 3:yW2lWRdvL7YMlbK7lZxnAkcl:y1lWnlxK73xnAk |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4826c0d860af884d_~wrs{5f8b61f0-3c4f-4530-a0a2-26cab4cfd072}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{5F8B61F0-3C4F-4530-A0A2-26CAB4CFD072}.tmp |
| Size | 1.0KB |
| Processes | 1016 (WINWORD.EXE) |
| Type | data |
| MD5 | 5d4d94ee7e06bbb0af9584119797b23a |
| SHA1 | dbb111419c704f116efa8e72471dd83e86e49677 |
| SHA256 | 4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1 |
| CRC32 | 23C03491 |
| ssdeep | 3:ol3lYdn:4Wn |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 48dcc3515f0a9134_7be406ca.emf |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7BE406CA.emf |
| Size | 5.5KB |
| Processes | 1016 (WINWORD.EXE) |
| Type | Windows Enhanced Metafile (EMF) image data version 0x10000 |
| MD5 | e88060ea3b9941a6184a993538e8931c |
| SHA1 | 3467041e5d1e7e729131f87c5d45f49f03c3e3af |
| SHA256 | 48dcc3515f0a913486442a5496ef2b91b9e5c510a2d57ee0f99fee84da509a86 |
| CRC32 | 710F0DB9 |
| ssdeep | 48:Z/S35g2OkzjQVUlBcu3xIBcE/U4lXDASl9RQdXXX4YbcUMgzOxMQbALi3SXwTxnK:ZKJhOk7c2bpXXX4vLE5unksOz |
| Yara | None matched |
| VirusTotal | Search for analysis |
| Name | 4b60235334172234_~wrs{c3418050-0471-4684-b992-ae3dca60fd0f}.tmp |
|---|---|
| Filepath | C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C3418050-0471-4684-B992-AE3DCA60FD0F}.tmp |
| Size | 1.5KB |
| Processes | 1016 (WINWORD.EXE) |
| Type | data |
| MD5 | b3cf68f75928c012759c454a7442fce1 |
| SHA1 | 855890be27c398196133ceb46849a7639843921e |
| SHA256 | 4b60235334172234e12b62e6019e0f9229a24805ad70b669330399a6b55e3e37 |
| CRC32 | 9EE1984F |
| ssdeep | 12:3pUMClDbXHH34UYBRgKMePElRO0ulmTcaVtOLIvkgCDanJ0Hn/Bhr7Zfk:3GMCl3nojpL2tu0dVt6IvXeau/3O |
| Yara | None matched |
| VirusTotal | Search for analysis |