This allows users an easy way to whitelist domains using the domain.txt file located in cwd/whitelist/.  This signature caused misleading "hits "that require the analyst to spend large amounts of time sifting through legitimate URL's in order to find a malicious URL.

Microsoft states that:
"Owner File (Same Directory as Source File)
When a previously saved file is opened for editing, for printing, or for review, Word creates a temporary file that has a .doc file name extension. This file name extension begins with a tilde (~) that is followed by a dollar sign ($) that is followed by the remainder of the original file name."
https://support.microsoft.com/en-us/help/211632/description-of-how-word-creates-temporary-files