24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2015-2545 Sample 7a2a172b13cb… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7a2a172b13cb…. Malware family: CVE-2015-2545. Threat score 100/100. 9/25 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7a2a172b13cbf05da0031afbd4532eb9712b5aa45569024435802daa2adaaf5b","keywords":["Malicious","CVE-2015-2545","malware analysis","sandbox report","threat intelligence","7a2a172b13cbf05da0031afbd4532eb9712b5aa45569024435802daa2adaaf5b"],"about":{"@type":"SoftwareApplication","name":"abafa0cbfbe18afe6dd635d14e7d03d3.hwp","applicationCategory":["hwp"],"identifier":"7a2a172b13cbf05da0031afbd4532eb9712b5aa45569024435802daa2adaaf5b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2015-2545","antivirusDetections":{"malicious":9,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T65c,SetUnhandledExceptionFilter@KERNEL32.DLL at 00022092-00004696-16824-16-011B2ADC SetUnhandledExceptionFilter@KERNEL32.DLL at 00022092-00004696-16824-17-011B28F5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00022092-00004696-16824-184-011B8BF7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00022092-00004696-16824-379-011B4E67 SetUnhandledExceptionFilter@KERNEL32.DLL at 00022288-00004084-24674-16-00401FF2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00022288-00004084-24674-17-00406B9E SetUnhandledExceptionFilter@KERNEL32.DLL at 00022288-00004084-24674-365-00404E87 SetUnhandledExceptionFilter@KERNEL32.DLL at 00022288-00004084-24674-242-0040B896 SetUnhandledExceptionFilter@KERNEL32.DLL at 00024606-00003428-36673-16-00401FF2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00024606-00003428-36673-17-00406B9E SetUnhandledExceptionFilter@KERNEL32.DLL at 00024606-00003428-36673-242-0040B896 SetUnhandledExceptionFilter@KERNEL32.DLL at 00024606-00003428-36673-365-00404E87 SetUnhandledExceptionFilter@KERNEL32.DLL at 00027279-00005208-46108-16-00401FF2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00027279-00005208-46108-17-00406B9E SetUnhandledExceptionFilter@KERNEL32.DLL at 00027279-00005208-46108-242-0040B896 SetUnhandledExceptionFilter@KERNEL32.DLL at 00027279-00005208-46108-365-00404E87 SetUnhandledExceptionFilter@KERNEL32.DLL at 00029017-00005324-57447-16-00401FF2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00029017-00005324-57447-17-00406B9E SetUnhandledExceptionFilter@KERNEL32.DLL at 00029017-00005324-57447-242-0040B896 SetUnhandledExceptionFilter@KERNEL32.DLL at 00029017-00005324-57447-365-00404E8726:T676,"Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFF33D0E043AC727ED.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF5BE18E7B48363814.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFA1808051D9095EBE.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF47488DFD62CC5D95.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF30045B0C70609C2A.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\Hnc\BinData\EMB00000f142574.eps" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gst3ECA.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gsa3ECA.tmp" "Hwp.exe" created file "C:\Users\eYPkqYr\AppData\Local\Temp\gse3ECA.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\Hwp80\abafa0cbfbe18afe6dd635d14e7d03d3.asv" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF03410BDAFFB556FB.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\Hnc\BinData\EMB00000f142576.eps" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gstCC45.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gsaCC45.tmp" "Hwp.exe" created file "C:\Users\eYPkqYr\AppData\Local\Temp\gseCC45.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\$$$00000f142577.bmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\prv00000f142575.gif" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gst6F6A.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gsa6F6A.tmp" "Hwp.exe" created file "C:\Users\eYPkqYr\AppData\Local\Temp\gse6F6A.tmp"27:T6e2,Process "HimTrayIcon.exe" (UID: 00022092-00004696) was launched with modified environment variables: "Path" Process "gbb.exe" (UID: 00022288-00004084) was launched with modified environment variables: "Path" Process "wscript.exe" (UID: 00022931-00004724) was launched with modified environment variables: "PSModulePath" Process "gbb.exe" (UID: 00024606-00003428) was launched with modified environment variables: "PSModulePath" Process "wscript.exe" (UID: 00025128-00004936) was launched with modified environment variables: "PSModulePath" Process "gbb.exe" (UID: 00027279-00005208) was launched with modified environment variables: "PSModulePath" Process "wscript.exe" (UID: 00027792-00005116) was launched with modified environment variables: "PSModulePath" Process "gbb.exe" (UID: 00029017-00005324) was launched with modified environment variables: "PSModulePath" Process "wscript.exe" (UID: 00029516-00004076) was launched with modified environment variables: "PSModulePath" Process "gbb.exe" (UID: 00029998-00006120) was launched with modified environment variables: "PSModulePath" Process "wscript.exe" (UID: 00030528-00003004) was launched with modified environment variables: "PSModulePath" Process "gbb.exe" (UID: 00031866-00005740) was launched with modified environment variables: "PSModulePath" Process "wscript.exe" (UID: 00032372-00003560) was launched with modified environment variables: "PSModulePath" Process "gbb.exe" (UID: 00032848-00003880) was launched with modified environment variables: "PSModulePath" Process "wscript.exe" (UID: 00033373-00002468) was launched with modified environment variables: "PSModulePath" Process "gbb.exe" (UID: 00034547-00004580) was launched with modified environment variables: "PSModulePath"28:T926,Spawned process "HimTrayIcon.exe" (UID: 00022092-00004696) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f142574.eps" "%TEMP%\gsb3ECA.tmp"" (UID: 00022288-00004084) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00022547-00002096) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa3ECA.tmp" (UID: 00022620-00001900) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\1.wsf"" (UID: 00022931-00004724) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f142576.eps" "%TEMP%\gsbCC45.tmp"" (UID: 00024606-00003428) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00024842-00003224) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsaCC45.tmp" (UID: 00024937-00002984) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\1.wsf"" (UID: 00025128-00004936) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f142576.eps" "%TEMP%\gsb6F6A.tmp"" (UID: 00027279-00005208) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00027508-00005440) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa6F6A.tmp" (UID: 00027611-00005540) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\1.wsf"" (UID: 00027792-00005116) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f142579.eps" "%TEMP%\gsbD98E.tmp"" (UID: 00029017-00005324) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00029236-00005284) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsaD98E.tmp" (UID: 00029350-00006028) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\1.wsf"" (UID: 00029516-00004076) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f142579.eps" "%TEMP%\gsb155F.tmp"" (UID: 00029998-00006120) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00030254-00006072) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa155F.tmp" (UID: 00030331-00005864) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\1.wsf"" (UID: 00030528-00003004) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f14257c.eps" "%TEMP%\gsb8772.tmp"" (UID: 00031866-00005740) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00032104-00003540) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa8772.tmp" (UID: 00032199-00005764) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\1.wsf"" (UID: 00032372-00003560) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f14257c.eps" "%TEMP%\gsbC362.tmp"" (UID: 00032848-00003880) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00033083-00003784) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsaC362.tmp" (UID: 00033181-00001300) Spawned process "wscript.exe" with commandline ""%ALLUSERSPROFILE%\1.wsf"" (UID: 00033373-00002468) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000f14257f.eps" "%TEMP%\gsb2B14.tmp"" (UID: 00034547-00004580) Spawned process "powershell.exe" with commandline "powershell "echo ''|Out-File %ALLUSERSPROFILE%\1.wsf;Invoke-Item %ALLUSERSPROFILE%\1.wsf"" (UID: 00034773-00004360)30:T794,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFdklEQVR42uWX6U9UVxiH/QuqVoqoWLFYtVZNY611QcvmVi2Smjb9UPtB02q0tlELIosBxw1XBEXFrWJVwA0RrCAIwjAzwAzDzrDvAwzOsIhsAk/PTNRYTVs2mzQ9yS83c3NzznPe5703c4YNe2Ws9oniTWbYPw3jQ11dXTx9+pTu7u4hiXEu45x9Bni+eE9PD729vYOKcY7nEH0GeHnxwY6XIfoFMBSLvwzx3wSQy+WkpaWhVCpRqVQvYryXlZVFR0dHnwBq23tJaOhh/RlF/wB0Oh16vR6DwUBjY+OLGH83Nzeb3P7V6BYFzGnp5bq2h7MVPQQWd7L2lOzfUaAVOw6t7iaorJsATTtuSXV8e6cC56PS/gEoFApT+dVq9Z9i1JCTk/Oagk5RkERR6pMlT/EXC/8cV82q6+UsCW9g2b1WnANS35yCpq5eLpZ1cbywg+1JtTiFleJws56l99pYFtvFsvju/gP0ddSLkp8Rjg9mtbAmvAT7kCoc7zSz+F47i+93skQAGLOqvwB/p+B54tT5HMtrxSO5ns9/K8A2rA7biBbs77Zh/3sbDgLCMboDx5gOVvmnDJ0C4zW3ronDua1sfVCN3YUCbELqWBTexCIB8Nmdx9hGtmIX9QS7ZzBOx1KGTkGzcO4vFt8cXcGCs/nMvaJlflgDErmehLIWNjwwsPAVGCc/xdAoSFOlE6DW8WNMBfNOZjMnuJo5V3XYhmqRJFQjK9VzPLUem2s6Ftxqwia8mYW3W/jCTz40Cm4VNrJFlH3u8XRmnSnjq1taTisb0DW1Uqpr4nZGFcHKGpZeq2Fe2CPmXzcw/0YjK4/KB6+gob0bT3kDtieUzAwsZMbpUtaGl3NaVol/fBG/JhfxuPUJ+pZWDku1OIfX8amozlwBsuKIbPAK/FOqcL6YwbQjmXx4soQPAouZ6pfNFF856y6nk1Jci1bfRK2hhfb2dvJqm/k4uIpProi35FDy4BRkVhv4IaqEGb4KJvsVMCWgSERU4biGNSEaHj9pQ6qpYcWxWDZdkmEQVXCLyGdmUBGzgrUsPygdnIKLeY04nFBgvU+N9REN74lYH9Vgf1bDJVEZ446dA5OwliSw4bKK6kei+fwVTD9VxMzzVSw/kDRwBcr0DLH7YiZ7J2K1P4sJvjlMOJiL1cEcZvup2Xc31wRwQVqCa0QBZfVNnE8Szx9IM2n6MKicpb6JA1cQl1fD8qA0xu+UYbknk3EilvuyGL8vk/GSNKZ5x3JFWkiRVo+yVEdArIbJu+KZdDjLpGpqYAlL9j8cuIITiSXM9k1irKcCC590LHalM0aiZqzIOEk6Y72kjNkWyRzJPT7yicZyx32s9qRifTiXSaJf3vcvZMnehIErWHcukak+D7HwkGPumYq5VxrmO5WMFle/+Aoup1Yzfa+cb86pyK7UY3NMxbv7M4WiXCYeyhP9ks/iPfEDV/BdkJSJHvGYuckYtUPBKPcUzDxE3JIorDGY/K8MFN+G3UlsDslkkkQuNKlFr2QLkGwmHMjBcXf8wP+Wu15Lx9ojjlGuUkZulzFCZKSbnJFb4wiMyaXe0GwCOS9U+UVrCJaVE5dfL76KtYwTuiz3ZuIgeTDwg0mkupLpotHe3hLPiF+kvCUy3CWZ4Vvi+DoggQtxOajERyg2s5JIVTn3syqRF2gJTSnHwlMm+kSNvU9sHwC8I+ns7KRTHKW6jEeqZ3nS3sHG0Awst8UwZnsy5s/jksA7P0Vhtj4Us+8vY77+KuYbwxgtYrEpDMutkVi5i1fXU4qD192+VWC1TySrve+8HnF/hQBc7B6Jo8ddUxzco7B3i8DO9Ra2LjdMsXsWe5frOLjeZJn7bZy8IviyL+eC/934A8vDMzp31PmtAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7a2a172b13cbf05da0031afbd4532eb9712b5aa45569024435802daa2adaaf5b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790610803264,"unified_at":"2026-09-28T15:53:23.264Z","metadata":{"hashes":{"sha256":"7a2a172b13cbf05da0031afbd4532eb9712b5aa45569024435802daa2adaaf5b","sha1":"6d135d32fdb79ba578418d0cbaf1b04db78db10c","md5":"abafa0cbfbe18afe6dd635d14e7d03d3","sha512":"611d9e48edf84990ece4d85e67af71928b8b281ad3f456fb070bc15725ae12b9264acdea72ba22a061262e026870c743d2c88b2d2f86e47726262fb9a4cc7b1a","ssdeep":"384:EubcEK3ArYrV/FizByPLrO8z1SdLjS0CYW4gwvvpFf1KH+y9x+1zPxeL1BfDb:ncEKpV//TrZ1SVjMWKH+z1z4L1Bbb","ssdeep_chunks":["384:EubcEK3","384:ubcEK3A","384:bcEK3Ar","384:cEK3ArY","384:EK3ArYr","384:K3ArYrV","384:3ArYrV/","384:ArYrV/F","384:rYrV/Fi","384:YrV/Fiz","384:rV/FizB","384:V/FizBy","384:/FizByP","384:FizByPL","384:izByPLr","384:zByPLrO","384:ByPLrO8","384:yPLrO8z","384:PLrO8z1","384:LrO8z1S","384:rO8z1Sd","384:O8z1SdL","384:8z1SdLj","384:z1SdLjS","384:1SdLjS0","384:SdLjS0C","384:dLjS0CY","384:LjS0CYW","384:jS0CYW4","384:S0CYW4g","384:0CYW4gw","384:CYW4gwv","384:YW4gwvv","384:W4gwvvp","384:4gwvvpF","384:gwvvpFf","384:wvvpFf1","384:vvpFf1K","384:vpFf1KH","384:pFf1KH+","384:Ff1KH+y","384:f1KH+y9","384:1KH+y9x","384:KH+y9x+","384:H+y9x+1","384:+y9x+1z","384:y9x+1zP","384:9x+1zPx","384:x+1zPxe","384:+1zPxeL","384:1zPxeL1","384:zPxeL1B","384:PxeL1Bf","384:xeL1BfD","384:eL1BfDb","768:EubcEK3","768:ubcEK3A","768:bcEK3Ar","768:cEK3ArY","768:EK3ArYr","768:K3ArYrV","768:3ArYrV/","768:ArYrV/F","768:rYrV/Fi","768:YrV/Fiz","768:rV/FizB","768:V/FizBy","768:/FizByP","768:FizByPL","768:izByPLr","768:zByPLrO","768:ByPLrO8","768:yPLrO8z","768:PLrO8z1","768:LrO8z1S","768:rO8z1Sd","768:O8z1SdL","768:8z1SdLj","768:z1SdLjS","768:1SdLjS0","768:SdLjS0C","768:dLjS0CY","768:LjS0CYW","768:jS0CYW4","768:S0CYW4g","768:0CYW4gw","768:CYW4gwv","768:YW4gwvv","768:W4gwvvp","768:4gwvvpF","768:gwvvpFf","768:wvvpFf1","768:vvpFf1K","768:vpFf1KH","768:pFf1KH+","768:Ff1KH+y","768:f1KH+y9","768:1KH+y9x","768:KH+y9x+","768:H+y9x+1","768:+y9x+1z","768:y9x+1zP","768:9x+1zPx","768:x+1zPxe","768:+1zPxeL","768:1zPxeL1","768:zPxeL1B","768:PxeL1Bf","768:xeL1BfD","768:eL1BfDb","384:ncEKpV/","384:cEKpV//","384:EKpV//T","384:KpV//Tr","384:pV//TrZ","384:V//TrZ1","384://TrZ1S","384:/TrZ1SV","384:TrZ1SVj","384:rZ1SVjM","384:Z1SVjMW","384:1SVjMWK","384:SVjMWKH","384:VjMWKH+","384:jMWKH+z","384:MWKH+z1","384:WKH+z1z","384:KH+z1z4","384:H+z1z4L","384:+z1z4L1","384:z1z4L1B","384:1z4L1Bb","384:z4L1Bbb"],"imphash":"Unknown"},"file_info":{"file_name":"abafa0cbfbe18afe6dd635d14e7d03d3.hwp","file_type":["hwp"],"file_type_id":"hwp","file_size":32768,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1554353417000,"last_seen":1640002705000,"last_multi_scan":1640002705000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","botnet","floxif","neshta","ramnit","tiggre","virut","xolxo"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":6},"sandbox_signatures":{"informative_count":20,"suspicious_count":8,"malicious_count":6,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"HWP/Exploit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"HWP/Agent.C trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Exploit.CVE-2015-2545","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Exploit.HWP.Agent.v","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic Exploit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Exploit/HWP.Spenib.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.C25B83E7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.C25B83E7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CVE-2015-2545","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00022092-00004696-16824-106-011B580A\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00022288-00004084-24674-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00024606-00003428-36673-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00027279-00005208-46108-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00029017-00005324-57447-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00029998-00006120-1377-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00031866-00005740-10582-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00032848-00003880-19624-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00034547-00004580-23467-210-00405C5D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00022092-00004696-16824-117-011B1BD0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00022288-00004084-24674-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00024606-00003428-36673-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00027279-00005208-46108-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00029017-00005324-57447-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00029998-00006120-1377-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00031866-00005740-10582-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00032848-00003880-19624-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00034547-00004580-23467-104-0040A6D1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ddlove.kr\"\n \"krdns.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"203.234.191.25:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"g:\\HOfficeDev_80\\Build\\Common\\HimTrayIcon.pdb\"\n \"e:\\Work\\HOffice2010\\Dev\\Build\\Common\\ImgFilters\\gs\\gs8.71\\bin\\gbb.pdb\"\n \"powershell.pdb\"\n \"wscript.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$26","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\NDRIVE_SHARE_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\C:_Users_eYPkqYr_AppData_Local_Temp_Hwp80_abafa0cbfbe18afe6dd635d14e7d03d3.asv\"\n \"C:_Users_eYPkqYr_AppData_Local_Temp_Hwp80_abafa0cbfbe18afe6dd635d14e7d03d3.asv\"\n \"DBWinMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"NDRIVE_SHARE_MUTEX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 668A0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 6A870000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"wscript.exe\" called \"Microsoft.XMLHTTP.1.0.CreateObject\" ...","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$27","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Hwp.exe\" searching for class \"HIM_TRAY_ICON\"\n \"Hwp.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"$2a","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2b","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ddlove.kr\"\n Heuristic match: \"krdns.com\"\n Pattern match: \"http://ddlove.kr/bbs/data/1\\,0\"\n Pattern match: \"http://ddlove.kr/bbs/data/1,0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights\n \"gswin32c.exe\" is protecting 64 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00022092-00004696-16824-268-011B8717\n cpuid at 00022288-00004084-24674-252-00409D57\n cpuid at 00024606-00003428-36673-252-00409D57\n cpuid at 00027279-00005208-46108-252-00409D57\n cpuid at 00029017-00005324-57447-252-00409D57\n cpuid at 00029998-00006120-1377-252-00409D57\n cpuid at 00031866-00005740-10582-252-00409D57\n cpuid at 00032848-00003880-19624-252-00409D57\n cpuid at 00034547-00004580-23467-252-00409D57","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"wscript.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2d","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 203.234.191.25 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"powershell.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/59 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/59 Antivirus vendors marked sample as malicious (20% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"4/59 Antivirus vendors marked dropped file \"1.wsf\" as malicious (classified as \"WSF.S.Agent\" with 6% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"malicious","category":"Installation/Persistance","name":"Found indicators of dropper code in the commandline","description":"Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00022547-00002096)\n Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00024842-00003224)\n Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00027508-00005440)\n Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00029236-00005284)\n Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00030254-00006072)\n Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00032104-00003540)\n Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00033083-00003784)\n Found \"... a/1\\\"\n0);x.Send();eval(x. ...\" on invoke of powershell.exe (UID: 00034773-00004360)","origin":"Monitored Target","relevance":5,"id":"target-32","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"wscript.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2f","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}]},"activity":{"stats":{"process_count":32,"spawned_processes_count":32,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":158,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":488,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":10,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["banker","botnet","floxif","neshta","ramnit","tiggre","virut","xolxo"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"5ca58d070388383a8bf26b93","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2015-2545","contacted_countries":["KOR"],"submit_name":"abafa0cbfbe18afe6dd635d14e7d03d3.hwp","analysis_start_time":"2019-04-04T04:40:56+00:00","indicators_count":{"informative":20,"suspicious":8,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"203.234.191.25","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}],"dns_resolutions":[{"domain":"ddlove.kr","address":"203.234.191.25","ttl":59,"country":"Korea, Republic of","registrar_name":"Whois Corp.(http://whois.co.kr)","registrar_name_servers":"ns1.krdns.net","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"domain":"krdns.com","address":"61.75.40.104","ttl":59,"country":"Korea, Republic of","registrar_name":"Whois Networks Co., Ltd.","registrar_name_servers":"NS1.KRDNS.NET","registrar_creation_date":"1999-02-14T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}],"http_requests":[{"host":"ddlove.kr","host_ip":"203.234.191.25:80","url":"/bbs/data/1","method":"GET","header":"GET /bbs/data/1 HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: ddlove.kr\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}],"processes":[{"pid":2308,"ppid":0,"name":"Hwp.exe","command_line":"\"C:\\abafa0cbfbe18afe6dd635d14e7d03d3.hwp\"","sha256":"1acb6efeb18f3b315eebfea24494ab9331ed10a2a3341d8abe4cf0da91718dc9","normalized_path":"%PROGRAMFILES%\\HNC\\Hwp80\\Hwp.exe","uid":"00019386-00002308","icon":"$30"},{"pid":4696,"ppid":2308,"name":"HimTrayIcon.exe","command_line":"","sha256":"b783a2a69591cc1509acd0d3b33bdf69c87908669741f03a06f7d152cbe2923e","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\HimTrayIcon.exe","parent_uid":"00019386-00002308","uid":"00022092-00004696"},{"pid":4084,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f142574.eps\" \"%TEMP%\\gsb3ECA.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00022288-00004084"},{"pid":2096,"ppid":4084,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00022288-00004084","uid":"00022547-00002096"},{"pid":4724,"ppid":2096,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\1.wsf\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00022547-00002096","uid":"00022931-00004724"},{"pid":1900,"ppid":2308,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsa3ECA.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00019386-00002308","uid":"00022620-00001900"},{"pid":3428,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f142576.eps\" \"%TEMP%\\gsbCC45.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00024606-00003428"},{"pid":3224,"ppid":3428,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00024606-00003428","uid":"00024842-00003224"},{"pid":4936,"ppid":3224,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\1.wsf\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00024842-00003224","uid":"00025128-00004936"},{"pid":2984,"ppid":2308,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsaCC45.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00019386-00002308","uid":"00024937-00002984"},{"pid":5208,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f142576.eps\" \"%TEMP%\\gsb6F6A.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00027279-00005208"},{"pid":5440,"ppid":5208,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00027279-00005208","uid":"00027508-00005440"},{"pid":5116,"ppid":5440,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\1.wsf\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00027508-00005440","uid":"00027792-00005116"},{"pid":5540,"ppid":2308,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsa6F6A.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00019386-00002308","uid":"00027611-00005540"},{"pid":5324,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f142579.eps\" \"%TEMP%\\gsbD98E.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00029017-00005324"},{"pid":5284,"ppid":5324,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00029017-00005324","uid":"00029236-00005284"},{"pid":4076,"ppid":5284,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\1.wsf\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00029236-00005284","uid":"00029516-00004076"},{"pid":6028,"ppid":2308,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsaD98E.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00019386-00002308","uid":"00029350-00006028"},{"pid":6120,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f142579.eps\" \"%TEMP%\\gsb155F.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00029998-00006120"},{"pid":6072,"ppid":6120,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00029998-00006120","uid":"00030254-00006072"},{"pid":3004,"ppid":6072,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\1.wsf\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00030254-00006072","uid":"00030528-00003004"},{"pid":5864,"ppid":2308,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsa155F.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00019386-00002308","uid":"00030331-00005864"},{"pid":5740,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f14257c.eps\" \"%TEMP%\\gsb8772.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00031866-00005740"},{"pid":3540,"ppid":5740,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00031866-00005740","uid":"00032104-00003540"},{"pid":3560,"ppid":3540,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\1.wsf\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00032104-00003540","uid":"00032372-00003560"},{"pid":5764,"ppid":2308,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsa8772.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00019386-00002308","uid":"00032199-00005764"},{"pid":3880,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f14257c.eps\" \"%TEMP%\\gsbC362.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00032848-00003880"},{"pid":3784,"ppid":3880,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00032848-00003880","uid":"00033083-00003784"},{"pid":2468,"ppid":3784,"name":"wscript.exe","command_line":"\"%ALLUSERSPROFILE%\\1.wsf\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","parent_uid":"00033083-00003784","uid":"00033373-00002468"},{"pid":1300,"ppid":2308,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsaC362.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00019386-00002308","uid":"00033181-00001300"},{"pid":4580,"ppid":2308,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000f14257f.eps\" \"%TEMP%\\gsb2B14.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00019386-00002308","uid":"00034547-00004580"},{"pid":4360,"ppid":4580,"name":"powershell.exe","command_line":"powershell \"echo ''|Out-File %ALLUSERSPROFILE%\\1.wsf;Invoke-Item %ALLUSERSPROFILE%\\1.wsf\"","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00034547-00004580","uid":"00034773-00004360"}],"all_imported_dlls":["HimCfgDlg80.dll","linkinfo.dll","msvcrt.dll","ole32.dll","mscms.dll","Microsoft.PowerShell.Security.ni.dll","msxml3.dll","wship6.dll","oledlg.dll","HncBD80.dll","cryptdll.dll","cfgmgr32.dll","atl.dll","normaliz.dll","dui70.dll","KernelBase.dll","sechost.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Core.ni.dll","userenv.dll","ntmarta.dll","HncSpeller80.dll","FWPUCLNT.DLL","oleaccrc.dll","msxml3r.dll","HncLibeay8.dll","credssp.dll","RpcRtRemote.dll","Microsoft.PowerShell.Commands.Management.ni.dll","profapi.dll","crypt32.dll","clbcatq.dll","duser.dll","kernel32.dll","advapi32.dll","dhcpcsvc.dll","msv1_0.dll","urlmon.dll","System.Management.Automation.dll","wininet.dll","devobj.dll","dwmapi.dll","user32.dll","System.ni.dll","System.Transactions.dll","winnsi.dll","rasadhlp.dll","HncEO.dll","GdiPlus.dll","wsock32.dll","ntshrui.dll","HncBlogDll.dll","mswsock.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","iertutil.dll","oleacc.dll","msvcr80.dll","System.DirectoryServices.ni.dll","mscorjit.dll","npmproxy.dll","HncAtlExt80.dll","wshext.dll","msvcr100.dll","apphelp.dll","Microsoft.WSMan.Runtime.dll","mscorrc.dll","netutils.dll","version.dll","ATL90.dll","shlwapi.dll","shdocvw.dll","wintrust.dll","mpr.dll","security.dll","secur32.dll","HNCXML80.dll","msasn1.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","comctl32.dll","msctf.dll","System.Management.Automation.ni.dll","bcrypt.dll","odbc32.dll","srvcli.dll","usp10.dll","ws2_32.dll","rpcrt4.dll","System.Configuration.Install.ni.dll","System.Xml.ni.dll","System.Management.ni.dll","HncBM80.dll","gdi32.dll","psapi.dll","shfolder.dll","System.Data.ni.dll","IPHLPAPI.DLL","rpcss.dll","slc.dll","mscorwks.dll","netprofm.dll","HncBL80.dll","odbcint.dll","setupapi.dll","mfc90u.dll","MFC90ENU.DLL","System.Transactions.ni.dll","msisip.dll","HncIMM80.dll","uxtheme.dll","sxs.dll","sspicli.dll","winmm.dll","cryptsp.dll","shell32.dll","mscoree.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","webio.dll","HncXerCore8.dll","propsys.dll","cscapi.dll","msvcp90.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","winhttp.dll","imm32.dll","cryptbase.dll","Wldap32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","lpk.dll","gsdll32.dll","jscript.dll","wshqos.dll","HncVfs80.dll","ExplorerFrame.dll","tzres.dll","scrobj.dll","api-ms-win-downlevel-version-l1-1-0.dll","rsaenh.dll","comdlg32.dll","ntdll.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","HncProcessObject.dll","msimg32.dll","dhcpcsvc6.dll","msvcr90.dll","mscorlib.ni.dll","Microsoft.WSMan.Management.ni.dll","System.Data.dll","WSHTCPIP.DLL","HwpABase.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dnsapi.dll","nlaapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","nsi.dll","oleaut32.dll","mscoreei.dll","mlang.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"1.wsf","sha256":"d456028b7edbeb7e97ef3dfed9cfd38e6981b9cfb0ff758b61f0fb0dd30d8a8b","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"CYI86PG5O8NZNB73VEVW.temp","sha256":"9b44f51193d766ac077917f9fe1fdba1f32e162eb0e5194d3bb18c37b3dbfa4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"EXLVZQUL5IAS648I4V7K.temp","sha256":"9b44f51193d766ac077917f9fe1fdba1f32e162eb0e5194d3bb18c37b3dbfa4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"I0W6IBC2K0JX76SODX3R.temp","sha256":"9b44f51193d766ac077917f9fe1fdba1f32e162eb0e5194d3bb18c37b3dbfa4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"J4DXJKV2MOMU12IUUZ3V.temp","sha256":"9b44f51193d766ac077917f9fe1fdba1f32e162eb0e5194d3bb18c37b3dbfa4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"VCMGF6L8M8U9IY4GYURF.temp","sha256":"9b44f51193d766ac077917f9fe1fdba1f32e162eb0e5194d3bb18c37b3dbfa4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"WROXWZOLRNJK8XU86QZS.temp","sha256":"9b44f51193d766ac077917f9fe1fdba1f32e162eb0e5194d3bb18c37b3dbfa4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"EMB00000f142574.eps","sha256":"826f946d980f611ecf12554269ecb0f173b76068980793b22d6d1a7cd6665951","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"EMB00000f142576.eps","sha256":"826f946d980f611ecf12554269ecb0f173b76068980793b22d6d1a7cd6665951","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"EMB00000f142579.eps","sha256":"826f946d980f611ecf12554269ecb0f173b76068980793b22d6d1a7cd6665951","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"EMB00000f14257c.eps","sha256":"826f946d980f611ecf12554269ecb0f173b76068980793b22d6d1a7cd6665951","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"EMB00000f14257f.eps","sha256":"826f946d980f611ecf12554269ecb0f173b76068980793b22d6d1a7cd6665951","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"gsa155F.tmp","sha256":"f73452732b585a428655ba193b39d8836970771b3c23b897f22c387d9a316c43","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"abafa0cbfbe18afe6dd635d14e7d03d3.hwp.lnk","sha256":"5b46583b972cf2b58cf3c8ad63e063497ffe484a3139d773e72de1eeeda2f7f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"Fontlist01.lst","sha256":"937b119f429b9a43771ffb05c9e6ad4013f6f1e08edec770e0eb2aa8b3606dd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"ShareFont.ini","sha256":"0455ac5659dac9c4bb458f57416e52e306b01919cdd07cda442b1934ae67e3ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"hjuser6.dic","sha256":"32f2e277aba9b9e28454c0d78b671d611acca3648c47589613c2d0a4c7e461ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"hjuser6Ext.dic","sha256":"32f2e277aba9b9e28454c0d78b671d611acca3648c47589613c2d0a4c7e461ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"6DZW5YLFFV8DPXTYOGLL.temp","sha256":"78864b01dd68ae8f73d59cac443bb64117e2a86fc8c644dbf63bcb67a84a8bc9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"IJU5BB69UJVGDJBHUROY.temp","sha256":"9b44f51193d766ac077917f9fe1fdba1f32e162eb0e5194d3bb18c37b3dbfa4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}],"files_written":[{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Hwp\\hncreg.brg","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\HGSMJ.HFT","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\HGGGT.HFT","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\HFTInfo.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\HNC\\User\\Shared\\Fonts\\HFTInfo.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Common\\80\\Fonts\\Fontlist\\Fontlist01.lst","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_1361.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Common\\80\\Fonts\\ShareFont.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\FontInfo.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\HNC\\User\\Shared\\Fonts\\FontInfo.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\HwpLogo.hfp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DFF33D0E043AC727ED.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\plugin\\HncChartPlugin.pfo","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\plugin\\HncEqEdit.pfo","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\plugin\\HncTextArt.pfo","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Hwp\\ShortKey80.htk","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Toolbox\\Preset\\textart_preset.hwp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DF5BE18E7B48363814.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DFA1808051D9095EBE.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Toolbox\\Preset\\memo_preset.hwp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\HimTrayIcon.exe","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\HwpTemplate\\Doc\\ENU\\Normal80.hwt","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DF47488DFD62CC5D95.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_Large_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_Large_Inactive_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\abafa0cbfbe18afe6dd635d14e7d03d3.hwp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DF30045B0C70609C2A.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\Office\\Recent\\abafa0cbfbe18afe6dd635d14e7d03d3.hwp.lnk","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\Office\\Recent\\C:\\.folder.lnk","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Help\\TbxTooltip\\Enu\\Help.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_Inactive_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsb3ECA.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gst3ECA.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\6DZW5YLFFV8DPXTYOGLL.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsa3ECA.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hnc\\BinData\\EMB00000f142574.eps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gse3ECA.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\NATMAL3.DIC","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\NATMAL3.INF","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\WARNING.DIC","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\tossi3.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\ssikkut3.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\ENGDIC.DIC","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\Dics","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\MARK.DIC","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\Dics\\mark.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\sendic.INF","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\sendic.DIC","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\pnteomi.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\pnteomi.inf","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\Pntconj.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbi.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbi.inf","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbicom.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbicom.inf","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Shared80\\Dics\\susa.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\freqmain.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\foreign.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_com.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_pua.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\freqmain.inf","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_gen.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_cjk.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_cht.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_kor.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_u2h.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_h2u.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u320_hnc.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_chs.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_jpn.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\hnchjsysext.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\Dics\\hjuser6Ext.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\HncHjSys.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\Dics\\hjuser6.dic","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hwp80\\~$tDC7D.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hwp80\\abafa0cbfbe18afe6dd635d14e7d03d3.asv","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DF03410BDAFFB556FB.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsbCC45.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gstCC45.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\EXLVZQUL5IAS648I4V7K.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF5eda3.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsaCC45.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gseCC45.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\$$$00000f142577.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\prv00000f142575.gif","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Help\\TbxTooltip\\Enu\\StyleCombo.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsb6F6A.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gst6F6A.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\CYI86PG5O8NZNB73VEVW.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF6908a.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsa6F6A.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hnc\\BinData\\EMB00000f142576.eps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gse6F6A.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hwp80\\~$tEAC1.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DF61D86009BDAFB7F1.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsbD98E.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gstD98E.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\J4DXJKV2MOMU12IUUZ3V.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF6f9b4.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsaD98E.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gseD98E.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\$$$00000f14257a.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\prv00000f142578.gif","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gst155F.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsb155F.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\I0W6IBC2K0JX76SODX3R.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF73805.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsa155F.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hnc\\BinData\\EMB00000f142579.eps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gse155F.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hwp80\\~$t98A6.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DF3B07AD93003803B4.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gst8772.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsb8772.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\WROXWZOLRNJK8XU86QZS.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF7a8d0.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsa8772.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gse8762.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\$$$00000f14257d.bmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\prv00000f14257b.gif","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gstC362.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsbC362.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\1.wsf","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\IJU5BB69UJVGDJBHUROY.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF7e4b0.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsaC362.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\lib\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\fonts\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hnc\\BinData\\EMB00000f14257c.eps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\en\\WScript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gseC362.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hwp80\\~$t3C49.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\~DF867BD9E14F45D8DC.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\gsb2B14.tmp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\lib\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\fonts\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\lib\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\fonts\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\cidfmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\cidfmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Fonts\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\lib\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"c:\\gs\\fonts\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%TEMP%\\Hnc\\BinData\\EMB00000f14257f.eps","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\VCMGF6L8M8U9IY4GYURF.temp","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RF84bf6.TMP","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index34e.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\pubpol205.dat","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\NDRIVE_SHARE_MUTEX","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\C:_Users_eYPkqYr_AppData_Local_Temp_Hwp80_abafa0cbfbe18afe6dd635d14e7d03d3.asv","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"C:_Users_eYPkqYr_AppData_Local_Temp_Hwp80_abafa0cbfbe18afe6dd635d14e7d03d3.asv","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"NDRIVE_SHARE_MUTEX","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"5ca58d070388383a8bf26b93"}]}]}},"report_ids":{"sandbox_job_ids":["5ca58d070388383a8bf26b93"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CVE-2015-2545 Sample 7a2a172b13cb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7a2a172b13cb…. Malware family: CVE-2015-2545. Threat score 100/100. 9/25 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7a2a172b13cbf05da0031afbd4532eb9712b5aa45569024435802daa2adaaf5b"}],["$","meta","4",{"property":"og:title","content":"Malicious CVE-2015-2545 Sample 7a2a172b13cb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7a2a172b13cb…. Malware family: CVE-2015-2545. Threat score 100/100. 9/25 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7a2a172b13cbf05da0031afbd4532eb9712b5aa45569024435802daa2adaaf5b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CVE-2015-2545 Sample 7a2a172b13cb… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7a2a172b13cb…. Malware family: CVE-2015-2545. Threat score 100/100. 9/25 AV engines flagged this file. 6 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]