24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T486,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.PoorWeb Sample dc69b98da87a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dc69b98da87a…. Malware family: Trojan.PoorWeb. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab","keywords":["Malicious","Trojan.PoorWeb","malware analysis","sandbox report","threat intelligence","dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab"],"about":{"@type":"SoftwareApplication","name":"tmpoaejpshj","applicationCategory":["peexe","executable"],"identifier":"dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.PoorWeb","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T2ca1,"GET /shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive" "GET /shopimages/mariehan/template/work/32889/common.css?r=1550638034 HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /font-awesome/4.1.0/css/font-awesome.min.css HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: maxcdn.bootstrapcdn.com DNT: 1 Connection: Keep-Alive" "GET /js/jquery-1.7.2.min.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /js/lazyload.min.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /earlyaccess/nanummyeongjo.css HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: fonts.googleapis.com DNT: 1 Connection: Keep-Alive" "GET /earlyaccess/nanumgothic.css HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: fonts.googleapis.com DNT: 1 Connection: Keep-Alive" "GET /js/flash.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /js/neodesign/rightbanner.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /js/bookmark.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /shopimages/mariehan/template/work/32889/shopdetail.css?t=201902201354 HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /shopimages/mariehan/template/work/32889/header.1.css?t=201912231119 HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /shopimages/mariehan/template/work/32889/footer.1.css?t=201902081418 HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /css/shopdetail.css HTTP/1.1 Accept: text/css, */* Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /shopimages/mariehan/template/work/32889/header.1.js?t=201912231119 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /html/shopRbanner.html?param1=1 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /shopimages/mariehan/template/work/32889/shopdetail.js?t=201902201354 HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /js/jquery.language.js HTTP/1.1 Accept: application/javascript, */*;q=0.8 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.hclassic.com DNT: 1 Connection: Keep-Alive Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" "GET /hyosung/download/images/image_escrow.gif HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.allthegate.com DNT: 1 Connection: Keep-Alive" "GET /_public/uploadFiles/editor/1701/20170119144157_eozkrziy.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: mariehan.img47.makeshop.co.kr DNT: 1 Connection: Keep-Alive"26:T7f8,"urlblockindex_2_.bin" has type "data" "netstates.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "RecoveryStore._CA54635B-4619-11EA-A10A-0A00272257C6_.dat" has type "Composite Document File V2 Document Cannot read section info" "T0YSQQ4K.txt" has type "ASCII text" "lazyload.min_1_.js" has type "ASCII text with very long lines" "NanumBarunGothic-Bold_1_.eot" has type "Embedded OpenType (EOT)" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "header.1_1_.js" has type "ISO-8859 text" "logo_1_.png" has type "PNG image data 138 x 118 8-bit/color RGB non-interlaced" "shopdetail_1_.css" has type "ISO-8859 text" "box_arrow_1_.gif" has type "GIF image data version 89a 11 x 6" "menu_navi_1_.png" has type "PNG image data 1219 x 30 8-bit/color RGBA non-interlaced" "ver599.tmp" has type "XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators" "footer.1_1_.css" has type "ISO-8859 text" "20170119144313_acsrdpnf_1_.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=10 manufacturer=Canon model=Canon EOS 550D orientation=upper-left xresolution=155 yresolution=163 resolutionunit=2 software=Adobe Photoshop CS2 Windows datetime=2012:09:25 19:44:47] baseline precision 8 600x400 frames 3" "9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2" has type "data" "jquery-1.7.2.min_1_.js" has type "HTML document UTF-8 Unicode text with very long lines" "TYZC2ARM.txt" has type "ASCII text" "mslog_1_.js" has type "UTF-8 Unicode text" "20170119144134_yivfheec_1_.jpg" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data little-endian direntries=10 manufacturer=Canon model=Canon EOS 550D orientation=upper-left xresolution=155 yresolution=163 resolutionunit=2 software=Adobe Photoshop CS2 Windows datetime=2015:08:17 19:06:01] baseline precision 8 700x467 frames 3"27:T729,"tmpoaejpshj.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "tmpoaejpshj.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "tmpoaejpshj.exe" touched file "C:\Windows\System32\notepad.exe" "tmpoaejpshj.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "tmpoaejpshj.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "netstates.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "netstates.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "netstates.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "iexplore.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies\Low" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\Low" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\PrivacIE" "iexplore.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\PrivacIE\Low"28:T665,Pattern match: "http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D" Pattern match: "www.hclassic.com" Heuristic match: "maxcdn.bootstrapcdn.com" Heuristic match: "fonts.googleapis.com" Pattern match: "www.allthegate.com" Heuristic match: "mariehan.img47.makeshop.co.kr" Pattern match: "www.asheater.co.kr" Pattern match: "www.asheater.co.kr:80" Heuristic match: "ocsp.trust-provider.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.trust-provider.com" Heuristic match: "ocsp.comodoca4.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.comodoca4.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "log28.makeshop.co.kr" Pattern match: "jquery.org/license" Heuristic match: "cdn.jsdelivr.net" Heuristic match: "image.makeshop.co.kr" Pattern match: "image.makeshop.co.kr/makeshop/d3/basic_simple/common/sp_qty.gif" Pattern match: "image.makeshop.co.kr/makeshop/d3/basic_simple/common/btn_comment_del.gif" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=401352" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=513071" Pattern match: "~)3jP.Nv/K_HXT]@Akx,f" Pattern match: " nj.po/@_#%N!$EBsPB0#X" Pattern match: "U[v.eN/fY/&x.-msr-S"29:T6a8,"POST /skin15/css/fire.php HTTP/1.1 Host: www.asheater.co.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0007a02004c59 Content-Length: 973" with no payload "POST /skin15/css/fire.php HTTP/1.1 Host: www.asheater.co.kr:80 Content-type: application/x-www-form-urlencoded Content-Length: 22" with no payload "POST /html/user_basket_quantity.html HTTP/1.1 Accept: application/json, text/javascript, */*; q=0.01 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Referer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D Accept-Language: en-US Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Host: www.hclassic.com Content-Length: 17 DNT: 1 Connection: Keep-Alive Cache-Control: no-cache Cookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C" with no payload "POST /skin15/css/fire.php HTTP/1.1 Host: www.asheater.co.kr:80 Content-type: multipart/form-data;boundary=-----------------------------00020a5005139 Content-Length: 973" with no payload "POST /skin15/css/fire.php HTTP/1.1 Host: www.asheater.co.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0002b44006103 Content-Length: 973" with no payload "POST /skin15/css/fire.php HTTP/1.1 Host: www.asheater.co.kr:80 Content-type: multipart/form-data;boundary=-----------------------------000570e007362 Content-Length: 973" with no payload2a:T1115,"121.78.72.162" "2.1.4.3" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: "" Heuristic match: ""2b:T96b,"tmpoaejpshj.exe" wrote bytes "48121375" to virtual address "0x75148364" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "b84013bd71ffe0" to virtual address "0x75131248" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "48120000" to virtual address "0x7513139C" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "e7393b77e1a63f772e713f77ee293f7785e23a776da03f7790643e773ad5457726e43a77d16d3f77003d3d77804b3d7700000000ad375c768b2d5c76b6415c7600000000" to virtual address "0x74C61000" (part of module "WSHIP6.DLL") "tmpoaejpshj.exe" wrote bytes "f8111375" to virtual address "0x7514834C" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "f8110000" to virtual address "0x75131408" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "f8111375" to virtual address "0x751483C4" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "f8111375" to virtual address "0x75148368" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "f8111375" to virtual address "0x751483E0" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "68130000" to virtual address "0x765C1680" (part of module "WS2_32.DLL") "tmpoaejpshj.exe" wrote bytes "b8c015bd71ffe0" to virtual address "0x751311F8" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "48121375" to virtual address "0x75148348" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "f8110000" to virtual address "0x751312CC" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "48121375" to virtual address "0x751483C0" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "c04e3d7720543e77e0653e77b5383f770000000000d0aa7600000000c5eaaa760000000088eaaa7600000000e968487582283f77ee293f7700000000d2694875000000007dbbaa760000000009be487500000000ba18aa7600000000" to virtual address "0x76B61000" (part of module "NSI.DLL") "tmpoaejpshj.exe" wrote bytes "48121375" to virtual address "0x751483DC" (part of module "SSPICLI.DLL") "tmpoaejpshj.exe" wrote bytes "6012bd71" to virtual address "0x768CE324" (part of module "WININET.DLL") "tmpoaejpshj.exe" wrote bytes "b83012bd71ffe0" to virtual address "0x765C1368" (part of module "WS2_32.DLL") "tmpoaejpshj.exe" wrote bytes "48120000" to virtual address "0x751312DC" (part of module "SSPICLI.DLL") "netstates.exe" wrote bytes "48121375" to virtual address "0x75148364" (part of module "SSPICLI.DLL")2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790893376311,"unified_at":"2026-10-01T22:22:56.311Z","metadata":{"hashes":{"sha256":"dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab","sha1":"d9a54d3ed3603bf0a1e2c9379a5fc9f0d2d563a0","md5":"7ed490c68b3425b64e3f79a9e489fde4","sha512":"b7adc4d950fe8f6fea552e64c032634706b0897e24e76d0972f1320005f8a4ff5f2466229b8c8661b2b297a6d7caa8b53c04de8554a63115176cfe5e08b380d0","ssdeep":"3072:v1d3wSw/eIZ9aBdPnYNWc49sL0gNy7JEphTZ4J5NHbvq:td3s1Z9agNpLF","ssdeep_chunks":["3072:v1d3wSw","3072:1d3wSw/","3072:d3wSw/e","3072:3wSw/eI","3072:wSw/eIZ","3072:Sw/eIZ9","3072:w/eIZ9a","3072:/eIZ9aB","3072:eIZ9aBd","3072:IZ9aBdP","3072:Z9aBdPn","3072:9aBdPnY","3072:aBdPnYN","3072:BdPnYNW","3072:dPnYNWc","3072:PnYNWc4","3072:nYNWc49","3072:YNWc49s","3072:NWc49sL","3072:Wc49sL0","3072:c49sL0g","3072:49sL0gN","3072:9sL0gNy","3072:sL0gNy7","3072:L0gNy7J","3072:0gNy7JE","3072:gNy7JEp","3072:Ny7JEph","3072:y7JEphT","3072:7JEphTZ","3072:JEphTZ4","3072:EphTZ4J","3072:phTZ4J5","3072:hTZ4J5N","3072:TZ4J5NH","3072:Z4J5NHb","3072:4J5NHbv","3072:J5NHbvq","6144:v1d3wSw","6144:1d3wSw/","6144:d3wSw/e","6144:3wSw/eI","6144:wSw/eIZ","6144:Sw/eIZ9","6144:w/eIZ9a","6144:/eIZ9aB","6144:eIZ9aBd","6144:IZ9aBdP","6144:Z9aBdPn","6144:9aBdPnY","6144:aBdPnYN","6144:BdPnYNW","6144:dPnYNWc","6144:PnYNWc4","6144:nYNWc49","6144:YNWc49s","6144:NWc49sL","6144:Wc49sL0","6144:c49sL0g","6144:49sL0gN","6144:9sL0gNy","6144:sL0gNy7","6144:L0gNy7J","6144:0gNy7JE","6144:gNy7JEp","6144:Ny7JEph","6144:y7JEphT","6144:7JEphTZ","6144:JEphTZ4","6144:EphTZ4J","6144:phTZ4J5","6144:hTZ4J5N","6144:TZ4J5NH","6144:Z4J5NHb","6144:4J5NHbv","6144:J5NHbvq","3072:td3s1Z9","3072:d3s1Z9a","3072:3s1Z9ag","3072:s1Z9agN","3072:1Z9agNp","3072:Z9agNpL","3072:9agNpLF"],"imphash":"554a715aa7fa9183cff35fc872fc5d2e"},"file_info":{"file_name":"tmpoaejpshj","file_type":["peexe","executable"],"file_type_id":"exe","file_size":185344,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1580689034000,"last_seen":1682675454000,"last_multi_scan":1682675454000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":28,"suspicious_count":13,"malicious_count":7,"total":48},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dldr.Agent.pqfwl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.650039","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.650039 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDropper.Agent.SHB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/Agent.ga","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055fd421 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PoorWeb.x","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ser.gyxvoj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Infostealer.185344","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.PoorWeb.Win32.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.PoorWeb","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","identifiers":[{"type":"informative","value":"Opened the service control manager"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Discovery","technique":"Network Service Scanning","attack_id":"T1046","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1046","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1132","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 44971-942-0041983C\n SetUnhandledExceptionFilter@KERNEL32.dll at 44971-1384-00406628","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.dll at 44971-659-00415FE0\n GetUserDefaultLCID@KERNEL32.dll at 44971-656-00416083\n EnumSystemLocalesA@KERNEL32.dll at 44971-657-00416047\n GetUserDefaultLCID@KERNEL32.dll at 44971-1463-00415B18\n EnumSystemLocalesA@KERNEL32.dll at 44971-1475-00415FB4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"tmpoaejpshj.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"tmpoaejpshj.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"tmpoaejpshj.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.hclassic.com\"\n \"maxcdn.bootstrapcdn.com\"\n \"fonts.googleapis.com\"\n \"www.allthegate.com\"\n \"mariehan.img47.makeshop.co.kr\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"14.129.113.48:80\"\n \"209.197.3.15:80\"\n \"104.16.89.20:443\"\n \"172.217.7.234:80\"\n \"172.217.7.234:443\"\n \"121.133.126.33:80\"\n \"121.78.207.47:80\"\n \"119.207.79.31:80\"\n \"172.217.13.67:80\"\n \"151.139.128.14:80\"\n \"172.217.164.131:80\"\n \"172.217.164.131:443\"\n \"121.78.72.162:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"F:\\))PROG\\ie\\test.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"iexplore.exe\" created file \"%TEMP%\\~DFDE41B5A55D5D35C6.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF7C169DAA311A4EB3.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF850A3F4D1B5B65E8.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\JavaDeployReg.log\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e68_IESQMMUTEX_0_519\"\n \"IsoScope_e68_IESQMMUTEX_0_519\"\n \"IsoScope_e68_ConnHashTable<3688>_HashTable_Mutex\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"IsoScope_e68_IESQMMUTEX_0_303\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"IsoScope_e68_IE_EarlyTabStart_0xbe8_Mutex\"\n \"IsoScope_e68_IESQMMUTEX_0_331\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"UpdatingNewTabPageData\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3688\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3688\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_2_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$25","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00058460-00003688)\n Launches browser \"iexplore.exe\" (UID: 00058497-00002348)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"0XE0000000L\"","origin":"API Call","mitre_attack_id":"T1035","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"tmpoaejpshj.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"tmpoaejpshj.exe\" touched \"Network\" (Path: \"HKCU\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")\n \"tmpoaejpshj.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")\n \"tmpoaejpshj.exe\" touched \"Application Registration\" (Path: \"HKCU\\CLSID\\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"netstates.exe\" (UID: 00058442-00003484) was launched with missing environment variables: \"PATH\"\n Process \"iexplore.exe\" (UID: 00058460-00003688) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"\n Process \"iexplore.exe\" (UID: 00058497-00002348) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c copy>\"%PUBLIC%\\netstates.exe\"\" on 2020-2-3.01:11:57.462","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"tmpoaejpshj.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c copy>\"%PUBLIC%\\netstates.exe\"\" (UID: 00058434-00001140)\n Spawned process \"netstates.exe\" (UID: 00058442-00003484)\n Spawned process \"iexplore.exe\" with commandline \"http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode= ...\" (UID: 00058460-00003688)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3688 CREDAT:275457 /prefetch:2\" (UID: 00058497-00002348)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c copy>\"%PUBLIC%\\netstates.exe\"\" (UID: 00058434-00001140)\n Spawned process \"netstates.exe\" (UID: 00058442-00003484)\n Spawned process \"iexplore.exe\" with commandline \"http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode= ...\" (UID: 00058460-00003688)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3688 CREDAT:275457 /prefetch:2\" (UID: 00058497-00002348)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"tmpoaejpshj.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Installation/Persistance","name":"Drops executable files","description":"\"netstates.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"iexplore.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"M}m~x\"\n \"M}m]}\"\n \"M}m<|\"\n \"M}mv7\"\n \"Mntw\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"netstates.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"tmpoaejpshj.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"netstates.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"tmpoaejpshj.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"netstates.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.55016074631","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"tmpoaejpshj.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netstates.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"netstates.exe\" sleeping for \"00300000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/72 reputation engines marked \"http://maxcdn.bootstrapcdn.com\" as malicious (1% detection rate)\n 1/71 reputation engines marked \"http://www.asheater.co.kr\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$29","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"tmpoaejpshj.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"GQDBS8Q\"; Value: \"%PUBLIC%\\netstates.exe\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2a","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 14.129.113.48 on port 80 is sent without HTTP header\n TCP traffic to 209.197.3.15 on port 80 is sent without HTTP header\n TCP traffic to 104.16.89.20 on port 443 is sent without HTTP header\n TCP traffic to 172.217.7.234 on port 80 is sent without HTTP header\n TCP traffic to 172.217.7.234 on port 443 is sent without HTTP header\n TCP traffic to 121.133.126.33 on port 80 is sent without HTTP header\n TCP traffic to 121.78.207.47 on port 80 is sent without HTTP header\n TCP traffic to 119.207.79.31 on port 80 is sent without HTTP header\n TCP traffic to 172.217.13.67 on port 80 is sent without HTTP header\n TCP traffic to 151.139.128.14 on port 80 is sent without HTTP header\n TCP traffic to 172.217.164.131 on port 80 is sent without HTTP header\n TCP traffic to 172.217.164.131 on port 443 is sent without HTTP header\n TCP traffic to 121.78.72.162 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"netstates.exe\" claimed CRC 0 while the actual is CRC 208464","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetModuleFileNameA\n WinExec\n GetStartupInfoW\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n TerminateProcess\n LoadLibraryW\n WriteFile\n GetModuleHandleW\n IsDebuggerPresent\n CreateProcessA\n CreateFileW\n Sleep\n GetTickCount\n CreateFileA\n ShellExecuteW\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA\n GetUserNameW\n GetVersionExW\n OpenProcess\n GetCommandLineW\n DeleteFileW\n GetComputerNameW\n GetFileSizeEx\n CreateThread\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetDriveTypeA\n CreateProcessW\n InternetOpenW\n socket\n recv\n send\n WSAStartup\n connect\n closesocket","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"28/73 Antivirus vendors marked sample as malicious (38% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"28/73 Antivirus vendors marked sample as malicious (38% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"tmpoaejpshj.exe\" allocated memory in \"%WINDIR%\\System32\\mswsock.dll\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"tmpoaejpshj.exe\" wrote 32 bytes to a remote process \"C:\\Users\\Public\\netstates.exe\" (Handle: 456)\n \"tmpoaejpshj.exe\" wrote 52 bytes to a remote process \"C:\\Users\\Public\\netstates.exe\" (Handle: 456)\n \"tmpoaejpshj.exe\" wrote 4 bytes to a remote process \"C:\\Users\\Public\\netstates.exe\" (Handle: 456)\n \"tmpoaejpshj.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 616)\n \"tmpoaejpshj.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 616)\n \"tmpoaejpshj.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 616)\n \"iexplore.exe\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 880)\n \"iexplore.exe\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 880)\n \"iexplore.exe\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 880)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 13 (or more) hosts in at least 2 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\n Microsoft-CryptoAPI/6.1","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"netstates.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 15 domains and 15 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":36,"imported_dlls_count":130,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":228,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":12,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":14,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":13,"dns_resolutions_count":15,"contacted_urls_count":65,"http_requests_count":65},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis","Decrypted SSL traffic"],"sandbox_reports":[{"id":"5e3764f19060c6154b299f3e","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","contacted_countries":["KOR","USA"],"submit_name":"tmpoaejpshj","analysis_start_time":"2020-02-03T00:10:31+00:00","indicators_count":{"informative":28,"suspicious":17,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","TOR analysis","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"14.129.113.48","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"209.197.3.15","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"104.16.89.20","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"172.217.7.234","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"172.217.7.234","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"121.133.126.33","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"121.78.207.47","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"119.207.79.31","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"172.217.13.67","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"151.139.128.14","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"172.217.164.131","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"172.217.164.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"address":"121.78.72.162","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}],"dns_resolutions":[{"domain":"cdn.jsdelivr.net","address":"104.16.88.20","ttl":34,"country":"United States","registrar_name":"ENOM, INC.","registrar_name_servers":"DNS1.P03.NSONE.NET","registrar_creation_date":"2012-05-16T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"crl.pki.goog","address":"172.217.13.67","ttl":173,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"fonts.googleapis.com","address":"172.217.7.234","ttl":299,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2005-01-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"fonts.gstatic.com","address":"172.217.164.131","country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Google Inc.","registrar_creation_date":"2008-02-11T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"image.makeshop.co.kr","address":"23.2.28.163","ttl":179,"country":"United States","registrar_name":"KOREACENTER.COM(http://www.ssandomain.com)","registrar_name_servers":"ns.makeshop.co.kr","registrar_creation_date":"1999-10-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"log28.makeshop.co.kr","address":"121.78.72.162","ttl":635,"country":"Korea, Republic of","registrar_name":"KOREACENTER.COM(http://www.ssandomain.com)","registrar_name_servers":"ns.makeshop.co.kr","registrar_creation_date":"1999-10-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"mariehan.img47.makeshop.co.kr","address":"121.78.207.47","ttl":899,"country":"Korea, Republic of","registrar_name":"KOREACENTER.COM(http://www.ssandomain.com)","registrar_name_servers":"ns.makeshop.co.kr","registrar_creation_date":"1999-10-17T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"maxcdn.bootstrapcdn.com","address":"209.197.3.15","ttl":247,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"DNStination Inc.","registrar_name_servers":"DNS1.P07.NSONE.NET","registrar_creation_date":"2012-05-25T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"ocsp.comodoca4.com","address":"151.139.128.14","ttl":1128,"country":"United States","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_organization":"Comodo Group, Inc.","registrar_creation_date":"2014-09-24T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"ocsp.pki.goog","address":"172.217.13.67","ttl":187,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"ocsp.trust-provider.com","address":"151.139.128.14","ttl":960,"country":"United States","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"www.allthegate.com","address":"121.133.126.33","ttl":21599,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"www.asheater.co.kr","address":"119.207.79.31","ttl":599,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"www.asheater.co.kr:80","address":"119.207.79.31","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"domain":"www.hclassic.com","address":"14.129.113.48","ttl":89,"country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}],"http_requests":[{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D","method":"GET","header":"GET /shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D HTTP/1.1\nAccept: text/html, application/xhtml+xml, */*\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/template/work/32889/common.css?r=1550638034","method":"GET","header":"GET /shopimages/mariehan/template/work/32889/common.css?r=1550638034 HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"maxcdn.bootstrapcdn.com","host_ip":"209.197.3.15:80","url":"/font-awesome/4.1.0/css/font-awesome.min.css","method":"GET","header":"GET /font-awesome/4.1.0/css/font-awesome.min.css HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: maxcdn.bootstrapcdn.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/jquery-1.7.2.min.js","method":"GET","header":"GET /js/jquery-1.7.2.min.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/lazyload.min.js","method":"GET","header":"GET /js/lazyload.min.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"fonts.googleapis.com","host_ip":"172.217.7.234:80","url":"/earlyaccess/nanummyeongjo.css","method":"GET","header":"GET /earlyaccess/nanummyeongjo.css HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: fonts.googleapis.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"fonts.googleapis.com","host_ip":"172.217.7.234:80","url":"/earlyaccess/nanumgothic.css","method":"GET","header":"GET /earlyaccess/nanumgothic.css HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: fonts.googleapis.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/flash.js","method":"GET","header":"GET /js/flash.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/neodesign/rightbanner.js","method":"GET","header":"GET /js/neodesign/rightbanner.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/bookmark.js","method":"GET","header":"GET /js/bookmark.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/template/work/32889/shopdetail.css?t=201902201354","method":"GET","header":"GET /shopimages/mariehan/template/work/32889/shopdetail.css?t=201902201354 HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/template/work/32889/header.1.css?t=201912231119","method":"GET","header":"GET /shopimages/mariehan/template/work/32889/header.1.css?t=201912231119 HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/template/work/32889/footer.1.css?t=201902081418","method":"GET","header":"GET /shopimages/mariehan/template/work/32889/footer.1.css?t=201902081418 HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/css/shopdetail.css","method":"GET","header":"GET /css/shopdetail.css HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/template/work/32889/header.1.js?t=201912231119","method":"GET","header":"GET /shopimages/mariehan/template/work/32889/header.1.js?t=201912231119 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/html/shopRbanner.html?param1=1","method":"GET","header":"GET /html/shopRbanner.html?param1=1 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/template/work/32889/shopdetail.js?t=201902201354","method":"GET","header":"GET /shopimages/mariehan/template/work/32889/shopdetail.js?t=201902201354 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/jquery.language.js","method":"GET","header":"GET /js/jquery.language.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.allthegate.com","host_ip":"121.133.126.33:80","url":"/hyosung/download/images/image_escrow.gif","method":"GET","header":"GET /hyosung/download/images/image_escrow.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.allthegate.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"mariehan.img47.makeshop.co.kr","host_ip":"121.78.207.47:80","url":"/_public/uploadFiles/editor/1701/20170119144157_eozkrziy.jpg","method":"GET","header":"GET /_public/uploadFiles/editor/1701/20170119144157_eozkrziy.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: mariehan.img47.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"mariehan.img47.makeshop.co.kr","host_ip":"121.78.207.47:80","url":"/_public/uploadFiles/editor/1701/20170119144107_pdxnwsjo.jpg","method":"GET","header":"GET /_public/uploadFiles/editor/1701/20170119144107_pdxnwsjo.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: mariehan.img47.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"mariehan.img47.makeshop.co.kr","host_ip":"121.78.207.47:80","url":"/_public/uploadFiles/editor/1701/20170119144134_yivfheec.jpg","method":"GET","header":"GET /_public/uploadFiles/editor/1701/20170119144134_yivfheec.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: mariehan.img47.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"mariehan.img47.makeshop.co.kr","host_ip":"121.78.207.47:80","url":"/_public/uploadFiles/editor/1701/20170119144221_gecbeubz.jpg","method":"GET","header":"GET /_public/uploadFiles/editor/1701/20170119144221_gecbeubz.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: mariehan.img47.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"mariehan.img47.makeshop.co.kr","host_ip":"121.78.207.47:80","url":"/_public/uploadFiles/editor/1701/20170119144313_acsrdpnf.jpg","method":"GET","header":"GET /_public/uploadFiles/editor/1701/20170119144313_acsrdpnf.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: mariehan.img47.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/jquery.multi_option.js","method":"GET","header":"GET /js/jquery.multi_option.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/lib.js","method":"GET","header":"GET /js/lib.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/js/cookie.js","method":"GET","header":"GET /js/cookie.js HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"mariehan.img47.makeshop.co.kr","host_ip":"121.78.207.47:80","url":"/_public/uploadFiles/editor/1701/20170119144250_kksnxwkp.jpg","method":"GET","header":"GET /_public/uploadFiles/editor/1701/20170119144250_kksnxwkp.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: mariehan.img47.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/template_common/shop/basic_simple/common.js?r=1511314772","method":"GET","header":"GET /template_common/shop/basic_simple/common.js?r=1511314772 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/icon_blog.png","method":"GET","header":"GET /design/mariehan/images/icon_blog.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/icon_insta.png","method":"GET","header":"GET /design/mariehan/images/icon_insta.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/icon_search.png","method":"GET","header":"GET /design/mariehan/images/icon_search.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/logo.png","method":"GET","header":"GET /design/mariehan/images/logo.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/box_arrow.gif","method":"GET","header":"GET /design/mariehan/images/box_arrow.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/0050010000102.jpg?1551315255","method":"GET","header":"GET /shopimages/mariehan/0050010000102.jpg?1551315255 HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"mariehan.img47.makeshop.co.kr","host_ip":"121.78.207.47:80","url":"/_public/uploadFiles/editor/1701/20170119144335_srkaludl.jpg","method":"GET","header":"GET /_public/uploadFiles/editor/1701/20170119144335_srkaludl.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: mariehan.img47.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/0020010000122.jpg?1551315255","method":"GET","header":"GET /shopimages/mariehan/0020010000122.jpg?1551315255 HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/board/images/btn_ok.gif","method":"GET","header":"GET /board/images/btn_ok.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/board/images/btn_close.gif","method":"GET","header":"GET /board/images/btn_close.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.asheater.co.kr","host_ip":"119.207.79.31:80","url":"/skin15/css/fire.php","method":"POST","header":"POST /skin15/css/fire.php HTTP/1.1\nHost: www.asheater.co.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------0007a02004c59\nContent-Length: 973","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.13.67:80","url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D","method":"GET","header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"ocsp.pki.goog","host_ip":"172.217.13.67:80","url":"/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCiskYiKIzzKQgAAAAAKZbr","method":"GET","header":"GET /gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQCiskYiKIzzKQgAAAAAKZbr HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"crl.pki.goog","host_ip":"172.217.13.67:80","url":"/GTS1O1.crl","method":"GET","header":"GET /GTS1O1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.pki.goog","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"ocsp.trust-provider.com","host_ip":"151.139.128.14:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR8sWZUnKvbRO5iJhat9GV793rVlAQUrb2YejS0Jvf6xCZU7wO94CTLVBoCEENSAj%2F6qJAfE5%2Fj9OXBRE4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.trust-provider.com","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"ocsp.comodoca4.com","host_ip":"151.139.128.14:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D","method":"GET","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrJdiQ%2Ficg9B19asFe73bPYs%2BreAQUdXGnGUgZvJ2d6kFH35TESHeZ03kCEFslzmkHxCZVZtM5DJmpVK0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.comodoca4.com","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"fonts.gstatic.com","host_ip":"172.217.164.131:80","url":"/s/nanumgothic/v17/PN_oRfi-oW3hYwmKDpxS7F_LXv7LyVsg.woff","method":"GET","header":"GET /s/nanumgothic/v17/PN_oRfi-oW3hYwmKDpxS7F_LXv7LyVsg.woff HTTP/1.1\nAccept: */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nOrigin: http://www.hclassic.com\nAccept-Encoding: gzip, deflate\nHost: fonts.gstatic.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"fonts.gstatic.com","host_ip":"172.217.164.131:80","url":"/s/nanumgothic/v17/PN_3Rfi-oW3hYwmKDpxS7F_D-djY.woff","method":"GET","header":"GET /s/nanumgothic/v17/PN_3Rfi-oW3hYwmKDpxS7F_D-djY.woff HTTP/1.1\nAccept: */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nOrigin: http://www.hclassic.com\nAccept-Encoding: gzip, deflate\nHost: fonts.gstatic.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"fonts.gstatic.com","host_ip":"172.217.164.131:80","url":"/s/nanumgothic/v17/PN_oRfi-oW3hYwmKDpxS7F_LQv3LyVsg.woff","method":"GET","header":"GET /s/nanumgothic/v17/PN_oRfi-oW3hYwmKDpxS7F_LQv3LyVsg.woff HTTP/1.1\nAccept: */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nOrigin: http://www.hclassic.com\nAccept-Encoding: gzip, deflate\nHost: fonts.gstatic.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"maxcdn.bootstrapcdn.com","host_ip":"209.197.3.15:80","url":"/font-awesome/4.1.0/fonts/fontawesome-webfont.eot?","method":"GET","header":"GET /font-awesome/4.1.0/fonts/fontawesome-webfont.eot? HTTP/1.1\nAccept: */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nOrigin: http://www.hclassic.com\nAccept-Encoding: gzip, deflate\nHost: maxcdn.bootstrapcdn.com\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/banner_arrow_down.gif","method":"GET","header":"GET /design/mariehan/images/banner_arrow_down.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/banner_arrow_up.gif","method":"GET","header":"GET /design/mariehan/images/banner_arrow_up.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/template/work/32889/scroll.css?t=201902121703","method":"GET","header":"GET /shopimages/mariehan/template/work/32889/scroll.css?t=201902121703 HTTP/1.1\nAccept: text/css, */*\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/shopimages/mariehan/0050010000103.jpg?1551315255","method":"GET","header":"GET /shopimages/mariehan/0050010000103.jpg?1551315255 HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/icon_banner_arrow.gif","method":"GET","header":"GET /design/mariehan/images/icon_banner_arrow.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/_public/menu_navi.png","method":"GET","header":"GET /design/mariehan/images/_public/menu_navi.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/_public/logo.png","method":"GET","header":"GET /design/mariehan/images/_public/logo.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/_public/sk_bg_header.gif","method":"GET","header":"GET /design/mariehan/images/_public/sk_bg_header.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/_public/sk_bg_btm.gif","method":"GET","header":"GET /design/mariehan/images/_public/sk_bg_btm.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/codi_arrow_next.png","method":"GET","header":"GET /design/mariehan/images/codi_arrow_next.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/design/mariehan/images/codi_arrow_prev.png","method":"GET","header":"GET /design/mariehan/images/codi_arrow_prev.png HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/html/user_basket_quantity.html","method":"POST","header":"POST /html/user_basket_quantity.html HTTP/1.1\nAccept: application/json, text/javascript, */*; q=0.01\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\nX-Requested-With: XMLHttpRequest\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nHost: www.hclassic.com\nContent-Length: 17\nDNT: 1\nConnection: Keep-Alive\nCache-Control: no-cache\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/images/common/basket_up.gif","method":"GET","header":"GET /images/common/basket_up.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C; MakeshopLogUniqueId=a56ae6e6e9bc98b3658ada812d653361","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/images/common/basket_down.gif","method":"GET","header":"GET /images/common/basket_down.gif HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C; MakeshopLogUniqueId=a56ae6e6e9bc98b3658ada812d653361","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"log28.makeshop.co.kr","host_ip":"121.78.72.162:80","url":"/js/mslog.js?r=0.4358038225068932","method":"GET","header":"GET /js/mslog.js?r=0.4358038225068932 HTTP/1.1\nAccept: application/javascript, */*;q=0.8\nReferer: http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: log28.makeshop.co.kr\nDNT: 1\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"host":"www.hclassic.com","host_ip":"14.129.113.48:80","url":"/favicon.ico","method":"GET","header":"GET /favicon.ico HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nHost: www.hclassic.com\nDNT: 1\nConnection: Keep-Alive\nCookie: db=VbKEWoM2WbIBAtbaQYo%2Bo77UUECLpszDNgFLU8yetutk9RLLaNNRwcYIxjG8VDSwNE9PsrSu3MphTr%2Fj63pSRIy%2Bt3XKtsHdUbQVppE89LIQb2phCHBkOCof6SfzLeaE; dgg_default_language=Y; shop_language=kor; viewproduct=%2C005001000010%2C; MakeshopLogUniqueId=a56ae6e6e9bc98b3658ada812d653361; ____MSLOG__initkey=0.58419286493235; ____MSLOG__initday=20200203","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}],"processes":[{"pid":2760,"ppid":0,"name":"tmpoaejpshj.exe","command_line":"","sha256":"dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab","normalized_path":"C:\\tmpoaejpshj.exe","uid":"00058247-00002760","icon":"$2c"},{"pid":1140,"ppid":2760,"name":"cmd.exe","command_line":"cmd /c copy>\"%PUBLIC%\\netstates.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00058247-00002760","uid":"00058434-00001140"},{"pid":3484,"ppid":2760,"name":"netstates.exe","command_line":"","sha256":"a201ae69d8c84d1c95f87dced704a38ad4e131c7e36d60b88ff859ba3bf7aab1","normalized_path":"%PUBLIC%\\netstates.exe","parent_uid":"00058247-00002760","uid":"00058442-00003484"},{"pid":3688,"ppid":2760,"name":"iexplore.exe","command_line":"http://www.hclassic.com/shop/shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00058247-00002760","uid":"00058460-00003688"},{"pid":2348,"ppid":3688,"name":"iexplore.exe","command_line":"SCODEF:3688 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00058460-00003688","uid":"00058497-00002348"}],"all_imported_dlls":["api-ms-win-downlevel-normaliz-l1-1-0.dll","userenv.dll","gdi32.dll","WSHTCPIP.DLL","IEShims.dll","ExplorerFrame.dll","dui70.dll","d3d11.dll","xmllite.dll","powrprof.dll","sqmapi.dll","ncrypt.dll","sxs.dll","kernel32.dll","secur32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","propsys.dll","dwmapi.dll","oleacc.dll","MSOHEV.DLL","WindowsCodecs.dll","msvcr100.dll","sechost.dll","oleaut32.dll","nlaapi.dll","RpcRtRemote.dll","schannel.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","netprofm.dll","srvcli.dll","msasn1.dll","wkscli.dll","rsaenh.dll","comctl32.dll","ieframe.dll","netapi32.dll","dxgi.dll","user32.dll","dnsapi.dll","bcrypt.dll","bcryptprimitives.dll","ntdll.dll","lpk.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dhcpcsvc.dll","mswsock.dll","NapiNSP.dll","mlang.dll","msvcr90.dll","imm32.dll","msctf.dll","IPHLPAPI.DLL","comdlg32.dll","mscorwks.dll","winrnr.dll","credssp.dll","ntmarta.dll","webio.dll","wshqos.dll","gpapi.dll","mscoree.dll","wship6.dll","pnrpnsp.dll","Wldap32.dll","cryptnet.dll","jscript9.dll","msxml6.dll","sspicli.dll","ole32.dll","KernelBase.dll","shlwapi.dll","psapi.dll","mscoreei.dll","winhttp.dll","npmproxy.dll","normaliz.dll","rpcrt4.dll","cfgmgr32.dll","usp10.dll","crypt32.dll","duser.dll","d2d1.dll","DWrite.dll","apphelp.dll","mshtml.dll","msimtf.dll","msxml6r.dll","t2embed.dll","winmm.dll","winbrand.dll","wininet.dll","iertutil.dll","urlmon.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","rasadhlp.dll","d3d10warp.dll","imagehlp.dll","cryptbase.dll","ieui.dll","advapi32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","setupapi.dll","ieproxy.dll","dhcpcsvc6.dll","winnsi.dll","uxtheme.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","FWPUCLNT.DLL","oleaccrc.dll","ssv.dll","api-ms-win-downlevel-version-l1-1-0.dll","ws2_32.dll","nsi.dll","shell32.dll","cryptsp.dll","msimg32.dll","SensApi.dll","WindowsCodecsExt.dll","version.dll","clbcatq.dll","netutils.dll","jp2ssv.dll","devobj.dll","profapi.dll","msvcrt.dll","rpcss.dll","wintrust.dll","URLREDIR.DLL","deploy.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_2_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"ver4DE.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"netstates.exe","sha256":"a201ae69d8c84d1c95f87dced704a38ad4e131c7e36d60b88ff859ba3bf7aab1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"0CNSHRG9.txt","sha256":"5061a3f9f54d4db57b7e62e266743efd871b4f89987a2d61c8228cee0b70c37f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"4Z3MA4UL.txt","sha256":"f5c1a77c6170c4e6d9673d0dfe849b9dc01ab13568c7f810a466fd8372b0bc77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"8DT2UCMK.txt","sha256":"552abb5aed5c164e98f546f059de04d3c3a9193c711fe04b3ae0ec56cee35727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"BWW3OWVI.txt","sha256":"755751a224b97eab2eac062c6b1925b0873214cfd533e6486e8c1329bd10abcb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"EK2PWHPD.txt","sha256":"98c34cd4c3517c3c369530353fadf9f014991deda6ebdd6ee34f445e7440a734","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"G2DO5GJ1.txt","sha256":"4767f95cb8b6b7a6ef974824cda4083bb9854d664d57e44d15f19350aa8091df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"J7JQ2UDV.txt","sha256":"6b97a45f94ec3bf88aae9d006f5c7e7664dcfc9e17b495bb7dc0b9e9920902b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"JO41ZTWB.txt","sha256":"6c236444e993517d23adbea1679f7f8a76db80a55a141e6503712358fa9a981c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"S41QVVG5.txt","sha256":"906df98b5a4245ecb2757c4341e374022ff197544126353b041e2416313d6644","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"T0YSQQ4K.txt","sha256":"6f0526f8ef9b5e3c5ae907e83b78a9a658b207af174298fde75243f0ff4f82c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"TLFJXOVP.txt","sha256":"6b97a45f94ec3bf88aae9d006f5c7e7664dcfc9e17b495bb7dc0b9e9920902b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"TN59GSNM.txt","sha256":"7c916987f0eb369b0a5b0cd1ff034eabab7ff876e6781d4ebe91b0d56b4c7fe2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"TYZC2ARM.txt","sha256":"e6d1b835cc4840c3995b41c52adb89b2a59b7f7232005108a33e9175d127f80a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"UWR2LEGW.txt","sha256":"155a10a0d80acaab320fd91116768104b2be4a64c910b88efa611902219aef38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Y4H8PKIO.txt","sha256":"0d2bd02a4aafe2047a2d160b9b7fe2deb6bebd8d21e4650deb36183258f08195","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"en-US.2","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"ver599.tmp","sha256":"8684403da59628039e9b4b0d245c5b7e1fac1242a087ded44eaf3b792e4a231e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"521F25E202FF760B8461B88413F425E7","sha256":"8e874dbedf978c70ae005e882831c3a412a741b289f12ec610986f2dffded7bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"af13fdd73422eda526297641fab1ec7787693fed2fe77527fb8be5d63031046d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}],"files_written":[{"path":"%WINDIR%\\System32\\notepad.exe","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%TEMP%\\~DFDE41B5A55D5D35C6.TMP","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%PUBLIC%\\netstates.exe","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"C:\\http:\\www.hclassic.com\\shop\\shopdetail.html?branduid=127&xcode=005&mcode=001&scode=&type=X&sort=manual&cur_code=005&GfDT=a2Z3Ug%3D%3D","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4Z3MA4UL.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\shopdetail[1].htm","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\jquery-1.7.2.min[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\nanummyeongjo[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\nanumgothic[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\lazyload.min[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\3mt7jhv\\imagestore.dat","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\flash[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\shopdetail[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\header.1[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\shopdetail[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\jquery.language[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\jquery.multi_option[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\20170119144221_gecbeubz[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\20170119144313_acsrdpnf[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{CA54635D-4619-11EA-A10A-0A00272257C6}.dat","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%TEMP%\\~DF7C169DAA311A4EB3.TMP","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\icon_search[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\logo[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\box_arrow[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\20170119144335_srkaludl[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\font-awesome.min[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_941E2CF7D52EA68A52B0353CBAFEDCB0","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\common[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\bookmark[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\rightbanner[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\footer.1[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\header.1[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\shopdetail[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\shopRbanner[1].htm","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\image_escrow[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\20170119144157_eozkrziy[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\20170119144107_pdxnwsjo[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\20170119144134_yivfheec[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\lib[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\cookie[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\20170119144250_kksnxwkp[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\common[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\icon_blog[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\icon_insta[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver599.tmp","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\0050010000102[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_B1284312EA055CCEA877D3433720BD99","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\BE8B021F9E811DFC8C8A28572A17C05A_B1284312EA055CCEA877D3433720BD99","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\0020010000122[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\urlblockindex[2].bin","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\btn_ok[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\btn_close[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\521F25E202FF760B8461B88413F425E7","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\521F25E202FF760B8461B88413F425E7","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{CA54635B-4619-11EA-A10A-0A00272257C6}.dat","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[3].ico","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[2].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[3].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[4].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[5].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[6].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ZN1CVVJS.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[7].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[8].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_A7A8E86FCB076C144BD04C40841E7074","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\css[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{CA54635E-4619-11EA-A10A-0A00272257C6}.dat","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%TEMP%\\~DF850A3F4D1B5B65E8.TMP","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver4DE.tmp","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\ERV9N2EC.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\L8DC4A47.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\nanumbarungothic[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\NanumBarunGothic-Bold[1].eot","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3S9Q96YC.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Fonts\\gulim.ttc","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\mem8YaGs126MiZpBA-UFVZ0d[1].woff","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\banner_arrow_up[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\menu_navi[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\9EC3B71635F8BA3FC68DE181A104A0EF_6BB6788F6A8528A0F9C552EFF5B09463","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\FAC339B39377A299AE11B4D208AD3090","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\9EC3B71635F8BA3FC68DE181A104A0EF_F6C39EF89D8A3A72327D8412589658B2","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\64DCC9872C5635B1B7891B30665E0558_0D8A59131C70FA8C84AEB496F0935D24","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\A6E643304C5FBB7CBF4025F1978D6EED","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\mslog[1].js","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\64DCC9872C5635B1B7891B30665E0558_5552C20A2631357820903FD38A8C0F9F","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\NanumBarunGothic-Regular[1].eot","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\sp_qty[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TLFJXOVP.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Y4H8PKIO.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\J7JQ2UDV.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001f.db","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\ms[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\PN_oRfi-oW3hYwmKDpxS7F_LXv7LyVsg[1].woff","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\PN_3Rfi-oW3hYwmKDpxS7F_D-djY[1].woff","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\PN_oRfi-oW3hYwmKDpxS7F_LQv3LyVsg[1].woff","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_B6E508CB345B95F29F504E60D228C8C1","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\BE8B021F9E811DFC8C8A28572A17C05A_96E60E226B5F6D0EA5C0A84219AA775A","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\mem5YaGs126MiZpBA-UN8rsOUuhv[1].woff","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\fontawesome-webfont[1].eot","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\banner_arrow_down[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\0050010000103[1].jpg","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\icon_banner_arrow[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\scroll[1].css","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\logo[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\sk_bg_header[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\sk_bg_btm[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\codi_arrow_next[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\codi_arrow_prev[1].png","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\basket_up[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\basket_down[1].gif","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TN59GSNM.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\UWR2LEGW.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\8DT2UCMK.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\JO41ZTWB.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\T0YSQQ4K.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\BWW3OWVI.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\favicon[1].htm","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript9.dll.mui","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\G2DO5GJ1.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0CNSHRG9.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.1","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\EK2PWHPD.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\TYZC2ARM.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\S41QVVG5.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VG8BU31O.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\4F7NV88N.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\I88H097X.txt","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\search[1].json","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e68_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"IsoScope_e68_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"IsoScope_e68_ConnHashTable<3688>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"IsoScope_e68_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"IsoScope_e68_IE_EarlyTabStart_0xbe8_Mutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"IsoScope_e68_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3688","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3688","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e68_IE_EarlyTabStart_0xbe8_Mutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e68_ConnHashTable<3688>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e68_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e68_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"IsoScope_e68_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e68_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"5e3764f19060c6154b299f3e"}]}]}},"report_ids":{"sandbox_job_ids":["5e3764f19060c6154b299f3e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.PoorWeb Sample dc69b98da87a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dc69b98da87a…. Malware family: Trojan.PoorWeb. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.PoorWeb Sample dc69b98da87a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dc69b98da87a…. Malware family: Trojan.PoorWeb. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dc69b98da87a7b6b683359082b63d1e945cbef17a32d432d11c5f488399460ab"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.PoorWeb Sample dc69b98da87a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dc69b98da87a…. Malware family: Trojan.PoorWeb. Threat score 100/100. 16/28 AV engines flagged this file. 7 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]