An example of 1.hwp with registry and system information:  Gold Dragon executes these steps executed in the exfiltration process:  Once the malware has gathered the required data from the endpoint, it encrypts the data file 1.hwp using the password “www[dot]GoldDragon[dot]com” The encrypted content is written to the data file 1.hwp