Any information gathered from the endpoint is first stored in the following file, encrypted, and sent to the control server:  C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  The following information is gathered from the endpoint, stored in the file 1.hwp, and sent to the control server:  Directory listing of the user’s Desktop folder using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Desktop\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the user’s recently accessed files using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Recent >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the system’s %programfiles% folder using command:  cmd.exe /c dir C:\PROGRA~1\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Systeminfo of the endpoint using command:  cmd.exe /c systeminfo >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Copies the file ixe000.bin from:  C:\Documents and Settings\<username>\Application Data\Microsoft\Windows\UserProfiles\ixe000.bin To: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Registry key and value information for the current user’s Run key (with information collected):  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Number of subkeys (<KeyIndex>) <KeyName> Number of Values under each key including the parent Run key (<ValueIndex>) <Value_Name> <Value_Content>  Registry Run key enumeration by Gold Dragon