6522ab0c608cdccf5327ecd28c5e751e8960dc84748e5558c03aeb7020d2015a

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 15:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RunGame.exe
Size

71KB
MD5

6cbf23d640553b01afb2bcd64e513603
SHA1

85553697fa8aa86bbc5de321c94b20664018ea28
SHA256

bdf45e650caaf214fadbeb8a534893bcdf45541e5d641d4beda97ce49317ee83
SHA512

232e910ae2f0fc551f8fa2b6157824b44f95389546b5f42797b225dec7a1c28a5ce89702d6393809cc4f3d057d31889b4bf12d9644e89207ed354fb8d157957c
SSDEEP

768:TUntxZvPzGB6rVz3gFobjZkVfW9HPCfv+I6rhPX3aH8+GbebcYaSMP5aGNSNg:TUtxhkFKjmVfW1PC+xhl+DbFarPfug

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
2656	KGGWSetup_1003.exe
2948	KGGouwo.exe
2388	KGGouwo.exe

Loads dropped DLL 5 IoCs

pid	Process
1620	RunGame.exe
2656	KGGWSetup_1003.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	KGGouwo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd154180e3df334793185d587fd90cf90000000002000000000010660000000100002000000036019201fc4d6ca11a10192b9fee320f5031bdc93eafe39ba6a16e8447b55bb7000000000e8000000002000020000000af7c779b590ea7abb127183974358f5e9bcbb211ee2e5296e027099384bae81690000000a4254b2c70e62aa442abec1b839a27a725b42a9fbfa6d12a0cdcbf6d6b74732c096cb3e057cface34ffc8a72964b59cab813037b9f4a0507cd45508e1f839e554ceaf4cc60fbb75eb43e9cb4b274e7cec9f10a05e73fb43718cdc4633e6212065ef42a6cdd03ecb33952ebcb26e714746d704e90877342cfd655746be51796f21df8128f665e61312b7f5b378593c29d40000000df27568b60dc66a9e6b4a8faa71222c0dfc71685c7b3e7b0a812f23616d19df8e5fae9683d0c75927c53f159d90f0dc155574110ea0ea0da2336c69b8838db44	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70f25bf5359eda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DF44F71-0A29-11EF-A140-5ABF6C2465D5} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cd154180e3df334793185d587fd90cf9000000000200000000001066000000010000200000001ebb30daf130cf3b8e60daa96f753a7cb50613159b188020dae75413693a64de000000000e800000000200002000000065de0f5292912211e30dcd566ab78a65331d3ff4ff88efcdef0d000b8199ed2520000000ab02e102ca6c9001a48d6660f3882422b6b23685b11add8fe1fd54dadb4f26c740000000a75c7b4c9d4f063ee4ab2c0400b7955d65436a50118f054f9ec6a557cb8ee12622d8d66cfbc2536064ea114fc4b67269ee4ec0d8ec5512197efeb91bb69f1ed2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420997585"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe
2388	KGGouwo.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	2388	KGGouwo.exe
Token: SeSecurityPrivilege	2388	KGGouwo.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2988	iexplore.exe
2388	KGGouwo.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2388	KGGouwo.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 2988	1620	RunGame.exe	28
PID 1620 wrote to memory of 2988	1620	RunGame.exe	28
PID 1620 wrote to memory of 2988	1620	RunGame.exe	28
PID 1620 wrote to memory of 2988	1620	RunGame.exe	28
PID 2988 wrote to memory of 2532	2988	iexplore.exe	29
PID 2988 wrote to memory of 2532	2988	iexplore.exe	29
PID 2988 wrote to memory of 2532	2988	iexplore.exe	29
PID 2988 wrote to memory of 2532	2988	iexplore.exe	29
PID 1620 wrote to memory of 2656	1620	RunGame.exe	31
PID 1620 wrote to memory of 2656	1620	RunGame.exe	31
PID 1620 wrote to memory of 2656	1620	RunGame.exe	31
PID 1620 wrote to memory of 2656	1620	RunGame.exe	31
PID 1620 wrote to memory of 2656	1620	RunGame.exe	31
PID 1620 wrote to memory of 2656	1620	RunGame.exe	31
PID 1620 wrote to memory of 2656	1620	RunGame.exe	31
PID 2656 wrote to memory of 2948	2656	KGGWSetup_1003.exe	32
PID 2656 wrote to memory of 2948	2656	KGGWSetup_1003.exe	32
PID 2656 wrote to memory of 2948	2656	KGGWSetup_1003.exe	32
PID 2656 wrote to memory of 2948	2656	KGGWSetup_1003.exe	32
PID 1620 wrote to memory of 2388	1620	RunGame.exe	33
PID 1620 wrote to memory of 2388	1620	RunGame.exe	33
PID 1620 wrote to memory of 2388	1620	RunGame.exe	33
PID 1620 wrote to memory of 2388	1620	RunGame.exe	33

C:\Users\Admin\AppData\Local\Temp\RunGame.exe
"C:\Users\Admin\AppData\Local\Temp\RunGame.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://game.kugou.com/AdsPage/2013/01/DiscMicroStartBox.htm?cid=1201
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2532
- C:\Users\Admin\AppData\Local\Temp\tpm2118.tmp\KGGWSetup_1003.exe
  C:\Users\Admin\AppData\Local\Temp\tpm2118.tmp\KGGWSetup_1003.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Users\Admin\AppData\Roaming\GouWo\1006\KGGouwo.exe
    "C:\Users\Admin\AppData\Roaming\GouWo\1006\KGGouwo.exe" /install=1
    3⤵
    - Executes dropped EXE
    PID:2948
- C:\Users\Admin\AppData\Roaming\GouWo\1006\KGGouwo.exe
  C:\Users\Admin\AppData\Roaming\GouWo\1006\KGGouwo.exe mini#1|from#12
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
d62e959720b30244927ac52363072d5a

SHA1
388594cded8cb116b69d6bdea1efb0310af4d6f9

SHA256
a2e73a00b7617094749c5592d32c256a85af1a84d44e907910c2ad34b14d6c6d

SHA512
42e0415602adf73d936c4b0290ad4c636a13db770224331e0bcdd261c91054849922f643c7326bd19f1879884cf280bd96dd2b876a3ca3f8f222a0486a250007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fb3f5b787cf64815ce9d164ad1204d5f

SHA1
3cc116d470583ce7a3574dd52d870b61968ab884

SHA256
06e2eee1d7746277de3e161af73b2b2b943dc22993585030a5d934bb300d715b

SHA512
5bf154b2ba0c71c24423662f4c52cfdf98183e744b7a498f488e1e2415a3608f8fabe5d4828f3d79d17b45d70def5d9ae5330f9350967bc6e3e8bd8347cf14e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad92d2fadccc836b283d1be02dacc9f7

SHA1
162a0fe8c35a4a37d92289ea5dc6351083104f0f

SHA256
403abe9542130d54cff02d3f5ba4a4674ea429186a5027b5692887cc488fc09d

SHA512
42f876b8d217e832d6d25b759a07d158324e54ea15f8fbbeb34a1729bfbf88f99ce1525f3c7cdbb4f63ad591a4d3f01cd20563a92bc85126578ad8abab59a622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b01a9453295d65268734be458e385eb9

SHA1
3e2b43920740bee492e064f7881d8f2d75f16aac

SHA256
3b0488ca23411e6114c8ac2a0f02e9114512dc03ce03ea3df5137d6ebd13b4e7

SHA512
147a8c9ecf9a88c692f1769248175e7b598131b732ad7c0310cf355db0a571b7a7f395ef6fa7c2d4b4b1128ecd68f67f2d9cbb9a226a620ca9bf18aeef5e76f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3d7df73588795e4490d04d178263a29a

SHA1
223cf31050ab7986b012ced704e235edf65398e3

SHA256
b86161fb9de29c664662d6e1a82cedfd1e0a8697695c3aa58da9abe341eacecc

SHA512
2f694286aeb9c74d3d00e774a04429f2eaca408a5c2b607875daa9293a05f513a9f221fd66e009a8f415d5a5e746d1b27bb95c989ae58d27b5620761afadf49e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c601f5e79107b7e912d575b660855a1

SHA1
9966ca11d46c062ba2b71f7a639d6b72e19566ee

SHA256
8458290312960db48f257b21c76e0f78494c65d6ba87f72c29f3d4a24baa9b37

SHA512
976047f191b9029518f9ec7e1f5aa259de22e1acf809917cedf6004e678bda5650a72f19921001f77fb56002e7c76a0a0d36d7f2d9092d7739f06f0158dd1a18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
201bb0b2d0dec59dc77a1c7117c43bac

SHA1
1887d87b71064ed42a368cb315cfd235775f0530

SHA256
04579e6dc377d1c34473fe4aa73dd4a399100426af9c62d38425bc889ad89f31

SHA512
b13bf687951d289e8eb07965eb0fa2ffad8880cfe3441c10a31880d30435df78bd4375bbb652f95c183028abae271c7d515a78b050fcff3265c939be6780d47e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91a78e16f4fa71459e58c5970e000a3f

SHA1
2f07daa0888dbcb0bb2c37a1fff7acca4a67e9e0

SHA256
8d42aa803cd9015742c3f73a0219ef98252ea7ccdaa0682fe8e06c3e2acad0c7

SHA512
0ab954100f3cdb31b0c571e4021d880a7503e4fbacfa006e63b2750eb26533138304b8f26488766accc59fb725bcd6f5a5c1bd02e0c5695ff8b80aa6f2e521ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8bc006f1d23e36a2c0b0eba2bad4c509

SHA1
c6a95562fd2a6425a312d420db0b670cb1682a1b

SHA256
318d8b51c943be23232ec58cddecfeb665198768e8fb5f2ff0ed3e9b56463cdd

SHA512
e2147b3fa04fb4b072d0a36cfc8eb5f5bbdf9a18d6d2d8f1cf9a41f1a49b5afa0ba27aff929b181a56a893a198bf462636c797512dfa50e1d6af0e4fe77f84c0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
88c97b9383444c9af5fa70ceeb94d85c

SHA1
996bc526558d04ec9619b487a7afc8e8e49cace5

SHA256
869487cf5d733af7fda402a2ae998ff52aec3cac2d226edb529f768b2c64e7b0

SHA512
33793946cd6854dcd58e790b61a02e6724bafafcc012ee4cc3e5a9699378bc100edca5ff13596e551416f6ef16b813408f1d23bdc2d5ad3a0c20c9a3cf5fcc0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cce90cf65391f8de0ccbfbd86ad72a7

SHA1
2ee511b5c11fc43bab692eb34b64c06d1857b194

SHA256
c593c9a58182fc45b9fed5156f20bd1220310c8ef67a2b3adab20060c37f4e2e

SHA512
f3e0b70c0ee08e36b4ff8ffa29d1def966519717d4093a21fae72346ba683ec670f64376fca9ec00f11384f24f13b312b8e9ba7855c4815a529c58c076325a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b5fed0f22ff372972f7e7874373d9a8b

SHA1
b9ac9287179ec5caf5fcd4047c1e3bf60af2e9b3

SHA256
e707d13287a7198adf4f6591bb7a467f243a1b2982279ab48c886da273e4f822

SHA512
22edba4e76ffdddcb7b19385b03be21812738c5497002e494b004a5566026d8258860f84d5f93f0cdaee8fc30d6de9f7e399e535025c6465cec581ab05885718

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3e997f11d8ac0483cafc7a2f59fc94b2

SHA1
aae8d5eadeae8e0318fe6e72a78f56be4e517c96

SHA256
65846e13d136bdb79676646b472638082bb5349a8b16001c53e9e8ef916385de

SHA512
1821c3a9523521000b1866c84dddad9f599a6440f0dd81a6715e1ded6805b0622f6bfc99ff8caf72af7f12edfb6a9756150384549ae007d1dffbc06a07d3e76b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70abcc9a228b6325481fd080075aa3ca

SHA1
fbb061f9ae44eef1e0f4e6f179378006e8dbf793

SHA256
f98915abda179c39c8495f3b56e514514caccfc73699083dc4d087b56a70cc38

SHA512
9e236d253d86cd92199b9bf36fd9008d072074c7c88e49f5d7c2e6211efd0ab75589153280558ec7e798dec1a18d0a6db8610700546d71a3d871efa57cfe6e14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76e37c17b59f1805207c953ae6547dae

SHA1
10a64212dc1ef7302e3cd277b060e16b7cadcbbc

SHA256
6118fb0e60d9ed148fb55248f96a06230f90c426e861f65a789bcc7635410c65

SHA512
02b7f25348c8191e4aeacaf1e87b40cd9388b20554be758833084735149c5d7736d1f327b89b152d6363bfb603b2367c90607346d5b722f0253fd2349b9fa2b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40a8735b022584985e4a4ca316517728

SHA1
f819b5f4cba31a210ae27c81f840c891979fa0c0

SHA256
4432659ed19b4fd64073c99a744848bc9a34f574f3c23a06c011bc0a0dab4666

SHA512
bfa150d5afb3a823334e93dd633549ab5c70cbaea71f233c8e6ecfcb43fd7364de139913ec39672666aaa83bbf45277cfc7dbd6292e1ae0d06f01ede87663755

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cca983408713bdc0f0807202db2873e4

SHA1
efb580ecf498d6050fe3eea03bf0078223277af1

SHA256
89c3d0becd39f2e4667dea4a8f5fa27a77be109fce9d72be3dcdd05cf38581a3

SHA512
66b77c8d0927f8175f5481d5a447122c6f27e1a3bb52ff46af5871b8071790efd8bb6dc23dac45b03cb41e1e4930447fcb598b8b72ee70284e401c7589038c9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fa31d74e7e9319361e859338691110ef

SHA1
974f9fbcd6f6f6d107313f2d5ee79e676a6b7b86

SHA256
086cd6d070ec517b2005b6f5c12d9c4c2891d4f7b671c9b2682038c5c1fcf04d

SHA512
be61ff34617f7f913094f9c8dcca72708c964cc668691a23120da01cc9a13ed388c4b27fe8a2a556c8408280fdd430a4dc3101b48c0e8e25cd87e903f7166019

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2bc4044b07bbf3d9e3cd98bf26ed2a3e

SHA1
32b2b94fff77f09508135bdc89e6f766ff71e60e

SHA256
b179cd78cd88b9221946f8adc9935a3989d2c61cf9c2afd2ffe179b280a7bada

SHA512
b5c384945a68a53abf605cdcd4dc0704659125eab4fc88c2f5566aec398246ace542eacf421856d39f1f4bea969eaae8e981c073d0d1f1aae895e199301cb9ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
05144269f4fd994749deac8c61a3729d

SHA1
9fd176f641476e90cb2fec7abd986fa0020990a9

SHA256
d6dca0469e0243a318c78d642863f94e9c4efeed16f7ba7471061174d4db139f

SHA512
5be83b778f4f5f4cd8036b90f1aa5be2bbb854a556165aef8d765f79ba3af331c5faf516e244909c1bbf66e61cc36445c63e149986e64db037ab531d85f0f51f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
feeb0f3a37e8d3bdccb41eda7585f552

SHA1
b76f991b06adf69502563e920783903a08851819

SHA256
7590c245dc3e4a6f88ffe9574735f0563f9cc7bc0c2b0cee4fa031bec3a545f1

SHA512
445bde3f930141f99e25d7446acf97ff5d0512b673139e13afae368f715183cd0eb53cd4155b567dd85056ac0e1c84ad709b127ab4fa28a7b5b11f95c5a1419f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5161.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Roaming\GouWo\1006\KGGouwo.exe

Filesize
2.4MB

MD5
cb937008ac49500aa24b505c5b6105a6

SHA1
aefef477251967316ca2b1169150ef9c0865cbea

SHA256
5b672cbfb422bc4531bb4f5146b24b4b05111879d1c3a746aaee57dee4f9b6f5

SHA512
a1015d0e51167d89ecd1d512bb76058452902729a5657b950e6a5476f14826ec1637ef436bf882645585971757bb6deb387a8ae47bbdbb04b26223ac7f33de9c

Download Submit
C:\Users\Admin\AppData\Roaming\GouWo\1006\config.ini

Filesize
206B

MD5
ac9296bfa552ef71827600de7c44f681

SHA1
1e9b14de71417904076167d0a09ad13f7d50b507

SHA256
5bbc50878279735f70bf455cc91587c7842982d3e647baeba8c90627900bab8e

SHA512
05015ff88517366d477723cf74c04fa05bb1756b6d7e8b657749e9b4ff1c4872f148d808a6900e8942855c86dcc9776741e2a8a147b9034157f14106e0cc3f68

Download Submit
\Users\Admin\AppData\Local\Temp\tpm2118.tmp\KGGWSetup_1003.exe

Filesize
1.9MB

MD5
56c3f6c9eb6f7e8223e49d7a032a3eb6

SHA1
7626a176ef3f9571a53a443e809ad3ae96526d7c

SHA256
5143a8115e9d6d0199a6e67de56b98bcdbcb4adda9ed85e062558b1d05710826

SHA512
31ef589f8070c3ce5454744a7d01c1bf6c44f40f9ff86dfd3034cddbc0f9a3e01f36d9a7aeea2927e858349e75f38f8203da8dead84d635f580995cc102b2021

Download Submit