URL:

https://pinyin.sogou.com/

Full analysis: https://app.any.run/tasks/c04c40be-9af6-4bd8-adbc-98ea3d4e87f5
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 19, 2019, 10:58:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
sogou
loader
Indicators:
MD5:

6D5011B78ADA4C46FFFA95719D5FB33B

SHA1:

C8205300C5BB3C1198D421692781F7884D20181C

SHA256:

55AED97511FB3080BBF356AB7FD7670899D03FD6E750B269C82794A5D509A31E

SSDEEP:

3:N8IoKLfeKKn:2ItreKK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • sogou_pinyin_93d.exe (PID: 2896)
      • sogou_pinyin_93d.exe (PID: 2716)
      • SGTool.exe (PID: 2692)
      • SGTool.exe (PID: 4036)
      • SGTool.exe (PID: 3396)
      • SGTool.exe (PID: 3548)
      • SogouSvc.exe (PID: 2396)
      • SGTool.exe (PID: 3072)
      • SGTool.exe (PID: 2072)
      • SGTool.exe (PID: 968)
      • userNetSchedule.exe (PID: 4068)
      • SGTool.exe (PID: 4012)
      • SGTool.exe (PID: 3564)
      • SGTool.exe (PID: 3880)
      • SGTool.exe (PID: 2380)
      • SGTool.exe (PID: 2940)
      • SGTool.exe (PID: 3204)
      • SGTool.exe (PID: 4040)
      • SGTool.exe (PID: 2768)
      • SogouImeBroker.exe (PID: 3412)
      • SogouComMgr.exe (PID: 2368)
      • SGMedalLoader.exe (PID: 2208)
      • SogouComMgr.exe (PID: 900)
      • SGTool.exe (PID: 3428)
      • SGTool.exe (PID: 3956)
      • SGTool.exe (PID: 2896)
      • userNetSchedule.exe (PID: 3964)
      • SGTool.exe (PID: 2856)
      • SogouExe.exe (PID: 3980)
      • pinyinup.exe (PID: 2732)
      • SGDownload.exe (PID: 2656)
      • SGSetc.exe (PID: 3044)
      • SGSetc.exe (PID: 3652)
      • SGSetc.exe (PID: 312)
      • SGSetc.exe (PID: 3364)

    • Downloads executable files from the Internet

      • chrome.exe (PID: 2884)

    • Loads dropped or rewritten executable

      • sogou_pinyin_93d.exe (PID: 2716)
      • regsvr32.exe (PID: 3204)
      • regsvr32.exe (PID: 2676)
      • SogouComMgr.exe (PID: 900)
      • SogouComMgr.exe (PID: 2368)
      • SGTool.exe (PID: 2896)
      • SogouExe.exe (PID: 3980)
      • SGTool.exe (PID: 2856)
      • SGTool.exe (PID: 3956)
      • pinyinup.exe (PID: 2732)
      • SGTool.exe (PID: 2768)
      • conhost.exe (PID: 3856)
      • svchost.exe (PID: 844)

    • Registers / Runs the DLL via REGSVR32.EXE

      • sogou_pinyin_93d.exe (PID: 2716)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 892)
      • schtasks.exe (PID: 3364)

    • Uses Task Scheduler to run other applications

      • sogou_pinyin_93d.exe (PID: 2716)

    • Changes the autorun value in the registry

      • sogou_pinyin_93d.exe (PID: 2716)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 2884)
      • sogou_pinyin_93d.exe (PID: 2716)
      • SGTool.exe (PID: 2768)
      • SogouComMgr.exe (PID: 900)

    • Creates files in the program directory

      • SGTool.exe (PID: 2692)
      • SGTool.exe (PID: 3396)
      • sogou_pinyin_93d.exe (PID: 2716)
      • SogouComMgr.exe (PID: 900)
      • SGTool.exe (PID: 3428)
      • SGTool.exe (PID: 2856)
      • SGTool.exe (PID: 2768)

    • Creates files in the user directory

      • sogou_pinyin_93d.exe (PID: 2716)
      • SGTool.exe (PID: 2896)
      • SGMedalLoader.exe (PID: 2208)
      • pinyinup.exe (PID: 2732)
      • SGTool.exe (PID: 2768)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 3204)
      • regsvr32.exe (PID: 2676)

    • Modifies the open verb of a shell class

      • SGTool.exe (PID: 4036)
      • SGTool.exe (PID: 968)
      • SGTool.exe (PID: 3564)
      • SogouComMgr.exe (PID: 900)

    • Removes files from Windows directory

      • sogou_pinyin_93d.exe (PID: 2716)

    • Creates files in the Windows directory

      • sogou_pinyin_93d.exe (PID: 2716)
      • svchost.exe (PID: 844)

    • Creates a software uninstall entry

      • sogou_pinyin_93d.exe (PID: 2716)

    • Starts Internet Explorer

      • sogou_pinyin_93d.exe (PID: 2716)

    • Changes the started page of IE

      • sogou_pinyin_93d.exe (PID: 2716)

    • Reads Internet Cache Settings

      • SGMedalLoader.exe (PID: 2208)
      • pinyinup.exe (PID: 2732)
      • SGTool.exe (PID: 2768)

    • Uses ICACLS.EXE to modify access control list

      • SGTool.exe (PID: 2768)

    • Reads internet explorer settings

      • SGTool.exe (PID: 2768)

  • INFO

    • Reads Internet Cache Settings

      • chrome.exe (PID: 2884)

    • Application launched itself

      • chrome.exe (PID: 2884)
      • iexplore.exe (PID: 2972)

    • Dropped object may contain Bitcoin addresses

      • sogou_pinyin_93d.exe (PID: 2716)
      • SogouComMgr.exe (PID: 900)

    • Changes internet zones settings

      • iexplore.exe (PID: 2972)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2584)

    • Creates files in the user directory

      • iexplore.exe (PID: 2584)

    • Reads settings of System Certificates

      • SogouExe.exe (PID: 3980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
92
Monitored processes
55
Malicious processes
14
Suspicious processes
6

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sogou_pinyin_93d.exe no specs sogou_pinyin_93d.exe sgtool.exe no specs sgtool.exe no specs regsvr32.exe no specs regsvr32.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs sogousvc.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs usernetschedule.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs schtasks.exe no specs schtasks.exe no specs sgtool.exe no specs sgtool.exe no specs sogouimebroker.exe no specs regsvr32.exe no specs sogoucommgr.exe sgtool.exe sgtool.exe no specs sogoucommgr.exe sgmedalloader.exe sgtool.exe sgtool.exe usernetschedule.exe no specs iexplore.exe sogouexe.exe no specs sgtool.exe iexplore.exe pinyinup.exe no specs sgdownload.exe icacls.exe no specs conhost.exe no specs svchost.exe sgsetc.exe no specs sgsetc.exe no specs sgsetc.exe no specs sgsetc.exe no specs wmiapsrv.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
312"C:\Program Files\SogouInput\9.3.0.2941\SGSetc.exe" "http://soso.com" "" "YYID=7F855651D0D0DCE43693E170256AB6A4; path=/; expires=Thu, 07-Mar-43 09:15:47 GMT; domain=.soso.com" 64C:\Program Files\SogouInput\9.3.0.2941\SGSetc.exe—SGTool.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗输入法 网络更新程序
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\sogouinput\9.3.0.2941\sgsetc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
844C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
892schtasks /delete /tn SogouImeMgr /fC:\Windows\system32\schtasks.exe—sogou_pinyin_93d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
900"C:\Program Files\SogouInput\Components\SogouComMgr.exe" -installdoall "C:\Program Files\SogouInput\Components\TempComponents" -param "-setup -rdele -pluginlist HandInput#MouseGesture#ScreenCapture -installplu 0 -removelist SearchSuggestionBundle#WonderfulWriteBundle#SmartInfoBundle" -silent -overwriteC:\Program Files\SogouInput\Components\SogouComMgr.exe
sogou_pinyin_93d.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗输入法 扩展功能管理器
Exit code:
0
Version:
9.3.0.2941
Modules
Images
c:\program files\sogouinput\components\sogoucommgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
968"C:\Program Files\SogouInput\9.3.0.2941\SGTool.exe" --appid=scdreg -register "C:\Program Files\SogouInput\9.3.0.2941"C:\Program Files\SogouInput\9.3.0.2941\SGTool.exe—sogou_pinyin_93d.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗输入法 工具
Exit code:
0
Version:
9.3.0.2941
Modules
Images
c:\program files\sogouinput\9.3.0.2941\sgtool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1832"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=976,242606157672125368,8062065844879851193,131072 --enable-features=PasswordImport --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --service-request-channel-token=D24AAD625AB16B6FA0E38663173B429A --mojo-platform-channel-handle=1008 --ignored=" --type=renderer " /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google Inc.
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
68.0.3440.106
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\68.0.3440.106\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2072"C:\Program Files\SogouInput\9.3.0.2941\SGTool.exe" --appid=scdreg -ConvV1toV2InstPath "C:\Program Files\SogouInput\9.3.0.2941"C:\Program Files\SogouInput\9.3.0.2941\SGTool.exe—sogou_pinyin_93d.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗输入法 工具
Exit code:
0
Version:
9.3.0.2941
Modules
Images
c:\program files\sogouinput\9.3.0.2941\sgtool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2208"C:\Program Files\SogouInput\9.3.0.2941\SGMedalLoader.exe" 6 9.3.0.2941 7F855651D0D0DCE43693E170256AB6A4 1,5,9,10 0 -s 0000C:\Program Files\SogouInput\9.3.0.2941\SGMedalLoader.exe
sogou_pinyin_93d.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗输入法 勋章推荐
Exit code:
0
Version:
1.0.0.41
Modules
Images
c:\program files\sogouinput\9.3.0.2941\sgmedalloader.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2368"C:\Program Files\SogouInput\Components\SogouComMgr.exe" -GetSugglistC:\Program Files\SogouInput\Components\SogouComMgr.exe
sogou_pinyin_93d.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗输入法 扩展功能管理器
Exit code:
0
Version:
9.3.0.2941
Modules
Images
c:\program files\sogouinput\components\sogoucommgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wininet.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2380"C:\Program Files\SogouInput\9.3.0.2941\SGTool.exe" --appid=check -oC:\Program Files\SogouInput\9.3.0.2941\SGTool.exe—sogou_pinyin_93d.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
搜狗输入法 工具
Exit code:
0
Version:
9.3.0.2941
Modules
Images
c:\program files\sogouinput\9.3.0.2941\sgtool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
2 919
Read events
2 343
Write events
548
Delete events
28

Modification events

(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(2980) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:2884-13197466707019500
Value:
259
(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3516-13180984670829101
Value:
0
(PID) Process:(2884) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:2884-13197466707019500
Value:
259
(PID) Process:(2884) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
Executable files
49
Suspicious files
112
Text files
490
Unknown types
43

Dropped files

PID
Process
Filename
Type
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\4cfba733-4308-44a7-8e63-db4e11cb7ad1.tmp —
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB\000016.dbtmp —
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000016.dbtmp —
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\03fbd698-3853-4ab0-9c01-38025a8466aa.tmp —
MD5:—
SHA256:—
844svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\LOG.oldtext
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Thumbnails\LOG.old~RF198c0a.TMPtext
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Translate Ranker Model~RF198ea9.TMPbinary
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RF198ad1.TMPtext
MD5:—
SHA256:—
2884chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
57
TCP/UDP connections
83
DNS requests
37
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
900
SogouComMgr.exe
GET
200
211.159.235.58:80
http://ping.pinyin.sogou.com/component.gif?h=7F855651D0D0DCE43693E170256AB6A4&r=0000_sogou_pinyin_93d&v=9.3.0.2941&tt=ipb&id=PicFace&ver=1.1.0.1859&it=5&ir=1
CN
—
—
malicious
900
SogouComMgr.exe
GET
200
211.159.235.58:80
http://ping.pinyin.sogou.com/component.gif?h=7F855651D0D0DCE43693E170256AB6A4&r=0000_sogou_pinyin_93d&v=9.3.0.2941&tt=ipb&id=SkinBox&ver=1.0.0.431&it=5&ir=1
CN
—
—
malicious
900
SogouComMgr.exe
GET
200
211.159.235.58:80
http://ping.pinyin.sogou.com/component.gif?h=7F855651D0D0DCE43693E170256AB6A4&r=0000_sogou_pinyin_93d&v=9.3.0.2941&tt=rpb&id=SearchSuggestionBundle
CN
—
—
malicious
900
SogouComMgr.exe
GET
200
211.159.235.58:80
http://ping.pinyin.sogou.com/component.gif?h=7F855651D0D0DCE43693E170256AB6A4&r=0000_sogou_pinyin_93d&v=9.3.0.2941&tt=ipb&id=SogouFlash&ver=2.2.0.273&it=5&ir=1
CN
—
—
malicious
900
SogouComMgr.exe
GET
200
211.159.235.58:80
http://ping.pinyin.sogou.com/component.gif?h=7F855651D0D0DCE43693E170256AB6A4&r=0000_sogou_pinyin_93d&v=9.3.0.2941&tt=ipb&id=VoiceInput&ver=1.0.0.162&it=5&ir=1
CN
—
—
malicious
900
SogouComMgr.exe
GET
200
211.159.235.58:80
http://ping.pinyin.sogou.com/component.gif?h=7F855651D0D0DCE43693E170256AB6A4&r=0000_sogou_pinyin_93d&v=9.3.0.2941&tt=rpb&id=WonderfulWriteBundle
CN
—
—
malicious
2884
chrome.exe
GET
200
163.171.132.18:80
http://cdn2.ime.sogou.com/fefac539db97ed6b444a5b910b5a21b0/5c90cb56/dl/index/1551149840/sogou_pinyin_93d.exe
US
executable
42.2 Mb
malicious
2716
sogou_pinyin_93d.exe
GET
200
118.191.216.57:80
http://pinyin.sogou.com/client/validateinstall.php?v=9.3.0.2941&h=7F855651D0D0DCE43693E170256AB6A4&r=0000_sogou_pinyin_93d&pp=chrome.exe&mode=0
CN
text
92 b
whitelisted
2368
SogouComMgr.exe
GET
200
49.51.130.237:80
http://config.pinyin.sogou.com/components/update.php?h=7F855651D0D0DCE43693E170256AB6A4&v=9.3.0.2941&r=0000_sogou_pinyin_93d&utp=3
CN
text
2.77 Kb
malicious
2856
SGTool.exe
GET
200
49.51.130.237:80
http://config.pinyin.sogou.com/api/app/ini/update.ini?vc=20181030&vr=20180423&vi=2&h=7F855651D0D0DCE43693E170256AB6A4&v=9.3.0.2941&r=0000_sogou_pinyin_93d
CN
text
396 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2884
chrome.exe
172.217.16.195:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
2884
chrome.exe
172.217.22.67:443
www.gstatic.com
Google Inc.
US
whitelisted
2884
chrome.exe
172.217.22.109:443
accounts.google.com
Google Inc.
US
whitelisted
2884
chrome.exe
119.28.109.132:443
pinyin.sogou.com
Tencent Building, Kejizhongyi Avenue
CN
malicious
2884
chrome.exe
172.217.22.99:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2884
chrome.exe
27.221.54.22:443
imedl.sogoucdn.com
CHINA UNICOM China169 Backbone
CN
malicious
2884
chrome.exe
87.245.210.77:443
img04.sogoucdn.com
RETN Limited
GB
unknown
2884
chrome.exe
123.138.67.113:443
s11.cnzz.com
CHINA UNICOM China169 Backbone
CN
unknown
2884
chrome.exe
118.191.216.42:443
pinyin.sogou.com
—
CN
malicious
2884
chrome.exe
172.217.22.10:443
translate.googleapis.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
pinyin.sogou.com
  • 119.28.109.132
  • 118.191.216.42
  • 118.191.216.57
whitelisted
www.gstatic.com
  • 172.217.22.67
whitelisted
clientservices.googleapis.com
  • 172.217.16.195
whitelisted
accounts.google.com
  • 172.217.22.109
shared
ssl.gstatic.com
  • 172.217.22.99
whitelisted
imedl.sogoucdn.com
  • 27.221.54.22
  • 112.132.32.105
  • 112.90.58.197
  • 123.6.2.171
  • 27.221.54.21
  • 113.200.16.30
  • 121.29.54.234
  • 112.132.32.89
  • 58.251.150.54
  • 113.59.43.98
  • 36.248.26.201
  • 59.83.218.231
  • 121.29.54.195
  • 27.221.54.19
  • 27.221.54.20
suspicious
img04.sogoucdn.com
  • 87.245.210.77
  • 203.205.224.14
  • 203.205.224.27
  • 203.205.224.26
  • 203.205.224.16
  • 87.245.210.76
whitelisted
img02.sogoucdn.com
  • 87.245.210.76
  • 203.205.224.16
  • 87.245.210.77
  • 203.205.224.26
  • 203.205.224.14
  • 203.205.224.27
suspicious
img03.sogoucdn.com
  • 87.245.210.77
  • 203.205.224.16
  • 203.205.224.26
  • 203.205.224.27
  • 203.205.224.14
  • 87.245.210.76
suspicious
s11.cnzz.com
  • 123.138.67.113
  • 123.138.67.112
whitelisted

Threats

PID
Process
Class
Message
2884
chrome.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2716
sogou_pinyin_93d.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
2716
sogou_pinyin_93d.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/Sogou Server Response
3956
SGTool.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
2208
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2208
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2208
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2208
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2656
SGDownload.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
2656
SGDownload.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://pinyin.sogou.com/