URL:

https://sogou.com

Full analysis: https://app.any.run/tasks/6b8a47b1-56b6-4e88-8b9e-2886e1783458
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 22, 2021, 22:26:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
sogou
Indicators:
MD5:

9FDD2B4EBD7C071D83003DBAABB26546

SHA1:

A0983F9F18A77DF2F7789AA6D0029BC9B802E7E4

SHA256:

6FD4C6C0DF7D21D6E2A76133A3A898B1FF49F5E5FEEA0917816B49BAF9ABA9B9

SSDEEP:

3:N8Hrn:2Ln

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • sogou_pinyin_104a.exe (PID: 2020)
      • sogou_pinyin_104a.exe (PID: 3224)
      • SGTool.exe (PID: 2684)
      • SGTool.exe (PID: 2980)
      • SGTool.exe (PID: 3200)
      • SGTool.exe (PID: 360)
      • SGTool.exe (PID: 504)
      • SGTool.exe (PID: 2548)
      • SGTool.exe (PID: 3220)
      • SGTool.exe (PID: 3816)
      • SGTool.exe (PID: 3488)
      • SGTool.exe (PID: 880)
      • userNetSchedule.exe (PID: 2112)
      • SGTool.exe (PID: 3536)
      • SGTool.exe (PID: 4052)
      • SogouSvc.exe (PID: 3184)
      • SogouExe.exe (PID: 4064)
      • SGTool.exe (PID: 2588)
      • SGTool.exe (PID: 1552)
      • SogouImeBroker.exe (PID: 2840)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 2660)
      • SogouComMgr.exe (PID: 2076)
      • SGTool.exe (PID: 1172)
      • SGMedalLoader.exe (PID: 3816)
      • SGTool.exe (PID: 2396)
      • userNetSchedule.exe (PID: 3180)
      • SogouExe.exe (PID: 2296)
      • SGTool.exe (PID: 3736)
      • SGTool.exe (PID: 2452)

    • Drops executable file immediately after starts

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouExe.exe (PID: 4064)
      • SogouComMgr.exe (PID: 2908)
      • chrome.exe (PID: 3108)
      • SogouExe.exe (PID: 2296)

    • Loads dropped or rewritten executable

      • sogou_pinyin_104a.exe (PID: 3224)
      • SGTool.exe (PID: 504)
      • SogouExe.exe (PID: 4064)
      • regsvr32.exe (PID: 3828)
      • regsvr32.exe (PID: 3676)
      • SogouComMgr.exe (PID: 2908)
      • SogouComMgr.exe (PID: 2076)
      • SGTool.exe (PID: 2396)
      • SGTool.exe (PID: 1172)
      • SGTool.exe (PID: 3736)
      • SogouExe.exe (PID: 2296)

    • Registers / Runs the DLL via REGSVR32.EXE

      • sogou_pinyin_104a.exe (PID: 3224)

    • Changes settings of System certificates

      • SogouExe.exe (PID: 4064)

    • Uses Task Scheduler to run other applications

      • sogou_pinyin_104a.exe (PID: 3224)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2164)
      • schtasks.exe (PID: 2644)

    • Changes the autorun value in the registry

      • sogou_pinyin_104a.exe (PID: 3224)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 3296)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 4092)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 4092)
      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouExe.exe (PID: 4064)
      • SogouComMgr.exe (PID: 2908)
      • chrome.exe (PID: 3108)
      • SogouExe.exe (PID: 2296)

    • Reads the computer name

      • sogou_pinyin_104a.exe (PID: 3224)
      • SGTool.exe (PID: 3200)
      • SGTool.exe (PID: 504)
      • SGTool.exe (PID: 360)
      • SogouExe.exe (PID: 4064)
      • SogouSvc.exe (PID: 3184)
      • SGTool.exe (PID: 2548)
      • SGTool.exe (PID: 3220)
      • SGTool.exe (PID: 3816)
      • userNetSchedule.exe (PID: 2112)
      • SGTool.exe (PID: 880)
      • SGTool.exe (PID: 2588)
      • SGTool.exe (PID: 1552)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 2660)
      • SogouComMgr.exe (PID: 2076)
      • SGTool.exe (PID: 2396)
      • SGTool.exe (PID: 1172)
      • userNetSchedule.exe (PID: 3180)
      • SogouExe.exe (PID: 2296)
      • SGTool.exe (PID: 3736)
      • SGMedalLoader.exe (PID: 3816)

    • Checks supported languages

      • sogou_pinyin_104a.exe (PID: 3224)
      • SGTool.exe (PID: 2684)
      • SGTool.exe (PID: 2980)
      • SGTool.exe (PID: 3200)
      • SogouExe.exe (PID: 4064)
      • SGTool.exe (PID: 360)
      • SGTool.exe (PID: 504)
      • SogouSvc.exe (PID: 3184)
      • SGTool.exe (PID: 2548)
      • SGTool.exe (PID: 3220)
      • userNetSchedule.exe (PID: 2112)
      • SGTool.exe (PID: 3488)
      • SGTool.exe (PID: 3816)
      • SGTool.exe (PID: 880)
      • SGTool.exe (PID: 3536)
      • SGTool.exe (PID: 4052)
      • SGTool.exe (PID: 2588)
      • SGTool.exe (PID: 1552)
      • SogouImeBroker.exe (PID: 2840)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 2660)
      • SogouComMgr.exe (PID: 2076)
      • SGMedalLoader.exe (PID: 3816)
      • SGTool.exe (PID: 1172)
      • SGTool.exe (PID: 2396)
      • userNetSchedule.exe (PID: 3180)
      • SogouExe.exe (PID: 2296)
      • SGTool.exe (PID: 3736)
      • SGTool.exe (PID: 2452)

    • Drops a file that was compiled in debug mode

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouComMgr.exe (PID: 2908)
      • chrome.exe (PID: 3108)

    • Creates a directory in Program Files

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouComMgr.exe (PID: 2908)

    • Creates files in the user directory

      • sogou_pinyin_104a.exe (PID: 3224)

    • Creates files in the program directory

      • SGTool.exe (PID: 2684)
      • SGTool.exe (PID: 3200)
      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 2660)
      • SGTool.exe (PID: 3736)

    • Changes default file association

      • SGTool.exe (PID: 2980)
      • SGTool.exe (PID: 3220)
      • SGTool.exe (PID: 3536)
      • SogouComMgr.exe (PID: 2908)

    • Creates files in the Windows directory

      • sogou_pinyin_104a.exe (PID: 3224)

    • Removes files from Windows directory

      • sogou_pinyin_104a.exe (PID: 3224)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3828)
      • regsvr32.exe (PID: 3676)

    • Adds / modifies Windows certificates

      • SogouExe.exe (PID: 4064)

    • Creates a software uninstall entry

      • sogou_pinyin_104a.exe (PID: 3224)

    • Starts Internet Explorer

      • sogou_pinyin_104a.exe (PID: 3224)

    • Reads the date of Windows installation

      • sogou_pinyin_104a.exe (PID: 3224)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2404)
      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 3788)
      • chrome.exe (PID: 2204)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 3260)
      • chrome.exe (PID: 3336)
      • chrome.exe (PID: 412)
      • chrome.exe (PID: 2652)
      • chrome.exe (PID: 696)
      • chrome.exe (PID: 2876)
      • chrome.exe (PID: 3828)
      • chrome.exe (PID: 1196)
      • chrome.exe (PID: 444)
      • chrome.exe (PID: 3312)
      • chrome.exe (PID: 2500)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 2392)
      • chrome.exe (PID: 3792)
      • chrome.exe (PID: 3028)
      • chrome.exe (PID: 2244)
      • chrome.exe (PID: 3968)
      • chrome.exe (PID: 3492)
      • chrome.exe (PID: 3992)
      • chrome.exe (PID: 3020)
      • chrome.exe (PID: 2236)
      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 3504)
      • chrome.exe (PID: 3692)
      • chrome.exe (PID: 3740)
      • chrome.exe (PID: 1164)
      • chrome.exe (PID: 3768)
      • chrome.exe (PID: 3560)
      • chrome.exe (PID: 4012)
      • chrome.exe (PID: 2440)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 3464)
      • chrome.exe (PID: 3380)
      • chrome.exe (PID: 1176)
      • chrome.exe (PID: 2808)
      • chrome.exe (PID: 2580)
      • chrome.exe (PID: 3920)
      • chrome.exe (PID: 3360)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 148)
      • chrome.exe (PID: 2520)
      • chrome.exe (PID: 3108)
      • chrome.exe (PID: 3496)
      • chrome.exe (PID: 3340)
      • chrome.exe (PID: 3212)
      • chrome.exe (PID: 2592)
      • chrome.exe (PID: 3800)
      • regsvr32.exe (PID: 3828)
      • regsvr32.exe (PID: 3556)
      • schtasks.exe (PID: 2644)
      • schtasks.exe (PID: 2164)
      • regsvr32.exe (PID: 3676)
      • chrome.exe (PID: 2968)
      • chrome.exe (PID: 4000)
      • iexplore.exe (PID: 3588)
      • iexplore.exe (PID: 3296)
      • chrome.exe (PID: 3108)
      • chrome.exe (PID: 3744)
      • chrome.exe (PID: 3644)
      • chrome.exe (PID: 1172)
      • chrome.exe (PID: 412)

    • Changes internet zones settings

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3588)

    • Reads the computer name

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2404)
      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 3788)
      • chrome.exe (PID: 444)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 3020)
      • chrome.exe (PID: 2440)
      • chrome.exe (PID: 4012)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 1176)
      • chrome.exe (PID: 2580)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 148)
      • schtasks.exe (PID: 2644)
      • schtasks.exe (PID: 2164)
      • iexplore.exe (PID: 3588)
      • iexplore.exe (PID: 3296)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2404)
      • chrome.exe (PID: 4092)
      • SogouExe.exe (PID: 4064)
      • SogouExe.exe (PID: 2296)
      • iexplore.exe (PID: 3296)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 4008)
      • chrome.exe (PID: 3788)
      • chrome.exe (PID: 4092)
      • SogouExe.exe (PID: 4064)
      • iexplore.exe (PID: 3296)
      • SogouExe.exe (PID: 2296)

    • Creates files in the user directory

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3296)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 3296)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3296)

    • Application launched itself

      • iexplore.exe (PID: 4008)
      • chrome.exe (PID: 4092)
      • iexplore.exe (PID: 3588)

    • Manual execution by user

      • chrome.exe (PID: 4092)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3296)

    • Reads the hosts file

      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 3788)

    • Reads the date of Windows installation

      • chrome.exe (PID: 4012)

    • Dropped object may contain Bitcoin addresses

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouComMgr.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
98
Malicious processes
13
Suspicious processes
11

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sogou_pinyin_104a.exe no specs sogou_pinyin_104a.exe chrome.exe no specs sgtool.exe no specs sgtool.exe no specs regsvr32.exe no specs regsvr32.exe no specs chrome.exe no specs chrome.exe no specs sgtool.exe no specs chrome.exe no specs sgtool.exe no specs sgtool.exe sogouexe.exe sogousvc.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs usernetschedule.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs schtasks.exe no specs schtasks.exe no specs sgtool.exe no specs sgtool.exe no specs sogouimebroker.exe no specs regsvr32.exe no specs sogoucommgr.exe chrome.exe no specs sgtool.exe no specs sogoucommgr.exe chrome.exe no specs sgtool.exe sgtool.exe sgmedalloader.exe usernetschedule.exe no specs sogouexe.exe iexplore.exe no specs sgtool.exe iexplore.exe chrome.exe sgtool.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
148"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1056 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\gdi32.dll
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
360"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe" --appid=ucfont -yahei -extb6 "\"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe—sogou_pinyin_104a.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
????? ??
Exit code:
4294967295
Version:
10.4.0.4620
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\sogouinput\10.4.0.4620\sgtool.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
412"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
412"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1764 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1016 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
504"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe" --appid=pinyinrepair /kC:\Program Files\SogouInput\10.4.0.4620\SGTool.exe
sogou_pinyin_104a.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
????? ??
Exit code:
0
Version:
10.4.0.4620
Modules
Images
c:\program files\sogouinput\10.4.0.4620\sgtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
880"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe" -mutiforce -line 0 -border --appid=scdreg -delete 15097,22408,270,15183,15201,15486,5,6,15182,15153 1C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe—sogou_pinyin_104a.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
????? ??
Exit code:
0
Version:
10.4.0.4620
Modules
Images
c:\program files\sogouinput\10.4.0.4620\sgtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
65 938
Read events
64 949
Write events
951
Delete events
38

Modification events

(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30894005
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30894005
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
57
Suspicious files
228
Text files
736
Unknown types
55

Dropped files

PID
Process
Filename
Type
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3binary
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\6S6JNV6D.txttext
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FBB1A89F86228563755A882F3F5A2422der
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\suggbase_b9937f7[1].jstext
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\X0TTOJUF.txttext
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3der
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FBB1A89F86228563755A882F3F5A2422binary
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\doodle_beb2c55[1].csstext
MD5:—
SHA256:—
2404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\index_style_97bc648[1].csstext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
96
TCP/UDP connections
198
DNS requests
94
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2404
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
US
der
1.40 Kb
whitelisted
4008
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.68 Kb
whitelisted
4008
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertGlobalRootCA.crl
US
der
631 b
whitelisted
2404
iexplore.exe
GET
200
104.18.21.226:80
http://crl.globalsign.com/root.crl
US
der
1.61 Kb
whitelisted
2404
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
2404
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSvyPk%2BZDtUgoAAAAA2QPH
US
der
472 b
whitelisted
2404
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEF6BZF1IwxRPCgAAAADY%2Fdo%3D
US
der
471 b
whitelisted
2404
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDDimzqFG62tdNZ4O9g%3D%3D
US
der
1.41 Kb
whitelisted
2404
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDFlYUls3Fs%2BQoAAAAA2QMY
US
der
472 b
whitelisted
2404
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
US
der
1.41 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2404
iexplore.exe
119.28.109.132:443
sogou.com
Tencent Building, Kejizhongyi Avenue
CN
malicious
2404
iexplore.exe
8.248.133.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
2404
iexplore.exe
118.191.216.57:80
sogou.com
—
CN
malicious
2404
iexplore.exe
104.18.21.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
2404
iexplore.exe
118.191.216.57:443
sogou.com
—
CN
malicious
2404
iexplore.exe
8.253.207.121:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2404
iexplore.exe
203.205.224.59:443
dlweb.sogoucdn.com
Tencent Building, Kejizhongyi Avenue
CN
suspicious
2404
iexplore.exe
140.143.116.174:443
pb6.sogou.com
Shenzhen Tencent Computer Systems Company Limited
CN
malicious
—
—
111.202.100.49:443
pb.sogou.com
China Unicom Beijing Province Network
CN
malicious
2404
iexplore.exe
111.202.100.49:443
pb.sogou.com
China Unicom Beijing Province Network
CN
malicious

DNS requests

Domain
IP
Reputation
sogou.com
  • 119.28.109.132
  • 118.191.216.57
  • 118.191.216.42
malicious
ctldl.windowsupdate.com
  • 8.248.133.254
  • 8.248.113.254
  • 8.253.95.120
  • 67.26.137.254
  • 8.253.207.121
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
www.sogou.com
  • 118.191.216.57
  • 118.191.216.42
  • 119.28.109.132
whitelisted
dlweb.sogoucdn.com
  • 203.205.224.59
  • 101.33.11.29
  • 101.33.11.88
  • 101.33.11.45
  • 101.33.11.25
  • 101.33.10.52
  • 101.33.11.110
  • 101.33.11.48
  • 101.33.10.114
suspicious

Threats

PID
Process
Class
Message
3224
sogou_pinyin_104a.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
2396
SGTool.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
3816
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3816
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sogou.com