URL:

https://sogou.com

Full analysis: https://app.any.run/tasks/6b8a47b1-56b6-4e88-8b9e-2886e1783458
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 22, 2021, 22:26:48
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
sogou
Indicators:
MD5:

9FDD2B4EBD7C071D83003DBAABB26546

SHA1:

A0983F9F18A77DF2F7789AA6D0029BC9B802E7E4

SHA256:

6FD4C6C0DF7D21D6E2A76133A3A898B1FF49F5E5FEEA0917816B49BAF9ABA9B9

SSDEEP:

3:N8Hrn:2Ln

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • sogou_pinyin_104a.exe (PID: 3224)
      • sogou_pinyin_104a.exe (PID: 2020)
      • SGTool.exe (PID: 2684)
      • SGTool.exe (PID: 2980)
      • SGTool.exe (PID: 3200)
      • SGTool.exe (PID: 360)
      • SGTool.exe (PID: 504)
      • SGTool.exe (PID: 2548)
      • SGTool.exe (PID: 3220)
      • SGTool.exe (PID: 3816)
      • userNetSchedule.exe (PID: 2112)
      • SGTool.exe (PID: 880)
      • SGTool.exe (PID: 3488)
      • SGTool.exe (PID: 3536)
      • SGTool.exe (PID: 4052)
      • SogouSvc.exe (PID: 3184)
      • SogouExe.exe (PID: 4064)
      • SogouImeBroker.exe (PID: 2840)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 2588)
      • SGTool.exe (PID: 1552)
      • SGTool.exe (PID: 2660)
      • SogouComMgr.exe (PID: 2076)
      • SGTool.exe (PID: 1172)
      • SGMedalLoader.exe (PID: 3816)
      • SGTool.exe (PID: 2396)
      • userNetSchedule.exe (PID: 3180)
      • SogouExe.exe (PID: 2296)
      • SGTool.exe (PID: 3736)
      • SGTool.exe (PID: 2452)

    • Drops executable file immediately after starts

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouExe.exe (PID: 4064)
      • SogouComMgr.exe (PID: 2908)
      • SogouExe.exe (PID: 2296)
      • chrome.exe (PID: 3108)

    • Loads dropped or rewritten executable

      • sogou_pinyin_104a.exe (PID: 3224)
      • regsvr32.exe (PID: 3828)
      • SGTool.exe (PID: 504)
      • SogouExe.exe (PID: 4064)
      • regsvr32.exe (PID: 3676)
      • SogouComMgr.exe (PID: 2908)
      • SogouComMgr.exe (PID: 2076)
      • SGTool.exe (PID: 2396)
      • SGTool.exe (PID: 1172)
      • SGTool.exe (PID: 3736)
      • SogouExe.exe (PID: 2296)

    • Registers / Runs the DLL via REGSVR32.EXE

      • sogou_pinyin_104a.exe (PID: 3224)

    • Changes settings of System certificates

      • SogouExe.exe (PID: 4064)

    • Uses Task Scheduler to run other applications

      • sogou_pinyin_104a.exe (PID: 3224)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2164)
      • schtasks.exe (PID: 2644)

    • Changes the autorun value in the registry

      • sogou_pinyin_104a.exe (PID: 3224)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 3296)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 4092)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 4092)
      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouExe.exe (PID: 4064)
      • SogouComMgr.exe (PID: 2908)
      • chrome.exe (PID: 3108)
      • SogouExe.exe (PID: 2296)

    • Reads the computer name

      • sogou_pinyin_104a.exe (PID: 3224)
      • SGTool.exe (PID: 3200)
      • SGTool.exe (PID: 360)
      • SGTool.exe (PID: 504)
      • SogouExe.exe (PID: 4064)
      • SogouSvc.exe (PID: 3184)
      • SGTool.exe (PID: 2548)
      • SGTool.exe (PID: 3816)
      • SGTool.exe (PID: 3220)
      • userNetSchedule.exe (PID: 2112)
      • SGTool.exe (PID: 880)
      • SGTool.exe (PID: 1552)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 2588)
      • SGTool.exe (PID: 2660)
      • SogouComMgr.exe (PID: 2076)
      • SGTool.exe (PID: 1172)
      • userNetSchedule.exe (PID: 3180)
      • SGTool.exe (PID: 2396)
      • SGTool.exe (PID: 3736)
      • SogouExe.exe (PID: 2296)
      • SGMedalLoader.exe (PID: 3816)

    • Creates files in the user directory

      • sogou_pinyin_104a.exe (PID: 3224)

    • Drops a file that was compiled in debug mode

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouComMgr.exe (PID: 2908)
      • chrome.exe (PID: 3108)

    • Checks supported languages

      • sogou_pinyin_104a.exe (PID: 3224)
      • SGTool.exe (PID: 2684)
      • SGTool.exe (PID: 2980)
      • SGTool.exe (PID: 3200)
      • SGTool.exe (PID: 360)
      • SGTool.exe (PID: 504)
      • SogouExe.exe (PID: 4064)
      • SGTool.exe (PID: 2548)
      • SogouSvc.exe (PID: 3184)
      • SGTool.exe (PID: 3220)
      • SGTool.exe (PID: 3816)
      • SGTool.exe (PID: 3488)
      • userNetSchedule.exe (PID: 2112)
      • SGTool.exe (PID: 3536)
      • SGTool.exe (PID: 4052)
      • SGTool.exe (PID: 880)
      • SGTool.exe (PID: 1552)
      • SogouImeBroker.exe (PID: 2840)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 2588)
      • SGTool.exe (PID: 2660)
      • SogouComMgr.exe (PID: 2076)
      • SGMedalLoader.exe (PID: 3816)
      • SGTool.exe (PID: 1172)
      • SGTool.exe (PID: 2396)
      • userNetSchedule.exe (PID: 3180)
      • SogouExe.exe (PID: 2296)
      • SGTool.exe (PID: 3736)
      • SGTool.exe (PID: 2452)

    • Creates a directory in Program Files

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouComMgr.exe (PID: 2908)

    • Creates files in the program directory

      • SGTool.exe (PID: 2684)
      • SGTool.exe (PID: 3200)
      • sogou_pinyin_104a.exe (PID: 3224)
      • SGTool.exe (PID: 2660)
      • SogouComMgr.exe (PID: 2908)
      • SGTool.exe (PID: 3736)

    • Changes default file association

      • SGTool.exe (PID: 2980)
      • SGTool.exe (PID: 3220)
      • SGTool.exe (PID: 3536)
      • SogouComMgr.exe (PID: 2908)

    • Removes files from Windows directory

      • sogou_pinyin_104a.exe (PID: 3224)

    • Creates files in the Windows directory

      • sogou_pinyin_104a.exe (PID: 3224)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3828)
      • regsvr32.exe (PID: 3676)

    • Adds / modifies Windows certificates

      • SogouExe.exe (PID: 4064)

    • Creates a software uninstall entry

      • sogou_pinyin_104a.exe (PID: 3224)

    • Starts Internet Explorer

      • sogou_pinyin_104a.exe (PID: 3224)

    • Reads the date of Windows installation

      • sogou_pinyin_104a.exe (PID: 3224)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 4008)
      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 3788)
      • chrome.exe (PID: 444)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 3020)
      • chrome.exe (PID: 4012)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 2580)
      • chrome.exe (PID: 1176)
      • chrome.exe (PID: 2440)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 148)
      • schtasks.exe (PID: 2164)
      • schtasks.exe (PID: 2644)
      • iexplore.exe (PID: 3588)
      • iexplore.exe (PID: 3296)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2404)
      • chrome.exe (PID: 3788)
      • chrome.exe (PID: 4092)
      • SogouExe.exe (PID: 4064)
      • SogouExe.exe (PID: 2296)
      • iexplore.exe (PID: 3296)

    • Checks supported languages

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2404)
      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 3788)
      • chrome.exe (PID: 3260)
      • chrome.exe (PID: 2876)
      • chrome.exe (PID: 3336)
      • chrome.exe (PID: 2204)
      • chrome.exe (PID: 412)
      • chrome.exe (PID: 2652)
      • chrome.exe (PID: 1196)
      • chrome.exe (PID: 444)
      • chrome.exe (PID: 3828)
      • chrome.exe (PID: 696)
      • chrome.exe (PID: 3312)
      • chrome.exe (PID: 2500)
      • chrome.exe (PID: 3524)
      • chrome.exe (PID: 3792)
      • chrome.exe (PID: 2392)
      • chrome.exe (PID: 3968)
      • chrome.exe (PID: 3992)
      • chrome.exe (PID: 2944)
      • chrome.exe (PID: 3504)
      • chrome.exe (PID: 3692)
      • chrome.exe (PID: 1164)
      • chrome.exe (PID: 3492)
      • chrome.exe (PID: 3740)
      • chrome.exe (PID: 3020)
      • chrome.exe (PID: 3028)
      • chrome.exe (PID: 2244)
      • chrome.exe (PID: 2236)
      • chrome.exe (PID: 3560)
      • chrome.exe (PID: 3108)
      • chrome.exe (PID: 2440)
      • chrome.exe (PID: 304)
      • chrome.exe (PID: 4012)
      • chrome.exe (PID: 3464)
      • chrome.exe (PID: 1176)
      • chrome.exe (PID: 2580)
      • chrome.exe (PID: 3380)
      • chrome.exe (PID: 3920)
      • chrome.exe (PID: 2808)
      • chrome.exe (PID: 3360)
      • chrome.exe (PID: 2980)
      • chrome.exe (PID: 3768)
      • chrome.exe (PID: 2780)
      • chrome.exe (PID: 148)
      • chrome.exe (PID: 2520)
      • chrome.exe (PID: 3496)
      • chrome.exe (PID: 3340)
      • regsvr32.exe (PID: 3828)
      • regsvr32.exe (PID: 3556)
      • chrome.exe (PID: 3212)
      • chrome.exe (PID: 2592)
      • chrome.exe (PID: 3800)
      • schtasks.exe (PID: 2164)
      • regsvr32.exe (PID: 3676)
      • schtasks.exe (PID: 2644)
      • chrome.exe (PID: 2968)
      • chrome.exe (PID: 4000)
      • iexplore.exe (PID: 3588)
      • iexplore.exe (PID: 3296)
      • chrome.exe (PID: 3108)
      • chrome.exe (PID: 1172)
      • chrome.exe (PID: 3744)
      • chrome.exe (PID: 3644)
      • chrome.exe (PID: 412)

    • Changes internet zones settings

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3588)

    • Application launched itself

      • iexplore.exe (PID: 4008)
      • chrome.exe (PID: 4092)
      • iexplore.exe (PID: 3588)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 3296)

    • Creates files in the user directory

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 3296)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2404)
      • iexplore.exe (PID: 4008)
      • chrome.exe (PID: 4092)
      • SogouExe.exe (PID: 4064)
      • SogouExe.exe (PID: 2296)
      • iexplore.exe (PID: 3296)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3296)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4008)
      • iexplore.exe (PID: 3296)

    • Manual execution by user

      • chrome.exe (PID: 4092)

    • Reads the hosts file

      • chrome.exe (PID: 4092)
      • chrome.exe (PID: 3788)

    • Reads the date of Windows installation

      • chrome.exe (PID: 4012)

    • Dropped object may contain Bitcoin addresses

      • sogou_pinyin_104a.exe (PID: 3224)
      • SogouComMgr.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
98
Malicious processes
13
Suspicious processes
11

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs sogou_pinyin_104a.exe no specs sogou_pinyin_104a.exe chrome.exe no specs sgtool.exe no specs sgtool.exe no specs regsvr32.exe no specs regsvr32.exe no specs chrome.exe no specs chrome.exe no specs sgtool.exe no specs chrome.exe no specs sgtool.exe no specs sgtool.exe sogouexe.exe sogousvc.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs usernetschedule.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs schtasks.exe no specs schtasks.exe no specs sgtool.exe no specs sgtool.exe no specs sogouimebroker.exe no specs regsvr32.exe no specs sogoucommgr.exe chrome.exe no specs sgtool.exe no specs sogoucommgr.exe chrome.exe no specs sgtool.exe sgtool.exe sgmedalloader.exe usernetschedule.exe no specs sogouexe.exe iexplore.exe no specs sgtool.exe iexplore.exe chrome.exe sgtool.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
148"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3820 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\shell32.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1056 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\gdi32.dll
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1700 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
360"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe" --appid=ucfont -yahei -extb6 "\"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe—sogou_pinyin_104a.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
????? ??
Exit code:
4294967295
Version:
10.4.0.4620
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\sogouinput\10.4.0.4620\sgtool.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
412"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2264 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
412"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1764 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1016 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
504"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe" --appid=pinyinrepair /kC:\Program Files\SogouInput\10.4.0.4620\SGTool.exe
sogou_pinyin_104a.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
????? ??
Exit code:
0
Version:
10.4.0.4620
Modules
Images
c:\program files\sogouinput\10.4.0.4620\sgtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1040,12194820122476285715,1501507139205114491,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
880"C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe" -mutiforce -line 0 -border --appid=scdreg -delete 15097,22408,270,15183,15201,15486,5,6,15182,15153 1C:\Program Files\SogouInput\10.4.0.4620\SGTool.exe—sogou_pinyin_104a.exe
User:
admin
Company:
Sogou.com Inc.
Integrity Level:
HIGH
Description:
????? ??
Exit code:
0
Version:
10.4.0.4620
Modules
Images
c:\program files\sogouinput\10.4.0.4620\sgtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
65 938
Read events
64 949
Write events
951
Delete events
38

Modification events

(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30894005
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30894005
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
57
Suspicious files
228
Text files
736
Unknown types
55

Dropped files

PID
Process
Filename
Type
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:4B5BE000B96A0550AE5B38AE24A1E399
SHA256:08BC71413E36444774D1DA6FBC018C742D22C98122757F3F994F15F5545324D9
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3der
MD5:34B2ACA74F8B0E93C5B14043BEF28541
SHA256:97B4D9EE1B3A52648B2E221D6966F7F3A7C5FA5DD3B10F02A1AF0272414D20DE
2404iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\X0TTOJUF.txttext
MD5:6C89601D09BF098B1B790A673E76DAD9
SHA256:6ABDEFA8791021BB315A7C798EB9F7E6E1AB54157CBA7EFA8BD3C404901C7854
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40B450FE900A9C5BA9DF001B23D4D874binary
MD5:4B8D3934C9CFFDDCF415E17CAC4A4809
SHA256:0D8B53D497E6193D08423265D362426EFB5D2A0378694347E4C4BD8FA4484E33
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3binary
MD5:0F3C85C720C1EFA25125A353C68C70F7
SHA256:4619F5772BEA18ED37BFC105420713E2A46EB5AA13D2DA248135D3DA339A079D
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685binary
MD5:DA0F8199740A9233389DA2E282B5906A
SHA256:47C9BB7F37584581C72CCD0825DFDCBF8F25698A92B38D11D0A016F6C0E240AE
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685der
MD5:B3A4BDCB8261FD338476216A614C3200
SHA256:B703FB44A48909F628B11E90C23A98F22D685A8062FF5C95CBFE772E9EC2487D
2404iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\6S6JNV6D.txttext
MD5:83298790ECCC4DD07D1FBAF23B5716CF
SHA256:EE101F49C8660940CB57036A307D80FAA7AFF95D4C6D2BA44EE4C487BFE6F52F
2404iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40B450FE900A9C5BA9DF001B23D4D874der
MD5:717EAA4171F7BCF0779C48D56CB0C379
SHA256:72A7DB0D703293273A6224C1D91EEEE0DB666C43E51C37D7D6D5D52422021100
2404iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\UW2PP2BQ.htmhtml
MD5:1F6F8856A614601DB6EABF8ED2DEF3C2
SHA256:32C64BA9C292DCCFC16E108AD48D658F6AB6CAF1F44B76875244A30DF9FAA3B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
96
TCP/UDP connections
198
DNS requests
94
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2404
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
US
der
1.40 Kb
whitelisted
2404
iexplore.exe
GET
200
8.248.133.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?90858b06f1d4a5b4
US
compressed
4.70 Kb
whitelisted
2404
iexplore.exe
GET
200
104.18.21.226:80
http://crl.globalsign.com/root.crl
US
der
1.61 Kb
whitelisted
2404
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDFrJFfrtqHmRa3eFJw%3D%3D
US
der
1.41 Kb
whitelisted
2404
iexplore.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDDimzqFG62tdNZ4O9g%3D%3D
US
der
1.41 Kb
whitelisted
4008
iexplore.exe
GET
200
93.184.220.29:80
http://crl3.digicert.com/Omniroot2025.crl
US
der
7.68 Kb
whitelisted
2404
iexplore.exe
GET
302
118.191.216.57:80
http://www.sogou.com/
CN
html
138 b
whitelisted
2404
iexplore.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
US
der
1.41 Kb
whitelisted
2404
iexplore.exe
GET
200
172.217.23.99:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDSvyPk%2BZDtUgoAAAAA2QPH
US
der
472 b
whitelisted
2404
iexplore.exe
GET
302
172.217.19.99:80
http://www.google.com.gt/
US
html
234 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2404
iexplore.exe
119.28.109.132:443
sogou.com
Tencent Building, Kejizhongyi Avenue
CN
malicious
2404
iexplore.exe
8.253.207.121:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2404
iexplore.exe
8.248.133.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
2404
iexplore.exe
104.18.20.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
—
—
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
4008
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted
4008
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2404
iexplore.exe
104.18.21.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
2404
iexplore.exe
118.191.216.57:80
sogou.com
—
CN
malicious
2404
iexplore.exe
203.205.224.59:443
dlweb.sogoucdn.com
Tencent Building, Kejizhongyi Avenue
CN
suspicious

DNS requests

Domain
IP
Reputation
sogou.com
  • 119.28.109.132
  • 118.191.216.57
  • 118.191.216.42
malicious
ctldl.windowsupdate.com
  • 8.248.133.254
  • 8.248.113.254
  • 8.253.95.120
  • 67.26.137.254
  • 8.253.207.121
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
crl.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
www.sogou.com
  • 118.191.216.57
  • 118.191.216.42
  • 119.28.109.132
whitelisted
dlweb.sogoucdn.com
  • 203.205.224.59
  • 101.33.11.29
  • 101.33.11.88
  • 101.33.11.45
  • 101.33.11.25
  • 101.33.10.52
  • 101.33.11.110
  • 101.33.11.48
  • 101.33.10.114
suspicious

Threats

PID
Process
Class
Message
3224
sogou_pinyin_104a.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
2396
SGTool.exe
A Network Trojan was detected
ET POLICY Win32/Sogou User-Agent (SOGOU_UPDATER)
3816
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3816
SGMedalLoader.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://sogou.com