URL:

http://pro.cdn.ime.sogou.com/sogou_pinyin_14.2.0.8968.exe

Full analysis: https://app.any.run/tasks/df9ac15a-4842-40dc-8877-b7ace022bae5
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: March 18, 2024, 08:59:14
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
adware
sogou
loader
ramnit
trojan
Indicators:
MD5:

E9C8EDCFCD0A36B0CBAAA6CEB03622E0

SHA1:

34E4EE5DCDCB35F305E8DD0A01FAFF9659EABA88

SHA256:

E80D444B99172A26CEE2E60E4DEEFCCFA428A788B771EDF3012DF887A852222B

SSDEEP:

3:N1KOXTpM9iZ/KKNepbLetNn:COXGi/KVbytNn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SogouExe.exe (PID: 3256)
      • SogouExe.exe (PID: 3780)
      • SogouExe.exe (PID: 752)
      • SogouComMgr.exe (PID: 2044)

    • Registers / Runs the DLL via REGSVR32.EXE

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • biz_helper.exe (PID: 3460)

    • Creates a writable file in the system directory

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)

    • Signature: RAMNIT has been detected

      • regsvr32.exe (PID: 3656)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)

    • The process creates files with name similar to system file names

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)

    • Executable content was dropped or overwritten

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SogouExe.exe (PID: 3256)
      • SogouExe.exe (PID: 3780)
      • SogouExe.exe (PID: 752)
      • SogouComMgr.exe (PID: 2044)

    • Process requests binary or script from the Internet

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)

    • Reads the Internet Settings

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SGTool.exe (PID: 3292)
      • SGTool.exe (PID: 3900)
      • SGTool.exe (PID: 2828)
      • SogouComMgr.exe (PID: 2044)
      • SGTool.exe (PID: 2088)

    • Reads security settings of Internet Explorer

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SGTool.exe (PID: 3292)
      • SogouExe.exe (PID: 3256)
      • SGTool.exe (PID: 3900)
      • SogouExe.exe (PID: 3780)
      • SGTool.exe (PID: 2828)
      • SogouExe.exe (PID: 752)
      • SGTool.exe (PID: 2088)
      • SogouComMgr.exe (PID: 2044)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1636)
      • regsvr32.exe (PID: 3656)

    • Checks Windows Trust Settings

      • SogouExe.exe (PID: 3256)
      • SogouExe.exe (PID: 3780)
      • SogouExe.exe (PID: 752)

    • Reads settings of System Certificates

      • SogouExe.exe (PID: 3256)
      • SogouExe.exe (PID: 3780)
      • SogouExe.exe (PID: 752)

    • Creates a software uninstall entry

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)

    • Application launched itself

      • biz_helper.exe (PID: 3708)

  • INFO

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3276)

    • Checks supported languages

      • wmpnscfg.exe (PID: 980)
      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SGTool.exe (PID: 3292)
      • SGTool.exe (PID: 552)
      • SogouExe.exe (PID: 3256)
      • SGTool.exe (PID: 3900)
      • SogouExe.exe (PID: 3780)
      • SogouExe.exe (PID: 752)
      • SogouSvc.exe (PID: 2768)
      • SGTool.exe (PID: 908)
      • SGTool.exe (PID: 324)
      • userNetSchedule.exe (PID: 3588)
      • SGTool.exe (PID: 2088)
      • SGTool.exe (PID: 2612)
      • SGTool.exe (PID: 3548)
      • SGTool.exe (PID: 3876)
      • SogouImeBroker.exe (PID: 3268)
      • SGTool.exe (PID: 3884)
      • SogouComMgr.exe (PID: 2044)
      • biz_helper.exe (PID: 3708)
      • biz_helper.exe (PID: 3460)
      • SGTool.exe (PID: 2828)
      • biz_helper.exe (PID: 2356)
      • biz_helper.exe (PID: 3664)
      • SGTool.exe (PID: 2228)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3276)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 4008)

    • Reads the computer name

      • wmpnscfg.exe (PID: 980)
      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SGTool.exe (PID: 3292)
      • SogouExe.exe (PID: 3256)
      • SGTool.exe (PID: 3900)
      • SogouExe.exe (PID: 3780)
      • SogouExe.exe (PID: 752)
      • SGTool.exe (PID: 2828)
      • SogouSvc.exe (PID: 2768)
      • SGTool.exe (PID: 324)
      • SGTool.exe (PID: 908)
      • SGTool.exe (PID: 2088)
      • userNetSchedule.exe (PID: 3588)
      • SGTool.exe (PID: 3548)
      • SGTool.exe (PID: 3884)
      • SogouComMgr.exe (PID: 2044)

    • Application launched itself

      • iexplore.exe (PID: 4008)

    • The process uses the downloaded file

      • iexplore.exe (PID: 4008)

    • Create files in a temporary directory

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 980)

    • Reads the machine GUID from the registry

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SogouExe.exe (PID: 3256)
      • SogouExe.exe (PID: 3780)
      • SGTool.exe (PID: 2828)
      • SogouExe.exe (PID: 752)
      • SogouComMgr.exe (PID: 2044)

    • Dropped object may contain TOR URL's

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SogouComMgr.exe (PID: 2044)

    • Creates files in the program directory

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SogouExe.exe (PID: 3780)
      • SogouComMgr.exe (PID: 2044)
      • biz_helper.exe (PID: 3460)
      • biz_helper.exe (PID: 3664)
      • biz_helper.exe (PID: 2356)

    • Creates files or folders in the user directory

      • SGTool.exe (PID: 3292)
      • SogouExe.exe (PID: 3256)
      • SGTool.exe (PID: 3900)
      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SGTool.exe (PID: 2828)
      • SogouExe.exe (PID: 752)
      • SGTool.exe (PID: 908)
      • SGTool.exe (PID: 324)
      • SGTool.exe (PID: 2088)
      • userNetSchedule.exe (PID: 3588)
      • SGTool.exe (PID: 2612)
      • SGTool.exe (PID: 2228)
      • SGTool.exe (PID: 3548)
      • SGTool.exe (PID: 3876)
      • SogouExe.exe (PID: 3780)
      • SGTool.exe (PID: 3884)
      • SogouComMgr.exe (PID: 2044)

    • Reads the software policy settings

      • SogouExe.exe (PID: 3256)
      • SogouExe.exe (PID: 3780)
      • SogouExe.exe (PID: 752)

    • Checks proxy server information

      • sogou_pinyin_14.2.0.8968.exe (PID: 1728)
      • SGTool.exe (PID: 2828)
      • SogouComMgr.exe (PID: 2044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
32
Malicious processes
12
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs sogou_pinyin_14.2.0.8968.exe no specs sogou_pinyin_14.2.0.8968.exe sgtool.exe no specs regsvr32.exe no specs sgtool.exe no specs sogouexe.exe sgtool.exe no specs sogouexe.exe sgtool.exe sogouexe.exe sogousvc.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs usernetschedule.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs sgtool.exe no specs schtasks.exe no specs sgtool.exe no specs sogouimebroker.exe no specs sogoucommgr.exe biz_helper.exe no specs biz_helper.exe no specs biz_helper.exe no specs biz_helper.exe no specs regsvr32.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Program Files\SogouInput\14.2.0.8968\SGTool.exe" --appid=scdreg -register "C:\Program Files\SogouInput\14.2.0.8968"C:\Program Files\SogouInput\14.2.0.8968\SGTool.exe—sogou_pinyin_14.2.0.8968.exe
User:
admin
Company:
Sogou.com
Integrity Level:
HIGH
Description:
搜狗输入法 工具
Exit code:
0
Version:
14.2.0.8968
Modules
Images
c:\program files\sogouinput\14.2.0.8968\sgtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wininet.dll
552"C:\Program Files\SogouInput\14.2.0.8968\SGTool.exe" --appid=skinreg -register "C:\Program Files\SogouInput\14.2.0.8968"C:\Program Files\SogouInput\14.2.0.8968\SGTool.exe—sogou_pinyin_14.2.0.8968.exe
User:
admin
Company:
Sogou.com
Integrity Level:
HIGH
Description:
搜狗输入法 工具
Exit code:
0
Version:
14.2.0.8968
Modules
Images
c:\program files\sogouinput\14.2.0.8968\sgtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wininet.dll
568"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sogou_pinyin_14.2.0.8968.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sogou_pinyin_14.2.0.8968.exe—iexplore.exe
User:
admin
Company:
Sogou.com
Integrity Level:
MEDIUM
Description:
搜狗输入法 安装程序
Exit code:
3221226540
Version:
14.2.0.8968
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\sogou_pinyin_14.2.0.8968.exe
c:\windows\system32\ntdll.dll
752"C:\Program Files\SogouInput\SogouExe\SogouExe.exe" /checkC:\Program Files\SogouInput\SogouExe\SogouExe.exe
SGTool.exe
User:
admin
Company:
Sogou.com
Integrity Level:
HIGH
Description:
搜狗输入法 安全启动程序
Exit code:
0
Version:
14.2.0.8968
Modules
Images
c:\program files\sogouinput\sogouexe\sogouexe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
864"regsvr32.exe" /s "C:\Program Files\SogouInput\Components\biz_center\1.0.0.2283\biz_shellext64.dll"C:\Windows\System32\regsvr32.exe—biz_helper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
908"C:\Program Files\SogouInput\14.2.0.8968\SGTool.exe" --appid=scdreg -ConvV1toV2InstPath "C:\Program Files\SogouInput\14.2.0.8968"C:\Program Files\SogouInput\14.2.0.8968\SGTool.exe—sogou_pinyin_14.2.0.8968.exe
User:
admin
Company:
Sogou.com
Integrity Level:
HIGH
Description:
搜狗输入法 工具
Exit code:
0
Version:
14.2.0.8968
Modules
Images
c:\program files\sogouinput\14.2.0.8968\sgtool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wininet.dll
980"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1636regsvr32 /s /i "C:\Program Files\SogouInput\14.2.0.8968\SogouTSF.dll"C:\Windows\System32\regsvr32.exe—sogou_pinyin_14.2.0.8968.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
4
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1728"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sogou_pinyin_14.2.0.8968.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sogou_pinyin_14.2.0.8968.exe
iexplore.exe
User:
admin
Company:
Sogou.com
Integrity Level:
HIGH
Description:
搜狗输入法 安装程序
Exit code:
0
Version:
14.2.0.8968
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\sogou_pinyin_14.2.0.8968.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
2044"C:\Program Files\SogouInput\Components\SogouComMgr.exe" -installdoall "C:\Program Files\SogouInput\Components\TempComponents" -param "-setup -rdele -installplu 0 -removelist SearchSuggestionBundle#WonderfulWriteBundle#SmartInfoBundle" -silent -overwriteC:\Program Files\SogouInput\Components\SogouComMgr.exe
sogou_pinyin_14.2.0.8968.exe
User:
admin
Company:
Sogou.com
Integrity Level:
HIGH
Description:
搜狗输入法 扩展功能管理器
Exit code:
0
Version:
14.2.0.8968
Modules
Images
c:\program files\sogouinput\components\sogoucommgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
50 272
Read events
49 812
Write events
376
Delete events
84

Modification events

(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31095058
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31095058
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(4008) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
75
Suspicious files
68
Text files
177
Unknown types
43

Dropped files

PID
Process
Filename
Type
3276iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sogou_pinyin_14.2.0.8968.exe.v3k9p51.partial —
MD5:—
SHA256:—
4008iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\sogou_pinyin_14.2.0.8968.exe —
MD5:—
SHA256:—
4008iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver995D.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
1728sogou_pinyin_14.2.0.8968.exeC:\Users\admin\AppData\Local\Temp\nsu61CA.tmp\SetupUi.cupfbinary
MD5:817CBF611CFF0DEB62A614ACA93F1B31
SHA256:EDA6D0EB05CDCC1941F67F8DF5C63A91ADEB073CF64C80A0276385A04A4D13EC
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Abinary
MD5:C13726CB8F36554E48194607251E72D6
SHA256:F922131781EE8DE44C3E76C89E74E9F798E7A91F9651350F5E1C293A62780AE9
4008iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\urlblockindex[1].binbinary
MD5:FA518E3DFAE8CA3A0E495460FD60C791
SHA256:775853600060162C4B4E5F883F9FD5A278E61C471B3EE1826396B6D129499AA7
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:671750E95147C280C29000B09A5A5540
SHA256:C2BCF615C8BD97A3BDAFF1E0BDCE5AD328B8777A1F694613BD227280BEE9645B
4008iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
4008iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:03286F86A6340EF1EB71162CA877B4CA
SHA256:F6E395EAB531C2331F213B764ECB38E1B4A1E883299D15C1D8B688291E26F20A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
34
DNS requests
24
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4008
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
unknown
4008
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
314 b
unknown
3276
iexplore.exe
GET
200
119.167.147.251:80
http://pro.cdn.ime.sogou.com/sogou_pinyin_14.2.0.8968.exe
unknown
executable
140 Mb
unknown
1728
sogou_pinyin_14.2.0.8968.exe
GET
200
129.226.103.145:80
http://pinyin.sogou.com/client/validateinstall.php?v=14.2.0.8968&h=0923E3199566CF719B92C686B73BE6C5&r=0000_sogou_pinyin_14.2.0.8968&pp=iexplore.exe&mode=0
unknown
text
87 b
unknown
1080
svchost.exe
GET
200
173.222.108.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1dd404ff67a3d8ee
unknown
compressed
67.5 Kb
unknown
3276
iexplore.exe
GET
—
119.167.147.251:80
http://pro.cdn.ime.sogou.com/sogou_pinyin_14.2.0.8968.exe
unknown
—
—
unknown
2044
SogouComMgr.exe
GET
200
43.129.115.16:80
http://ping.pinyin.sogou.com/component.gif?h=0923E3199566CF719B92C686B73BE6C5&r=0000_sogou_pinyin_14.2.0.8968&v=14.2.0.8968&tt=ipb&id=biz_center&ver=1.0.0.2283&it=5&ir=1
unknown
—
—
unknown
1080
svchost.exe
GET
304
173.222.108.243:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?aa4b77dd5ef709e5
unknown
compressed
67.5 Kb
unknown
2044
SogouComMgr.exe
GET
200
43.129.115.16:80
http://ping.pinyin.sogou.com/component.gif?h=0923E3199566CF719B92C686B73BE6C5&r=0000_sogou_pinyin_14.2.0.8968&v=14.2.0.8968&tt=ipb&id=biz_pdf&ver=1.0.0.2266&it=5&ir=1
unknown
—
—
unknown
2044
SogouComMgr.exe
GET
—
43.129.115.16:80
http://ping.pinyin.sogou.com/component.gif?h=0923E3199566CF719B92C686B73BE6C5&r=0000_sogou_pinyin_14.2.0.8968&v=14.2.0.8968&tt=ipb&id=game_center&ver=1.0.0.2281&it=5&ir=1
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3276
iexplore.exe
113.201.158.139:80
pro.cdn.ime.sogou.com
CHINA UNICOM China169 Backbone
CN
unknown
4008
iexplore.exe
2.19.96.42:443
www.bing.com
Akamai International B.V.
DE
unknown
4008
iexplore.exe
173.222.108.147:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown
4008
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3276
iexplore.exe
119.167.147.251:80
pro.cdn.ime.sogou.com
CHINA UNICOM China169 Backbone
CN
unknown
4008
iexplore.exe
2.19.96.48:443
www.bing.com
Akamai International B.V.
DE
unknown
4008
iexplore.exe
173.222.108.210:80
ctldl.windowsupdate.com
Akamai International B.V.
CH
unknown

DNS requests

Domain
IP
Reputation
pro.cdn.ime.sogou.com
  • 42.177.83.63
  • 123.234.2.61
  • 36.249.65.247
  • 42.177.83.214
  • 42.177.83.78
  • 36.249.65.232
  • 42.177.83.82
  • 42.177.83.87
  • 119.167.147.251
  • 42.177.83.224
  • 113.201.158.139
  • 113.207.69.190
  • 60.220.213.207
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.19.96.42
  • 2.19.96.48
  • 2.19.96.67
  • 2.19.96.56
  • 2.19.96.66
  • 2.19.96.65
  • 2.19.96.51
  • 2.19.96.41
  • 2.19.96.59
  • 2.19.96.75
  • 2.19.96.58
  • 2.19.96.50
  • 2.19.96.73
  • 2.19.96.74
  • 2.19.96.80
whitelisted
ctldl.windowsupdate.com
  • 173.222.108.147
  • 173.222.108.210
  • 173.222.108.243
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ieonline.microsoft.com
  • 204.79.197.200
whitelisted
go.microsoft.com
  • 23.43.62.58
whitelisted
pinyin.sogou.com
  • 129.226.103.145
  • 129.226.102.244
whitelisted

Threats

PID
Process
Class
Message
3276
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1728
sogou_pinyin_14.2.0.8968.exe
Misc activity
ET INFO Win32/Sogou User-Agent (SOGOU_UPDATER)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://pro.cdn.ime.sogou.com/sogou_pinyin_14.2.0.8968.exe