Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 23:40
Static task
static1
Behavioral task
behavioral1
Sample
ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe
-
Size
2.3MB
-
MD5
ac0bf74c05127212f2800825bf73af08
-
SHA1
bb7fe3dc76356a717ede736bbf3490c07a9a42ba
-
SHA256
860befc00c41c533fa7c9011a0f5d1df1120724188050b67b088b1d7e06349e3
-
SHA512
7dc15cef913690cca3c5aacf9616daec22d5b20a093abeb63acd2d3bb62cf1f9d2a7ad4a40700109f8763923a1176b786b43d208204d70cd04f345f2a9a119db
-
SSDEEP
49152:2uuE7AnqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFWd:4E7AqrlyutLxC3sEwwMd
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SogouSoftware.exeExternalApp.exeMiniTPFw.exeac0bf74c05127212f2800825bf73af08_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation SogouSoftware.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation ExternalApp.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation MiniTPFw.exe Key value queried \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe -
Executes dropped EXE 9 IoCs
Processes:
minidownload.exeSogouSoftware.exeExternalApp.exeSogouSoftware.exeMiniTPFw.exeUpdateService.exeUpdateService.exeThunderFW.exeMiniThunderPlatform.exepid process 4396 minidownload.exe 3256 SogouSoftware.exe 1652 ExternalApp.exe 4984 SogouSoftware.exe 4932 MiniTPFw.exe 3144 UpdateService.exe 3152 UpdateService.exe 5928 ThunderFW.exe 4516 MiniThunderPlatform.exe -
Loads dropped DLL 26 IoCs
Processes:
SogouSoftware.exeExternalApp.exeregsvr32.exeregsvr32.exeregsvr32.exeSogouSoftware.exeMiniThunderPlatform.exepid process 3256 SogouSoftware.exe 1652 ExternalApp.exe 1652 ExternalApp.exe 1652 ExternalApp.exe 1652 ExternalApp.exe 1652 ExternalApp.exe 3160 regsvr32.exe 1204 regsvr32.exe 836 regsvr32.exe 4984 SogouSoftware.exe 4984 SogouSoftware.exe 4984 SogouSoftware.exe 4984 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 4516 MiniThunderPlatform.exe 4516 MiniThunderPlatform.exe 4516 MiniThunderPlatform.exe 4516 MiniThunderPlatform.exe 4516 MiniThunderPlatform.exe 4516 MiniThunderPlatform.exe 4516 MiniThunderPlatform.exe -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ = "C:\\Program Files (x86)\\SogouSoftware\\3.2.2.58\\npdownload64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ExternalApp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SogouSoftwareAutoRun = "C:\\Program Files (x86)\\SogouSoftware\\SogouSoftware.exe /AutoRun" ExternalApp.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exeSogouSoftware.exeExternalApp.exeSogouSoftware.exeMiniThunderPlatform.exedescription ioc process File opened for modification \??\PhysicalDrive0 ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe File opened for modification \??\PhysicalDrive0 SogouSoftware.exe File opened for modification \??\PhysicalDrive0 ExternalApp.exe File opened for modification \??\PhysicalDrive0 SogouSoftware.exe File opened for modification \??\PhysicalDrive0 MiniThunderPlatform.exe -
Drops file in System32 directory 4 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy regsvr32.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini regsvr32.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol regsvr32.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI regsvr32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
ExternalApp.exedescription ioc process File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\close_act.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\text-base\driver_uninstall.gif.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\text-base\closebtn_normal_dlg.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\text-base\Monitor4848.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\gzipdll.dll ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\tips_down.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\.svn\text-base\msvcp71.dll.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\update_dlg_otherfont.xml ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\text-base\CPU4848.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\text-base\Printer4848.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\smallbtn_shadow.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\progress_bk.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\closebtn.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\.svn\all-wcprops ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\prop-base\Monitor4848.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\closebtn_normal.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\default_pkgicon.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\uninstall_list_item.xml ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\star_half.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\MiniThunderPlatform.exe ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\dl_peer_id.dll ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver_restore_list_item.xml ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\GIF\.svn\prop-base\refreshing.gif.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\prop-base\update_dwn.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\update_info.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\ins_app2phone_arrow.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\.svn\text-base\driver_uninstall_list_item.xml.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\feedback_dwn.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\ins_app2phone.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\.svn\text-base\MiniThunderPlatform.exe.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\.svn\text-base\driver_restore_page.xml.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\prop-base\bottom_shadow.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\IEHint64.dll ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\.svn\text-base\driver_restore_list_item.xml.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\download_btn_icon.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\logo3434.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\update\USBDT.dll ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\text-base\finishbtn.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\prop-base\recommend_hov.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\close_search.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\text-base\dash_line.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\confirm_closebtn.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\item_icon_4.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\upgrade_beta_list_item.xml ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\prop-base\apk.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\driver_fresh_progress_fore.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\GIF\.svn\entries ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\prop-base\closebtn_hover.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\.svn\text-base\driver_backup_list_item.xml.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\.svn\text-base\hardware_info_page.xml.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\prop-base\1.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\.svn\prop-base\Disk4848.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\logo_text.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\search_bar_act_focus.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\prop-base\9+.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\ins_title.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\tab.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\HardwareInfo.dll ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver_restore_page.xml ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\text-base\setting_dwn.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\check_uncheck_disable.png ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\menu.xml ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\ApkTool\extheme\ApkTool\.svn\text-base\ins_confirm.png.svn-base ExternalApp.exe File created C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\combo_mask.png ExternalApp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\minidownload.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\minidownload.exe nsis_installer_2 C:\Program Files (x86)\SogouSoftware\tmp\ExternalApp.exe nsis_installer_1 C:\Program Files (x86)\SogouSoftware\tmp\ExternalApp.exe nsis_installer_2 -
Processes:
ExternalApp.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C} ExternalApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C}\AppName ExternalApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C}\AppPath ExternalApp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C}\Policy = "3" ExternalApp.exe -
Modifies data under HKEY_USERS 37 IoCs
Processes:
regsvr32.exeregsvr32.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows regsvr32.exe Key created \REGISTRY\USER\.DEFAULT regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft regsvr32.exe Key created \REGISTRY\USER\S-1-5-19 regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows regsvr32.exe Key created \REGISTRY\USER\S-1-5-20 regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft regsvr32.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext regsvr32.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats regsvr32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore regsvr32.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeExternalApp.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ = "IGameDownload" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SogouSoftware\Shell ExternalApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SogouSoftware\ = "URL:SogouSoftware Protocol" ExternalApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SogouSoftware\DefaultIcon\ = "C:\\Program Files (x86)\\SogouSoftware\\SogouSoftware.exe" ExternalApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C} ExternalApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ = "C:\\Program Files (x86)\\SogouSoftware\\3.2.2.58\\npdownload64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID ExternalApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SogouSoftware\Shell\Open\command\ = "\"C:\\Program Files (x86)\\SogouSoftware\\SogouSoftware.exe\" \"%1\"" ExternalApp.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE\Microsoft\Windows regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\FLAGS\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Implemented Categories regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains\* regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D1871D0A-4929-4A3C-AAE5-684235E62244}\iexplore\AllowedDomains regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\ = "DownLoadBHO Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546}\1.0\0\win32\ = "C:\\Program Files (x86)\\SogouSoftware\\3.2.2.58\\npdownload64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SogouSoftware ExternalApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SogouSoftware\Shell\Open ExternalApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\InprocServer32\ = "C:\\Program Files (x86)\\SogouSoftware\\3.2.2.58\\npdownload.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ ExternalApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SogouSoftware\Shell\Open\command ExternalApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4D786E8-0535-41DB-91F8-B18ABBCCDE6C}\LocalServer32\ = "C:\\Program Files (x86)\\SogouSoftware\\SogouSoftware.exe" ExternalApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ = "IDownLoadBHO" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ = "IGameDownload" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\SOFTWARE\Microsoft\Windows\CurrentVersion regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1871D0A-4929-4A3C-AAE5-684235E62244}\Version regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13D91BAE-B37C-41C3-AE86-463E53990546} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib\ = "{13D91BAE-B37C-41C3-AE86-463E53990546}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6D89601E-1736-40FB-A3A5-84A376F286D0}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64608416-BAFE-43A2-91C4-324C6CA4EF52}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
UpdateService.exeSogouSoftware.exepid process 3152 UpdateService.exe 3152 UpdateService.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SogouSoftware.exepid process 3256 SogouSoftware.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
SogouSoftware.exepid process 3256 SogouSoftware.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
SogouSoftware.exeSogouSoftware.exepid process 4984 SogouSoftware.exe 4984 SogouSoftware.exe 3256 SogouSoftware.exe 3256 SogouSoftware.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exeSogouSoftware.exeExternalApp.exeregsvr32.exeMiniTPFw.exedescription pid process target process PID 4108 wrote to memory of 4396 4108 ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe minidownload.exe PID 4108 wrote to memory of 4396 4108 ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe minidownload.exe PID 4108 wrote to memory of 4396 4108 ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe minidownload.exe PID 4108 wrote to memory of 3256 4108 ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe SogouSoftware.exe PID 4108 wrote to memory of 3256 4108 ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe SogouSoftware.exe PID 4108 wrote to memory of 3256 4108 ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe SogouSoftware.exe PID 3256 wrote to memory of 1652 3256 SogouSoftware.exe ExternalApp.exe PID 3256 wrote to memory of 1652 3256 SogouSoftware.exe ExternalApp.exe PID 3256 wrote to memory of 1652 3256 SogouSoftware.exe ExternalApp.exe PID 1652 wrote to memory of 3160 1652 ExternalApp.exe regsvr32.exe PID 1652 wrote to memory of 3160 1652 ExternalApp.exe regsvr32.exe PID 1652 wrote to memory of 3160 1652 ExternalApp.exe regsvr32.exe PID 1652 wrote to memory of 1204 1652 ExternalApp.exe regsvr32.exe PID 1652 wrote to memory of 1204 1652 ExternalApp.exe regsvr32.exe PID 1652 wrote to memory of 1204 1652 ExternalApp.exe regsvr32.exe PID 1204 wrote to memory of 836 1204 regsvr32.exe regsvr32.exe PID 1204 wrote to memory of 836 1204 regsvr32.exe regsvr32.exe PID 1652 wrote to memory of 4984 1652 ExternalApp.exe SogouSoftware.exe PID 1652 wrote to memory of 4984 1652 ExternalApp.exe SogouSoftware.exe PID 1652 wrote to memory of 4984 1652 ExternalApp.exe SogouSoftware.exe PID 1652 wrote to memory of 4932 1652 ExternalApp.exe MiniTPFw.exe PID 1652 wrote to memory of 4932 1652 ExternalApp.exe MiniTPFw.exe PID 1652 wrote to memory of 4932 1652 ExternalApp.exe MiniTPFw.exe PID 1652 wrote to memory of 3144 1652 ExternalApp.exe UpdateService.exe PID 1652 wrote to memory of 3144 1652 ExternalApp.exe UpdateService.exe PID 1652 wrote to memory of 3144 1652 ExternalApp.exe UpdateService.exe PID 4932 wrote to memory of 5928 4932 MiniTPFw.exe ThunderFW.exe PID 4932 wrote to memory of 5928 4932 MiniTPFw.exe ThunderFW.exe PID 4932 wrote to memory of 5928 4932 MiniTPFw.exe ThunderFW.exe PID 3256 wrote to memory of 4516 3256 SogouSoftware.exe MiniThunderPlatform.exe PID 3256 wrote to memory of 4516 3256 SogouSoftware.exe MiniThunderPlatform.exe PID 3256 wrote to memory of 4516 3256 SogouSoftware.exe MiniThunderPlatform.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ac0bf74c05127212f2800825bf73af08_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\minidownload.exe"C:\Users\Admin\AppData\Local\Temp\minidownload.exe"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe"C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe" /Loader /DownLoad?status=true&softurl=https%3A%2F%2Fxiazai.sogou.com%2Fcomm%2Fredir%3Fsoftdown%3D1%26u%3D5M778mNuk-IR5IpbEw6j9YpS1Wc4Ved3WXa85rh1XgyheSu4KSc873XX-0eLlV_4175qK_X1cC089g3UvQT4HFgXJ8-dW6Zyh6i63LXZxGM0W2Wqaimckia18juZWspKniF5_tMpLpMTV9OOG3TDj5uSN8GNMfht-hhfyrotZuymqeXTs4DKsqrgKv2NitWRKqRFCy2Uw-s.%26pcid%3D-1577129102750396778%26fr%3Dxiazai%26source%3Dtencent%26filename%3DTHS_qqguanjia_9.10.20.exe&iconurl=http%3A%2F%2Fpc3.gtimg.com%2Fsoftmgr%2Flogo%2F48%2F1402_48_1626246961.png&softname=%E5%90%8C%E8%8A%B1%E9%A1%BA+%E5%85%8D%E8%B4%B9%E7%89%88&softsize=148.36MB2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SogouSoftware\tmp\ExternalApp.exe"C:\Program Files (x86)\SogouSoftware\tmp\ExternalApp.exe" /Update3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SogouSoftware\3.2.2.58\npdownload.dll"4⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SogouSoftware\3.2.2.58\npdownload64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\SogouSoftware\3.2.2.58\npdownload64.dll"5⤵
- Loads dropped DLL
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe"C:\Program Files (x86)\SogouSoftware\SogouSoftware.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\SogouSoftware\download\download\MiniTPFw.exe"C:\Program Files (x86)\SogouSoftware\download\download\MiniTPFw.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\SogouSoftware\download\download\ThunderFW.exe"C:\Program Files (x86)\SogouSoftware\download\download\ThunderFW.exe" MiniThunderPlatform2024-06-1423:42:37 "C:\Program Files (x86)\SogouSoftware\download\download\MiniThunderPlatform.exe"5⤵
- Executes dropped EXE
-
C:\Program Files (x86)\SogouSoftware\update\UpdateService.exe"C:\Program Files (x86)\SogouSoftware\update\UpdateService.exe" /Install4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\SogouSoftware\download\download\MiniThunderPlatform.exe"C:\Program Files (x86)\SogouSoftware\download\download\MiniThunderPlatform.exe" -StartTP3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Program Files (x86)\SogouSoftware\update\UpdateService.exe"C:\Program Files (x86)\SogouSoftware\update\UpdateService.exe" /Service1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\CommonState.dllFilesize
83KB
MD56e888d41691f655ab9ec752384e009eb
SHA16c54689dc6fe3070e2d24011a9f8e710f5444d66
SHA256a5adc7b2757172c55834a3720731c0b3eb22ddd1766cc531c06de537bcef786d
SHA5125995cb6a7bc4573d5593904fb518bef91401b4f44fef808ed915017a0b7f0589bb5b810fc183b196ea57de32ec4a0e63b54ce89dde3283e41ff706c6999c4977
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\DuiLib.dllFilesize
827KB
MD528ba86c039552346dafff7e9363ce02e
SHA10c7848c17f84f7fae9f058ae49658dba4371975c
SHA25649837458d579b16b25f81d0d477922c0d363867e120e0114577c2eb0506639a9
SHA51260fa470134c5a9dfeacf2ebf615d656fd84d80f00ce0c3ff6d617e73f7942b5d48501b1073cd76fa717a0323d69b246170af5f8232ae7d4af3bc45b0325e7283
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\SogouSoftware.dllFilesize
1.2MB
MD5fb7a98797d8601196a79545775864de7
SHA10148ce7895eab4725b95a57e0fd3469a21de579f
SHA256ffd9ab6a997659efee084a1493784c2755010a04f5a2ab03cd0ea74c637b3e96
SHA5123afbef824abb40ccf128bdfa52cb7357b7340fe9a65139b6a2f42a17425548a96a7c95c3154728517aa784d8b00c0a5834a4af95f04bdc590eb8cfab9c24f75a
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\npdownload.dllFilesize
272KB
MD5c97af614b96b1d7adeed67261b3771c0
SHA1f67f94dff7a78953d4a9a6af63d30fc7dfe40a8e
SHA25698f283754465cae416af646c9c68e4c1a60eea088616bb5a265cfdd9c896b1b8
SHA512972cee7e0fe258ec1d62cbe7b077380010a5ab4a02c24791d23e10047f5d2a16e847b2a33bde9f7b27e6a59483f61371d98186281ef40a3a370629f546f6d322
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\npdownload64.dllFilesize
315KB
MD5b256f88501223e358c03ea2a172e0f7f
SHA19ee8c5b3db6d7076742c488b001a76741fc3aefe
SHA2562fc446c8fdb3ad5711e6e83c720379062accd40cf9203c6e484eea83faecb840
SHA51210f9d2bcf55d2241cb92dea7b1f7833f7d2536e93c7906d3c483df25f8515f24bd3fa57659f8972b888cf57457ae5bd5a9f564e9326278ddc66ed7201e52d19e
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\MySoftwareManager.xmlFilesize
23KB
MD5f5f5698ee6b73535a7a55ffc9df6f38f
SHA176b4f170b339481149f72a7294218ad7ea5f9ecd
SHA256613125461abb68bf1535c2b28d3cbf1efc3fe04484acdb89c0e961296837f1ec
SHA5125c83a38a0a0639bada0666592bcd73754e3f161b52ffcb14f066ce11ddac2f818de39ac5a36ebe3d026c202d087fcd1284d6fd5b65d38a112c6c1647274a3bc1
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\.svn\formatFilesize
2B
MD5c30f7472766d25af1dc80b3ffc9a58c7
SHA1136571b41aa14adc10c5f3c987d43c02c8f5d498
SHA256aa67a169b0bba217aa0aa88a65346920c84c42447c36ba5f7ea65f422c1fe5d8
SHA5120354672b288ac5ccd92c7336f24c3b5a9e669d95bf3036241d3919bae5aadba2c312742d7b422cb04347d6ce98151019baf81a3390e12de140365f17a9cf9afc
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\all_updated.pngFilesize
8KB
MD554fa38a675e31cb61c4d684857401bfa
SHA1548d9fae0de3f34a40c66400524a48a4d9295491
SHA2565bee78015e52f35c0e604a38b4045d04d174950a26658201714a770e4176f02d
SHA51261bb5f5cbc3cb5ff9e05984678e2d12b5914340ab2dbf812ad1a519aa4938b3f4b220234c5b33d198efc2d8a90e6a947f8a20b352bd2862a313e57c43aad8fda
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\download_btn_icon.pngFilesize
1003B
MD56e30b0f37668df11c09a638ec2901959
SHA162f3c4379d14c86261724942016e8b30777049cb
SHA256bf08172a35630a61b905c438f4c7f33df2a57ad078e24125de41b77880ee7e53
SHA512f82eb5a5efcb8994a89a30ec47fc43173964adc5913f5277ac30adfd5c7f7a5c8cddbb6dcdff6ae49dc5391bed38884633482600e1fca84ce9738e52ade08cc1
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\driver_fresh_progress_bk.pngFilesize
950B
MD5a0151daa5f849bb6b22e20abbab78436
SHA10f8a2ae2f4982fd562221cf8567cd6a5e68bad1f
SHA2564443ee00c111715fdfbcc9f221c44bef3333de7e887b70c39417c61ec7369728
SHA512b9dfb5c784a762ea9ee6b0b3fa514dd3c96242019d79c1919f11f195984c9626b934e668480152ee56c8b88ac2ebd0e028cc6af0c33f25573bb5fd019781071e
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\driver_icon.pngFilesize
1KB
MD5af5deb4ef4870c69e6a7edf2f38faef4
SHA116bc05409d7da0a8121da977607af958d10e96fb
SHA256638a6fd479b267e2a2b349953604a149bd521fc3f9d8f1ccd4b53aaef0a78513
SHA512153714ebf00226c67d2a6d2cd88c1226bd16b951704cde38df869d7c488e2c753d2bfcc9389f504558578af4819e4573fdcb1f0bf478fe227ccc9c3f31294054
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\grin.pngFilesize
23KB
MD50d5b69334bc73302a52bc3bab5a5ac27
SHA1da23a6f5ce158774ca047f7761e834258d907f52
SHA25642030cb3333c77d3019180f5aca1deb1345de55cd33a1816db5b1a276445ac84
SHA512c2d54552b7a874d8189adfb15d35af852d5b5b4526b76e72b914ea2fc4b022e632f5e583ff6528ad9bde2f2639d976d7215d9e76c5bf9376b1e33c84be1a3fb5
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\hwinfo.pngFilesize
1KB
MD5bd0f970f72b8b9064dfaab084fc55fea
SHA1c792935e9f72bea9b4ecc555b28ebb5fdf03ddfb
SHA2566234d5b195a6f28da3e7fff79c4a95262ce33a176e8e8355b94a36f61e96913e
SHA512cfcc5608056bdaf647361416e5c51a58caaed58548c1d32942eb946d177f781f76e984e997f1326abd07395ec42fff6fe47b1553a83728e9b1c4bbb849fd13bf
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\logo3434.pngFilesize
1KB
MD54c74aab2bcf16cb617837aaeaa7cfa1b
SHA137925cfde22e94db3f4ad04df39d8fb20ca55c17
SHA2568092dffbb4bc611d6f92786fbab70fddf7da5634f84d423c6fc20afd26172628
SHA51262d96a3dc3001b396907855f12f91073a9d9e1d602e111a859c84a3207431c12564e46d0f052f293692cb130b56eb4b9e6fe7310ec2db0b401e4225f7afefc2f
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\logo3636.pngFilesize
1KB
MD5fa6fd08affac19e21aa47df7a50eacd4
SHA1fff56332d1d2e2386ca874c9bd8540b3306f59fc
SHA25697f1d1b373351f9593227c67cb5e8dc073641a962d81df936920f33cb8d3c4cc
SHA5129f4ce00d51450ef25e06dfe64587fcf8a5e9d65288ac9c44af733e10825e2173f40ea1e37d4dd1c39842b4b23b8a53cf9d0a0aeb609261ef0a3ee394c6f3ddd8
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\logo_text.pngFilesize
1KB
MD59876c5a2a2433a1d0d12dc272c2c226b
SHA1508fbfb0a0164ce84a83c1f8fe257035e3b62929
SHA256e182eb30de511bbc685548a771daa015a42299c207989c495bba0e8c9f5d0c1b
SHA5125c89ba6180d0b22cf45db507b4d90e61e4d32b0753703f5735d36caf442e25d2ee4a617495ff022a6cedbb9fd0949912d5feb068afcb6aecc2451a7541edeeef
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\pcinfo.pngFilesize
1KB
MD5ee3e7acb4e6cbd2bd2280af9f3b61805
SHA13173f5a908928a464ce97181e20b84bc67e7adc8
SHA2567f721406c23540bef70c6f91abc63b98ca26bca59f13605f96005612e56e5e7a
SHA5124adec1dbff9bf684f2637df46094f2e344b71c960775ebce7885b45fe71ac9f356cad868ee18b04d7cef54e52cb5d98756f1c2f3397a9fc3b30ac4f4ce6697dd
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\search_bar_nor.pngFilesize
17KB
MD56e0e5b09e6b0dbcd105c1dcfd13025bf
SHA1421f47fb759a3b8a68dfd33e980ee01a3312677e
SHA256d4bf4bf16ea64e57391cebd9d85d8cbbad866b7dfbb32882ecc7f8a29b19f5e0
SHA512783070dc6a31297c942ca857a04c6d1c3542456b63987cf9ca54c7b7c22d6fc0b3bd78c7e7a7d0a8d898307a0c1740554096640991ffcf0d21baac96266a9f65
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\shy.pngFilesize
5KB
MD541e22dc53a45821cf4755dfd512097fa
SHA19009f852a32c89dc6a2a01c6a658579389f0907c
SHA25681e89178822622014427ff3d3b11179d392ec4f222b331d6483214667e8e9749
SHA5123770f8c789bc51b8d9354cd8de7e70072d4f4d09f66e37e6030e830f28a8f3b2f4aea90db53bf5e713d2a7b38b86f150e0f9b44ea4f56fe3362cc508feecabd4
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\PNG\software_icon.pngFilesize
995B
MD5db61ef6be10662bde9e80c76e3b51854
SHA1f48725f24dec25548d1a778dbc9fa95146a042b2
SHA256478ce132c5472395f0ccfe3853a6b60dc727c2ee1c8d525c05e8717e264fd176
SHA512dce39e93e47089104cc9fd1a73abcc506ccb4b29132e2b56adf8f052c9bc6dc6a05452bf7e44c60363705467af13a1cfefb87fede4f15aee6e73272a07e72f95
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\bottom_shadow.pngFilesize
4KB
MD5292cae7ef8a682ebc2fb855afcf54f2d
SHA12401ce33d598bf417859eee779127703fdaa4762
SHA2569ccfd9c2c1a3b12aa881d6c4a52375595a50a7f3f2d8ba157dd12ffcdf1d75f7
SHA5128f1b781676ba8dd945f9974282715be65f4b4302dc07196e7a1377b3fcbb73c209836be42e912a079879d5db0af9d411dd614a53fa5533d232b5dce5ea50055a
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\dash_line.pngFilesize
946B
MD51e8fb34ac9925d9bad14a75ec8ea5f56
SHA1bb197cb5dc01c484788f958fcc4ada2b129fa5ef
SHA2569f98ab7d58b34d7ce6bb84eac14edfb3ae263b315c1e8e6a3c161b31c19ed0a5
SHA5129b9643a36bf239c78d77668e9b61bbb7247cc86ad03ff542fb2863c32775b1bd9f4ba964b23519e95c573cbae67389ea37697dd222dbca100cd3c2ea847b997b
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver\driver_freshed_waring.pngFilesize
1KB
MD5e3e5a56632c8620a18044e695ba7cdb7
SHA1bd2d52b5a6afcfc331117b6aa8e51b8c5db3e66e
SHA256dfc05aa1d37f984f68db0303d2c4cf894b190659ebfc94486eda228d6b5fa95e
SHA512c5808e1e035bce16e4599f0c0c7fcc54c007ea548c945a8c2bfff7c75efecfdc3a80da1b5fd9db70d60af05194b8b22842b501c76378af88a4f92f6e72bd2723
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver_backup_page.xmlFilesize
8KB
MD599c91df6c81dadcd064743be25f50480
SHA1da5af0368ada0b3ecb6eede6137a5a01ea388113
SHA256f8e4a1dfa021ebea8f705739f0d1eeaa29824af0f7283eee268d72cc3b53a1f8
SHA512b703ef1330337dca4499ae204e5e23aec8dff6b47f361257e56e6abc499650266f86133effd5843c0dfc076cde32b2d8b46ac67608366b815d0f2e8035abde10
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver_restore_page.xmlFilesize
3KB
MD50075ebe78309b52bd59fb132c31f912c
SHA1dc931227e1f076abbce19c89245f38e303890665
SHA256f7267655ec266625f19be5845a005da04da328cdd5ff91d239388a5ef21c0616
SHA512fcfb1f872c5012db302f5330f12b2f6d5ee6ed86c3cd36f29ba4b57204f909f4be18692f4e2c887ef31cec009721191602f7c8d9647e3b293c168e674bb2563d
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver_scan_page.xmlFilesize
7KB
MD5273805210c8d49fd526e45ba8caca3c9
SHA10a45b0d24a345dbbae8be8f157af3288cc73a29b
SHA25669931a6debab54157d1b5c0bdb124f36a6831ed7ae110b98c8f00cd886215f87
SHA512f14df0ad40667999cc45710f342978c981a89cebd27a726e7b02bebd6dc807985db2cf1a2df6227ce8834c15763ecb6b9f3f161071c1bc4d7103ef39471e566e
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\driver_uninstall_page.xmlFilesize
2KB
MD55add447f7599a9bacc6c870c6d9e8c3d
SHA1429cefa6b79b2bc2abe0923e6e222b102eff3228
SHA2560fc1ccdcb753da863531b1da84ffcc482ebd2ef9f9e5bc2c0c1c5c9674527a6b
SHA512f9ee6ce2c7a0e2f7574b4730a9dd7824f0c1926332743ab00a9772aadd600cd668ccd76a0b07a3a901ebcedd43aeed3b6c4624b4a2d23396c0342be669dcc2e7
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\hardware_info_page.xmlFilesize
5KB
MD525eff46b9c07384eb6514c3056cf3edc
SHA1a2703aa571978fd4405a548f9ca3c58924c5451d
SHA256a31e6b90ae103837c49da3037458b843248b58ce4a6a79e551dd9b4f30129c33
SHA5123ef4c686657683c0b23b138b025ed0f1318a07cbb4013d009d0d980c09c43088548aabbe34c95cc586838f130f9d76f2421311387f0bb5e5e69d966081b8d5d1
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\recommend_classify_table.xmlFilesize
5KB
MD574b9cc551416a9e012ad8d30d309e754
SHA122168c14cfeaff5d9ad1399fba131a3c5d4ee67c
SHA256a004641143d10d28fb7302963e1afc77b16b4df41fb3df6b752944f3a190fff3
SHA512989ce2b5520976a0c5cbc9d44149e5cb86444614557ddcaaffbad580ae1b38b8868fe6bca09768d2ce7b868c2335920e744cf530f24658bac78ed877875b83d8
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\skin\soft_search_list.xmlFilesize
1KB
MD570d0733d91369221657da75972aa2996
SHA196f083da2839e79d1abfd48a59814184abaa32b3
SHA256af03f14213c248c7fe7b670a7aa2d9dea1a1c724330c32f01352cf386ff5e57d
SHA5123999d25b5d0cf7f94f60f20b78704161aed4a3871cbf508b9f575e93081cc7a23a8bd950d0eb3c9b08e0c86f8b7775f33efe047a1fa3f08c21390430b2b057a1
-
C:\Program Files (x86)\SogouSoftware\3.2.2.58\sqlite3.dllFilesize
589KB
MD5ae8a8778ac495b47070774f33089753a
SHA124b443630adbf79b12c920f8fa2586abdf8ba6d2
SHA256bc35883beeb5da827d8eceb32d30bd07a838ad6c8ffa07f0dc7708a118ab4a39
SHA5121bd8933a7ca742769bce5463190d774ecfb70b984e500ab8b0229330eb7c4aa5e7c8432385459f4cc8e528504d2d5382e8379f7d6c13daa7a7506184fef3b125
-
C:\Program Files (x86)\SogouSoftware\SogouSoftware.exeFilesize
232KB
MD50bc2d003fcfe3fa65f4c3ba7a015fa41
SHA172ed85bc1c57259b4f2ed36d16ce3fed4e30607c
SHA256388069590fb9569b6c498f941d0565416cb52fc803648ee21b8c59917c63eb4b
SHA512ae8d83e6ca21ee9b0d5e5845fac3a4dc01c6038243da36b4360b2f42763478265cdafc89072c47672b9738de1930e5e5191e2bf91715055cbd16a949d313ff24
-
C:\Program Files (x86)\SogouSoftware\SogouSoftwareLoader.dllFilesize
450KB
MD5b1ce2dba9515e144908aa34ac77f5a46
SHA10a3e601eeba273a16d815c5e59793eb73db9daad
SHA2565a7349e46f16ec394af8575b666c132c010bacaa2c59da472b842ffeccc5623f
SHA512d0a78b5de9126b8126b531fb8f72ae375aac898930dccd8a61f173c28470895daab56b368c34a5925020dfdc642785651445967904d8756bb1ce7c1d2f95525a
-
C:\Program Files (x86)\SogouSoftware\download\download\.svn\prop-base\atl71.dll.svn-baseFilesize
53B
MD5113136892f2137aa0116093a524ade0b
SHA1a0284943f8ddfe69ceec90833e66d96bdf4a97f0
SHA256ebbf7e8800c3446bc3a195fa53573bde1073b0bf7581a614372f1391a9286d02
SHA512d3201cc19ae702a9813aa8bc39612ebaa48138903e9ede64dcadff213691f6e711876aa4fa083887c545325d5d8bf70649523c528090542459f2b01697180e99
-
C:\Program Files (x86)\SogouSoftware\download\download\MiniTPFw.exeFilesize
58KB
MD558bb62e88687791ad2ea5d8d6e3fe18b
SHA10ffb029064741d10c9cf3f629202aa97167883de
SHA256f02fa7ddab2593492b9b68e3f485e59eb755380a9235f6269705f6d219dff100
SHA512cd36b28f87be9cf718f0c44bf7c500d53186edc08889bcfa5222041ff31c5cbee509b186004480efbd99c36b2233182ae0969447f4051510e1771a73ed209da5
-
C:\Program Files (x86)\SogouSoftware\download\download\ThunderFW.exeFilesize
71KB
MD5f0372ff8a6148498b19e04203dbb9e69
SHA127fe4b5f8cb9464ab5ddc63e69c3c180b77dbde8
SHA256298d334b630c77b70e66cf5e9c1924c7f0d498b02c2397e92e2d9efdff2e1bdf
SHA51265d84817cdddb808b6e0ab964a4b41e96f7ce129e3cc8c253a31642efe73a9b7070638c22c659033e1479322aceea49d1afdceff54f8ed044b1513bffd33f865
-
C:\Program Files (x86)\SogouSoftware\manifest.cfgFilesize
29B
MD5dbdddb37dffafd829b9dddd86c8cbf57
SHA14fd1a652c7bfe2eb39e98a795cd77bc415b13d07
SHA256e661aadd4b5793e960bebdb4862589720b757d7f2c9849c73a9490c162830466
SHA512f1883accc58a7098f9b15a1a7225e7ef0e2ce3175dde6f5b2851c63654ee02919db734e41b45e74f998ba4c5e4f1fdc96abb5546a7fa1b02cc32ffe7d0c5fe36
-
C:\Program Files (x86)\SogouSoftware\tmp\ExternalApp.exeFilesize
11.9MB
MD51ea611695a4d643cf4c63a60151b9387
SHA17210cc8750b0c8c4d5cf0c49ad5274f1aab2c724
SHA2569c2f73221152802fd96b407477ee23b75f1ce9c9dc7de0c019e95f9d9b453ff2
SHA51268b50b8facba55b416b4160849c8ef4d79cc2af3969de14f26b96aeb9ed610ecfc201202a3f542030e5f26fb021e85acbb8c0602f1ef285387bfbac4b39e1a87
-
C:\Program Files (x86)\SogouSoftware\update\UpdateService.exeFilesize
168KB
MD53d3e5a0455863ae5b4db90b07c974967
SHA1d6316c15eeccb0942a2779636812be9b3da333d7
SHA2568671d4570f9462ff5c4cca67094baaecefebea212b2c8f27ad29d38f76ff312b
SHA51237178f6ce1bb692b3eb19767955089be56649a02b8eaa940522fcac29397030e2510a3c7419f3e72be0b595b2e8c8f13ce6d4ac723f22a52103d669e6490331e
-
C:\Program Files (x86)\SogouSoftware\ÈüþÖúÊÖ.lnkFilesize
1KB
MD51a884f8e4e7bb2620c9bf45e451dddf8
SHA1d4997bd8b700007ec0a76ae418fe2b0efa5f4613
SHA256cf4384227eb9f77b1c618975bd1dc45e43b4ca3a36296d26ba670d248c901dc0
SHA51272fd4fb81c915d1f4a7f3451adc1de811a6eff2bce8efd58fc961c6fec5d3742c9d3de9810108ad018ac06b30206289904be676496934f2aca0ab141a7828456
-
C:\Users\Admin\AppData\Local\Temp\minidownload.exeFilesize
1.9MB
MD50618e9851ea4a522abeded8d40c2f19e
SHA1c6772967fdf545e32d28f3b46e97aec5b9ff99f5
SHA256506c374fbdf14420306e2da8d123c2138c2ceabd2046178317508a25949d3dc4
SHA512b8c4816d81aa14646a3b690da76c0d33f59b7d419305638747503dba6bb84a63b906fe7d0ced59850ad25db37c1e0e6f3bd614a902f2f5ffb3d2bf74ec4e571f
-
C:\Users\Admin\AppData\Local\Temp\nsx2F16.tmp\System.dllFilesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
memory/3256-65-0x00000000012D0000-0x00000000012D1000-memory.dmpFilesize
4KB
-
memory/3256-64-0x00000000012D0000-0x00000000012D1000-memory.dmpFilesize
4KB
-
memory/4516-1117-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB