Техническая информация
Вредоносные функции
Запускает большое число процессов
Изменения в файловой системе
Создает следующие файлы
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\companybox.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\config.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\correction.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\default_repair.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\eudc\options.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\eudc\sgpyeudc.euf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\eudc\sgpyeudc.tte
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\fuzzy.dat
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\kaomoji_sugg.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\mohuyin.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\pandorabox.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\protectconfig.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\punctures.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\richinput.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\richinput\richinputconfig.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\rightpopmenu.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\runtime.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_adjcache.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_annex.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_ath_v2.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_blackifk.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_charvalid.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_core.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_eng.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_eng_pre.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_fix_first.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_gl.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_hz.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_infokey.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_numfreqadjust.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_numfreqadjust_v1.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_phrases.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_py.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_quick.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_simtra.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_smartinfo.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_tip.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_ur.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_url.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgim_urlguide.bin
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgkaomoji.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\abc.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\guobiao.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\ms2003.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\pinyinjiajia.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\sogou.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\xiaohe.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\ziguang.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\shuangpinschemes\ziranma.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\skin.dat
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\smartinfo.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\softkeyboard.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\thirdpassport.ini
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\urlbaseg.enc
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\urlsignaturev.dat
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\wizard.cupf
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\旗黑55扩b6字.ttf
- %ProgramFiles(x86)%\sogouinput\ime\env.ini
- %ProgramFiles(x86)%\sogouinput\ime\sogoupy.ime
- %ProgramFiles(x86)%\sogouinput\ime\sogoupy_x64.ime
- %ProgramFiles(x86)%\sogouinput\ime\sogoutsf.ime
- %ProgramFiles(x86)%\sogouinput\ime\sogoutsf_x64.ime
- %ProgramFiles(x86)%\sogouinput\inst.bat
- %ProgramFiles(x86)%\sogouinput\unist.cmd
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\hwsignature.dll
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\imefunc.dll
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\resource.dll
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sgtool.exe
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\sogoutsf.dll
- %ProgramFiles(x86)%\sogouinput\10.2.0.4519\userexportdll.dll
- <SYSTEM32>\sogoupy.ime
- %WINDIR%\syswow64\sogoupy.ime
- <SYSTEM32>\sogoutsf.ime
- %WINDIR%\syswow64\sogoutsf.ime
- %LOCALAPPDATA%low\sogoupy\env.ini
Сетевая активность
Подключается к
- '<DNS_SERVER>':53
Другое
Запускает на исполнение
- '<SYSTEM32>\cmd.exe' /c ""%ProgramFiles(x86)%\SogouInput\inst.bat" " (со скрытым окном)
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /ve /t REG_SZ /d "╦╤╣╖╞┤╥⌠╩Σ╚δ╖ÐÑ" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{E7EA138E-69F8-11D7-A6EA-00065B844310}\InProcServer32" /ve /t REG_SZ /d "<SYSTEM32>\SogouTSF.ime" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\CLSID\{E7EA138E-69F8-11D7-A6EA-00065B844310}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{CC43AF26-60C3-4612-B58D-27A07A40E90B}" /ve /t REG_SZ /d "SogouPY Text Service" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{CC43AF26-60C3-4612-B58D-27A07A40E90B}\InProcServer32" /ve /t REG_SZ /d "%ProgramFiles(x86)%\SogouInput\10.2.0.4519\SogouTSF.dll" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{CC43AF26-60C3-4612-B58D-27A07A40E90B}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{046B8C80-1647-40F7-9B21-B93B81AABC1B}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{13A016DF-560B-46CD-947A-4C3AF1E0E35D}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{25504FB4-7BAB-4BC1-9C69-CF81890F0EF5}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{364215D9-75BC-11D7-A6EF-00065B84435C}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{364215DA-75BC-11D7-A6EF-00065B84435C}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{49D2F9CE-1F5E-11D7-A6D3-00065B84435C}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{49D2F9CF-1F5E-11D7-A6D3-00065B84435C}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Category\{CCF05DD7-4A87-11D7-A6E2-00065B84435C}\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{046B8C80-1647-40F7-9B21-B93B81AABC1B}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{13A016DF-560B-46CD-947A-4C3AF1E0E35D}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{25504FB4-7BAB-4BC1-9C69-CF81890F0EF5}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{34745C63-B2F0-4784-8B67-5E12C8701A31}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{364215D9-75BC-11D7-A6EF-00065B84435C}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{364215DA-75BC-11D7-A6EF-00065B84435C}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{49D2F9CE-1F5E-11D7-A6D3-00065B84435C}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{49D2F9CF-1F5E-11D7-A6D3-00065B84435C}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\Category\Item\{E7EA138E-69F8-11D7-A6EA-00065B844310}\{CCF05DD7-4A87-11D7-A6E2-00065B84435C}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\LanguageProfile\0x00000804\{E7EA138F-69F8-11D7-A6EA-00065B844311}" /v "Description" /t REG_SZ /d "╦╤╣╖╞┤╥⌠╩Σ╚δ╖ÐÑ" ...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\LanguageProfile\0x00000804\{E7EA138F-69F8-11D7-A6EA-00065B844311}" /v "IconFile" /t REG_SZ /d "<SYSTEM32>\SogouTSF.im...
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\LanguageProfile\0x00000804\{E7EA138F-69F8-11D7-A6EA-00065B844311}" /v "IconIndex" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\LanguageProfile\0x00000804\{E7EA138F-69F8-11D7-A6EA-00065B844311}" /v "Enable" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\LanguageProfile\0x00000804\{E7EA138F-69F8-11D7-A6EA-00065B844311}" /v "HiddenInSettingUI" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{E7EA138E-69F8-11D7-A6EA-00065B844310}\LanguageProfile\0x00000804\{E7EA138F-69F8-11D7-A6EA-00065B844311}" /v "SubItemInSettingUI" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{CC43AF26-60C3-4612-B58D-27A07A40E90B}" /v "Enable" /t REG_SZ /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{CC43AF26-60C3-4612-B58D-27A07A40E90B}\Category\Category\{34745C63-B2F0-4784-8B67-5E12C8701A31}\{CC43AF26-60C3-4612-B58D-27A07A40E90B}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\CTF\TIP\{CC43AF26-60C3-4612-B58D-27A07A40E90B}\Category\Item\{CC43AF26-60C3-4612-B58D-27A07A40E90B}\{34745C63-B2F0-4784-8B67-5E12C8701A31}" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /v "ImeHint" /t REG_DWORD /d "0" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /v "StartMenuFolder" /t REG_SZ /d "╦╤╣╖╞┤╥⌠╩Σ╚δ╖ÐÑ" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /ve /t REG_SZ /d "%ProgramFiles(x86)%\SogouInput" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /v "Version" /t REG_SZ /d "10.2.0.4519" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /v "Region" /t REG_SZ /d "0000_sogou_pinyin_98a" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /v "VersionType" /t REG_SZ /d "Final" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /v "PatchFlag" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\WOW6432Node\SogouInput" /v "EnableSogouEudc" /t REG_DWORD /d "1" /f
- '<SYSTEM32>\reg.exe' add "HKCU\SOFTWARE\SogouInput" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouInputPY" /f /v "DisplayName" /t REG_SZ /d "╦╤╣╖╞┤╥⌠╩Σ╚δ╖ÐÑ"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouInputPY" /f /v "DisplayVersion" /t REG_SZ /d "10.2.0.4519"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouInputPY" /f /v "DisplayIcon" /t REG_SZ /d "\"%ProgramFiles(x86)%\SogouInput\10.2.0.4519\SGTool.exe\""
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouInputPY" /f /v "UninstallString" /t REG_SZ /d "\"%ProgramFiles(x86)%\SogouInput\unist.cmd\""
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouInputPY" /f /v "InstallLocation" /t REG_SZ /d "%ProgramFiles(x86)%\SogouInput"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SogouInputPY" /f /v "Publisher" /t REG_SZ /d "╦╤╣╖╞┤╥⌠╩Σ╚δ╖ÐÑ"
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{E7EA138E-69F8-11D7-A6EA-00065B844310}" /ve /t REG_SZ /d "╦╤╣╖╞┤╥⌠╩Σ╚δ╖ÐÑ" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{E7EA138E-69F8-11D7-A6EA-00065B844310}\InProcServer32" /ve /t REG_SZ /d "%WINDIR%\SysWow64\SogouTSF.ime" /f
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Classes\WOW6432Node\CLSID\{E7EA138E-69F8-11D7-A6EA-00065B844310}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
- '<SYSTEM32>\xcopy.exe' /Y "%ProgramFiles(x86)%\SogouInput\ime\env.ini" "%LOCALAPPDATA%Low\SogouPY\"
- '<SYSTEM32>\xcopy.exe' /Y "%ProgramFiles(x86)%\SogouInput\ime\skin_v3.dat" "%LOCALAPPDATA%Low\SogouPY\"
