SOG.EXE – Unclassified Malware removal

SOG.EXE size: 369664 bytes
SOG.EXE hash: 0D714C67E422A6C719D18DB1E6944283

Created files:

%Program Files%\SogouFinger\InstallOK.exe
%Program Files%\SogouFinger\Sogoud.dll
C:\Windows\System32\DOWIRE.sys
C:\Windows\System32\sog.exe
C:\Windows\System32\z5.exe
C:\Windows\System32\z6.exe

Autostart registry keys:

HKLM\System\CurrentControlSet\Services\DOWIRE\Type: 01000000
HKLM\System\CurrentControlSet\Services\DOWIRE\Start: 03000000
HKLM\System\CurrentControlSet\Services\DOWIRE\ErrorControl: 01000000
HKLM\System\CurrentControlSet\Services\DOWIRE\DisplayName: DOWIRE
HKLM\System\CurrentControlSet\Services\DOWIRE\ImagePath: C:\Windows\System32\DOWIRE.sys

Detected by UnHackMe:

SOG.EXE
Default location: %SYSDIR%\SOG.EXE

Dropper information:
MD5: 8f48424cf687ac3ab27fafbbf7e8ed58
File size: 218112 bytes