96831d18540642bb2c1e34c0de14ab751f4da62e2c183b72a94854ba12dcc004

Sharing

Copy URL Twitter E-mail

General

Target

96831d18540642bb2c1e34c0de14ab751f4da62e2c183b72a94854ba12dcc004
Size

7.5MB
MD5

069def7c78d4841fcb718d61a1cf3238
SHA1

3b2eed433a5ed0490a6592f54f977f4d86f2208c
SHA256

96831d18540642bb2c1e34c0de14ab751f4da62e2c183b72a94854ba12dcc004
SHA512

46cdfbd922362d843e17fde2a9f286c661f8f566b6334993de09047b46c1ce5b73f39831b52a40155355a8874ccd431758d9d2f454d1d8ab5f90be2d6d1dfa61
SSDEEP

196608:ofxIRGi9PkGv9rTKhyqfLWtFnntd6R7Bkupv:o2Rt5v9PKhTkaP

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
96831d18540642bb2c1e34c0de14ab751f4da62e2c183b72a94854ba12dcc004
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/SogouPY.ime
unpack001/$PLUGINSDIR/System.dll
unpack001/out.upx

Files

96831d18540642bb2c1e34c0de14ab751f4da62e2c183b72a94854ba12dcc004
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/HWSignature.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a
Signer

Actual PE Digest

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ImageMagik.dll
.dll windows:6 windows x86 arch:x86

f204f2299a0324f196a8576faef59e72

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3
Signer

Actual PE Digest

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\data\landun\workspace\p-a6b81373d56245738becf19644b9638b\src\third_party_build\imagemagick\tmp\x86\RelWithDebInfo\ImageMagik.pdb

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeProcess
GetSystemTimeAsFileTime
GetConsoleOutputCP
LoadLibraryA
MultiByteToWideChar
IsValidCodePage
GetACP
GetCPInfo
IsDBCSLeadByteEx
ReadFile
WriteFile
PeekNamedPipe
SetEvent
ResetEvent
ReadConsoleInputA
DeviceIoControl
DuplicateHandle
GetConsoleWindow
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventW
WaitForMultipleObjects
GetExitCodeThread
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
GetCurrentThreadId
ExitProcess
MoveFileExW
GetFileInformationByHandle
AttachConsole
GetThreadLocale
GetLocaleInfoA
WideCharToMultiByte
GetModuleHandleW
FreeLibrary
GetVersion
CreateProcessA
CreateEventA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetShortPathNameW
GetCommandLineW
GetStdHandle
GetFileAttributesW
GetCurrentDirectoryW
TerminateProcess
GetSystemInfo
SetConsoleMode
GetConsoleMode
GetFileInformationByHandleEx
IsDebuggerPresent
GetFileType
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcessAffinityMask
GetNativeSystemInfo
GetCurrentProcess
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CloseHandle
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AllocConsole
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
RaiseException
GetComputerNameW
GetModuleHandleA
GetModuleFileNameW
VirtualQuery
GetWindowsDirectoryW
GetSystemDirectoryW
DebugBreak
LoadLibraryW
GetProcAddress
FormatMessageW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTempPathW
GetTempFileNameW
DeleteFileW
CreateFileW
LocalFree
GetCurrentProcessId
OpenMutexW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetLastError
PeekConsoleInputA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
LoadLibraryExW
EncodePointer
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetEndOfFile
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
SetFileAttributesW
FlushFileBuffers
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetConsoleCP
CreatePipe
CreateProcessW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
ReadConsoleW
HeapFree
HeapAlloc
HeapReAlloc
DecodePointer
GetFileSizeEx
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetStringTypeW
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetOEMCP
GetCommandLineA
GetProcessHeap
OutputDebugStringW
HeapSize
WriteConsoleW
GetTickCount
GetDiskFreeSpaceExW
GetVolumeInformationW
GetVolumePathNameW
GetModuleHandleExA
GetLogicalDrives
GetSystemDirectoryA
GetLongPathNameW
ReadDirectoryChangesW
GetDriveTypeA
GetFileSize

user32

PeekMessageA
MessageBoxA
FillRect
IsWindow
MsgWaitForMultipleObjectsEx
ReleaseDC
GetDC
SystemParametersInfoA
PostMessageA
LoadStringW

gdi32

Polyline
StretchDIBits
CreateSolidBrush
GetDeviceCaps
GdiFlush
CreateDIBSection
GetWorldTransform
Rectangle
SelectClipRgn
IntersectClipRect
GetClipRgn
GetClipBox
ExtCreateRegion
CreateRectRgn
CreateCompatibleBitmap
BitBlt
ExtTextOutW
GetObjectW
ModifyWorldTransform
SetWorldTransform
GetTextMetricsA
SetTextAlign
SetTextColor
SetMapMode
SetGraphicsMode
SetBkMode
SelectObject
SaveDC
RestoreDC
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsA
GetGlyphOutlineW
GetFontData
GetCharWidth32A
DeleteObject
DeleteDC
CreateFontIndirectW
CreateCompatibleDC
GetStockObject
GetGlyphOutlineA
CreatePen
CreateDCA
EnumFontFamiliesExW
ExtSelectClipRgn
GetGraphicsMode
CreateFontIndirectA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
LookupAccountSidW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
GetFileSecurityW
GetSecurityDescriptorOwner
RegLoadMUIStringW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
GetUserNameW
BuildExplicitAccessWithNameW
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
GetSecurityDescriptorGroup

ws2_32

ioctlsocket
closesocket
WSAStartup
getsockopt
recv
send
WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSASetEvent
getservbyport
getservbyname
inet_pton
inet_ntop
htonl
htons
inet_addr
inet_ntoa
ntohs
gethostbyaddr
gethostbyname
WSASetLastError

dnsapi

DnsFree
DnsQuery_A

iphlpapi

NotifyRouteChange2
CancelMibChangeNotify2
GetIpForwardTable2

Exports

Exports

ImageMagickEx_FreePNGBuffer
ImageMagickEx_SVGToPNGBuffer
ImageMagickEx_SVGToPNGBufferByDpi

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupFlash.swf
$PLUGINSDIR/SetupLib.dll
.dll windows:6 windows x86 arch:x86

1c326b518f92a7bcf049e8fa323b3174

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:0a:e3:2f:a6:77:68:fb:3b:05:60:30:ea:99:60:ca:e9:97:76:dd:11:1f:2a:a1:86:26:9b:86:f4:f7:d7:fb
Signer

Actual PE Digest

43:0a:e3:2f:a6:77:68:fb:3b:05:60:30:ea:99:60:ca:e9:97:76:dd:11:1f:2a:a1:86:26:9b:86:f4:f7:d7:fb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SetupLib.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wininet

HttpAddRequestHeadersW
HttpOpenRequestA
InternetReadFile
InternetConnectA
InternetCloseHandle
HttpSendRequestExW
HttpEndRequestW
InternetOpenW
InternetCrackUrlA
InternetErrorDlg
HttpAddRequestHeadersA
InternetSetOptionW
InternetQueryOptionW
InternetWriteFile

shlwapi

StrRetToBufW
SHDeleteKeyW
StrToIntW
PathFileExistsW
PathMatchSpecW

shell32

ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetDesktopFolder
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHGetKnownFolderPath
SHFileOperationW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

advapi32

BuildExplicitAccessWithNameW
CryptEncrypt
CryptImportKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
SystemFunction036
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
GetTokenInformation
RegDeleteValueW
LookupAccountSidW
LookupAccountNameW
AddAccessAllowedAce
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
GetFileSecurityW
AddAce
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
EqualSid
GetAce
GetAclInformation
SetFileSecurityW
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegOpenKeyW
ConvertSidToStringSidW
RegCreateKeyW
RegLoadKeyW
RegUnLoadKeyW
OpenProcessToken
RegEnumKeyExW
RegSaveKeyW
RegFlushKey
RegQueryInfoKeyW
RegEnumKeyW
AdjustTokenPrivileges
CryptSetKeyParam

kernel32

CreateProcessW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
GetTickCount
GetExitCodeProcess
Sleep
DeleteFileW
Process32FirstW
GlobalAlloc
LockResource
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
UnmapViewOfFile
GetSystemDirectoryW
GetCurrentThreadId
CreateFileW
WaitForSingleObject
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
EnterCriticalSection
SizeofResource
ReadFile
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
GetModuleFileNameW
GetTempPathW
LoadLibraryExW
GetEnvironmentVariableW
GlobalHandle
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
InitOnceComplete
InitOnceBeginInitialize
GetNativeSystemInfo
CreateFileMappingA
DebugBreak
FreeLibrary
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
MoveFileExW
GetProcAddress
DecodePointer
FindResourceW
lstrcpyW
lstrcatW
WaitNamedPipeW
SetNamedPipeHandleState
CreateFileA
OutputDebugStringA
LoadResource
FindResourceExW
RaiseException
CreateIoCompletionPort
PostQueuedCompletionStatus
GetCurrentProcessId
GetQueuedCompletionStatus
SetThreadContext
GetThreadContext
SuspendThread
VirtualQuery
VirtualProtect
HeapAlloc
LoadLibraryW
OutputDebugStringW
GetLastError
LocalAlloc
FindClose
lstrlenA
InitializeCriticalSectionAndSpinCount
lstrlenW
FindNextFileW
GetFullPathNameW
SetLastError
HeapFree
FindFirstFileW
RtlCaptureStackBackTrace
GetLongPathNameW
CloseHandle
LocalFree
GlobalFree
TransactNamedPipe
GetCommandLineW
TerminateThread
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
QueryDosDeviceW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetLogicalDriveStringsW
FileTimeToSystemTime
GlobalLock
GetTempFileNameW
GlobalUnlock
CreateDirectoryW
GetProcessId
GetFileAttributesExW
SystemTimeToFileTime
CopyFileW
GetFileTime
WriteFile
SetFilePointer
DuplicateHandle
ExitThread
CreateEventW
FormatMessageW
CreateThread
GetFileSize
OpenMutexW
CreateMutexW
ReleaseMutex
GetVersionExW
OpenFileMappingW
GetWindowsDirectoryW
FlushFileBuffers
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
VirtualFree
VirtualAlloc
GetCurrentThread
GetExitCodeThread
SetThreadPriority
lstrcmpiW
GetDiskFreeSpaceExW
OpenEventW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
FormatMessageA
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
SetConsoleCtrlHandler
GetFileSizeEx
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleOutputCP
SetEndOfFile
WriteConsoleW
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
GetLocalTime
GetSystemInfo
GetCurrentDirectoryW

user32

ClientToScreen
PtInRect
OffsetRect
ExitWindowsEx
SetCursor
GetProcessWindowStation
PostQuitMessage
wvsprintfW
GetMessageW
SetActiveWindow
SetRect
SetFocus
IsIconic
DestroyWindow
GetUserObjectInformationW
SetForegroundWindow
GetParent
GetPropW
FindWindowW
MessageBoxIndirectW
SystemParametersInfoW
GetDesktopWindow
NotifyWinEvent
IsWindowEnabled
GetForegroundWindow
AttachThreadInput
GetMonitorInfoW
ShowWindow
CharNextW
LoadStringW
UnregisterClassW
DestroyIcon
EndPaint
BeginPaint
InvalidateRect
LoadImageW
SetWindowLongW
CopyRect
SetTimer
FillRect
GetWindowRect
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetClassInfoExW
UnloadKeyboardLayout
GetClientRect
LoadCursorW
LoadKeyboardLayoutW
GetKeyboardLayoutList
IsWindow
RegisterClassExW
SendMessageW
CreateWindowExW
MessageBoxW
FindWindowExW
GetWindowTextW
RegisterWindowMessageW
SubtractRect
IntersectRect
GetMessagePos
GetFocus
UpdateLayeredWindow
DrawTextW
LoadIconW
SetParent
DispatchMessageW
GetKeyState
InsertMenuItemW
ScreenToClient
CreatePopupMenu
GetWindowPlacement
TrackPopupMenu
SetMenuItemInfoW
TrackMouseEvent
DestroyMenu
SetPropW
SetCapture
AppendMenuW
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
WindowFromPoint
SetRectEmpty
MoveWindow
ReleaseCapture
GetWindowThreadProcessId
GetCursorPos
WaitMessage
CallMsgFilterW
GetQueueStatus
EnableWindow
KillTimer
SetWindowTextW
GetWindowTextLengthW
GetDlgItem
wsprintfW
MonitorFromPoint
GetDC
IsWindowVisible
SetWindowPos
MonitorFromWindow
GetSystemMetrics
DeleteMenu
GetMenuItemInfoW
GetSystemMenu
PostMessageW
SendMessageTimeoutW
GetMenuItemCount
ReleaseDC

gdi32

CreateDIBSection
SetViewportOrgEx
GetTextExtentExPointW
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
DeleteDC
DeleteObject
SetTextCharacterExtra
SetBkMode
SetTextColor
GetObjectW
GetStockObject
CreateFontIndirectW
GetFontData

ole32

CoTaskMemFree
OleSetContainedObject
OleCreate
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysFreeString
VariantClear

imm32

ImmDisableIME
ImmGetIMEFileNameW
ImmInstallIMEW
ImmGetContext
ImmNotifyIME
ImmSetOpenStatus

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

msimg32

AlphaBlend

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty

wldap32

ord41
ord22
ord60
ord301
ord200
ord211
ord46
ord30
ord79
ord35
ord26
ord27
ord33
ord32
ord50
ord143
ord217

bcrypt

BCryptGenRandom

winhttp

WinHttpSetOption
WinHttpQueryOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpOpen
WinHttpWriteData
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpConnect
WinHttpCrackUrl

ws2_32

htonl
listen
recv
getaddrinfo
freeaddrinfo
connect
sendto
getpeername
ioctlsocket
gethostname
bind
accept
select
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
__WSAFDIsSet
socket
getsockname
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
setsockopt
WSAIoctl
recvfrom
htons
closesocket
WSAWaitForMultipleEvents

oleacc

AccessibleObjectFromWindow
LresultFromObject

winmm

timeGetTime

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
BackupExe
BackupOtherFile
BackupSysDict
CancelDelayDelDir
CancleDelayDelDirWrap
CheckAccess
CheckInDelayDir
CheckRegKeyIsVolatile
CmpFile
CopyRegToArm32
CorrectSmartInfoUsed
CreateSmartInfoUid
CreateSogouInputUid
DefaultBrowserIsIE
DelBackupExe
DelayDelFile
DelayDelReg
DelayDeleteSogouImeFile
DeleteShortcut
DeleteShortcutWithPath
DeleteVolatileRegKey
DownloadQuiet
ExecWait
FilterSid
GetAppDataPath
GetArm32SysPath
GetBDInfo
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetFinishIds
GetFinishStats
GetHWID
GetHandleVerifier
GetHwndImage
GetHwndMain
GetImeInstallMutex
GetInstallPath
GetOSVersionTime
GetPPName
GetQQStatistics
GetRealOsVersion
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstSuccessUserNetSchedule
InstallIME
InstalledIMEIsPre30b1
IsArmArch
IsFinishCheckBoxShow
IsFinishCloseBtnClicked
IsFullScreenActivated
IsInWin8
IsInX64
IsInXP
IsReadScreenEnable
IsRecommendTimeout
IsShowOpenMedal
IsSmartInfoEnable
IsSogouExplorerInstalled
IsSogouMobileInstalled
KillProcess
MonitorUninstallCompleted
MonitorVerifyUninstallSelect
MoveImeDir
MoveUrlGuideIcon
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
ReadSmartInfoOption
RemoveAppDataDir
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SaveInstallTime
SetAccessRights
SetCheckBoxState
SetGuideQQUrl
SetLowLabel
SetMutex
SetPathAccessRightsRecursive
SetQQShowType
SetReboot
SetRecommendTime
SetShowQQ
SetSmartInfoOption
SetUrlInvite
SetWithType
ShowQQOrNot
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
WaitAccountThread

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupLibNew.dll
.dll windows:6 windows x86 arch:x86

52e7b9435bfea29a22a84cc10de490ad

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:a2:46:57:56:57:c9:4f:fc:b3:bd:84:d3:0e:04:1d:1f:b5:4c:c1:02:f9:58:75:9a:00:aa:e2:4c:2b:7e:8c
Signer

Actual PE Digest

15:a2:46:57:56:57:c9:4f:fc:b3:bd:84:d3:0e:04:1d:1f:b5:4c:c1:02:f9:58:75:9a:00:aa:e2:4c:2b:7e:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SetupLibNew.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wininet

InternetReadFile
InternetCloseHandle
HttpSendRequestExW
InternetErrorDlg
InternetSetOptionW
HttpAddRequestHeadersA
InternetQueryOptionW
HttpEndRequestW
InternetOpenW
InternetCrackUrlA
InternetWriteFile
HttpOpenRequestA
InternetConnectA
HttpAddRequestHeadersW

shlwapi

StrRetToBufW
SHDeleteKeyW
StrToIntW
PathFileExistsW

shell32

SHFileOperationW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW
ShellExecuteW
SHGetDesktopFolder
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetFolderPathW

kernel32

Sleep
GetExitCodeProcess
MoveFileW
GetTickCount
MapViewOfFile
CreateFileMappingW
WideCharToMultiByte
CreateProcessW
GetCurrentProcessId
MoveFileExW
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
GlobalFree
Process32FirstW
GlobalAlloc
LockResource
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
UnmapViewOfFile
GetSystemDirectoryW
GetCurrentThreadId
CreateFileW
WaitForSingleObject
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
EnterCriticalSection
SizeofResource
ReadFile
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
GetModuleFileNameW
ConvertFiberToThread
DeleteFiber
lstrcpyW
lstrcpynW
lstrcmpiW
FreeResource
GetCurrentDirectoryW
VerifyVersionInfoW
GetTempPathW
GetModuleHandleA
LoadLibraryExW
GetEnvironmentVariableW
VerSetConditionMask
LoadLibraryA
LocalFileTimeToFileTime
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetThreadPriority
DebugBreak
FreeLibrary
GetModuleHandleW
WriteConsoleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
VirtualQuery
SetThreadContext
GetThreadContext
GetCommandLineW
TerminateThread
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
QueryDosDeviceW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetLogicalDriveStringsW
FileTimeToSystemTime
GlobalLock
GlobalUnlock
CreateDirectoryW
SetFileTime
SystemTimeToFileTime
CopyFileW
GetFileTime
WriteFile
SetFilePointer
ExitThread
CreateEventW
FormatMessageW
CreateThread
GetFileSize
OpenMutexW
CreateMutexW
ReadConsoleA
GetVersionExW
OpenFileMappingW
GetWindowsDirectoryW
FlushFileBuffers
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
VirtualFree
VirtualAlloc
GetTickCount64
GetLocalTime
IsProcessorFeaturePresent
PeekNamedPipe
GetCurrentThread
MulDiv
GetDiskFreeSpaceExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
GetStringTypeW
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
LoadLibraryExA
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
SystemTimeToTzSpecificLocalTime
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
SetConsoleCtrlHandler
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
SetEndOfFile
WriteConsoleW
SuspendThread
VirtualProtect
DeleteFileW
ReleaseMutex
SetConsoleMode
GetProcessHeap
DeleteCriticalSection
LocalFree
GetProcAddress
DecodePointer
HeapAlloc
LoadLibraryW
OutputDebugStringW
GetLastError
LocalAlloc
FindClose
lstrlenA
InitializeCriticalSectionAndSpinCount
lstrlenW
FindNextFileW
GetFullPathNameW
SetLastError
HeapFree
FindFirstFileW
GetSystemInfo
GetDriveTypeW
GetFileInformationByHandle
GetStdHandle

user32

LoadIconW
GetClassInfoW
RemovePropW
DestroyWindow
SetWindowPos
GetDC
MonitorFromWindow
GetSystemMetrics
ShowWindow
GetMonitorInfoW
MonitorFromPoint
GetWindowThreadProcessId
GetGUIThreadInfo
RegisterClassW
GetPropW
CharNextW
LoadStringW
SetRectEmpty
DestroyIcon
EndPaint
BeginPaint
SetFocus
LoadImageW
SetWindowLongW
CopyRect
SetTimer
FillRect
GetWindowRect
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetClassInfoExW
UnloadKeyboardLayout
SetPropW
MsgWaitForMultipleObjects
IsWindowVisible
GetUserObjectInformationW
GetDesktopWindow
SystemParametersInfoW
GetParent
SetForegroundWindow
IsIconic
ReleaseDC
GetProcessWindowStation
ClientToScreen
IsWindowEnabled
IntersectRect
SetCursor
ReplyMessage
GetClientRect
DispatchMessageW
PeekMessageW
LoadCursorW
LoadKeyboardLayoutW
GetKeyboardLayoutList
IsWindow
PtInRect
RegisterClassExW
MessageBoxIndirectW
InvalidateRect
SendMessageW
CreateWindowExW
MessageBoxW
SetParent
MsgWaitForMultipleObjectsEx
TranslateMessage
UnregisterClassW
WindowFromPoint
FindWindowExW
GetWindowTextW
EnableWindow
KillTimer
SetWindowTextW
GetWindowTextLengthW
GetMenuItemInfoW
GetSystemMenu
PostQuitMessage
GetQueueStatus
CallMsgFilterW
WaitMessage
GetMessageW
IsZoomed
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetUpdateRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
UnionRect
OffsetRect
IsRectEmpty
GetWindow
NotifyWinEvent
GetWindowPlacement
CreatePopupMenu
AppendMenuW
TrackPopupMenu
InsertMenuItemW
SetMenuItemInfoW
SetWindowRgn
EqualRect
GetMenu
AdjustWindowRectEx
InflateRect
CharPrevW
DrawTextW
SetRect
UpdateLayeredWindow
MoveWindow
GetWindowRgn
DestroyMenu
EnableMenuItem
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
UpdateWindow
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
PostMessageW
SendMessageTimeoutW
GetMenuItemCount
DeleteMenu
wsprintfW
GetDlgItem

gdi32

GetDeviceCaps
SelectObject
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
StretchBlt
DeleteDC
SetViewportOrgEx
PtInRegion
CreateDCW
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
CreateRectRgn
CreatePatternBrush
GdiFlush
TextOutW
MoveToEx
SetTextColor
DeleteObject
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetDIBits
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetFontData
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
SetStretchBltMode

advapi32

GetSecurityDescriptorSacl
GetLengthSid
GetTokenInformation
RegDeleteValueW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
LookupAccountSidW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
SetSecurityDescriptorDacl
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
LookupAccountNameW
RegOpenKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyW
RegQueryInfoKeyW
RegFlushKey
RegSaveKeyW
RegEnumKeyExW
OpenProcessToken
RegUnLoadKeyW
RegLoadKeyW
RegCreateKeyW
ConvertSidToStringSidW

ole32

CoInitializeEx
CoTaskMemFree
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoSetProxyBlanket
CreateStreamOnHGlobal
OleDuplicateData
DoDragDrop
CoUninitialize
CoCreateInstance
CoCreateGuid
CoInitialize
ReleaseStgMedium
CoInitializeSecurity

oleaut32

SysAllocString
SysStringLen
SysFreeString
VariantInit
VariantClear

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

imm32

ImmGetIMEFileNameW
ImmDisableIME
ImmNotifyIME
ImmSetOpenStatus
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmInstallIMEW

psapi

GetModuleFileNameExW

msimg32

AlphaBlend

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

winmm

timeKillEvent
timeSetEvent
timeGetTime

winhttp

WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpWriteData
WinHttpReadData
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpCrackUrl
WinHttpReceiveResponse

ws2_32

gethostbyname
gethostname
WSAStartup
closesocket
WSASetLastError
send
recv
WSAGetLastError
WSACleanup

oleacc

LresultFromObject

crypt32

CertOpenStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore

imagemagik

ImageMagickEx_FreePNGBuffer
ImageMagickEx_SVGToPNGBufferByDpi

bcrypt

BCryptGenRandom

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
CancelDelayDelDir
CancleDelayDelDirWrap
CheckAccess
CheckInDelayDir
CheckProcessIsRunning
CheckRegKeyIsVolatile
CmpFile
CopyRegToArm32
CorrectSmartInfoUsed
CreateSmartInfoUid
CreateSogouInputUid
DefaultBrowserIsIE
DelayDelFile
DelayDelReg
DelayDeleteSogouImeFile
DelayTakeEffectDark
DeleteShortcut
DeleteShortcutWithPath
DeleteVolatileRegKey
ExecWait
FilterSid
GetAppDataPath
GetArm32SysPath
GetBDInfo
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetFinishIds
GetFinishStats
GetHWID
GetHwndImage
GetHwndMain
GetImeInstallMutex
GetInstallPath
GetOSVersionTime
GetPPName
GetQQStatistics
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstSuccessUserNetSchedule
InstallIME
InstalledIMEIsPre30b1
IsArmArch
IsBeforeWin10
IsFinishCheckBoxShow
IsFinishCloseBtnClicked
IsFullScreenActivated
IsInWin8
IsInX64
IsInXP
IsReadScreenEnable
IsRecommendTimeout
IsShowOpenMedal
IsSmartInfoEnable
IsSogouExplorerInstalled
IsSogouMobileInstalled
KillProcess
MonitorUninstallCompleted
MonitorVerifyUninstallSelect
MoveImeDir
MoveUrlGuideIcon
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
ReadSmartInfoOption
RegisterPluginUnloadCallback
RemoveAppDataDir
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SaveInstallTime
SendInstallInfo2Beacon
SetCheckBoxState
SetGuideQQUrl
SetLowLabel
SetMutex
SetPingbackCommonParam
SetQQShowType
SetReboot
SetRecommendTime
SetShowQQ
SetSmartInfoOption
SetUrlInvite
SetWithType
ShowQQOrNot
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
WaitAccountThread

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 739KB - Virtual size: 739KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupUi.cupf
$PLUGINSDIR/SogouPY.ime
.dll windows:6 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 7.8MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 254KB - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 634KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 385KB - Virtual size: 384KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/setuppage.zip
.zip
font.xml
img/bg_hole.png
.png
img/browseclick.svg
img/browsedisable.svg
img/browsehover.svg
img/browsenormal.svg
img/buttoninstallclick.svg
img/buttoninstalldisable.svg
img/buttoninstallhover.svg
img/buttoninstallnormal.svg
img/closeclick.svg
img/closedisable.svg
img/closehover.svg
img/closenormal.svg
img/closenormalclick.svg
img/closenormaldisable.svg
img/closenormalhover.svg
img/closenormalnormal.svg
img/customizebuttonclick.svg
img/customizebuttondisable.svg
img/customizebuttonhover.svg
img/customizebuttonnormal.svg
img/filebg.svg
img/gouxuanselected.svg
img/icon.svg
img/installbg1.svg
img/installbg2.svg
img/installfinish.svg
img/installfinish_no_yyb.svg
img/itemuse_hover.svg
.xml
img/itemuse_normal.svg
.xml
img/itemuse_push.svg
.xml
img/logo_bg_1.png
.png
img/logo_bg_1.svg
.xml
img/miniclick.svg
img/minidisable.svg
img/minihover.svg
img/mininormal.svg
img/miniprogressclick.svg
img/miniprogressdisable.svg
img/miniprogresshover.svg
img/miniprogressnormal.svg
img/packupclick.svg
img/packupdisable.svg
img/packuphover.svg
img/packupnormal.svg
img/pathinputactive.svg
img/pathinputdisable.svg
img/pathinputhover.svg
img/pathinputnormal.svg
img/popup_close_disable.svg
.xml
img/popup_close_hover.svg
.xml
img/popup_close_normal.svg
.xml
img/popup_close_push.svg
.xml
img/popup_ok_hover.svg
.xml
img/popup_ok_normal.svg
.xml
img/popup_ok_push.svg
.xml
img/process.svg
img/progressbar.svg
img/search_suggest_tip_hover.svg
img/search_suggest_tip_normal.svg
img/search_suggest_tips_bak.svg
img/slideshow/1.svg
img/slideshow/2.svg
img/slideshow/3.svg
img/slideshow/4.svg
.xml
img/slideshow/5.svg
img/slideshow/6.svg
img/tipsbg.svg
img/ungouxuanclick.svg
img/ungouxuanhover.svg
img/ungouxuannormal.svg
img/warning_popup_icon.svg
.xml
searchsuggesttips.xml
setuppage.xml
slideshow.xml
sogoumessage.xml
style.xml
$_15_/HWSignature.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a
Signer

Actual PE Digest

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14.1.0.8858/HWSignature.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a
Signer

Actual PE Digest

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14.1.0.8858/ImageMagik.dll
.dll windows:6 windows x86 arch:x86

f204f2299a0324f196a8576faef59e72

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3
Signer

Actual PE Digest

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\data\landun\workspace\p-a6b81373d56245738becf19644b9638b\src\third_party_build\imagemagick\tmp\x86\RelWithDebInfo\ImageMagik.pdb

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeProcess
GetSystemTimeAsFileTime
GetConsoleOutputCP
LoadLibraryA
MultiByteToWideChar
IsValidCodePage
GetACP
GetCPInfo
IsDBCSLeadByteEx
ReadFile
WriteFile
PeekNamedPipe
SetEvent
ResetEvent
ReadConsoleInputA
DeviceIoControl
DuplicateHandle
GetConsoleWindow
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventW
WaitForMultipleObjects
GetExitCodeThread
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
GetCurrentThreadId
ExitProcess
MoveFileExW
GetFileInformationByHandle
AttachConsole
GetThreadLocale
GetLocaleInfoA
WideCharToMultiByte
GetModuleHandleW
FreeLibrary
GetVersion
CreateProcessA
CreateEventA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetShortPathNameW
GetCommandLineW
GetStdHandle
GetFileAttributesW
GetCurrentDirectoryW
TerminateProcess
GetSystemInfo
SetConsoleMode
GetConsoleMode
GetFileInformationByHandleEx
IsDebuggerPresent
GetFileType
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcessAffinityMask
GetNativeSystemInfo
GetCurrentProcess
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CloseHandle
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AllocConsole
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
RaiseException
GetComputerNameW
GetModuleHandleA
GetModuleFileNameW
VirtualQuery
GetWindowsDirectoryW
GetSystemDirectoryW
DebugBreak
LoadLibraryW
GetProcAddress
FormatMessageW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTempPathW
GetTempFileNameW
DeleteFileW
CreateFileW
LocalFree
GetCurrentProcessId
OpenMutexW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetLastError
PeekConsoleInputA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
LoadLibraryExW
EncodePointer
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetEndOfFile
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
SetFileAttributesW
FlushFileBuffers
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetConsoleCP
CreatePipe
CreateProcessW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
ReadConsoleW
HeapFree
HeapAlloc
HeapReAlloc
DecodePointer
GetFileSizeEx
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetStringTypeW
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetOEMCP
GetCommandLineA
GetProcessHeap
OutputDebugStringW
HeapSize
WriteConsoleW
GetTickCount
GetDiskFreeSpaceExW
GetVolumeInformationW
GetVolumePathNameW
GetModuleHandleExA
GetLogicalDrives
GetSystemDirectoryA
GetLongPathNameW
ReadDirectoryChangesW
GetDriveTypeA
GetFileSize

user32

PeekMessageA
MessageBoxA
FillRect
IsWindow
MsgWaitForMultipleObjectsEx
ReleaseDC
GetDC
SystemParametersInfoA
PostMessageA
LoadStringW

gdi32

Polyline
StretchDIBits
CreateSolidBrush
GetDeviceCaps
GdiFlush
CreateDIBSection
GetWorldTransform
Rectangle
SelectClipRgn
IntersectClipRect
GetClipRgn
GetClipBox
ExtCreateRegion
CreateRectRgn
CreateCompatibleBitmap
BitBlt
ExtTextOutW
GetObjectW
ModifyWorldTransform
SetWorldTransform
GetTextMetricsA
SetTextAlign
SetTextColor
SetMapMode
SetGraphicsMode
SetBkMode
SelectObject
SaveDC
RestoreDC
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsA
GetGlyphOutlineW
GetFontData
GetCharWidth32A
DeleteObject
DeleteDC
CreateFontIndirectW
CreateCompatibleDC
GetStockObject
GetGlyphOutlineA
CreatePen
CreateDCA
EnumFontFamiliesExW
ExtSelectClipRgn
GetGraphicsMode
CreateFontIndirectA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
LookupAccountSidW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
GetFileSecurityW
GetSecurityDescriptorOwner
RegLoadMUIStringW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
GetUserNameW
BuildExplicitAccessWithNameW
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
GetSecurityDescriptorGroup

ws2_32

ioctlsocket
closesocket
WSAStartup
getsockopt
recv
send
WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSASetEvent
getservbyport
getservbyname
inet_pton
inet_ntop
htonl
htons
inet_addr
inet_ntoa
ntohs
gethostbyaddr
gethostbyname
WSASetLastError

dnsapi

DnsFree
DnsQuery_A

iphlpapi

NotifyRouteChange2
CancelMibChangeNotify2
GetIpForwardTable2

Exports

Exports

ImageMagickEx_FreePNGBuffer
ImageMagickEx_SVGToPNGBuffer
ImageMagickEx_SVGToPNGBufferByDpi

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14.1.0.8858/SetupUi.cupf
SogouExe/HWSignatureEx.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25/05/2021, 00:00

Not After

21/08/2024, 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a
Signer

Actual PE Digest

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.7MB

UPX1 Size: 23KB - Virtual size: 24KB

.rsrc Size: 133KB - Virtual size: 136KB

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

version

kernel32

user32

Exports

Exports

Sections

.text Size: 89KB - Virtual size: 89KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 2KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

f204f2299a0324f196a8576faef59e72

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

advapi32

ws2_32

dnsapi

iphlpapi

Exports

Exports

Sections

UPX0
Size: - Virtual size: 2.7MB

UPX1
Size: 23KB - Virtual size: 24KB

.rsrc
Size: 133KB - Virtual size: 136KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

ed:53:ea:a1:c0:b3:61:71:e8:66:62:c3:65:d8:9a:ba:e3:14:06:7e:ec:c3:2f:70:15:02:01:b9:8c:8f:5f:0a
Signer

.text
Size: 89KB - Virtual size: 89KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3
Signer

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 14KB - Virtual size: 30KB

.idata
Size: 10KB - Virtual size: 10KB

.tls
Size: 1KB - Virtual size: 1KB

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 138KB - Virtual size: 138KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

43:0a:e3:2f:a6:77:68:fb:3b:05:60:30:ea:99:60:ca:e9:97:76:dd:11:1f:2a:a1:86:26:9b:86:f4:f7:d7:fb
Signer