sogou_pinyin_guanwang[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

sogou_pinyin_guanwang.exe
Size

140.9MB
MD5

0bea38038c6ca7a2e4a516474c94baa0
SHA1

844f9e9bb72038ef9ee1c48c83ab47080b8f11f3
SHA256

cabb8566e3429886d15e9ff914808f5188540fa91335051533e37afbeb92c127
SHA512

217f34ba3635d1385937ed52d254c85d3f097d49633530b8d2611b2e9afe408bc4d7381c64eb2d0ce53cec7f1bcd82d58e28d89f58eec4850d91d7099581cc63
SSDEEP

3145728:crG637IKRmCHQIWpw6mG6TOAKSPFR5OPC99BVxwqOBE:MUUcw6mGDSPFROC9zFj

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/out.upx

Files

sogou_pinyin_guanwang.exe
.exe windows:5 windows x86 arch:x86

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e5:00:f1:9a:a5:54:d5:fd:cc:6c:10:64:a7:6f:b9:42:7e:a1:a4:a2:d7:4b:8b:36:5b:0d:f8:17:a3:ac:6e:e4
Signer

Actual PE Digest

e5:00:f1:9a:a5:54:d5:fd:cc:6c:10:64:a7:6f:b9:42:7e:a1:a4:a2:d7:4b:8b:36:5b:0d:f8:17:a3:ac:6e:e4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 2.7MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 133KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/HWSignature.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3
Signer

Actual PE Digest

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ImageMagik.dll
.dll windows:6 windows x86 arch:x86

f204f2299a0324f196a8576faef59e72

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3
Signer

Actual PE Digest

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\data\landun\workspace\p-a6b81373d56245738becf19644b9638b\src\third_party_build\imagemagick\tmp\x86\RelWithDebInfo\ImageMagik.pdb

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeProcess
GetSystemTimeAsFileTime
GetConsoleOutputCP
LoadLibraryA
MultiByteToWideChar
IsValidCodePage
GetACP
GetCPInfo
IsDBCSLeadByteEx
ReadFile
WriteFile
PeekNamedPipe
SetEvent
ResetEvent
ReadConsoleInputA
DeviceIoControl
DuplicateHandle
GetConsoleWindow
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventW
WaitForMultipleObjects
GetExitCodeThread
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
GetCurrentThreadId
ExitProcess
MoveFileExW
GetFileInformationByHandle
AttachConsole
GetThreadLocale
GetLocaleInfoA
WideCharToMultiByte
GetModuleHandleW
FreeLibrary
GetVersion
CreateProcessA
CreateEventA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetShortPathNameW
GetCommandLineW
GetStdHandle
GetFileAttributesW
GetCurrentDirectoryW
TerminateProcess
GetSystemInfo
SetConsoleMode
GetConsoleMode
GetFileInformationByHandleEx
IsDebuggerPresent
GetFileType
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcessAffinityMask
GetNativeSystemInfo
GetCurrentProcess
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CloseHandle
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AllocConsole
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
RaiseException
GetComputerNameW
GetModuleHandleA
GetModuleFileNameW
VirtualQuery
GetWindowsDirectoryW
GetSystemDirectoryW
DebugBreak
LoadLibraryW
GetProcAddress
FormatMessageW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTempPathW
GetTempFileNameW
DeleteFileW
CreateFileW
LocalFree
GetCurrentProcessId
OpenMutexW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetLastError
PeekConsoleInputA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
LoadLibraryExW
EncodePointer
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetEndOfFile
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
SetFileAttributesW
FlushFileBuffers
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetConsoleCP
CreatePipe
CreateProcessW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
ReadConsoleW
HeapFree
HeapAlloc
HeapReAlloc
DecodePointer
GetFileSizeEx
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetStringTypeW
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetOEMCP
GetCommandLineA
GetProcessHeap
OutputDebugStringW
HeapSize
WriteConsoleW
GetTickCount
GetDiskFreeSpaceExW
GetVolumeInformationW
GetVolumePathNameW
GetModuleHandleExA
GetLogicalDrives
GetSystemDirectoryA
GetLongPathNameW
ReadDirectoryChangesW
GetDriveTypeA
GetFileSize

user32

PeekMessageA
MessageBoxA
FillRect
IsWindow
MsgWaitForMultipleObjectsEx
ReleaseDC
GetDC
SystemParametersInfoA
PostMessageA
LoadStringW

gdi32

Polyline
StretchDIBits
CreateSolidBrush
GetDeviceCaps
GdiFlush
CreateDIBSection
GetWorldTransform
Rectangle
SelectClipRgn
IntersectClipRect
GetClipRgn
GetClipBox
ExtCreateRegion
CreateRectRgn
CreateCompatibleBitmap
BitBlt
ExtTextOutW
GetObjectW
ModifyWorldTransform
SetWorldTransform
GetTextMetricsA
SetTextAlign
SetTextColor
SetMapMode
SetGraphicsMode
SetBkMode
SelectObject
SaveDC
RestoreDC
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsA
GetGlyphOutlineW
GetFontData
GetCharWidth32A
DeleteObject
DeleteDC
CreateFontIndirectW
CreateCompatibleDC
GetStockObject
GetGlyphOutlineA
CreatePen
CreateDCA
EnumFontFamiliesExW
ExtSelectClipRgn
GetGraphicsMode
CreateFontIndirectA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
LookupAccountSidW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
GetFileSecurityW
GetSecurityDescriptorOwner
RegLoadMUIStringW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
GetUserNameW
BuildExplicitAccessWithNameW
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
GetSecurityDescriptorGroup

ws2_32

ioctlsocket
closesocket
WSAStartup
getsockopt
recv
send
WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSASetEvent
getservbyport
getservbyname
inet_pton
inet_ntop
htonl
htons
inet_addr
inet_ntoa
ntohs
gethostbyaddr
gethostbyname
WSASetLastError

dnsapi

DnsFree
DnsQuery_A

iphlpapi

NotifyRouteChange2
CancelMibChangeNotify2
GetIpForwardTable2

Exports

Exports

ImageMagickEx_FreePNGBuffer
ImageMagickEx_SVGToPNGBuffer
ImageMagickEx_SVGToPNGBufferByDpi

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupFlash.swf
$PLUGINSDIR/SetupLib.dll
.dll windows:6 windows x86 arch:x86

75f1f7c178111583982f278a1e2e112f

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:46:57:63:39:9a:4d:00:7c:be:e1:69:c0:b3:ec:0d:ce:b3:63:9c:f5:06:89:1e:56:dc:cb:01:3b:8a:dc:ae
Signer

Actual PE Digest

23:46:57:63:39:9a:4d:00:7c:be:e1:69:c0:b3:ec:0d:ce:b3:63:9c:f5:06:89:1e:56:dc:cb:01:3b:8a:dc:ae

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SetupLib.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wininet

InternetQueryOptionW
HttpOpenRequestA
InternetSetOptionW
HttpAddRequestHeadersA
InternetErrorDlg
HttpAddRequestHeadersW
InternetReadFile
InternetConnectA
InternetCloseHandle
HttpSendRequestExW
HttpEndRequestW
InternetOpenW
InternetCrackUrlA
InternetWriteFile

shlwapi

StrRetToBufW
SHDeleteKeyW
PathFileExistsW
StrToIntW
PathMatchSpecW

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetDesktopFolder
CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteW
SHFileOperationW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

advapi32

RegCreateKeyW
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptSetKeyParam
CryptEncrypt
CryptImportKey
SystemFunction036
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
GetTokenInformation
RegDeleteValueW
LookupAccountSidW
LookupAccountNameW
AddAccessAllowedAce
GetLengthSid
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
GetFileSecurityW
AddAce
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
EqualSid
GetAce
GetAclInformation
SetFileSecurityW
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
RegOpenKeyW
ConvertSidToStringSidW
CryptGetProvParam
RegLoadKeyW
RegUnLoadKeyW
OpenProcessToken
RegEnumKeyExW
RegSaveKeyW
RegFlushKey
RegQueryInfoKeyW
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW

kernel32

CreateProcessW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
GetTickCount
GetExitCodeProcess
Sleep
DeleteFileW
GlobalAlloc
LockResource
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
UnmapViewOfFile
GetSystemDirectoryW
GetCurrentThreadId
CreateFileW
VirtualProtect
VirtualQuery
OutputDebugStringA
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetLongPathNameW
GetNativeSystemInfo
RtlCaptureStackBackTrace
WaitForSingleObject
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
EnterCriticalSection
SizeofResource
MoveFileExW
HeapDestroy
HeapReAlloc
FindResourceW
HeapSize
InitializeCriticalSectionEx
GetModuleFileNameW
GetTempPathW
LoadLibraryExW
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
LoadResource
FindResourceExW
RaiseException
SuspendThread
GetCurrentProcessId
GetEnvironmentVariableW
DebugBreak
FreeLibrary
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
LocalFree
GetProcAddress
DecodePointer
HeapAlloc
GetThreadContext
SetThreadContext
LoadLibraryW
CreateFileA
CreateFileMappingA
OutputDebugStringW
GetLastError
LocalAlloc
FindClose
lstrlenA
InitializeCriticalSectionAndSpinCount
lstrlenW
FindNextFileW
GetFullPathNameW
SetLastError
HeapFree
FindFirstFileW
TransactNamedPipe
SetNamedPipeHandleState
WaitNamedPipeW
InitOnceBeginInitialize
InitOnceComplete
GetDriveTypeW
GlobalHandle
CloseHandle
GlobalFree
ReadFile
lstrcatW
lstrcpyW
GetCommandLineW
TerminateThread
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
QueryDosDeviceW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetLogicalDriveStringsW
FileTimeToSystemTime
GlobalLock
GetTempFileNameW
GlobalUnlock
CreateDirectoryW
GetProcessId
GetFileAttributesExW
SystemTimeToFileTime
CopyFileW
GetFileTime
WriteFile
SetFilePointer
DuplicateHandle
ExitThread
CreateEventW
FormatMessageW
CreateThread
GetFileSize
OpenMutexW
CreateMutexW
ReleaseMutex
GetVersionExW
OpenFileMappingW
GetWindowsDirectoryW
FlushFileBuffers
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
VirtualFree
VirtualAlloc
GetCurrentThread
GetExitCodeThread
SetThreadPriority
lstrcmpiW
GetDiskFreeSpaceExW
OpenEventW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
FormatMessageA
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetStringTypeW
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
Process32FirstW
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
SetConsoleCtrlHandler
GetFileSizeEx
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetConsoleOutputCP
SetEndOfFile
WriteConsoleW
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
PeekNamedPipe
WaitForMultipleObjects
SleepEx
VerSetConditionMask
VerifyVersionInfoW
SetConsoleMode
ReadConsoleA
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
GetLocalTime
GetSystemInfo
GetCurrentDirectoryW
ResumeThread

user32

ClientToScreen
PtInRect
OffsetRect
ExitWindowsEx
SetCursor
GetProcessWindowStation
GetUserObjectInformationW
wvsprintfW
InsertMenuItemW
GetKeyState
ScreenToClient
GetWindowThreadProcessId
DrawTextW
UpdateLayeredWindow
GetFocus
MonitorFromPoint
GetDC
IsWindowVisible
CreatePopupMenu
GetWindowPlacement
IsWindowEnabled
GetMessageW
SetWindowPos
TrackPopupMenu
SetMenuItemInfoW
TrackMouseEvent
DestroyMenu
SetPropW
SetCapture
AppendMenuW
ReleaseCapture
GetCursorPos
WaitMessage
CallMsgFilterW
GetQueueStatus
GetMessagePos
SubtractRect
RegisterWindowMessageW
SetFocus
FindWindowW
MessageBoxIndirectW
LoadIconW
SetParent
SetActiveWindow
MonitorFromWindow
DispatchMessageW
ShowWindow
SetRect
GetMonitorInfoW
AttachThreadInput
GetForegroundWindow
GetMenuItemInfoW
GetSystemMenu
PostMessageW
SendMessageTimeoutW
GetMenuItemCount
DeleteMenu
wsprintfW
GetDlgItem
GetWindowTextLengthW
SetWindowTextW
KillTimer
EnableWindow
GetWindowTextW
FindWindowExW
MessageBoxW
CreateWindowExW
SendMessageW
RegisterClassExW
IsWindow
GetKeyboardLayoutList
PeekMessageW
LoadKeyboardLayoutW
LoadCursorW
GetClientRect
UnloadKeyboardLayout
GetClassInfoExW
GetWindowLongW
DefWindowProcW
CallWindowProcW
GetWindowRect
FillRect
SetTimer
CopyRect
SetWindowLongW
LoadImageW
InvalidateRect
BeginPaint
EndPaint
DestroyIcon
UnregisterClassW
LoadStringW
CharNextW
DestroyWindow
MsgWaitForMultipleObjectsEx
TranslateMessage
WindowFromPoint
SetRectEmpty
PostQuitMessage
GetPropW
NotifyWinEvent
MoveWindow
GetDesktopWindow
SystemParametersInfoW
GetParent
SetForegroundWindow
IsIconic
GetSystemMetrics
IntersectRect
ReleaseDC

gdi32

CreateFontIndirectW
GetFontData
BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
StretchBlt
DeleteDC
SetViewportOrgEx
DeleteObject
GetStockObject
GetObjectW
SetTextColor
SetBkMode
SetTextCharacterExtra
GetTextExtentExPointW
CreateDIBSection

ole32

OleCreate
OleSetContainedObject
CoTaskMemFree
CoUninitialize
CoCreateGuid
CoInitialize
CoCreateInstance

oleaut32

SysAllocStringByteLen
SysStringLen
SysAllocString
VariantInit
SysFreeString
SysStringByteLen
VariantClear

imm32

ImmDisableIME
ImmGetIMEFileNameW
ImmInstallIMEW
ImmGetContext
ImmSetOpenStatus
ImmNotifyIME

psapi

GetModuleFileNameExW
GetProcessMemoryInfo

msimg32

AlphaBlend

crypt32

CertOpenStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreA
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore

wldap32

ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217

bcrypt

BCryptGenRandom

winhttp

WinHttpQueryOption
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpAddRequestHeaders
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpSetOption
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpWriteData
WinHttpCloseHandle

ws2_32

WSAIoctl
__WSAFDIsSet
select
gethostname
socket
htons
setsockopt
WSACleanup
WSAStartup
WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
getsockopt
send
WSACloseEvent
WSACreateEvent
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
sendto
ioctlsocket
getpeername

oleacc

AccessibleObjectFromWindow
LresultFromObject

winmm

timeGetTime

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
BackupExe
BackupOtherFile
BackupSysDict
CancelDelayDelDir
CancleDelayDelDirWrap
CheckAccess
CheckInDelayDir
CheckRegKeyIsVolatile
CmpFile
CopyRegToArm32
CorrectSmartInfoUsed
CreateSmartInfoUid
CreateSogouInputUid
DefaultBrowserIsIE
DelBackupExe
DelayDelFile
DelayDelReg
DelayDeleteSogouImeFile
DeleteShortcut
DeleteShortcutWithPath
DeleteVolatileRegKey
DownloadQuiet
ExecWait
FilterSid
GetAppDataPath
GetArm32SysPath
GetBDInfo
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetFinishIds
GetFinishStats
GetHWID
GetHandleVerifier
GetHwndImage
GetHwndMain
GetImeInstallMutex
GetInstallPath
GetOSVersionTime
GetPPName
GetQQStatistics
GetRealOsVersion
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstSuccessUserNetSchedule
InstallIME
InstalledIMEIsPre30b1
IsArmArch
IsFinishCheckBoxShow
IsFinishCloseBtnClicked
IsFullScreenActivated
IsInWin8
IsInX64
IsInXP
IsReadScreenEnable
IsRecommendTimeout
IsShowOpenMedal
IsSmartInfoEnable
IsSogouExplorerInstalled
IsSogouMobileInstalled
KillProcess
MonitorUninstallCompleted
MonitorVerifyUninstallSelect
MoveImeDir
MoveUrlGuideIcon
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
ReadSmartInfoOption
RemoveAppDataDir
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SaveInstallTime
SetAccessRights
SetCheckBoxState
SetGuideQQUrl
SetLowLabel
SetMutex
SetPathAccessRightsRecursive
SetQQShowType
SetReboot
SetRecommendTime
SetShowQQ
SetSmartInfoOption
SetUrlInvite
SetWithType
ShowQQOrNot
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
WaitAccountThread

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 123KB - Virtual size: 295KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupLibNew.dll
.dll windows:6 windows x86 arch:x86

52e7b9435bfea29a22a84cc10de490ad

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:8f:97:54:d6:64:d1:f9:d1:c6:d3:05:85:86:23:0a:88:5a:ad:17:8d:3c:d4:48:05:af:c2:7a:1f:51:2f:9c
Signer

Actual PE Digest

3f:8f:97:54:d6:64:d1:f9:d1:c6:d3:05:85:86:23:0a:88:5a:ad:17:8d:3c:d4:48:05:af:c2:7a:1f:51:2f:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SetupLibNew.pdb

Imports

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

wininet

InternetReadFile
InternetCloseHandle
HttpSendRequestExW
InternetErrorDlg
InternetSetOptionW
HttpAddRequestHeadersA
InternetQueryOptionW
HttpEndRequestW
InternetOpenW
InternetCrackUrlA
InternetWriteFile
HttpOpenRequestA
InternetConnectA
HttpAddRequestHeadersW

shlwapi

StrRetToBufW
SHDeleteKeyW
StrToIntW
PathFileExistsW

shell32

SHFileOperationW
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW
ShellExecuteW
SHGetDesktopFolder
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetFolderPathW

kernel32

Sleep
GetExitCodeProcess
MoveFileW
GetTickCount
MapViewOfFile
CreateFileMappingW
WideCharToMultiByte
CreateProcessW
GetCurrentProcessId
MoveFileExW
FindResourceW
LoadResource
FindResourceExW
RaiseException
CloseHandle
GlobalFree
Process32FirstW
GlobalAlloc
LockResource
Process32NextW
MultiByteToWideChar
CreateToolhelp32Snapshot
OpenProcess
UnmapViewOfFile
GetSystemDirectoryW
GetCurrentThreadId
CreateFileW
WaitForSingleObject
LeaveCriticalSection
TerminateProcess
GetCurrentProcess
EnterCriticalSection
SizeofResource
ReadFile
HeapDestroy
HeapReAlloc
HeapSize
InitializeCriticalSectionEx
GetModuleFileNameW
ConvertFiberToThread
DeleteFiber
lstrcpyW
lstrcpynW
lstrcmpiW
FreeResource
GetCurrentDirectoryW
VerifyVersionInfoW
GetTempPathW
GetModuleHandleA
LoadLibraryExW
GetEnvironmentVariableW
VerSetConditionMask
LoadLibraryA
LocalFileTimeToFileTime
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetThreadPriority
DebugBreak
FreeLibrary
GetModuleHandleW
WriteConsoleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
VirtualQuery
SetThreadContext
GetThreadContext
GetCommandLineW
TerminateThread
TlsSetValue
TlsGetValue
TlsAlloc
TlsFree
QueryDosDeviceW
RemoveDirectoryW
GetFileAttributesW
SetFileAttributesW
GetLogicalDriveStringsW
FileTimeToSystemTime
GlobalLock
GlobalUnlock
CreateDirectoryW
SetFileTime
SystemTimeToFileTime
CopyFileW
GetFileTime
WriteFile
SetFilePointer
ExitThread
CreateEventW
FormatMessageW
CreateThread
GetFileSize
OpenMutexW
CreateMutexW
ReadConsoleA
GetVersionExW
OpenFileMappingW
GetWindowsDirectoryW
FlushFileBuffers
SetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
InitializeCriticalSection
VirtualFree
VirtualAlloc
GetTickCount64
GetLocalTime
IsProcessorFeaturePresent
PeekNamedPipe
GetCurrentThread
MulDiv
GetDiskFreeSpaceExW
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WaitForSingleObjectEx
GetExitCodeThread
GetStringTypeW
EncodePointer
LCMapStringEx
GetSystemTimeAsFileTime
GetCPInfo
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
LoadLibraryExA
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
ResumeThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetTimeZoneInformation
ExitProcess
SystemTimeToTzSpecificLocalTime
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
SetConsoleCtrlHandler
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
SetEndOfFile
WriteConsoleW
SuspendThread
VirtualProtect
DeleteFileW
ReleaseMutex
SetConsoleMode
GetProcessHeap
DeleteCriticalSection
LocalFree
GetProcAddress
DecodePointer
HeapAlloc
LoadLibraryW
OutputDebugStringW
GetLastError
LocalAlloc
FindClose
lstrlenA
InitializeCriticalSectionAndSpinCount
lstrlenW
FindNextFileW
GetFullPathNameW
SetLastError
HeapFree
FindFirstFileW
GetSystemInfo
GetDriveTypeW
GetFileInformationByHandle
GetStdHandle

user32

LoadIconW
GetClassInfoW
RemovePropW
DestroyWindow
SetWindowPos
GetDC
MonitorFromWindow
GetSystemMetrics
ShowWindow
GetMonitorInfoW
MonitorFromPoint
GetWindowThreadProcessId
GetGUIThreadInfo
RegisterClassW
GetPropW
CharNextW
LoadStringW
SetRectEmpty
DestroyIcon
EndPaint
BeginPaint
SetFocus
LoadImageW
SetWindowLongW
CopyRect
SetTimer
FillRect
GetWindowRect
CallWindowProcW
DefWindowProcW
GetWindowLongW
GetClassInfoExW
UnloadKeyboardLayout
SetPropW
MsgWaitForMultipleObjects
IsWindowVisible
GetUserObjectInformationW
GetDesktopWindow
SystemParametersInfoW
GetParent
SetForegroundWindow
IsIconic
ReleaseDC
GetProcessWindowStation
ClientToScreen
IsWindowEnabled
IntersectRect
SetCursor
ReplyMessage
GetClientRect
DispatchMessageW
PeekMessageW
LoadCursorW
LoadKeyboardLayoutW
GetKeyboardLayoutList
IsWindow
PtInRect
RegisterClassExW
MessageBoxIndirectW
InvalidateRect
SendMessageW
CreateWindowExW
MessageBoxW
SetParent
MsgWaitForMultipleObjectsEx
TranslateMessage
UnregisterClassW
WindowFromPoint
FindWindowExW
GetWindowTextW
EnableWindow
KillTimer
SetWindowTextW
GetWindowTextLengthW
GetMenuItemInfoW
GetSystemMenu
PostQuitMessage
GetQueueStatus
CallMsgFilterW
WaitMessage
GetMessageW
IsZoomed
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetUpdateRect
GetCursorPos
ScreenToClient
MapWindowPoints
GetSysColor
UnionRect
OffsetRect
IsRectEmpty
GetWindow
NotifyWinEvent
GetWindowPlacement
CreatePopupMenu
AppendMenuW
TrackPopupMenu
InsertMenuItemW
SetMenuItemInfoW
SetWindowRgn
EqualRect
GetMenu
AdjustWindowRectEx
InflateRect
CharPrevW
DrawTextW
SetRect
UpdateLayeredWindow
MoveWindow
GetWindowRgn
DestroyMenu
EnableMenuItem
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
UpdateWindow
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
PostMessageW
SendMessageTimeoutW
GetMenuItemCount
DeleteMenu
wsprintfW
GetDlgItem

gdi32

GetDeviceCaps
SelectObject
CreateCompatibleBitmap
BitBlt
CreateCompatibleDC
StretchBlt
DeleteDC
SetViewportOrgEx
PtInRegion
CreateDCW
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
CreateRectRgn
CreatePatternBrush
GdiFlush
TextOutW
MoveToEx
SetTextColor
DeleteObject
SetBkMode
SetBkColor
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetDIBits
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetFontData
CreatePen
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
SetStretchBltMode

advapi32

GetSecurityDescriptorSacl
GetLengthSid
GetTokenInformation
RegDeleteValueW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptAcquireContextW
CryptDecrypt
CryptSetKeyParam
CryptDestroyKey
CryptEncrypt
CryptImportKey
CryptReleaseContext
AddAccessAllowedAceEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
InitializeAcl
InitializeSecurityDescriptor
LookupAccountSidW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
SetSecurityDescriptorSacl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetEntriesInAclW
BuildExplicitAccessWithNameW
SetSecurityDescriptorDacl
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExW
RegEnumValueW
LookupAccountNameW
RegOpenKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegEnumKeyW
RegQueryInfoKeyW
RegFlushKey
RegSaveKeyW
RegEnumKeyExW
OpenProcessToken
RegUnLoadKeyW
RegLoadKeyW
RegCreateKeyW
ConvertSidToStringSidW

ole32

CoInitializeEx
CoTaskMemFree
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoSetProxyBlanket
CreateStreamOnHGlobal
OleDuplicateData
DoDragDrop
CoUninitialize
CoCreateInstance
CoCreateGuid
CoInitialize
ReleaseStgMedium
CoInitializeSecurity

oleaut32

SysAllocString
SysStringLen
SysFreeString
VariantInit
VariantClear

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

imm32

ImmGetIMEFileNameW
ImmDisableIME
ImmNotifyIME
ImmSetOpenStatus
ImmGetContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmInstallIMEW

psapi

GetModuleFileNameExW

msimg32

AlphaBlend

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

winmm

timeKillEvent
timeSetEvent
timeGetTime

winhttp

WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpWriteData
WinHttpReadData
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpCrackUrl
WinHttpReceiveResponse

ws2_32

gethostbyname
gethostname
WSAStartup
closesocket
WSASetLastError
send
recv
WSAGetLastError
WSACleanup

oleacc

LresultFromObject

crypt32

CertOpenStore
CertGetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore

imagemagik

ImageMagickEx_FreePNGBuffer
ImageMagickEx_SVGToPNGBufferByDpi

bcrypt

BCryptGenRandom

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
CancelDelayDelDir
CancleDelayDelDirWrap
CheckAccess
CheckInDelayDir
CheckProcessIsRunning
CheckRegKeyIsVolatile
CmpFile
CopyRegToArm32
CorrectSmartInfoUsed
CreateSmartInfoUid
CreateSogouInputUid
DefaultBrowserIsIE
DelayDelFile
DelayDelReg
DelayDeleteSogouImeFile
DelayTakeEffectDark
DeleteShortcut
DeleteShortcutWithPath
DeleteVolatileRegKey
ExecWait
FilterSid
GetAppDataPath
GetArm32SysPath
GetBDInfo
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetFinishIds
GetFinishStats
GetHWID
GetHwndImage
GetHwndMain
GetImeInstallMutex
GetInstallPath
GetOSVersionTime
GetPPName
GetQQStatistics
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstSuccessUserNetSchedule
InstallIME
InstalledIMEIsPre30b1
IsArmArch
IsBeforeWin10
IsFinishCheckBoxShow
IsFinishCloseBtnClicked
IsFullScreenActivated
IsInWin8
IsInX64
IsInXP
IsReadScreenEnable
IsRecommendTimeout
IsShowOpenMedal
IsSmartInfoEnable
IsSogouExplorerInstalled
IsSogouMobileInstalled
KillProcess
MonitorUninstallCompleted
MonitorVerifyUninstallSelect
MoveImeDir
MoveUrlGuideIcon
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
ReadSmartInfoOption
RegisterPluginUnloadCallback
RemoveAppDataDir
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SaveInstallTime
SendInstallInfo2Beacon
SetCheckBoxState
SetGuideQQUrl
SetLowLabel
SetMutex
SetPingbackCommonParam
SetQQShowType
SetReboot
SetRecommendTime
SetShowQQ
SetSmartInfoOption
SetUrlInvite
SetWithType
ShowQQOrNot
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
WaitAccountThread

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 739KB - Virtual size: 739KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 174KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupUi.cupf
$PLUGINSDIR/SogouPY.ime
.dll windows:6 windows x86 arch:x86

38e62f763ff29d4927478bfeff019c44

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:37:eb:b2:5f:16:77:41:2d:83:85:04:a5:97:d2:3e:96:47:db:05:fc:c4:58:ea:68:c0:1e:32:79:64:2e:e2
Signer

Actual PE Digest

11:37:eb:b2:5f:16:77:41:2d:83:85:04:a5:97:d2:3e:96:47:db:05:fc:c4:58:ea:68:c0:1e:32:79:64:2e:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SogouPy.pdb

Imports

kernel32

OpenThread
SetEvent
CreateEventW
OpenMutexW
CreateFileMappingW
CreateThread
ReleaseMutex
WaitForSingleObject
GetProcAddress
DecodePointer
WaitNamedPipeW
GetSystemTimeAsFileTime
CreateFileW
WriteFile
SetNamedPipeHandleState
ReadFile
GetACP
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
GlobalUnlock
TlsGetValue
DeleteCriticalSection
QueryPerformanceFrequency
LCMapStringW
QueryPerformanceCounter
GetTickCount64
ReleaseSemaphore
OutputDebugStringW
OpenWaitableTimerW
SetWaitableTimer
CreateWaitableTimerW
GetLocalTime
CreateSemaphoreW
LoadLibraryW
FreeLibrary
DeleteFileW
GetCurrentProcess
HeapWalk
DuplicateHandle
GlobalLock
GlobalFree
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
EnterCriticalSection
TlsSetValue
GetModuleFileNameA
GlobalAddAtomW
GlobalGetAtomNameW
OpenEventW
DebugBreak
GetTickCount
ResumeThread
VirtualFreeEx
GetModuleHandleW
GetCurrentProcessId
ReadProcessMemory
VirtualAllocEx
CloseHandle
OpenProcess
GetCurrentThreadId
HeapValidate
GetProcessHeaps
VirtualQuery
InitializeCriticalSectionEx
SetThreadPriority
SetFileAttributesW
GetCurrentThread
GetSystemWow64DirectoryW
AttachConsole
GetConsoleDisplayMode
FreeConsole
SetLastError
GetCurrentDirectoryW
GetSystemInfo
LocalFree
LocalAlloc
CreateMutexW
GetStartupInfoW
MoveFileExW
CopyFileW
GetSystemTime
SetFilePointer
GetTempFileNameW
GetFileSize
GetFileAttributesW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
GetModuleHandleA
GlobalHandle
LoadLibraryA
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
DeleteFiber
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapSize
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetTempPathW
GetLastError
Sleep
WideCharToMultiByte
MultiByteToWideChar
SwitchToThread
RaiseException
VirtualProtect
LoadLibraryExA
ExitThread
FormatMessageW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
QueryDosDeviceW
RemoveDirectoryW
GetLogicalDriveStringsW
FileTimeToSystemTime
CreateDirectoryW
GetProcessId
GetFileAttributesExW
CreateProcessW
GetFileTime
GetExitCodeProcess
lstrlenW
LoadLibraryExW
TlsAlloc
TlsFree
SizeofResource
LockResource
LoadResource
FindResourceW
HeapFree
GetFullPathNameW
lstrlenA
HeapAlloc
GetProcessHeap
GetVersionExW
GetWindowsDirectoryW
VirtualFree
VirtualAlloc
TerminateProcess
IsProcessorFeaturePresent
PeekNamedPipe
ExpandEnvironmentStringsW
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
OutputDebugStringA
MulDiv
ReleaseSRWLockExclusive
GetUserDefaultLangID
FormatMessageA
QueryThreadCycleTime
GetThreadPriority
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetThreadId
IsDebuggerPresent
GetFileSizeEx
SetEndOfFile
GetFileInformationByHandle
SetFilePointerEx
SetEnvironmentVariableW
GetEnvironmentVariableW
GetNativeSystemInfo
GetProcessTimes
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
ResetEvent
PostQueuedCompletionStatus
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
lstrcatW
lstrcpyW
GlobalReAlloc
GetWindowsDirectoryA
CreateFileA
CreateFileMappingA
OpenFileMappingA
InitOnceComplete
InitOnceBeginInitialize
InitializeSRWLock
GetExitCodeThread
GetStringTypeW
EncodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetDriveTypeW
GetFileType
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
SetConsoleCtrlHandler
GetModuleFileNameW

user32

GetWindowTextW
GetWindowThreadProcessId
GetGUIThreadInfo
SetRectEmpty
ReleaseDC
IsIconic
SetClipboardData
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
MonitorFromWindow
MonitorFromRect
SetWindowPos
GetDC
MonitorFromPoint
CharNextW
LoadStringW
WindowFromPoint
wsprintfW
MsgWaitForMultipleObjectsEx
SetPropW
ReplyMessage
LoadCursorW
RegisterClassW
GetClassInfoW
RemovePropW
CreateWindowExW
DefWindowProcW
EnableWindow
EndPaint
BeginPaint
ReleaseCapture
AppendMenuW
GetClientRect
SetCursor
SetCapture
IsWindowEnabled
TrackMouseEvent
SetMenuItemInfoW
TrackPopupMenu
GetWindowPlacement
RegisterClassExW
CreatePopupMenu
ScreenToClient
InsertMenuItemW
CallWindowProcW
DrawTextW
UpdateLayeredWindow
IntersectRect
SubtractRect
SetCaretPos
GetQueueStatus
wvsprintfW
FillRect
OffsetRect
DestroyIcon
GetKeyboardLayoutList
GetProcessWindowStation
GetUserObjectInformationW
GetClassLongW
RedrawWindow
SetClassLongW
GetCursor
SetWindowRgn
SetCursorPos
InflateRect
CopyRect
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
SetScrollInfo
EqualRect
IsRectEmpty
DrawIconEx
PostQuitMessage
GetWindowLongW
GetDesktopWindow
GetTopWindow
IsWindowVisible
GetKeyState
SendInput
GetAncestor
SetWindowsHookExW
UnhookWindowsHookEx
GetForegroundWindow
GetAsyncKeyState
GetSystemMetrics
CallNextHookEx
UnhookWinEvent
RegisterWindowMessageW
GetParent
SetWinEventHook
SetRect
GetClassNameW
FindWindowW
IsWindow
NotifyWinEvent
GetMenuItemID
SendMessageW
mouse_event
GetWindowRect
GetWindow
keybd_event
LoadImageW
SystemParametersInfoW
EndDialog
LoadIconW
SetForegroundWindow
FindWindowExW
GetCaretPos
GetPropW
ClientToScreen
PtInRect
SendMessageTimeoutW
EnumWindows
DispatchMessageW
TranslateMessage
DestroyMenu
GetCursorPos
UnregisterClassW
GetMessageW
SetTimer
PeekMessageW
PostThreadMessageW
MessageBoxW
GetKeyboardState
SetWindowLongW
UnregisterHotKey
RegisterHotKey
KillTimer
DestroyWindow
InvalidateRect
ShowWindow
MoveWindow
GetMessageExtraInfo
PostMessageW
GetFocus
GetWindowTextLengthW

gdi32

Rectangle
GetDeviceCaps
StretchBlt
BitBlt
CreateDCW
SetTextCharacterExtra
SetBkMode
SetTextColor
CreateFontIndirectW
GetFontData
GetTextMetricsW
GetTextExtentPointW
CreateSolidBrush
MoveToEx
LineTo
GetStockObject
SelectClipRgn
CreatePen
CreateRectRgn
GetClipRgn
GetTextExtentExPointW
GetFontUnicodeRanges
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
DeleteObject
SetBkColor
CombineRgn
OffsetRgn
ExtCreateRegion
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchDIBits
SetMapMode
CreateFontW

advapi32

EventRegister
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetLengthSid
AddAccessAllowedAceEx
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextW
LookupAccountSidW
SystemFunction036
EventUnregister
RegisterEventSourceW
EventWrite
RegQueryValueW
DeregisterEventSource
CryptEnumProvidersW

imm32

ImmUnlockIMC
ImmAssociateContextEx
ImmUnlockIMCC
ImmDisableIME
ImmLockIMC
ImmLockIMCC
ImmGetHotKey
ImmNotifyIME
ImmGetIMCCSize
ImmReSizeIMCC
ImmGenerateMessage
ImmCreateIMCC

msimg32

TransparentBlt
AlphaBlend
GradientFill

ws2_32

WSACleanup
WSAGetLastError
closesocket
recv
send
WSASetLastError

oleacc

LresultFromObject
AccessibleObjectFromPoint
AccessibleObjectFromEvent
AccessibleObjectFromWindow

winhttp

WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpOpen

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Exports

Exports

GetHandleVerifier
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeExtension
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
NotifyIMEComMsg

Sections

.text
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 634KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 393KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SogouPY64.ime
.dll windows:6 windows x64 arch:x64

ffb2523bf8883009ebe7f33f752d7625

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:14:2f:77:2e:8e:9c:b4:83:a6:f7:ed:b8:02:03:d0:d3:25:44:23:76:ed:93:0f:78:d5:e0:9f:77:12:be:0e
Signer

Actual PE Digest

7e:14:2f:77:2e:8e:9c:b4:83:a6:f7:ed:b8:02:03:d0:d3:25:44:23:76:ed:93:0f:78:d5:e0:9f:77:12:be:0e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_x64\SogouPy64.pdb

Imports

kernel32

OpenMutexW
CreateFileMappingW
CreateThread
ReleaseMutex
WaitForSingleObject
GetProcAddress
DecodePointer
WaitNamedPipeW
GetSystemTimeAsFileTime
CreateFileW
WriteFile
SetNamedPipeHandleState
ReadFile
GetACP
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
GlobalUnlock
TlsGetValue
DeleteCriticalSection
QueryPerformanceFrequency
LCMapStringW
QueryPerformanceCounter
GetTickCount64
SetFileAttributesW
OutputDebugStringW
OpenWaitableTimerW
SetEvent
CreateWaitableTimerW
GetLocalTime
SwitchToThread
GetModuleHandleA
FindClose
OpenThread
ReleaseSemaphore
CreateSemaphoreW
LoadLibraryW
FreeLibrary
GlobalLock
GlobalFree
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
EnterCriticalSection
TlsSetValue
GetModuleFileNameA
GlobalAddAtomW
GlobalGetAtomNameW
OpenEventW
DebugBreak
GetTickCount
ResumeThread
VirtualFreeEx
GetModuleHandleW
GetCurrentProcessId
ReadProcessMemory
VirtualAllocEx
CloseHandle
OpenProcess
GetCurrentThreadId
DeleteFileW
GetCurrentProcess
DuplicateHandle
VirtualQuery
InitializeCriticalSectionEx
SetThreadPriority
CreateEventW
SetWaitableTimer
GetCurrentThread
GetSystemWow64DirectoryW
AttachConsole
GetConsoleDisplayMode
FreeConsole
SetLastError
GetCurrentDirectoryW
GetSystemInfo
LocalFree
LocalAlloc
CreateMutexW
GetStartupInfoW
MoveFileExW
CopyFileW
GetSystemTime
SetFilePointer
GetTempFileNameW
GetFileSize
GetFileAttributesW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
GlobalHandle
LoadLibraryA
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
DeleteFiber
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetTempPathW
GetLastError
Sleep
WideCharToMultiByte
MultiByteToWideChar
FindFirstFileW
RaiseException
VirtualProtect
LoadLibraryExA
ExitThread
FormatMessageW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
QueryDosDeviceW
RemoveDirectoryW
GetLogicalDriveStringsW
FileTimeToSystemTime
CreateDirectoryW
GetProcessId
GetFileAttributesExW
CreateProcessW
GetFileTime
GetExitCodeProcess
lstrlenW
LoadLibraryExW
TlsAlloc
TlsFree
SizeofResource
LockResource
LoadResource
FindResourceW
HeapFree
GetFullPathNameW
lstrlenA
HeapAlloc
GetProcessHeap
GetVersionExW
GetWindowsDirectoryW
TerminateProcess
IsProcessorFeaturePresent
PeekNamedPipe
ExpandEnvironmentStringsW
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
OutputDebugStringA
MulDiv
ReleaseSRWLockExclusive
GetUserDefaultLangID
FormatMessageA
QueryThreadCycleTime
GetThreadPriority
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetThreadId
IsDebuggerPresent
GetFileSizeEx
SetEndOfFile
GetFileInformationByHandle
SetFilePointerEx
GetNativeSystemInfo
GetProcessTimes
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
ResetEvent
PostQueuedCompletionStatus
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
lstrcatW
lstrcpyW
GetEnvironmentVariableW
GlobalReAlloc
GetWindowsDirectoryA
CreateFileA
CreateFileMappingA
OpenFileMappingA
InitOnceComplete
InitOnceBeginInitialize
InitializeSRWLock
GetExitCodeThread
GetStringTypeW
EncodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
UnhandledExceptionFilter
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetDriveTypeW
SetEnvironmentVariableW
GetFileType
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
SetConsoleCtrlHandler
HeapSize
GetModuleFileNameW

user32

FindWindowW
GetGUIThreadInfo
SetRectEmpty
ReleaseDC
IsIconic
SetClipboardData
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
MonitorFromWindow
MonitorFromRect
SetWindowPos
GetDC
MonitorFromPoint
CharNextW
LoadStringW
WindowFromPoint
wsprintfW
MsgWaitForMultipleObjectsEx
SetPropW
ReplyMessage
LoadCursorW
RegisterClassW
GetClassInfoW
RemovePropW
CreateWindowExW
DefWindowProcW
EnableWindow
EndPaint
BeginPaint
ReleaseCapture
AppendMenuW
GetClientRect
SetCursor
SetCapture
IsWindowEnabled
TrackMouseEvent
SetMenuItemInfoW
TrackPopupMenu
GetWindowPlacement
RegisterClassExW
CreatePopupMenu
ScreenToClient
InsertMenuItemW
CallWindowProcW
DrawTextW
SetRect
IntersectRect
SubtractRect
SetCaretPos
GetQueueStatus
wvsprintfW
FillRect
OffsetRect
DestroyIcon
GetKeyboardLayoutList
GetProcessWindowStation
GetUserObjectInformationW
RedrawWindow
GetCursor
SetWindowRgn
SetCursorPos
InflateRect
CopyRect
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
SetScrollInfo
EqualRect
IsRectEmpty
DrawIconEx
PostQuitMessage
IsWindow
NotifyWinEvent
SendMessageW
GetWindowRect
GetWindow
GetWindowTextLengthW
GetWindowThreadProcessId
GetWindowLongW
GetDesktopWindow
GetTopWindow
IsWindowVisible
GetKeyState
SendInput
SetWindowsHookExW
SetWinEventHook
GetParent
RegisterWindowMessageW
UnhookWinEvent
GetAncestor
GetWindowTextW
mouse_event
GetClassLongPtrW
SetClassLongPtrW
GetClassNameW
GetMenuItemID
UpdateLayeredWindow
UnhookWindowsHookEx
LoadImageW
SystemParametersInfoW
EndDialog
LoadIconW
SetForegroundWindow
FindWindowExW
GetCaretPos
GetPropW
ClientToScreen
PtInRect
SendMessageTimeoutW
EnumWindows
DispatchMessageW
TranslateMessage
DestroyMenu
GetCursorPos
UnregisterClassW
GetMessageW
SetTimer
PeekMessageW
PostThreadMessageW
MessageBoxW
GetKeyboardState
GetWindowLongPtrW
SetWindowLongPtrW
UnregisterHotKey
RegisterHotKey
KillTimer
DestroyWindow
InvalidateRect
ShowWindow
MoveWindow
GetMessageExtraInfo
PostMessageW
GetFocus
keybd_event
CallNextHookEx
GetSystemMetrics
GetAsyncKeyState
GetForegroundWindow

gdi32

CreateCompatibleBitmap
GetDeviceCaps
StretchBlt
BitBlt
CreateDCW
SetTextCharacterExtra
SetBkMode
SetTextColor
CreateFontIndirectW
GetFontData
GetTextMetricsW
GetTextExtentPointW
CreateSolidBrush
MoveToEx
LineTo
GetStockObject
SelectClipRgn
CreatePen
CreateRectRgn
GetClipRgn
GetTextExtentExPointW
GetFontUnicodeRanges
SelectObject
CreateDIBSection
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
DeleteObject
SetBkColor
Rectangle
CombineRgn
OffsetRgn
ExtCreateRegion
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchDIBits
SetMapMode
CreateFontW

advapi32

EventUnregister
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetLengthSid
AddAccessAllowedAceEx
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextW
LookupAccountSidW
SystemFunction036
RegisterEventSourceW
EventRegister
EventWrite
RegQueryValueW
DeregisterEventSource
CryptEnumProvidersW

imm32

ImmLockIMC
ImmUnlockIMC
ImmAssociateContextEx
ImmUnlockIMCC
ImmDisableIME
ImmLockIMCC
ImmGetHotKey
ImmNotifyIME
ImmGetIMCCSize
ImmReSizeIMCC
ImmGenerateMessage
ImmCreateIMCC

msimg32

AlphaBlend
TransparentBlt
GradientFill

oleacc

AccessibleObjectFromPoint
AccessibleObjectFromEvent
AccessibleObjectFromWindow
LresultFromObject

winhttp

WinHttpCrackUrl
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData
WinHttpOpen
WinHttpConnect
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Exports

Exports

GetHandleVerifier
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeExtension
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
NotifyIMEComMsg

Sections

.text
Size: 10.3MB - Virtual size: 10.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 319KB - Virtual size: 568KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 436KB - Virtual size: 436KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 634KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/setuppage.zip
.zip
font.xml
img/bg_hole.png
.png
img/browseclick.svg
img/browsedisable.svg
img/browsehover.svg
img/browsenormal.svg
img/buttoninstallclick.svg
img/buttoninstalldisable.svg
img/buttoninstallhover.svg
img/buttoninstallnormal.svg
img/closeclick.svg
img/closedisable.svg
img/closehover.svg
img/closenormal.svg
img/closenormalclick.svg
img/closenormaldisable.svg
img/closenormalhover.svg
img/closenormalnormal.svg
img/customizebuttonclick.svg
img/customizebuttondisable.svg
img/customizebuttonhover.svg
img/customizebuttonnormal.svg
img/filebg.svg
img/gouxuanselected.svg
img/icon.svg
img/installbg1.svg
img/installbg2.svg
img/installfinish.svg
img/installfinish_no_yyb.svg
img/itemuse_hover.svg
.xml
img/itemuse_normal.svg
.xml
img/itemuse_push.svg
.xml
img/logo_bg_1.png
.png
img/logo_bg_1.svg
.xml
img/miniclick.svg
img/minidisable.svg
img/minihover.svg
img/mininormal.svg
img/miniprogressclick.svg
img/miniprogressdisable.svg
img/miniprogresshover.svg
img/miniprogressnormal.svg
img/packupclick.svg
img/packupdisable.svg
img/packuphover.svg
img/packupnormal.svg
img/pathinputactive.svg
img/pathinputdisable.svg
img/pathinputhover.svg
img/pathinputnormal.svg
img/popup_close_disable.svg
.xml
img/popup_close_hover.svg
.xml
img/popup_close_normal.svg
.xml
img/popup_close_push.svg
.xml
img/popup_ok_hover.svg
.xml
img/popup_ok_normal.svg
.xml
img/popup_ok_push.svg
.xml
img/process.svg
img/progressbar.svg
img/search_suggest_tip_hover.svg
img/search_suggest_tip_normal.svg
img/search_suggest_tips_bak.svg
img/slideshow/1.svg
img/slideshow/2.svg
img/slideshow/3.svg
img/slideshow/4.svg
.xml
img/slideshow/5.svg
img/slideshow/6.svg
img/tipsbg.svg
img/ungouxuanclick.svg
img/ungouxuanhover.svg
img/ungouxuannormal.svg
img/warning_popup_icon.svg
.xml
searchsuggesttips.xml
setuppage.xml
slideshow.xml
sogoumessage.xml
style.xml
$SYSDIR/SogouPY.ime
.dll windows:6 windows x86 arch:x86

38e62f763ff29d4927478bfeff019c44

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:37:eb:b2:5f:16:77:41:2d:83:85:04:a5:97:d2:3e:96:47:db:05:fc:c4:58:ea:68:c0:1e:32:79:64:2e:e2
Signer

Actual PE Digest

11:37:eb:b2:5f:16:77:41:2d:83:85:04:a5:97:d2:3e:96:47:db:05:fc:c4:58:ea:68:c0:1e:32:79:64:2e:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SogouPy.pdb

Imports

kernel32

OpenThread
SetEvent
CreateEventW
OpenMutexW
CreateFileMappingW
CreateThread
ReleaseMutex
WaitForSingleObject
GetProcAddress
DecodePointer
WaitNamedPipeW
GetSystemTimeAsFileTime
CreateFileW
WriteFile
SetNamedPipeHandleState
ReadFile
GetACP
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
GlobalUnlock
TlsGetValue
DeleteCriticalSection
QueryPerformanceFrequency
LCMapStringW
QueryPerformanceCounter
GetTickCount64
ReleaseSemaphore
OutputDebugStringW
OpenWaitableTimerW
SetWaitableTimer
CreateWaitableTimerW
GetLocalTime
CreateSemaphoreW
LoadLibraryW
FreeLibrary
DeleteFileW
GetCurrentProcess
HeapWalk
DuplicateHandle
GlobalLock
GlobalFree
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
EnterCriticalSection
TlsSetValue
GetModuleFileNameA
GlobalAddAtomW
GlobalGetAtomNameW
OpenEventW
DebugBreak
GetTickCount
ResumeThread
VirtualFreeEx
GetModuleHandleW
GetCurrentProcessId
ReadProcessMemory
VirtualAllocEx
CloseHandle
OpenProcess
GetCurrentThreadId
HeapValidate
GetProcessHeaps
VirtualQuery
InitializeCriticalSectionEx
SetThreadPriority
SetFileAttributesW
GetCurrentThread
GetSystemWow64DirectoryW
AttachConsole
GetConsoleDisplayMode
FreeConsole
SetLastError
GetCurrentDirectoryW
GetSystemInfo
LocalFree
LocalAlloc
CreateMutexW
GetStartupInfoW
MoveFileExW
CopyFileW
GetSystemTime
SetFilePointer
GetTempFileNameW
GetFileSize
GetFileAttributesW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
GetModuleHandleA
GlobalHandle
LoadLibraryA
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
DeleteFiber
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapSize
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetTempPathW
GetLastError
Sleep
WideCharToMultiByte
MultiByteToWideChar
SwitchToThread
RaiseException
VirtualProtect
LoadLibraryExA
ExitThread
FormatMessageW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
QueryDosDeviceW
RemoveDirectoryW
GetLogicalDriveStringsW
FileTimeToSystemTime
CreateDirectoryW
GetProcessId
GetFileAttributesExW
CreateProcessW
GetFileTime
GetExitCodeProcess
lstrlenW
LoadLibraryExW
TlsAlloc
TlsFree
SizeofResource
LockResource
LoadResource
FindResourceW
HeapFree
GetFullPathNameW
lstrlenA
HeapAlloc
GetProcessHeap
GetVersionExW
GetWindowsDirectoryW
VirtualFree
VirtualAlloc
TerminateProcess
IsProcessorFeaturePresent
PeekNamedPipe
ExpandEnvironmentStringsW
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
OutputDebugStringA
MulDiv
ReleaseSRWLockExclusive
GetUserDefaultLangID
FormatMessageA
QueryThreadCycleTime
GetThreadPriority
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetThreadId
IsDebuggerPresent
GetFileSizeEx
SetEndOfFile
GetFileInformationByHandle
SetFilePointerEx
SetEnvironmentVariableW
GetEnvironmentVariableW
GetNativeSystemInfo
GetProcessTimes
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
ResetEvent
PostQueuedCompletionStatus
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
lstrcatW
lstrcpyW
GlobalReAlloc
GetWindowsDirectoryA
CreateFileA
CreateFileMappingA
OpenFileMappingA
InitOnceComplete
InitOnceBeginInitialize
InitializeSRWLock
GetExitCodeThread
GetStringTypeW
EncodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetDriveTypeW
GetFileType
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
SetConsoleCtrlHandler
GetModuleFileNameW

user32

GetWindowTextW
GetWindowThreadProcessId
GetGUIThreadInfo
SetRectEmpty
ReleaseDC
IsIconic
SetClipboardData
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
MonitorFromWindow
MonitorFromRect
SetWindowPos
GetDC
MonitorFromPoint
CharNextW
LoadStringW
WindowFromPoint
wsprintfW
MsgWaitForMultipleObjectsEx
SetPropW
ReplyMessage
LoadCursorW
RegisterClassW
GetClassInfoW
RemovePropW
CreateWindowExW
DefWindowProcW
EnableWindow
EndPaint
BeginPaint
ReleaseCapture
AppendMenuW
GetClientRect
SetCursor
SetCapture
IsWindowEnabled
TrackMouseEvent
SetMenuItemInfoW
TrackPopupMenu
GetWindowPlacement
RegisterClassExW
CreatePopupMenu
ScreenToClient
InsertMenuItemW
CallWindowProcW
DrawTextW
UpdateLayeredWindow
IntersectRect
SubtractRect
SetCaretPos
GetQueueStatus
wvsprintfW
FillRect
OffsetRect
DestroyIcon
GetKeyboardLayoutList
GetProcessWindowStation
GetUserObjectInformationW
GetClassLongW
RedrawWindow
SetClassLongW
GetCursor
SetWindowRgn
SetCursorPos
InflateRect
CopyRect
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
SetScrollInfo
EqualRect
IsRectEmpty
DrawIconEx
PostQuitMessage
GetWindowLongW
GetDesktopWindow
GetTopWindow
IsWindowVisible
GetKeyState
SendInput
GetAncestor
SetWindowsHookExW
UnhookWindowsHookEx
GetForegroundWindow
GetAsyncKeyState
GetSystemMetrics
CallNextHookEx
UnhookWinEvent
RegisterWindowMessageW
GetParent
SetWinEventHook
SetRect
GetClassNameW
FindWindowW
IsWindow
NotifyWinEvent
GetMenuItemID
SendMessageW
mouse_event
GetWindowRect
GetWindow
keybd_event
LoadImageW
SystemParametersInfoW
EndDialog
LoadIconW
SetForegroundWindow
FindWindowExW
GetCaretPos
GetPropW
ClientToScreen
PtInRect
SendMessageTimeoutW
EnumWindows
DispatchMessageW
TranslateMessage
DestroyMenu
GetCursorPos
UnregisterClassW
GetMessageW
SetTimer
PeekMessageW
PostThreadMessageW
MessageBoxW
GetKeyboardState
SetWindowLongW
UnregisterHotKey
RegisterHotKey
KillTimer
DestroyWindow
InvalidateRect
ShowWindow
MoveWindow
GetMessageExtraInfo
PostMessageW
GetFocus
GetWindowTextLengthW

gdi32

Rectangle
GetDeviceCaps
StretchBlt
BitBlt
CreateDCW
SetTextCharacterExtra
SetBkMode
SetTextColor
CreateFontIndirectW
GetFontData
GetTextMetricsW
GetTextExtentPointW
CreateSolidBrush
MoveToEx
LineTo
GetStockObject
SelectClipRgn
CreatePen
CreateRectRgn
GetClipRgn
GetTextExtentExPointW
GetFontUnicodeRanges
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
DeleteObject
SetBkColor
CombineRgn
OffsetRgn
ExtCreateRegion
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchDIBits
SetMapMode
CreateFontW

advapi32

EventRegister
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetLengthSid
AddAccessAllowedAceEx
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextW
LookupAccountSidW
SystemFunction036
EventUnregister
RegisterEventSourceW
EventWrite
RegQueryValueW
DeregisterEventSource
CryptEnumProvidersW

imm32

ImmUnlockIMC
ImmAssociateContextEx
ImmUnlockIMCC
ImmDisableIME
ImmLockIMC
ImmLockIMCC
ImmGetHotKey
ImmNotifyIME
ImmGetIMCCSize
ImmReSizeIMCC
ImmGenerateMessage
ImmCreateIMCC

msimg32

TransparentBlt
AlphaBlend
GradientFill

ws2_32

WSACleanup
WSAGetLastError
closesocket
recv
send
WSASetLastError

oleacc

LresultFromObject
AccessibleObjectFromPoint
AccessibleObjectFromEvent
AccessibleObjectFromWindow

winhttp

WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpOpen

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Exports

Exports

GetHandleVerifier
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeExtension
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
NotifyIMEComMsg

Sections

.text
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 634KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 393KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPY.ime~
.dll windows:6 windows x86 arch:x86

38e62f763ff29d4927478bfeff019c44

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:37:eb:b2:5f:16:77:41:2d:83:85:04:a5:97:d2:3e:96:47:db:05:fc:c4:58:ea:68:c0:1e:32:79:64:2e:e2
Signer

Actual PE Digest

11:37:eb:b2:5f:16:77:41:2d:83:85:04:a5:97:d2:3e:96:47:db:05:fc:c4:58:ea:68:c0:1e:32:79:64:2e:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\SogouPy.pdb

Imports

kernel32

OpenThread
SetEvent
CreateEventW
OpenMutexW
CreateFileMappingW
CreateThread
ReleaseMutex
WaitForSingleObject
GetProcAddress
DecodePointer
WaitNamedPipeW
GetSystemTimeAsFileTime
CreateFileW
WriteFile
SetNamedPipeHandleState
ReadFile
GetACP
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
GlobalUnlock
TlsGetValue
DeleteCriticalSection
QueryPerformanceFrequency
LCMapStringW
QueryPerformanceCounter
GetTickCount64
ReleaseSemaphore
OutputDebugStringW
OpenWaitableTimerW
SetWaitableTimer
CreateWaitableTimerW
GetLocalTime
CreateSemaphoreW
LoadLibraryW
FreeLibrary
DeleteFileW
GetCurrentProcess
HeapWalk
DuplicateHandle
GlobalLock
GlobalFree
GlobalAlloc
InitializeCriticalSection
LeaveCriticalSection
GetCommandLineW
EnterCriticalSection
TlsSetValue
GetModuleFileNameA
GlobalAddAtomW
GlobalGetAtomNameW
OpenEventW
DebugBreak
GetTickCount
ResumeThread
VirtualFreeEx
GetModuleHandleW
GetCurrentProcessId
ReadProcessMemory
VirtualAllocEx
CloseHandle
OpenProcess
GetCurrentThreadId
HeapValidate
GetProcessHeaps
VirtualQuery
InitializeCriticalSectionEx
SetThreadPriority
SetFileAttributesW
GetCurrentThread
GetSystemWow64DirectoryW
AttachConsole
GetConsoleDisplayMode
FreeConsole
SetLastError
GetCurrentDirectoryW
GetSystemInfo
LocalFree
LocalAlloc
CreateMutexW
GetStartupInfoW
MoveFileExW
CopyFileW
GetSystemTime
SetFilePointer
GetTempFileNameW
GetFileSize
GetFileAttributesW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
GetModuleHandleA
GlobalHandle
LoadLibraryA
ReadConsoleA
SetConsoleMode
ConvertFiberToThread
DeleteFiber
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapSize
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryW
GetTempPathW
GetLastError
Sleep
WideCharToMultiByte
MultiByteToWideChar
SwitchToThread
RaiseException
VirtualProtect
LoadLibraryExA
ExitThread
FormatMessageW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
QueryDosDeviceW
RemoveDirectoryW
GetLogicalDriveStringsW
FileTimeToSystemTime
CreateDirectoryW
GetProcessId
GetFileAttributesExW
CreateProcessW
GetFileTime
GetExitCodeProcess
lstrlenW
LoadLibraryExW
TlsAlloc
TlsFree
SizeofResource
LockResource
LoadResource
FindResourceW
HeapFree
GetFullPathNameW
lstrlenA
HeapAlloc
GetProcessHeap
GetVersionExW
GetWindowsDirectoryW
VirtualFree
VirtualAlloc
TerminateProcess
IsProcessorFeaturePresent
PeekNamedPipe
ExpandEnvironmentStringsW
WaitForSingleObjectEx
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
OutputDebugStringA
MulDiv
ReleaseSRWLockExclusive
GetUserDefaultLangID
FormatMessageA
QueryThreadCycleTime
GetThreadPriority
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
GetThreadId
IsDebuggerPresent
GetFileSizeEx
SetEndOfFile
GetFileInformationByHandle
SetFilePointerEx
SetEnvironmentVariableW
GetEnvironmentVariableW
GetNativeSystemInfo
GetProcessTimes
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
ResetEvent
PostQueuedCompletionStatus
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
lstrcatW
lstrcpyW
GlobalReAlloc
GetWindowsDirectoryA
CreateFileA
CreateFileMappingA
OpenFileMappingA
InitOnceComplete
InitOnceBeginInitialize
InitializeSRWLock
GetExitCodeThread
GetStringTypeW
EncodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetDriveTypeW
GetFileType
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetTimeZoneInformation
SetStdHandle
HeapReAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
SetConsoleCtrlHandler
GetModuleFileNameW

user32

GetWindowTextW
GetWindowThreadProcessId
GetGUIThreadInfo
SetRectEmpty
ReleaseDC
IsIconic
SetClipboardData
EmptyClipboard
CloseClipboard
GetMonitorInfoW
OpenClipboard
MonitorFromWindow
MonitorFromRect
SetWindowPos
GetDC
MonitorFromPoint
CharNextW
LoadStringW
WindowFromPoint
wsprintfW
MsgWaitForMultipleObjectsEx
SetPropW
ReplyMessage
LoadCursorW
RegisterClassW
GetClassInfoW
RemovePropW
CreateWindowExW
DefWindowProcW
EnableWindow
EndPaint
BeginPaint
ReleaseCapture
AppendMenuW
GetClientRect
SetCursor
SetCapture
IsWindowEnabled
TrackMouseEvent
SetMenuItemInfoW
TrackPopupMenu
GetWindowPlacement
RegisterClassExW
CreatePopupMenu
ScreenToClient
InsertMenuItemW
CallWindowProcW
DrawTextW
UpdateLayeredWindow
IntersectRect
SubtractRect
SetCaretPos
GetQueueStatus
wvsprintfW
FillRect
OffsetRect
DestroyIcon
GetKeyboardLayoutList
GetProcessWindowStation
GetUserObjectInformationW
GetClassLongW
RedrawWindow
SetClassLongW
GetCursor
SetWindowRgn
SetCursorPos
InflateRect
CopyRect
DialogBoxParamW
CreateDialogParamW
GetClassInfoExW
SetScrollInfo
EqualRect
IsRectEmpty
DrawIconEx
PostQuitMessage
GetWindowLongW
GetDesktopWindow
GetTopWindow
IsWindowVisible
GetKeyState
SendInput
GetAncestor
SetWindowsHookExW
UnhookWindowsHookEx
GetForegroundWindow
GetAsyncKeyState
GetSystemMetrics
CallNextHookEx
UnhookWinEvent
RegisterWindowMessageW
GetParent
SetWinEventHook
SetRect
GetClassNameW
FindWindowW
IsWindow
NotifyWinEvent
GetMenuItemID
SendMessageW
mouse_event
GetWindowRect
GetWindow
keybd_event
LoadImageW
SystemParametersInfoW
EndDialog
LoadIconW
SetForegroundWindow
FindWindowExW
GetCaretPos
GetPropW
ClientToScreen
PtInRect
SendMessageTimeoutW
EnumWindows
DispatchMessageW
TranslateMessage
DestroyMenu
GetCursorPos
UnregisterClassW
GetMessageW
SetTimer
PeekMessageW
PostThreadMessageW
MessageBoxW
GetKeyboardState
SetWindowLongW
UnregisterHotKey
RegisterHotKey
KillTimer
DestroyWindow
InvalidateRect
ShowWindow
MoveWindow
GetMessageExtraInfo
PostMessageW
GetFocus
GetWindowTextLengthW

gdi32

Rectangle
GetDeviceCaps
StretchBlt
BitBlt
CreateDCW
SetTextCharacterExtra
SetBkMode
SetTextColor
CreateFontIndirectW
GetFontData
GetTextMetricsW
GetTextExtentPointW
CreateSolidBrush
MoveToEx
LineTo
GetStockObject
SelectClipRgn
CreatePen
CreateRectRgn
GetClipRgn
GetTextExtentExPointW
GetFontUnicodeRanges
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
GetPixel
DeleteDC
GetObjectW
DeleteObject
SetBkColor
CombineRgn
OffsetRgn
ExtCreateRegion
GetCharABCWidthsFloatW
GetTextExtentPoint32W
StretchDIBits
SetMapMode
CreateFontW

advapi32

EventRegister
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
ReportEventW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildExplicitAccessWithNameW
SetSecurityInfo
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
GetSecurityDescriptorSacl
GetLengthSid
AddAccessAllowedAceEx
EqualSid
AllocateAndInitializeSid
OpenProcessToken
FreeSid
GetTokenInformation
RegCreateKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegOpenKeyW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
RegQueryInfoKeyW
RegEnumKeyW
CryptReleaseContext
CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptDecrypt
CryptAcquireContextW
LookupAccountSidW
SystemFunction036
EventUnregister
RegisterEventSourceW
EventWrite
RegQueryValueW
DeregisterEventSource
CryptEnumProvidersW

imm32

ImmUnlockIMC
ImmAssociateContextEx
ImmUnlockIMCC
ImmDisableIME
ImmLockIMC
ImmLockIMCC
ImmGetHotKey
ImmNotifyIME
ImmGetIMCCSize
ImmReSizeIMCC
ImmGenerateMessage
ImmCreateIMCC

msimg32

TransparentBlt
AlphaBlend
GradientFill

ws2_32

WSACleanup
WSAGetLastError
closesocket
recv
send
WSASetLastError

oleacc

LresultFromObject
AccessibleObjectFromPoint
AccessibleObjectFromEvent
AccessibleObjectFromWindow

winhttp

WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpWriteData
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpQueryOption
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpConnect
WinHttpOpen

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

crypt32

CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

bcrypt

BCryptGenRandom

Exports

Exports

GetHandleVerifier
ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeExtension
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME
NotifyIMEComMsg

Sections

.text
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 257KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 634KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 393KB - Virtual size: 393KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_15_/HWSignature.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3
Signer

Actual PE Digest

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14.3.0.9006/HWSignature.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3
Signer

Actual PE Digest

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14.3.0.9006/ImageMagik.dll
.dll windows:6 windows x86 arch:x86

f204f2299a0324f196a8576faef59e72

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3
Signer

Actual PE Digest

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\data\landun\workspace\p-a6b81373d56245738becf19644b9638b\src\third_party_build\imagemagick\tmp\x86\RelWithDebInfo\ImageMagik.pdb

Imports

kernel32

QueryPerformanceCounter
QueryPerformanceFrequency
GetExitCodeProcess
GetSystemTimeAsFileTime
GetConsoleOutputCP
LoadLibraryA
MultiByteToWideChar
IsValidCodePage
GetACP
GetCPInfo
IsDBCSLeadByteEx
ReadFile
WriteFile
PeekNamedPipe
SetEvent
ResetEvent
ReadConsoleInputA
DeviceIoControl
DuplicateHandle
GetConsoleWindow
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateEventW
WaitForMultipleObjects
GetExitCodeThread
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateMutexA
GetCurrentThreadId
ExitProcess
MoveFileExW
GetFileInformationByHandle
AttachConsole
GetThreadLocale
GetLocaleInfoA
WideCharToMultiByte
GetModuleHandleW
FreeLibrary
GetVersion
CreateProcessA
CreateEventA
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
GetShortPathNameW
GetCommandLineW
GetStdHandle
GetFileAttributesW
GetCurrentDirectoryW
TerminateProcess
GetSystemInfo
SetConsoleMode
GetConsoleMode
GetFileInformationByHandleEx
IsDebuggerPresent
GetFileType
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetProcessAffinityMask
GetNativeSystemInfo
GetCurrentProcess
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetThreadPriority
SetThreadPriority
GetCurrentThread
CloseHandle
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
TryAcquireSRWLockShared
TryAcquireSRWLockExclusive
AcquireSRWLockShared
AllocConsole
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
RaiseException
GetComputerNameW
GetModuleHandleA
GetModuleFileNameW
VirtualQuery
GetWindowsDirectoryW
GetSystemDirectoryW
DebugBreak
LoadLibraryW
GetProcAddress
FormatMessageW
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTempPathW
GetTempFileNameW
DeleteFileW
CreateFileW
LocalFree
GetCurrentProcessId
OpenMutexW
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetLastError
PeekConsoleInputA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
InterlockedPushEntrySList
InterlockedFlushSList
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsFree
LoadLibraryExW
EncodePointer
SetStdHandle
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetEndOfFile
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetCurrentDirectoryW
CreateDirectoryW
RemoveDirectoryW
GetFileAttributesExW
SetFileAttributesW
FlushFileBuffers
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetConsoleCP
CreatePipe
CreateProcessW
GetFullPathNameW
FindClose
FindFirstFileExW
FindNextFileW
SetFilePointerEx
ReadConsoleW
HeapFree
HeapAlloc
HeapReAlloc
DecodePointer
GetFileSizeEx
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
GetStringTypeW
GetNumberOfConsoleInputEvents
ReadConsoleInputW
GetOEMCP
GetCommandLineA
GetProcessHeap
OutputDebugStringW
HeapSize
WriteConsoleW
GetTickCount
GetDiskFreeSpaceExW
GetVolumeInformationW
GetVolumePathNameW
GetModuleHandleExA
GetLogicalDrives
GetSystemDirectoryA
GetLongPathNameW
ReadDirectoryChangesW
GetDriveTypeA
GetFileSize

user32

PeekMessageA
MessageBoxA
FillRect
IsWindow
MsgWaitForMultipleObjectsEx
ReleaseDC
GetDC
SystemParametersInfoA
PostMessageA
LoadStringW

gdi32

Polyline
StretchDIBits
CreateSolidBrush
GetDeviceCaps
GdiFlush
CreateDIBSection
GetWorldTransform
Rectangle
SelectClipRgn
IntersectClipRect
GetClipRgn
GetClipBox
ExtCreateRegion
CreateRectRgn
CreateCompatibleBitmap
BitBlt
ExtTextOutW
GetObjectW
ModifyWorldTransform
SetWorldTransform
GetTextMetricsA
SetTextAlign
SetTextColor
SetMapMode
SetGraphicsMode
SetBkMode
SelectObject
SaveDC
RestoreDC
GetGlyphIndicesW
GetFontUnicodeRanges
GetOutlineTextMetricsA
GetGlyphOutlineW
GetFontData
GetCharWidth32A
DeleteObject
DeleteDC
CreateFontIndirectW
CreateCompatibleDC
GetStockObject
GetGlyphOutlineA
CreatePen
CreateDCA
EnumFontFamiliesExW
ExtSelectClipRgn
GetGraphicsMode
CreateFontIndirectA

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetFileInfoW
SHFileOperationW
CommandLineToArgvW

ole32

CoTaskMemFree

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegGetValueW
RegQueryValueExA
RegOpenKeyExA
RegSetValueExW
LookupAccountSidW
RegNotifyChangeKeyValue
RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
GetFileSecurityW
GetSecurityDescriptorOwner
RegLoadMUIStringW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
GetUserNameW
BuildExplicitAccessWithNameW
SetSecurityInfo
GetSecurityInfo
SetEntriesInAclW
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetSecurityDescriptorSacl
GetSecurityDescriptorGroup

ws2_32

ioctlsocket
closesocket
WSAStartup
getsockopt
recv
send
WSAGetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSASetEvent
getservbyport
getservbyname
inet_pton
inet_ntop
htonl
htons
inet_addr
inet_ntoa
ntohs
gethostbyaddr
gethostbyname
WSASetLastError

dnsapi

DnsFree
DnsQuery_A

iphlpapi

NotifyRouteChange2
CancelMibChangeNotify2
GetIpForwardTable2

Exports

Exports

ImageMagickEx_FreePNGBuffer
ImageMagickEx_SVGToPNGBuffer
ImageMagickEx_SVGToPNGBufferByDpi

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
14.3.0.9006/SetupUi.cupf
SogouExe/HWSignatureEx.dll
.dll windows:6 windows x86 arch:x86

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

25-05-2021 00:00

Not After

21-08-2024 23:59

Subject

CN=Beijing Sogou Technology Development Co.\, Ltd.,O=Beijing Sogou Technology Development Co.\, Ltd.,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3
Signer

Actual PE Digest

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

E:\landun\pinyin_agent\workspace\p-f93f0d74ed8a49278e11882bf2562c5a\src\bin\Release_Win32\HWSignature.pdb

Imports

ws2_32

WSAStartup

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

EnterCriticalSection
CreateFileW
DecodePointer
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
HeapFree
DeviceIoControl
lstrcatA
CopyFileA
CreateFileA
GetSystemDirectoryA
CloseHandle
HeapAlloc
GetProcessHeap
lstrcpyA
lstrlenA
GlobalAlloc
LocalAlloc
GetLastError
LoadLibraryA
GetVersionExA
GetProcAddress
LocalFree
FreeLibrary
HeapReAlloc
SetLastError
GlobalFree
GetTickCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
WriteConsoleW
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
SetFilePointerEx
GetStringTypeW
SetStdHandle
HeapSize

user32

IsCharAlphaNumericA
wsprintfA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2.1MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

e5:00:f1:9a:a5:54:d5:fd:cc:6c:10:64:a7:6f:b9:42:7e:a1:a4:a2:d7:4b:8b:36:5b:0d:f8:17:a3:ac:6e:e4Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 2.7MB

UPX1 Size: 23KB - Virtual size: 24KB

.rsrc Size: 133KB - Virtual size: 136KB

cdd42c264bacf432f4003380d6c8ce27

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

version

kernel32

user32

Exports

Exports

Sections

.text Size: 89KB - Virtual size: 89KB

.rdata Size: 28KB - Virtual size: 28KB

.data Size: 2KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

f204f2299a0324f196a8576faef59e72

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3Signer

Headers

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

e5:00:f1:9a:a5:54:d5:fd:cc:6c:10:64:a7:6f:b9:42:7e:a1:a4:a2:d7:4b:8b:36:5b:0d:f8:17:a3:ac:6e:e4
Signer

UPX0
Size: - Virtual size: 2.7MB

UPX1
Size: 23KB - Virtual size: 24KB

.rsrc
Size: 133KB - Virtual size: 136KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

80:5c:f3:12:6b:b1:fd:e9:19:29:06:d5:fd:49:49:5c:e3:72:1f:85:9a:99:bb:b9:12:ef:af:51:ff:f7:1b:f3
Signer

.text
Size: 89KB - Virtual size: 89KB

.rdata
Size: 28KB - Virtual size: 28KB

.data
Size: 2KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

59:ab:59:bb:f3:13:fc:85:33:e2:9c:a6:b7:5d:4c:d1:84:0c:a2:7d:67:cc:d8:6a:a1:17:d2:68:42:62:57:e3
Signer

.text
Size: 4.4MB - Virtual size: 4.4MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 14KB - Virtual size: 30KB

.idata
Size: 10KB - Virtual size: 10KB

.tls
Size: 1KB - Virtual size: 1KB

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 138KB - Virtual size: 138KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

08:90:b9:34:84:e6:f1:8e:fe:9f:43:68:3a:5f:49:d8
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

23:46:57:63:39:9a:4d:00:7c:be:e1:69:c0:b3:ec:0d:ce:b3:63:9c:f5:06:89:1e:56:dc:cb:01:3b:8a:dc:ae
Signer