4beed365844e33ae2e09b6644ca11940_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4beed365844e33ae2e09b6644ca11940_JaffaCakes118
Size

31.4MB
MD5

4beed365844e33ae2e09b6644ca11940
SHA1

ba8bc3ef4bac8635d77607b98fe8eebe148f4d61
SHA256

35923dc46fff6ddc766e04cac2694d45ee90e8345055a356350863129224fb4a
SHA512

d6b7f51bbf87b95a105a94ec2f32d520165be71dc50424193fd6a58c18f65687ebcb8daa2ec81e15d4ab055b65136d153c17679756f16850b517713a9e718481
SSDEEP

786432:YXE3ull4vwIH/cPwlc9XTCHCyEDH0iINCTylNtwde1vYH2Wt8RzY/w:YU+AwI0YlcwkH0iJWlNt8e1wd8VY/w

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
4beed365844e33ae2e09b6644ca11940_JaffaCakes118
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll

Files

4beed365844e33ae2e09b6644ca11940_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupFlash.swf
$PLUGINSDIR/SetupLib.dll
.dll windows:5 windows x86 arch:x86

6ef5faf1aea6f45ee07595a13d7590ae

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\SetupLib.pdb

Imports

shlwapi

StrStrIW
StrRetToBufW
StrToIntW
SHDeleteKeyW
SHGetValueW
PathFileExistsW

wininet

InternetCloseHandle
HttpQueryInfoW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW
InternetOpenW
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

kernel32

VirtualProtect
VirtualFree
LoadLibraryA
VirtualAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetVersionExW
TerminateProcess
SuspendThread
GetThreadContext
SetThreadContext
VirtualQuery
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
Sleep
GetModuleHandleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetEndOfFile
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
GetCurrentProcessId
DeleteFileW
CloseHandle
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GlobalFree
EnterCriticalSection
SetLastError
GetLastError
RaiseException
FlushInstructionCache
MultiByteToWideChar
CreateFileW
ReadFile
GetExitCodeProcess
LeaveCriticalSection
WideCharToMultiByte
GetSystemDirectoryW
GlobalAlloc
OpenProcess
TlsSetValue
WriteFile
WaitForSingleObject
GetCurrentProcess
MoveFileExW
CreateProcessW
FreeLibrary
DebugBreak
OutputDebugStringW
lstrlenA
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
LocalFree
LocalAlloc
LoadLibraryW
FindNextFileW
FindClose
GetProcAddress
lstrlenW
GetModuleHandleW
FindFirstFileW
HeapDestroy
HeapSize
FileTimeToLocalFileTime
GetDriveTypeW
GetSystemTimeAsFileTime
ResumeThread
IsProcessorFeaturePresent
InitializeCriticalSection
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringW
LCMapStringA
QueryPerformanceFrequency
UnhandledExceptionFilter
IsValidCodePage
GetOEMCP
GetACP
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
TlsGetValue
TlsAlloc
CreateFileA
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
UnmapViewOfFile
GetCurrentDirectoryA
GetFullPathNameW
RtlUnwind
GetFileType
TlsFree
InterlockedCompareExchange
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCurrentThread
GetTickCount
GetDiskFreeSpaceExW
SetThreadPriority
SetEvent
CreateEventW
OpenEventW
GetLogicalDriveStringsW
GetFileAttributesW
RemoveDirectoryW
QueryDosDeviceW
SetFileAttributesW
GetCommandLineW
GetTempPathW
SetFilePointer
FormatMessageW
ExitThread
CreateThread
CreateDirectoryW
CopyFileW
FileTimeToSystemTime
GetFileSize
FlushFileBuffers
CreateMutexW
OpenMutexW
ReleaseMutex

user32

IsWindowVisible
BeginPaint
LoadImageW
wvsprintfW
FillRect
CharNextW
UnregisterClassA
MonitorFromPoint
IntersectRect
LoadStringW
UnionRect
GetFocus
OffsetRect
PtInRect
CopyRect
DefWindowProcW
CallWindowProcW
SetWindowLongW
GetWindowLongW
wsprintfA
GetSystemMenu
DeleteMenu
GetMenuItemInfoW
SendMessageTimeoutW
GetMenuItemCount
GetWindowTextLengthW
PostMessageW
KillTimer
GetParent
GetForegroundWindow
GetWindowTextW
GetDlgItem
SetWindowPos
EnableWindow
SetWindowTextW
UnloadKeyboardLayout
LoadCursorW
GetClientRect
GetClassInfoExW
CharLowerW
LoadKeyboardLayoutW
RegisterClassExW
IsWindow
FindWindowExW
CreateWindowExW
MessageBoxW
SendMessageW
GetKeyboardLayoutList
EndPaint
SetTimer
GetWindowRect
MessageBoxIndirectW
ShowWindow
LoadIconW
SetParent
MoveWindow
SystemParametersInfoW
SetFocus
SetForegroundWindow
DestroyWindow
DispatchMessageW
GetMonitorInfoW
UpdateLayeredWindow
MonitorFromWindow
SetRect
TranslateMessage
GetMessageW
SetActiveWindow
ReleaseDC
GetDC
IsWindowEnabled
GetSystemMetrics
SetRectEmpty
GetPropW
ReleaseCapture
GetCursorPos
SetPropW
TrackMouseEvent
GetKeyState
SetCapture
NotifyWinEvent
IsIconic
ScreenToClient
SetCursor
ClientToScreen
GetDesktopWindow
DrawTextW
InvalidateRect

gdi32

GetDeviceCaps
GetFontData
CreateFontIndirectW
BitBlt
SetViewportOrgEx
DeleteDC
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
GetStockObject
GetTextExtentExPointW
SetBkMode
CreateDIBSection
SetTextColor

advapi32

SetEntriesInAclW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
AddAccessAllowedAceEx
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptSetKeyParam
RegDeleteValueW
LookupAccountSidW
CryptImportKey
CryptAcquireContextW
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
AdjustTokenPrivileges
RegEnumKeyExW
RegFlushKey
RegEnumValueW
LookupPrivilegeValueW
LookupAccountNameW
RegQueryInfoKeyW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyW
RegCreateKeyW
OpenProcessToken
SetSecurityDescriptorSacl
GetLengthSid
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetTokenInformation

shell32

SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetDesktopFolder

ole32

CoTaskMemFree
OleDraw
CoCreateGuid
CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

GetErrorInfo
VariantInit
SysStringLen
SysAllocString
SysFreeString

imm32

ImmNotifyIME
ImmSetOpenStatus
ImmGetContext
ImmInstallIMEW
ImmGetIMEFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

msimg32

AlphaBlend

oleacc

LresultFromObject
AccessibleObjectFromWindow

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
BackupExe
CancelDelayDelDir
CheckAccess
CmpFile
CreateSmartInfoUid
DefaultBrowserIsIE
DelBackupExe
DelayDelFile
DelayDelReg
DeleteShortcut
DeleteShortcutWithPath
DeleteUsbdt
DownloadQuiet
ExecWait
FilterSid
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetHWID
GetHwndImage
GetHwndMain
GetInstallPath
GetPPName
GetSmartInfoOption
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstallIME
InstalledIMEIsPre30b1
IsInWin8
MonitorUninstallCompleted
MonitorVerifyEdit
MonitorVerifyUninstallSelect
MoveImeDir
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
QQMgrSetIESP
ReadIniStr
RemoveCommonDir
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
RunLotus
SECheckOSInstalled
SetCheckBoxState
SetLowLabel
SetMutex
SetReadSecond
SetReboot
SetUrlInvite
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall
UpdateFireWall_OctopusDownloader

Sections

.text
Size: 693KB - Virtual size: 692KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupUi.cupf
$PLUGINSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

d67ad4097829d0121c3aaeae0cd1eb49

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

TransparentBlt
GradientFill
AlphaBlend

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
QueryPerformanceCounter
InterlockedIncrement
DeleteFileW
GetCurrentThread
CreateThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
CreateEventW
OpenThread
InitializeCriticalSection
ReleaseMutex
OpenFileMappingW
CreateFileMappingW
OpenMutexW
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
OpenProcess
GlobalHandle
GetFileAttributesExW
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
MultiByteToWideChar
ResumeThread
Sleep
GetTickCount
EnterCriticalSection
GetProcAddress
GetLastError
GetQueuedCompletionStatus
TransactNamedPipe
InterlockedExchange
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
CreateMutexW
OutputDebugStringA
OutputDebugStringW
GetSystemTimeAsFileTime
GetCurrentProcess
ReadFile
LeaveCriticalSection
VirtualAlloc
LoadLibraryA
VirtualFree
VirtualProtect
GetFileTime
FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
GetFileSize
WriteFile
lstrlenA
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
LocalFree
GetSystemDirectoryW
DeviceIoControl
CreateFileA
lstrcpyA
GetSystemDirectoryA
lstrcatA
CopyFileA
HeapReAlloc
SetLastError
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
FormatMessageW
TerminateProcess
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
ExitThread
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
MoveFileExW
GetLogicalDriveStringsW
QueryDosDeviceW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
TlsAlloc
TlsFree
FlushViewOfFile
FlushFileBuffers
SetWaitableTimer
CreateWaitableTimerW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GetWindowsDirectoryA
GlobalReAlloc
CreateFileMappingA
OpenFileMappingA
RaiseException
UnhandledExceptionFilter
ExitProcess
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
GetFullPathNameW
GetCurrentDirectoryA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
GetModuleHandleW
CloseHandle
GetCurrentThreadId
OpenEventW
ResetEvent
SetEvent
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
GetVersionExW
GetCommandLineA

user32

SetMenuItemInfoW
FillRect
LoadStringW
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
GetWindowPlacement
RegisterClassExW
UnregisterClassW
InflateRect
SetCursorPos
SetRect
SetClassLongW
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
EnableWindow
IsWindowEnabled
TrackMouseEvent
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
GetMessageW
PostThreadMessageW
IsRectEmpty
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
IsCharAlphaNumericW
wsprintfW
wsprintfA
ScreenToClient
GetCursor
RedrawWindow
TranslateMessage
PeekMessageW
GetClassLongW
mouse_event
PostMessageW
GetWindowTextLengthW
NotifyWinEvent
GetAncestor
GetWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetCursorPos
GetMenuItemCount
DestroyWindow
SetForegroundWindow
GetFocus
GetParent
FindWindowW
LoadIconW
EndDialog
IsWindow
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
MsgWaitForMultipleObjectsEx
SetWindowLongW
WindowFromPoint

gdi32

DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
SetMapMode
SetBkColor
CreateDIBSection
DeleteDC
StretchDIBits
ExtCreateRegion
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CombineRgn
GetTextExtentPointW
GetDeviceCaps
OffsetRgn
Rectangle
StretchBlt
GetTextMetricsW
CreateFontIndirectW
CreateDCW
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
CreateSolidBrush
SelectObject
CreateFontW

advapi32

InitializeSecurityDescriptor
CryptGetKeyParam
RegOpenKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCreateKeyExW
AddAccessAllowedAceEx
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegQueryValueW
SetEntriesInAclW
AllocateAndInitializeSid
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegDeleteKeyW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW
SetSecurityDescriptorDacl

ws2_32

WSAStartup

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

oleacc

AccessibleObjectFromWindow
LresultFromObject

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SogouPY64.ime
.dll windows:5 windows x64 arch:x64

dba81500aebff2c0a618bda276012fe1

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\SogouPy64.pdb

Imports

msimg32

TransparentBlt
GradientFill
AlphaBlend

kernel32

GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteFileW
GlobalAddAtomW
CreateThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
CreateEventW
OpenThread
InitializeCriticalSection
ReleaseMutex
OpenFileMappingW
CreateFileMappingW
GetCurrentThread
SetThreadPriority
OpenProcess
GlobalHandle
GetFileAttributesExW
LoadLibraryW
OpenMutexW
WaitForSingleObject
UnmapViewOfFile
MapViewOfFile
MultiByteToWideChar
ResumeThread
Sleep
GetTickCount
EnterCriticalSection
GetQueuedCompletionStatus
TransactNamedPipe
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
CreateMutexW
OutputDebugStringA
OutputDebugStringW
GetSystemTimeAsFileTime
GetCurrentProcess
ReadFile
GetVersionExW
VirtualAlloc
LoadLibraryA
VirtualFree
VirtualProtect
GetFileTime
FindFirstFileW
GetProcAddress
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
GetFileSize
WriteFile
lstrlenA
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
LocalFree
GetSystemDirectoryW
DeviceIoControl
CreateFileA
lstrcpyA
GetSystemDirectoryA
lstrcatA
CopyFileA
HeapReAlloc
SetLastError
SetFilePointer
RtlCaptureContext
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
RtlVirtualUnwind
FormatMessageW
TerminateProcess
lstrlenW
RtlLookupFunctionEntry
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
ExitThread
DuplicateHandle
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
MoveFileExW
GetLogicalDriveStringsW
QueryDosDeviceW
SetFileAttributesW
CopyFileW
GetExitCodeProcess
FileTimeToSystemTime
TlsAlloc
TlsFree
FlushViewOfFile
FlushFileBuffers
SetWaitableTimer
CreateWaitableTimerW
OpenWaitableTimerW
DebugBreak
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GetWindowsDirectoryA
GlobalReAlloc
CreateFileMappingA
OpenFileMappingA
RaiseException
UnhandledExceptionFilter
ExitProcess
FlsSetValue
GetCommandLineA
WriteConsoleW
GetFileType
GetStdHandle
GetLastError
GetDriveTypeW
EncodePointer
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
RtlUnwindEx
RtlPcToFileHeader
GetTimeZoneInformation
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSetInformation
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
GetFullPathNameW
GetCurrentDirectoryA
GetDateFormatA
GetTimeFormatA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
CloseHandle
GetCurrentThreadId
OpenEventW
ResetEvent
SetEvent
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
FindClose
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
FillRect
LoadStringW
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
GetWindowPlacement
RegisterClassExW
UnregisterClassW
InflateRect
SetCursorPos
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
EnableWindow
IsWindowEnabled
TrackMouseEvent
GetSysColorBrush
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
GetMessageW
PostThreadMessageW
IsRectEmpty
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
IsCharAlphaNumericW
wsprintfW
wsprintfA
ScreenToClient
GetCursor
RedrawWindow
TranslateMessage
PeekMessageW
GetWindowTextLengthW
NotifyWinEvent
GetAncestor
GetWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
GetWindowLongW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongPtrW
LoadImageW
GetMenuItemInfoW
GetCursorPos
GetMenuItemCount
GetMenuInfo
DestroyMenu
DestroyWindow
SetForegroundWindow
GetFocus
GetParent
FindWindowW
LoadIconW
EndDialog
IsWindow
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
MsgWaitForMultipleObjectsEx
SetClassLongPtrW
GetClassLongPtrW
mouse_event
PostMessageW
SetWindowLongPtrW
WindowFromPoint

gdi32

SelectObject
GetObjectW
GetPixel
StretchDIBits
SetMapMode
SetBkColor
DeleteObject
SetPixel
CreateDIBSection
DeleteDC
ExtCreateRegion
GetTextExtentPoint32W
GetCharABCWidthsFloatW
GetTextExtentPointW
GetDeviceCaps
CombineRgn
OffsetRgn
Rectangle
StretchBlt
GetTextMetricsW
CreateFontIndirectW
CreateDCW
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
CreateSolidBrush
CreateCompatibleDC
CreateFontW

advapi32

SetEntriesInAclW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CryptGetKeyParam
RegOpenKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCreateKeyExW
AddAccessAllowedAceEx
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegQueryValueW
AllocateAndInitializeSid
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegDeleteKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegCreateKeyW
RegSetValueExW
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

shlwapi

StrStrIW

oleacc

AccessibleObjectFromWindow
AccessibleObjectFromEvent
LresultFromObject

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 262KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SogouIn
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/install0.png
.png
$PLUGINSDIR/install1.png
.png
$PLUGINSDIR/install2.png
.png
$PLUGINSDIR/install3.png
.png
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

d67ad4097829d0121c3aaeae0cd1eb49

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

TransparentBlt
GradientFill
AlphaBlend

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
QueryPerformanceCounter
InterlockedIncrement
DeleteFileW
GetCurrentThread
CreateThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
CreateEventW
OpenThread
InitializeCriticalSection
ReleaseMutex
OpenFileMappingW
CreateFileMappingW
OpenMutexW
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
OpenProcess
GlobalHandle
GetFileAttributesExW
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
MultiByteToWideChar
ResumeThread
Sleep
GetTickCount
EnterCriticalSection
GetProcAddress
GetLastError
GetQueuedCompletionStatus
TransactNamedPipe
InterlockedExchange
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
CreateMutexW
OutputDebugStringA
OutputDebugStringW
GetSystemTimeAsFileTime
GetCurrentProcess
ReadFile
LeaveCriticalSection
VirtualAlloc
LoadLibraryA
VirtualFree
VirtualProtect
GetFileTime
FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
GetFileSize
WriteFile
lstrlenA
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
LocalFree
GetSystemDirectoryW
DeviceIoControl
CreateFileA
lstrcpyA
GetSystemDirectoryA
lstrcatA
CopyFileA
HeapReAlloc
SetLastError
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
FormatMessageW
TerminateProcess
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
ExitThread
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
MoveFileExW
GetLogicalDriveStringsW
QueryDosDeviceW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
TlsAlloc
TlsFree
FlushViewOfFile
FlushFileBuffers
SetWaitableTimer
CreateWaitableTimerW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GetWindowsDirectoryA
GlobalReAlloc
CreateFileMappingA
OpenFileMappingA
RaiseException
UnhandledExceptionFilter
ExitProcess
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
GetFullPathNameW
GetCurrentDirectoryA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
GetModuleHandleW
CloseHandle
GetCurrentThreadId
OpenEventW
ResetEvent
SetEvent
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
GetVersionExW
GetCommandLineA

user32

SetMenuItemInfoW
FillRect
LoadStringW
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
GetWindowPlacement
RegisterClassExW
UnregisterClassW
InflateRect
SetCursorPos
SetRect
SetClassLongW
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
EnableWindow
IsWindowEnabled
TrackMouseEvent
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
GetMessageW
PostThreadMessageW
IsRectEmpty
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
IsCharAlphaNumericW
wsprintfW
wsprintfA
ScreenToClient
GetCursor
RedrawWindow
TranslateMessage
PeekMessageW
GetClassLongW
mouse_event
PostMessageW
GetWindowTextLengthW
NotifyWinEvent
GetAncestor
GetWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetCursorPos
GetMenuItemCount
DestroyWindow
SetForegroundWindow
GetFocus
GetParent
FindWindowW
LoadIconW
EndDialog
IsWindow
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
MsgWaitForMultipleObjectsEx
SetWindowLongW
WindowFromPoint

gdi32

DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
SetMapMode
SetBkColor
CreateDIBSection
DeleteDC
StretchDIBits
ExtCreateRegion
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CombineRgn
GetTextExtentPointW
GetDeviceCaps
OffsetRgn
Rectangle
StretchBlt
GetTextMetricsW
CreateFontIndirectW
CreateDCW
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
CreateSolidBrush
SelectObject
CreateFontW

advapi32

InitializeSecurityDescriptor
CryptGetKeyParam
RegOpenKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCreateKeyExW
AddAccessAllowedAceEx
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegQueryValueW
SetEntriesInAclW
AllocateAndInitializeSid
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegDeleteKeyW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW
SetSecurityDescriptorDacl

ws2_32

WSAStartup

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

oleacc

AccessibleObjectFromWindow
LresultFromObject

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPY.ime~
.dll windows:5 windows x86 arch:x86

d67ad4097829d0121c3aaeae0cd1eb49

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

TransparentBlt
GradientFill
AlphaBlend

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
QueryPerformanceCounter
InterlockedIncrement
DeleteFileW
GetCurrentThread
CreateThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
CreateEventW
OpenThread
InitializeCriticalSection
ReleaseMutex
OpenFileMappingW
CreateFileMappingW
OpenMutexW
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
OpenProcess
GlobalHandle
GetFileAttributesExW
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
MultiByteToWideChar
ResumeThread
Sleep
GetTickCount
EnterCriticalSection
GetProcAddress
GetLastError
GetQueuedCompletionStatus
TransactNamedPipe
InterlockedExchange
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
CreateMutexW
OutputDebugStringA
OutputDebugStringW
GetSystemTimeAsFileTime
GetCurrentProcess
ReadFile
LeaveCriticalSection
VirtualAlloc
LoadLibraryA
VirtualFree
VirtualProtect
GetFileTime
FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
GetFileSize
WriteFile
lstrlenA
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
LocalFree
GetSystemDirectoryW
DeviceIoControl
CreateFileA
lstrcpyA
GetSystemDirectoryA
lstrcatA
CopyFileA
HeapReAlloc
SetLastError
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
FormatMessageW
TerminateProcess
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
ExitThread
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
MoveFileExW
GetLogicalDriveStringsW
QueryDosDeviceW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
TlsAlloc
TlsFree
FlushViewOfFile
FlushFileBuffers
SetWaitableTimer
CreateWaitableTimerW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GetWindowsDirectoryA
GlobalReAlloc
CreateFileMappingA
OpenFileMappingA
RaiseException
UnhandledExceptionFilter
ExitProcess
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
GetFullPathNameW
GetCurrentDirectoryA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
GetModuleHandleW
CloseHandle
GetCurrentThreadId
OpenEventW
ResetEvent
SetEvent
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
GetVersionExW
GetCommandLineA

user32

SetMenuItemInfoW
FillRect
LoadStringW
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
GetWindowPlacement
RegisterClassExW
UnregisterClassW
InflateRect
SetCursorPos
SetRect
SetClassLongW
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
EnableWindow
IsWindowEnabled
TrackMouseEvent
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
GetMessageW
PostThreadMessageW
IsRectEmpty
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
IsCharAlphaNumericW
wsprintfW
wsprintfA
ScreenToClient
GetCursor
RedrawWindow
TranslateMessage
PeekMessageW
GetClassLongW
mouse_event
PostMessageW
GetWindowTextLengthW
NotifyWinEvent
GetAncestor
GetWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetCursorPos
GetMenuItemCount
DestroyWindow
SetForegroundWindow
GetFocus
GetParent
FindWindowW
LoadIconW
EndDialog
IsWindow
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
MsgWaitForMultipleObjectsEx
SetWindowLongW
WindowFromPoint

gdi32

DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
SetMapMode
SetBkColor
CreateDIBSection
DeleteDC
StretchDIBits
ExtCreateRegion
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CombineRgn
GetTextExtentPointW
GetDeviceCaps
OffsetRgn
Rectangle
StretchBlt
GetTextMetricsW
CreateFontIndirectW
CreateDCW
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
CreateSolidBrush
SelectObject
CreateFontW

advapi32

InitializeSecurityDescriptor
CryptGetKeyParam
RegOpenKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCreateKeyExW
AddAccessAllowedAceEx
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegQueryValueW
SetEntriesInAclW
AllocateAndInitializeSid
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegDeleteKeyW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW
SetSecurityDescriptorDacl

ws2_32

WSAStartup

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

oleacc

AccessibleObjectFromWindow
LresultFromObject

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPy.ime
.dll windows:5 windows x86 arch:x86

d67ad4097829d0121c3aaeae0cd1eb49

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

TransparentBlt
GradientFill
AlphaBlend

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
QueryPerformanceCounter
InterlockedIncrement
DeleteFileW
GetCurrentThread
CreateThread
CreateSemaphoreW
ReleaseSemaphore
DeleteCriticalSection
CreateEventW
OpenThread
InitializeCriticalSection
ReleaseMutex
OpenFileMappingW
CreateFileMappingW
OpenMutexW
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
OpenProcess
GlobalHandle
GetFileAttributesExW
LoadLibraryW
UnmapViewOfFile
MapViewOfFile
MultiByteToWideChar
ResumeThread
Sleep
GetTickCount
EnterCriticalSection
GetProcAddress
GetLastError
GetQueuedCompletionStatus
TransactNamedPipe
InterlockedExchange
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
CreateMutexW
OutputDebugStringA
OutputDebugStringW
GetSystemTimeAsFileTime
GetCurrentProcess
ReadFile
LeaveCriticalSection
VirtualAlloc
LoadLibraryA
VirtualFree
VirtualProtect
GetFileTime
FindFirstFileW
FindClose
CreateDirectoryW
FindNextFileW
RemoveDirectoryW
GetFileSize
WriteFile
lstrlenA
FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LocalAlloc
LocalFree
GetSystemDirectoryW
DeviceIoControl
CreateFileA
lstrcpyA
GetSystemDirectoryA
lstrcatA
CopyFileA
HeapReAlloc
SetLastError
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
FormatMessageW
TerminateProcess
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
ExitThread
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
MoveFileExW
GetLogicalDriveStringsW
QueryDosDeviceW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
TlsAlloc
TlsFree
FlushViewOfFile
FlushFileBuffers
SetWaitableTimer
CreateWaitableTimerW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GetWindowsDirectoryA
GlobalReAlloc
CreateFileMappingA
OpenFileMappingA
RaiseException
UnhandledExceptionFilter
ExitProcess
InitializeCriticalSectionAndSpinCount
FileTimeToLocalFileTime
GetDriveTypeW
RtlUnwind
GetTimeZoneInformation
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
LCMapStringA
GetFullPathNameW
GetCurrentDirectoryA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CompareStringA
SetEnvironmentVariableA
GetModuleHandleW
CloseHandle
GetCurrentThreadId
OpenEventW
ResetEvent
SetEvent
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
GetVersionExW
GetCommandLineA

user32

SetMenuItemInfoW
FillRect
LoadStringW
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
GetWindowPlacement
RegisterClassExW
UnregisterClassW
InflateRect
SetCursorPos
SetRect
SetClassLongW
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
EnableWindow
IsWindowEnabled
TrackMouseEvent
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
GetMessageW
PostThreadMessageW
IsRectEmpty
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
IsCharAlphaNumericW
wsprintfW
wsprintfA
ScreenToClient
GetCursor
RedrawWindow
TranslateMessage
PeekMessageW
GetClassLongW
mouse_event
PostMessageW
GetWindowTextLengthW
NotifyWinEvent
GetAncestor
GetWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetCursorPos
GetMenuItemCount
DestroyWindow
SetForegroundWindow
GetFocus
GetParent
FindWindowW
LoadIconW
EndDialog
IsWindow
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
MsgWaitForMultipleObjectsEx
SetWindowLongW
WindowFromPoint

gdi32

DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
SetMapMode
SetBkColor
CreateDIBSection
DeleteDC
StretchDIBits
ExtCreateRegion
GetTextExtentPoint32W
GetCharABCWidthsFloatW
CombineRgn
GetTextExtentPointW
GetDeviceCaps
OffsetRgn
Rectangle
StretchBlt
GetTextMetricsW
CreateFontIndirectW
CreateDCW
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
CreateSolidBrush
SelectObject
CreateFontW

advapi32

InitializeSecurityDescriptor
CryptGetKeyParam
RegOpenKeyW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegCreateKeyExW
AddAccessAllowedAceEx
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegQueryValueW
SetEntriesInAclW
AllocateAndInitializeSid
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
CryptEncrypt
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegDeleteKeyW
RegCreateKeyW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegEnumValueW
RegEnumKeyW
RegQueryInfoKeyW
SetSecurityDescriptorDacl

ws2_32

WSAStartup

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

oleacc

AccessibleObjectFromWindow
LresultFromObject

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 133KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
7.2.0.2289/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
7.2.0.2289/SetupUi.cupf
SogouExe/HWSignatureEx.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\project\sogouime\branch\PinyinDev_R_7_1_Final_QQPicFace\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 1.6MB

.rsrc Size: 143KB - Virtual size: 142KB

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 1024B - Virtual size: 17KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

6ef5faf1aea6f45ee07595a13d7590ae

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.6MB

.rsrc
Size: 143KB - Virtual size: 142KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 693KB - Virtual size: 692KB

.rdata
Size: 158KB - Virtual size: 158KB

.data
Size: 52KB - Virtual size: 78KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 47KB - Virtual size: 46KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 707KB - Virtual size: 706KB

.data
Size: 133KB - Virtual size: 197KB