c1b919b0a69f67c764326366204e4dee_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

c1b919b0a69f67c764326366204e4dee_JaffaCakes118
Size

31.0MB
MD5

c1b919b0a69f67c764326366204e4dee
SHA1

3342ea304c3416d963e39d059590bf4715673855
SHA256

cb2a534f99144dec2f8bf546f0e582a932a4545c1653e2cf482719de2a4a6090
SHA512

3ffdefdb86dfae865774600700d7d4910a0e61d3b9ea17bc86c48a14a18751e0575596d15d7d317de9c5bfc4efaed78f0123dd67d4141aef23872d54e4cfaa2f
SSDEEP

786432:TVWPuTcFt3PDPrLGva0x72fRJJFiYylQYo5Ef7/4ZiWSFcFm00z:TEbtzaaSSZfc9lQHA7Q0WSFcFG

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/out.upx

Files

c1b919b0a69f67c764326366204e4dee_JaffaCakes118
.exe windows:5 windows x86 arch:x86

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.9MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupLib.dll
.dll windows:5 windows x86 arch:x86

952d37fb7a2d47973ece3f874e0f6f90

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SetupLib.pdb

Imports

shlwapi

StrToIntW
SHDeleteKeyW
PathFileExistsW

wininet

InternetCloseHandle
HttpQueryInfoW
InternetSetOptionW
InternetReadFile
InternetOpenUrlW
InternetOpenW
HttpQueryInfoA
InternetOpenA
InternetOpenUrlA

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

kernel32

LoadLibraryA
VirtualFree
VirtualProtect
VirtualAlloc
HeapFree
HeapReAlloc
GetProcessHeap
HeapAlloc
GetVersionExW
SuspendThread
GetThreadContext
SetThreadContext
VirtualQuery
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
TerminateProcess
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
SetEndOfFile
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
LCMapStringW
Sleep
GetCurrentProcessId
DeleteFileW
CloseHandle
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GlobalFree
EnterCriticalSection
SetLastError
GetLastError
RaiseException
GetCommandLineA
FlushInstructionCache
MultiByteToWideChar
CreateFileW
ReadFile
GetExitCodeProcess
LeaveCriticalSection
WideCharToMultiByte
GetSystemDirectoryW
GlobalAlloc
OpenProcess
WriteFile
WaitForSingleObject
GetCurrentProcess
MoveFileExW
CreateProcessW
FreeLibrary
DebugBreak
OutputDebugStringW
lstrlenA
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
LocalFree
LocalAlloc
LoadLibraryW
FindNextFileW
FindClose
GetProcAddress
lstrlenW
GetModuleHandleW
FindFirstFileW
HeapSize
FileTimeToLocalFileTime
GetDriveTypeW
GetSystemTimeAsFileTime
ResumeThread
HeapDestroy
IsProcessorFeaturePresent
InitializeCriticalSection
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetTickCount
UnhandledExceptionFilter
GetCPInfo
GetModuleFileNameA
GetStdHandle
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
ExitProcess
HeapCreate
GetCurrentDirectoryA
GetFullPathNameW
RtlUnwind
GetFileType
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetCurrentThread
GetDiskFreeSpaceExW
SetEvent
CreateEventW
OpenEventW
GetFileAttributesW
SetFileAttributesW
GetCommandLineW
GetTempPathW
SetFilePointer
FormatMessageW
ExitThread
CreateThread
CreateDirectoryW
CopyFileW
FileTimeToSystemTime
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetFileSize
FlushFileBuffers
CreateMutexW
OpenMutexW
ReleaseMutex
UnmapViewOfFile
QueryPerformanceFrequency

user32

MoveWindow
InvalidateRect
BeginPaint
UnregisterClassA
UpdateLayeredWindow
GetFocus
OffsetRect
PtInRect
DrawTextW
GetDesktopWindow
LoadStringW
ClientToScreen
SetCursor
ScreenToClient
PostQuitMessage
CopyRect
DefWindowProcW
CallWindowProcW
SetWindowLongW
wsprintfA
GetSystemMenu
DeleteMenu
GetMenuItemInfoW
SendMessageTimeoutW
GetMenuItemCount
GetWindowTextLengthW
PostMessageW
KillTimer
GetParent
GetForegroundWindow
GetWindowTextW
GetDlgItem
SetWindowPos
EnableWindow
SetWindowTextW
UnloadKeyboardLayout
LoadCursorW
GetClientRect
GetClassInfoExW
CharLowerW
LoadKeyboardLayoutW
RegisterClassExW
IsWindow
FindWindowExW
CreateWindowExW
MessageBoxW
SendMessageW
GetKeyboardLayoutList
EndPaint
SetTimer
GetWindowRect
CharNextW
FillRect
wvsprintfW
LoadImageW
MessageBoxIndirectW
ShowWindow
LoadIconW
SetParent
IsIconic
SystemParametersInfoW
SetFocus
SetForegroundWindow
DestroyWindow
DispatchMessageW
GetMonitorInfoW
IsWindowVisible
MonitorFromWindow
TranslateMessage
GetMessageW
SetActiveWindow
ReleaseDC
GetDC
IsWindowEnabled
GetSystemMetrics
SetRectEmpty
GetPropW
ReleaseCapture
GetCursorPos
SetPropW
TrackMouseEvent
GetKeyState
SetCapture
GetWindowLongW

gdi32

GetFontData
SetBkMode
CreateFontIndirectW
BitBlt
SetViewportOrgEx
DeleteDC
StretchBlt
DeleteObject
SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
SetTextColor
GetTextExtentExPointW
GetStockObject
CreateDIBSection

advapi32

RegSetValueExW
RegCreateKeyExW
RegDeleteKeyW
RegOpenKeyExW
CryptDecrypt
CryptReleaseContext
CryptDestroyKey
RegDeleteValueW
LookupAccountSidW
GetTokenInformation
RegCloseKey
AddAccessAllowedAceEx
CryptSetKeyParam
CryptImportKey
CryptAcquireContextW
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
AdjustTokenPrivileges
RegEnumKeyExW
RegFlushKey
RegEnumValueW
LookupPrivilegeValueW
LookupAccountNameW
RegQueryInfoKeyW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyW
RegCreateKeyW
OpenProcessToken
SetSecurityDescriptorSacl
GetLengthSid
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor

shell32

ShellExecuteW
SHGetSpecialFolderPathW
SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFolderPathW
ShellExecuteExW

ole32

CoInitialize
CoTaskMemFree
CoCreateInstance

oleaut32

VariantInit
SysStringLen
SysAllocString
SysFreeString

imm32

ImmInstallIMEW
ImmGetIMEFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

msimg32

AlphaBlend

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
CancelDelayDelDir
CheckAccess
CmpFile
DefaultBrowserIsIE
DelayDelFile
DelayDelReg
DownloadQuiet
ExecWait
FilterSid
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetHWID
GetHwndImage
GetHwndMain
GetInstallPath
GetPPName
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstallIME
InstalledIMEIsPre30b1
IsInWin8
MonitorUninstallCompleted
MonitorVerifyEdit
MonitorVerifyUninstallSelect
MoveImeDir
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
ReadIniStr
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
RunLotus
SECheckOSInstalled
SetCheckBoxState
SetLowLabel
SetMutex
SetReadSecond
SetReboot
SetUrlInvite
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall

Sections

.text
Size: 621KB - Virtual size: 621KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupUi.cupf
$PLUGINSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

57c6ff7a993195df4912898ddf6cb162

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
SetEnvironmentVariableA
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SogouPY64.ime
.dll windows:5 windows x64 arch:x64

66af19e974e9bc038fb5f1f53ffccbef

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy64.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GlobalAddAtomW
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
GetCurrentThread
SetThreadPriority
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
SetFilePointer
RtlCaptureContext
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
Sleep
RtlVirtualUnwind
FormatMessageW
lstrlenW
RtlLookupFunctionEntry
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
DuplicateHandle
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
GetExitCodeProcess
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
FlsSetValue
GetCommandLineA
FileTimeToLocalFileTime
GetDriveTypeW
Module32NextW
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
RtlUnwindEx
GetDriveTypeA
FindFirstFileA
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapSetInformation
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetDateFormatA
GetTimeFormatA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
SetEnvironmentVariableA
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
Module32FirstW
OutputDebugStringW
EncodePointer

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
ScreenToClient
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetSysColorBrush
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
RedrawWindow
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
TranslateMessage
PeekMessageW
GetAsyncKeyState
GetCursor
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
GetWindowLongW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongPtrW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongPtrW
PostMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx

gdi32

DeleteDC
CreateDIBSection
SetPixel
DeleteObject
SelectObject
GetObjectW
GetPixel
StretchBlt
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CombineRgn
CreateSolidBrush
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
CreateCompatibleDC
CreateFontW

advapi32

RegEnumValueW
RegSetValueExW
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 90KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SogouIn
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/install0.bmp
$PLUGINSDIR/install1.bmp
$PLUGINSDIR/install2.bmp
$PLUGINSDIR/install3.bmp
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

57c6ff7a993195df4912898ddf6cb162

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
SetEnvironmentVariableA
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPY.ime~
.dll windows:5 windows x86 arch:x86

57c6ff7a993195df4912898ddf6cb162

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
SetEnvironmentVariableA
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPy.ime
.dll windows:5 windows x86 arch:x86

57c6ff7a993195df4912898ddf6cb162

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalAddAtomW
GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
GetCurrentThread
InterlockedIncrement
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
QueryPerformanceCounter
SetWaitableTimer
MultiByteToWideChar
ResumeThread
CloseHandle
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
FindResourceW
FreeLibrary
LoadResource
LoadLibraryExW
SizeofResource
LockResource
VirtualFree
VirtualAlloc
LoadLibraryA
VirtualProtect
WriteFile
ReadFile
Sleep
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
lstrlenW
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GetWindowsDirectoryA
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetProcessHeap
CompareStringA
SetEnvironmentVariableA
GetTickCount
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
SetFilePointer
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
LoadIconW
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
SetRect
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
PeekMessageW
ScreenToClient
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
GetCursor
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadImageW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage

gdi32

StretchBlt
DeleteDC
CreateDIBSection
SetPixel
DeleteObject
CreateCompatibleDC
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateDCW
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
SelectObject
CreateFontW

advapi32

AddAccessAllowedAceEx
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
RegOpenKeyExW
RegQueryValueExW
RegCloseKey

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 485KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 92KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6.7.0.0499/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6.7.0.0499/SetupUi.cupf
SogouExe/HWSignatureEx.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08/11/2006, 00:00

Not After

07/11/2021, 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25/06/2012, 00:00

Not After

24/08/2015, 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_7_0\Bin\SogouPdb\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.9MB

UPX1 Size: 20KB - Virtual size: 20KB

.rsrc Size: 142KB - Virtual size: 144KB

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

UPX0
Size: - Virtual size: 1.9MB

UPX1
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 142KB - Virtual size: 144KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 621KB - Virtual size: 621KB

.rdata
Size: 133KB - Virtual size: 133KB

.data
Size: 19KB - Virtual size: 42KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 39KB - Virtual size: 39KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate