0f10bea9816ca538e674731f62afe8a4_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

0f10bea9816ca538e674731f62afe8a4_JaffaCakes118
Size

29.2MB
MD5

0f10bea9816ca538e674731f62afe8a4
SHA1

61129f87e2a32234779733868d814d0ccfa7a3c1
SHA256

ac4b45bc07af46efc0b0425b7c49b2b2b93781ebe8928fd5fd1e984b8b4b4a4c
SHA512

06836a2727ff2cb40a8ad3838f9c6e6eb4495a761d500a9079fae471418fee74cd6d9bb6973e92f83195c3acf52560101d0c7a1ef424444400e78778432961ef
SSDEEP

786432:sx5H5CVgd0qeSjPr9vnE/M+6/vsnDzqQ2khe:sx5H5JdbeSjPr9vnE/MLUnDE

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/sogou_pinyin_6.5.8.9174.exe	upx

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/out.upx

Files

0f10bea9816ca538e674731f62afe8a4_JaffaCakes118
.zip
sogou_pinyin_6.5.8.9174.exe
.exe windows:5 windows x86 arch:x86

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 142KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\Bin\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupLib.dll
.dll windows:5 windows x86 arch:x86

ec4b49231361d0705840be76bc9dc571

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\bin\SogouInput\SetupLib.pdb

Imports

shlwapi

SHDeleteKeyW
PathFileExistsW
StrToIntW

wininet

HttpQueryInfoW
InternetSetOptionW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetReadFile

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

kernel32

TerminateProcess
VirtualProtect
VirtualQuery
SetEnvironmentVariableA
CompareStringW
CompareStringA
SetEndOfFile
GetDriveTypeA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
CreateFileA
GetModuleHandleA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
Sleep
GetConsoleCP
GetTimeZoneInformation
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
GetStdHandle
ExitProcess
GetCurrentProcessId
DeleteFileW
CloseHandle
GetCurrentThreadId
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GlobalFree
EnterCriticalSection
SetEvent
SetLastError
GetLastError
RaiseException
FlushInstructionCache
MultiByteToWideChar
CreateFileW
ReadFile
LeaveCriticalSection
WideCharToMultiByte
GetSystemDirectoryW
GlobalAlloc
OpenProcess
WriteFile
WaitForSingleObject
GetCurrentProcess
MoveFileExW
CreateProcessW
FreeLibrary
DebugBreak
OutputDebugStringW
lstrlenA
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
LocalFree
LocalAlloc
LoadLibraryW
FindNextFileW
FindClose
GetProcAddress
lstrlenW
GetModuleHandleW
FindFirstFileW
HeapCreate
GetCurrentDirectoryA
GetFullPathNameW
RtlUnwind
TlsFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResumeThread
GetSystemTimeAsFileTime
GetDriveTypeW
SetThreadContext
TlsSetValue
TlsAlloc
TlsGetValue
GetThreadContext
SuspendThread
GetConsoleMode
GetCommandLineA
FileTimeToLocalFileTime
HeapSize
HeapReAlloc
GetCurrentThread
GetDiskFreeSpaceExW
HeapDestroy
CreateEventW
OpenEventW
GetFileAttributesW
SetFileAttributesW
GetCommandLineW
GetTempPathW
SetFilePointer
FormatMessageW
ExitThread
CreateThread
GetVersionExW
CreateDirectoryW
CopyFileW
GetExitCodeProcess
FileTimeToSystemTime
InterlockedCompareExchange
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetFileSize
FlushFileBuffers
CreateMutexW
OpenMutexW
ReleaseMutex
UnmapViewOfFile
QueryPerformanceFrequency
GetTickCount
InitializeCriticalSection
HeapFree
GetProcessHeap
HeapAlloc
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
IsDebuggerPresent

user32

GetSystemMenu
DeleteMenu
GetMenuItemInfoW
SendMessageTimeoutW
GetMenuItemCount
GetWindowTextLengthW
PostMessageW
KillTimer
GetParent
GetForegroundWindow
GetWindowTextW
GetDlgItem
SetWindowPos
EnableWindow
SetWindowTextW
UnloadKeyboardLayout
GetClientRect
GetClassInfoExW
CharLowerW
LoadKeyboardLayoutW
RegisterClassExW
IsWindow
FindWindowExW
CreateWindowExW
MessageBoxW
SendMessageW
GetKeyboardLayoutList
EndPaint
SetTimer
GetWindowRect
CharNextW
FillRect
wvsprintfW
LoadImageW
BeginPaint
InvalidateRect
GetWindowLongW
SetWindowLongW
CallWindowProcW
DefWindowProcW
CopyRect
LoadStringW
LoadCursorW
UnregisterClassA
UpdateLayeredWindow
MessageBoxIndirectW
ShowWindow
LoadIconW
SetParent
MoveWindow
SystemParametersInfoW
SetFocus
SetForegroundWindow
DestroyWindow
DispatchMessageW
GetMonitorInfoW
IsWindowVisible
MonitorFromWindow
TranslateMessage
GetMessageW
SetActiveWindow
ReleaseDC
GetDC
IsWindowEnabled
GetSystemMetrics
SetRectEmpty
GetPropW
ReleaseCapture
GetCursorPos
SetPropW
TrackMouseEvent
GetKeyState
SetCapture
IsIconic
PostQuitMessage
ScreenToClient
SetCursor
ClientToScreen
GetDesktopWindow
DrawTextW
PtInRect
OffsetRect
GetFocus

gdi32

GetFontData
CreateCompatibleDC
SelectObject
GetTextExtentExPointW
GetStockObject
SetTextColor
CreateFontIndirectW
SetBkMode
CreateDIBSection
CreateCompatibleBitmap
BitBlt
SetViewportOrgEx
DeleteDC
StretchBlt
DeleteObject

advapi32

RegCreateKeyExW
RegDeleteValueW
LookupAccountSidW
GetTokenInformation
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
RegUnLoadKeyW
RegLoadKeyW
ConvertSidToStringSidW
AdjustTokenPrivileges
RegEnumKeyExW
RegFlushKey
RegEnumValueW
LookupPrivilegeValueW
LookupAccountNameW
RegQueryInfoKeyW
RegOpenKeyW
RegQueryValueExW
RegEnumKeyW
RegCreateKeyW
OpenProcessToken
SetSecurityDescriptorSacl
GetLengthSid
BuildExplicitAccessWithNameW
GetSecurityDescriptorSacl
SetEntriesInAclW
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHBrowseForFolderW
ShellExecuteExW
SHGetFolderPathW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
ShellExecuteW

ole32

CoCreateInstance
CoTaskMemFree
CoInitialize

oleaut32

VariantInit
SysStringLen
SysAllocString
SysFreeString

imm32

ImmInstallIMEW
ImmGetIMEFileNameW

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

msimg32

AlphaBlend

Exports

Exports

AddAccess
AddAccessExec
AddAccessOnReg
AddAccess_RX
AddIE7ElevationPolicy
AddSogouImeMgrSchTasks
AttachProgressBar
CancelDelayDelDir
CheckAccess
CmpFile
DefaultBrowserIsIE
DelayDelFile
DelayDelReg
DownloadQuiet
FilterSid
GetCheckBoxState
GetFeedBackContact
GetFeedBackReason
GetHWID
GetHwndImage
GetHwndMain
GetInstallPath
GetPPName
GetVerifyText
GuiInitAndAttach
HideChildWindows
ImageInstallingStart
InitResource
InstallIME
InstalledIMEIsPre30b1
IsInWin8
MonitorUninstallCompleted
MonitorVerifyEdit
MonitorVerifyUninstallSelect
MoveImeDir
OnAbort
OnPageLeave
OnPagePre
OnPageShow
OpenPage
Ping
PluginToComp
ReadIniStr
RemoveDir
RemoveFireWall
RemoveIE7ElevationPolicy
RemoveSogouImeMgrSchTasks
SECheckOSInstalled
SetCheckBoxState
SetLowLabel
SetMutex
SetReadSecond
SetReboot
SetUrlInvite
SwitchIme
UnGuiInitAndAttach
UninstallInstPath
UninstallReg
UninstallUsrReg
UpdateFireWall

Sections

.text
Size: 602KB - Virtual size: 601KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SetupUi.cupf
$PLUGINSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

76425a6bf7de7281c168fc404d750a38

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\bin\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
QueryPerformanceCounter
GlobalAddAtomW
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetWaitableTimer
GetCurrentThread
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
InterlockedIncrement
MultiByteToWideChar
ResumeThread
CloseHandle
Sleep
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
WriteFile
ReadFile
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
GetTickCount
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
FreeLibrary
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
GetWindowsDirectoryA
LoadLibraryA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
lstrlenW
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
LoadImageW
SetRect
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
GetCursor
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
RedrawWindow
TranslateMessage
GetAsyncKeyState
ScreenToClient
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadIconW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW

gdi32

DeleteDC
CreateDIBSection
SetPixel
DeleteObject
SelectObject
StretchBlt
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
CreateCompatibleDC
CreateFontW

advapi32

InitializeSecurityDescriptor
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
AddAccessAllowedAceEx
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmGetContext
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/SogouPY64.ime
.dll windows:5 windows x64 arch:x64

3b0158dc48f480969a202b6dce48de37

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\bin\SogouInput\SogouPy64.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

LCMapStringW
QueryPerformanceFrequency
OpenEventW
QueryPerformanceCounter
GlobalGetAtomNameW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetWaitableTimer
GlobalAddAtomW
GetCurrentThread
SetThreadPriority
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
DeleteFileW
MultiByteToWideChar
ResumeThread
CloseHandle
Sleep
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
WriteFile
ReadFile
SetFilePointer
RtlCaptureContext
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
RtlVirtualUnwind
FormatMessageW
lstrlenW
RtlLookupFunctionEntry
GetLocalTime
GetTickCount
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
DuplicateHandle
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
FreeLibrary
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
GetWindowsDirectoryA
LoadLibraryA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
FlsSetValue
GetCommandLineA
FileTimeToLocalFileTime
GetDriveTypeW
Module32NextW
DecodePointer
FlsGetValue
FlsFree
FlsAlloc
RtlUnwindEx
GetDriveTypeA
FindFirstFileA
RtlPcToFileHeader
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapSetInformation
HeapCreate
HeapDestroy
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetDateFormatA
GetTimeFormatA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
Module32FirstW
lstrcatW
EncodePointer

user32

ScreenToClient
SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
LoadImageW
GetCursor
GetAsyncKeyState
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetSysColorBrush
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
TranslateMessage
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
PeekMessageW
MsgWaitForMultipleObjectsEx
SetRect
RedrawWindow
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
GetWindowLongW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongPtrW
LoadIconW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongPtrW
PostMessageW
IsRectEmpty
DispatchMessageW

gdi32

DeleteDC
CreateDIBSection
SetPixel
DeleteObject
SelectObject
CreateCompatibleDC
GetPixel
StretchBlt
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CombineRgn
CreateSolidBrush
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
GetObjectW
CreateFontW

advapi32

AddAccessAllowedAceEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
RegSetValueExW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmGetContext
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 220KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.SogouIn
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/install0.bmp
$PLUGINSDIR/install1.bmp
$PLUGINSDIR/install2.bmp
$PLUGINSDIR/install3.bmp
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$SYSDIR/SogouPY.ime
.dll windows:5 windows x86 arch:x86

76425a6bf7de7281c168fc404d750a38

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\bin\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
QueryPerformanceCounter
GlobalAddAtomW
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetWaitableTimer
GetCurrentThread
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
InterlockedIncrement
MultiByteToWideChar
ResumeThread
CloseHandle
Sleep
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
WriteFile
ReadFile
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
GetTickCount
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
FreeLibrary
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
GetWindowsDirectoryA
LoadLibraryA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
lstrlenW
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
LoadImageW
SetRect
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
GetCursor
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
RedrawWindow
TranslateMessage
GetAsyncKeyState
ScreenToClient
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadIconW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW

gdi32

DeleteDC
CreateDIBSection
SetPixel
DeleteObject
SelectObject
StretchBlt
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
CreateCompatibleDC
CreateFontW

advapi32

InitializeSecurityDescriptor
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
AddAccessAllowedAceEx
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmGetContext
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPY.ime~
.dll windows:5 windows x86 arch:x86

76425a6bf7de7281c168fc404d750a38

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\bin\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
QueryPerformanceCounter
GlobalAddAtomW
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetWaitableTimer
GetCurrentThread
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
InterlockedIncrement
MultiByteToWideChar
ResumeThread
CloseHandle
Sleep
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
WriteFile
ReadFile
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
GetTickCount
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
FreeLibrary
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
GetWindowsDirectoryA
LoadLibraryA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
lstrlenW
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
LoadImageW
SetRect
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
GetCursor
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
RedrawWindow
TranslateMessage
GetAsyncKeyState
ScreenToClient
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadIconW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW

gdi32

DeleteDC
CreateDIBSection
SetPixel
DeleteObject
SelectObject
StretchBlt
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
CreateCompatibleDC
CreateFontW

advapi32

InitializeSecurityDescriptor
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
AddAccessAllowedAceEx
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmGetContext
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$SYSDIR/SogouPy.ime
.dll windows:5 windows x86 arch:x86

76425a6bf7de7281c168fc404d750a38

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\bin\SogouInput\SogouPy.pdb

Imports

msimg32

AlphaBlend
TransparentBlt
GradientFill

kernel32

GlobalGetAtomNameW
LCMapStringW
QueryPerformanceFrequency
OpenEventW
QueryPerformanceCounter
GlobalAddAtomW
DeleteFileW
LoadLibraryW
CreateSemaphoreW
ReleaseSemaphore
CreateThread
DeleteCriticalSection
CreateWaitableTimerW
OpenThread
InitializeCriticalSection
WaitForSingleObject
SetWaitableTimer
GetCurrentThread
SetThreadPriority
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
OpenFileMappingW
InterlockedIncrement
MultiByteToWideChar
ResumeThread
CloseHandle
Sleep
GetQueuedCompletionStatus
SetEvent
TransactNamedPipe
InterlockedExchange
ResetEvent
CreateEventW
CreateIoCompletionPort
WaitNamedPipeW
CreateFileW
SetNamedPipeHandleState
WriteFile
ReadFile
SetFilePointer
VirtualQuery
CreateProcessW
SetUnhandledExceptionFilter
GetCurrentProcess
OutputDebugStringW
FormatMessageW
GetTickCount
GetLocalTime
lstrcatW
IsDebuggerPresent
lstrcpyW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
CreateDirectoryW
ExitThread
SetLastError
LocalFree
GetTempPathW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
FindFirstFileW
MoveFileExW
OpenProcess
GetSystemDirectoryW
FindClose
RemoveDirectoryW
FindNextFileW
SetFileAttributesW
CopyFileW
FileTimeToSystemTime
GetFileTime
TlsAlloc
TlsFree
CreateMutexW
OpenMutexW
ReleaseMutex
CreateFileMappingW
FreeLibrary
LocalAlloc
GetFileSize
FlushFileBuffers
GetVersionExW
OpenWaitableTimerW
LoadLibraryExW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CompareStringW
MulDiv
GlobalHandle
GlobalReAlloc
CreateFileA
CreateFileMappingA
OpenFileMappingA
GetWindowsDirectoryA
LoadLibraryA
RaiseException
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetTimeZoneInformation
HeapReAlloc
TerminateProcess
UnhandledExceptionFilter
ExitProcess
GetCommandLineA
GetDriveTypeW
RtlUnwind
GetDriveTypeA
FindFirstFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFullPathNameW
GetCurrentDirectoryA
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetModuleHandleA
GetFullPathNameA
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetProcessHeap
GetCurrentThreadId
EnterCriticalSection
GetProcAddress
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InterlockedCompareExchange
GetCurrentProcessId
GetModuleFileNameA
GlobalFree
GlobalUnlock
GetModuleFileNameW
GlobalAlloc
TlsSetValue
GlobalLock
TlsGetValue
GetCommandLineW
WideCharToMultiByte
lstrlenW
FileTimeToLocalFileTime

user32

SetMenuItemInfoW
SetMenuInfo
CreatePopupMenu
GetSysColor
AppendMenuW
SetMenuItemBitmaps
FillRect
LoadStringW
TrackPopupMenuEx
GetMenuItemRect
MenuItemFromPoint
GetMenuItemID
SetWindowTextW
LoadBitmapW
EndDialog
GetDlgItem
GetKeyboardLayoutList
CreateDialogParamW
BeginPaint
DialogBoxParamW
DrawTextW
EndPaint
SetClipboardData
SetCaretPos
OpenClipboard
GetCaretPos
EmptyClipboard
CloseClipboard
ClientToScreen
DefWindowProcW
RegisterClassExW
UnregisterClassW
InflateRect
LoadImageW
SetRect
SetWindowRgn
IntersectRect
SubtractRect
CallWindowProcW
TrackMouseEvent
SetCursorPos
GetPropW
SetPropW
GetClassInfoExW
SetScrollInfo
PostQuitMessage
PostThreadMessageW
IsRectEmpty
GetCursor
DispatchMessageW
SetRectEmpty
SetCursor
UpdateLayeredWindow
SetTimer
MonitorFromPoint
SetCapture
LoadCursorW
GetClientRect
PtInRect
GetDC
OffsetRect
ReleaseDC
SetWindowPos
GetCursorPos
CreateWindowExW
EqualRect
ReleaseCapture
GetMonitorInfoW
CopyRect
wvsprintfW
RedrawWindow
TranslateMessage
GetAsyncKeyState
ScreenToClient
MoveWindow
EnumWindows
KillTimer
UnregisterHotKey
RegisterHotKey
GetWindowThreadProcessId
DestroyWindow
InvalidateRect
IsWindowVisible
GetWindowRect
IsIconic
SetForegroundWindow
FindWindowW
SystemParametersInfoW
ShowWindow
GetSystemMetrics
RegisterWindowMessageW
SendMessageTimeoutW
keybd_event
SendInput
GetMessageExtraInfo
GetKeyState
GetFocus
GetParent
GetWindowTextW
GetClassNameW
GetDesktopWindow
GetWindowLongW
LoadIconW
GetMenuItemInfoW
GetMenuItemCount
IsWindow
GetMenuInfo
DestroyMenu
GetKeyboardState
GetForegroundWindow
MessageBoxW
SendMessageW
SetWindowLongW
PostMessageW
MsgWaitForMultipleObjectsEx
PeekMessageW

gdi32

DeleteDC
CreateDIBSection
SetPixel
DeleteObject
SelectObject
StretchBlt
GetObjectW
GetPixel
Rectangle
OffsetRgn
StretchDIBits
GetCharABCWidthsFloatW
GetTextExtentPoint32W
ExtCreateRegion
SetMapMode
SetBkColor
CreateSolidBrush
CombineRgn
GetClipRgn
MoveToEx
LineTo
SetTextColor
SetBkMode
SelectClipRgn
CreateCompatibleBitmap
GetTextExtentExPointW
CreateRectRgn
CreatePen
GetFontData
GetStockObject
BitBlt
GetTextMetricsW
CreateFontIndirectW
GetDeviceCaps
GetTextExtentPointW
CreateCompatibleDC
CreateFontW

advapi32

InitializeSecurityDescriptor
SetNamedSecurityInfoW
GetNamedSecurityInfoW
InitializeAcl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
GetSecurityDescriptorSacl
BuildExplicitAccessWithNameW
GetLengthSid
SetSecurityDescriptorSacl
RegOpenKeyW
RegQueryValueW
AddAccessAllowedAceEx
RegSetValueExW
RegEnumValueW
RegDeleteKeyW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SetSecurityDescriptorDacl
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

imm32

ImmGetHotKey
ImmGenerateMessage
ImmGetIMCCSize
ImmCreateIMCC
ImmReSizeIMCC
ImmNotifyIME
ImmGetContext
ImmDisableIME
ImmLockIMCC
ImmUnlockIMC
ImmAssociateContextEx
ImmLockIMC
ImmUnlockIMCC

Exports

Exports

ImeConfigure
ImeConversionList
ImeDestroy
ImeEnumRegisterWord
ImeEscape
ImeGetRegisterWordStyle
ImeInquire
ImeProcessKey
ImeRegisterWord
ImeSelect
ImeSetActiveContext
ImeSetCompositionString
ImeToAsciiEx
ImeUnregisterWord
NotifyIME

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 89KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 138KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6.5.8.9174/HWSignature.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\Bin\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
6.5.8.9174/SetupUi.cupf
SogouExe/HWSignatureEx.dll
.dll windows:5 windows x86 arch:x86

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29-01-1996 00:00

Not After

01-08-2028 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

07-11-2021 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

25-06-2012 00:00

Not After

24-08-2015 23:59

Subject

CN=Sogou.com,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Desktop,O=Sogou.com,L=Beijing,ST=Beijing,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\PinyinDev_R_6_5_win8\Bin\SogouInput\HWSignature.pdb

Imports

ws2_32

WSAStartup

kernel32

DeleteCriticalSection
CreateFileA
HeapAlloc
HeapFree
GetProcessHeap
GetSystemDirectoryA
lstrcatA
CopyFileA
DeviceIoControl
CloseHandle
lstrcpyA
lstrlenA
GlobalAlloc
FreeLibrary
GetLastError
GetProcAddress
LoadLibraryA
LocalAlloc
GetVersionExA
LocalFree
HeapReAlloc
GetTickCount
SetLastError
GlobalFree
FlushFileBuffers
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
VirtualAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize

user32

wsprintfA
IsCharAlphaNumericA

Exports

Exports

DLLGenHWID
GenHWID
GetDllVersionA

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:5 windows x86 arch:x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
԰.txt
԰.url

Sharing

General

Malware Config

Signatures

Files

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.8MB

UPX1 Size: 20KB - Virtual size: 20KB

.rsrc Size: 142KB - Virtual size: 144KB

02a9058c889f86b891a63b683ab98a79

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bfCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fdCertificate

Extended Key Usages

Key Usages

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9dCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

PDB Paths

Imports

ws2_32

kernel32

user32

Exports

Exports

Sections

.text Size: 45KB - Virtual size: 44KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 4KB - Virtual size: 3KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

UPX0
Size: - Virtual size: 1.8MB

UPX1
Size: 20KB - Virtual size: 20KB

.rsrc
Size: 142KB - Virtual size: 144KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 45KB - Virtual size: 44KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 1024B - Virtual size: 17KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

.text
Size: 602KB - Virtual size: 601KB

.rdata
Size: 124KB - Virtual size: 124KB

.data
Size: 19KB - Virtual size: 41KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 38KB - Virtual size: 37KB

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

25:0c:e8:e0:30:61:2e:9f:2b:89:f7:05:4d:7c:f8:fd
Certificate

59:b9:5d:55:8c:2d:cc:52:35:72:e3:f8:f9:a5:f7:9d
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate