ugokuecm[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

ugokuecm.zip
Size

418.1MB
MD5

2a5b2ac242ffe8bef4fc2d2508b248dc
SHA1

8f5a540a5c2bf13dd34c6e49e910f41c58dcbd87
SHA256

b19c330a037c36456d9fd9874865b9f398379fbf31ceb2735482c272e9c3e78d
SHA512

9caa337ecbbe70822ed28d60091193b34f802ddb9396af626880ad097f2f765522c0a547d5427e719bd269f6e0607b623783a837a0b0c2047843f0632dea14dd
SSDEEP

12582912:A+g/mcuBEsgQHp1ksv0mYAGh6Fj7Tpxayk+NalkO/yk:5gFPQJ1ksv0pWj7NvNLO6k

Score

9^/10

cryptone packer

Malware Config

Signatures

CryptOne packer 1 IoCs

Detects CryptOne packer defined in NCC blogpost.

cryptone packer

resource	yara_rule
static1/unpack001/Ugoku E.C.M. Collection (1-5) [FIXED]/ECM5.exe	cryptone

Files

ugokuecm.zip
.zip

Password: sussy
Ugoku E.C.M. Collection (1-5) [FIXED]/Chrome32 v53.0.2785.116.exe
.exe windows x86

Password: sussy

e6f39b3587ab9278fb99290006fa6b09

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
SysStringLen

ole32

CoCreateInstance
CoInitialize
CoUninitialize
OleInitialize

user32

CheckDlgButton
IsDlgButtonChecked
EndDialog
SetDlgItemTextW
GetFocus
SetFocus
GetKeyState
InvalidateRect
SetWindowTextW
EnableWindow
PostMessageW
MessageBoxW
SetTimer
DialogBoxParamW
SetWindowLongW
GetWindowLongW
ShowWindow
MoveWindow
ScreenToClient
GetDlgItem
GetWindowRect
MapDialogRect
SystemParametersInfoW
GetWindowTextLengthW
GetWindowTextW
SendMessageW
LoadStringW
CharUpperW
LoadIconW
GetParent
SetCursor
LoadCursorW
KillTimer

shell32

SHGetPathFromIDListW
SHBrowseForFolderW
SHGetFileInfoW
SHGetMalloc

msvcrt

memmove
memcpy
malloc
_CxxThrowException
free
wcsstr
wcscmp
wcslen
wcscat
_beginthreadex
_except_handler3
??1type_info@@UAE@XZ
?terminate@@YAXXZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_purecall
memcmp
__CxxFrameHandler
memset

kernel32

GetStartupInfoA
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
WaitForSingleObject
VirtualFree
VirtualAlloc
GetCurrentProcess
SetPriorityClass
DeleteCriticalSection
Sleep
EnterCriticalSection
LeaveCriticalSection
FileTimeToLocalFileTime
WaitForMultipleObjects
GetFileInformationByHandle
GetStdHandle
FileTimeToSystemTime
CompareFileTime
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetFileAttributesW
GetModuleHandleA
FindNextFileW
FindFirstFileW
FindClose
GetTickCount
GetCurrentDirectoryW
SetLastError
DeleteFileW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
SetFileAttributesW
CreateFileW
SetFileTime
CloseHandle
FormatMessageW
LocalFree
GetModuleFileNameW
MultiByteToWideChar
GetLastError
GetVersionExW
GetProcAddress
FreeLibrary
GetCommandLineW
LoadLibraryW

Sections

.text
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/ECM5.exe
.exe windows x86

Password: sussy

fb7edbaed2049fb3a26bdfb89c534f53

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
SetFilePointer
GetFileSize
CreateFileW
GetModuleFileNameA
GetCommandLineW
SetEndOfFile
WriteFile
CreateFileA
GetFileAttributesA
GetStartupInfoW
GetCommandLineA
ExitProcess
RemoveDirectoryW
CopyFileW
GetModuleFileNameW
GetCPInfo
GetACP
IsDBCSLeadByte
HeapSize
DeviceIoControl
CreateProcessA
GetTempPathA
FindNextFileW
GetSystemWow64DirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetLongPathNameW
CreateProcessW
GetTempFileNameA
CreateDirectoryA
DeleteFileA
GetFileAttributesW
CreateMutexA
SetFilePointerEx
GetFileSizeEx
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
MoveFileExW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
OutputDebugStringA
LoadLibraryA
GetSystemDirectoryA
FreeLibrary
GetVersionExW
GetCurrentProcess
VirtualQuery
ExitThread
GetUserDefaultLangID
GetUserDefaultUILanguage
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
GlobalAlloc
GlobalUnlock
GlobalLock
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalSize
QueueUserAPC
OpenThread
SleepEx
SetUnhandledExceptionFilter
GetCurrentProcessId
GetProcessTimes
RaiseException
FlushInstructionCache
SetLastError
TerminateThread
CreateEventW
SetEvent
ResetEvent
WaitForMultipleObjects
CreateWaitableTimerW
GetTickCount
SetThreadPriority
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
DebugBreak
GetModuleHandleW
LCMapStringW
GetExitCodeThread
DuplicateHandle
GetCurrentThread
MapViewOfFile
UnmapViewOfFile
CompareFileTime
ReleaseMutex
CreateFileMappingA
ReleaseSemaphore
CreateSemaphoreW
SetThreadAffinityMask
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
GetVersionExA
GetVersion
VirtualAlloc
VirtualFree
FlushFileBuffers
GlobalMemoryStatusEx
IsDebuggerPresent
SetSystemTime
FileTimeToSystemTime
TlsAlloc
TlsFree
ResumeThread
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateSemaphoreA
HeapAlloc
HeapFree
HeapUnlock
HeapWalk
HeapLock
HeapCreate
HeapDestroy
VirtualProtect
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
GetProcessAffinityMask
IsProcessorFeaturePresent
GetStartupInfoA
RtlUnwind
UnhandledExceptionFilter
GetSystemTimeAsFileTime
HeapReAlloc
GetStdHandle
TerminateProcess
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetOEMCP
IsValidCodePage
LCMapStringA
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CompareStringA
SetEnvironmentVariableA
LocalAlloc
GlobalMemoryStatus
FlushConsoleInputBuffer
GetProcAddress
WaitForSingleObject
GetExitCodeProcess
CloseHandle
FindFirstFileW
FindClose
GetSystemDirectoryW
LoadLibraryW
GetModuleHandleA
GetTempPathW
GetTempFileNameW
GetLastError
DeleteFileW
CreateDirectoryW
GetSystemInfo
SwitchToThread
TlsGetValue
TlsSetValue
GetCurrentThreadId
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
FindFirstFileA
EnterCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange
GetLocaleInfoW
Sleep
FileTimeToLocalFileTime
GetDriveTypeA
GetFullPathNameA
PeekNamedPipe
GetCurrentDirectoryA

advapi32

CryptEncrypt
CryptDestroyKey
CryptImportKey
CryptSetKeyParam
CryptGetHashParam
CryptHashData
CryptDestroyHash
CryptAcquireContextA
CryptCreateHash
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegOpenKeyA
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExW
CryptDecrypt

Exports

Exports

IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule
_WinMainSandboxed@20

Sections

.text
Size: 10.0MB - Virtual size: 10.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 863KB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 489KB - Virtual size: 489KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/MAIN.html
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/53.0.2785.116.manifest
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Extensions/external_extensions.json
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/am.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ar.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/bg.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/bn.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ca.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/cs.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/da.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/de.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/el.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/en-GB.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/en-US.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/es-419.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/es.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/et.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/fa.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/fi.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/fil.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/fr.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/gu.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/he.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/hi.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/hr.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/hu.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/id.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/it.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ja.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/kn.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ko.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/lt.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/lv.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ml.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/mr.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ms.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/nb.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/nl.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/pl.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/pt-BR.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/pt-PT.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ro.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ru.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/sk.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/sl.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/sr.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/sv.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/sw.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/ta.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/te.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/th.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/tr.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/uk.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/vi.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/zh-CN.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/Locales/zh-TW.pak
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/PepperFlash/manifest.json
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/PepperFlash/pepflashplayer.dll
.dll windows x86

Password: sussy

596c9b606aaebbc44b78357d784a061f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

04/03/2014, 00:00

Not After

03/03/2024, 23:59

Subject

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:a1:e8:9e:15:ea:4f:fa:93:79:84:d8:8f:54:5f:ba
Certificate

Issuer

CN=Symantec Class 3 Extended Validation Code Signing CA - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/05/2015, 00:00

Not After

07/05/2017, 23:59

Subject

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

9a:14:a3:bb:92:84:2b:38:ca:86:36:e4:dc:e6:ac:e8:3f:23:c9:64
Signer

Actual PE Digest

9a:14:a3:bb:92:84:2b:38:ca:86:36:e4:dc:e6:ac:e8:3f:23:c9:64

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Systems Incorporated,OU=Flash Player,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

30/08/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

crypt32

CryptVerifyMessageSignature
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertCreateCertificateContext
CertFreeCertificateContext
CertCompareCertificate
CertCloseStore
CryptGetMessageCertificates

shlwapi

ord12
UrlCanonicalizeW
AssocQueryStringW

gdiplus

GdiplusShutdown
GdiplusStartup
GdipFree
GdipDrawImageRect
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCloneImage
GdipDisposeImage
GdipGetImageGraphicsContext
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipAlloc

kernel32

DebugBreak
OutputDebugStringA
TlsAlloc
TlsFree
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
SleepEx
CreateEventW
QueueUserAPC
CreateThread
OpenThread
SetThreadPriority
ExitThread
VirtualQuery
GetFileSizeEx
ReadFile
SetFilePointerEx
WriteFile
GetVersionExW
GetModuleHandleW
GetProcAddress
CreateFileW
GetLastError
ConnectNamedPipe
DisconnectNamedPipe
GetCurrentProcessId
GetTickCount
MultiByteToWideChar
DeleteFileW
GetFileAttributesW
GetFileSize
SetLastError
ReleaseMutex
CreateMutexA
CreateProcessW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WideCharToMultiByte
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetFileAttributesExW
RemoveDirectoryW
GetSystemTimeAsFileTime
RaiseFailFastException
HeapSize
QueryPerformanceCounter
QueryPerformanceFrequency
HeapAlloc
HeapFree
GetProcessHeap
GetSystemTime
SystemTimeToFileTime
GetTimeZoneInformation
DecodePointer
RaiseException
InitializeCriticalSectionEx
TlsSetValue
CreateSemaphoreW
GetCurrentProcess
GetProcessAffinityMask
FreeLibrary
LoadLibraryA
VirtualAlloc
VirtualFree
CreateEventA
SetWaitableTimer
CancelWaitableTimer
GetCurrentThread
WaitForMultipleObjects
CreateWaitableTimerA
GetDateFormatW
GetTimeFormatW
RtlCaptureStackBackTrace
LCMapStringW
GetLocaleInfoW
GetNumberFormatW
GetCurrencyFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapCreate
HeapDestroy
HeapLock
HeapUnlock
HeapWalk
VirtualProtect
IsDebuggerPresent
GetProcessTimes
GlobalMemoryStatusEx
SetSystemTime
GetModuleFileNameA
FileTimeToSystemTime
GetACP
ResumeThread
CreateWaitableTimerW
GetStdHandle
GetFileType
GlobalMemoryStatus
LoadLibraryW
FlushConsoleInputBuffer
InitializeCriticalSectionAndSpinCount
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempFileNameW
GetFullPathNameW
CopyFileW
MoveFileExW
FlushFileBuffers
SetEndOfFile
EncodePointer
GetStringTypeW
GetCPInfo
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
OutputDebugStringW
ExpandEnvironmentStringsA
FormatMessageA
VerifyVersionInfoW
VerSetConditionMask
DeleteTimerQueueTimer
CreateTimerQueueTimer
lstrlenW
TlsGetValue
GetCurrentThreadId
SwitchToThread
Sleep
DeleteCriticalSection
lstrcpynW
LocalFree
LocalAlloc
GetNativeSystemInfo
InterlockedDecrement
InterlockedIncrement
DeviceIoControl
CreateFileA
WriteConsoleW
GetCommandLineW
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CompareStringW
GetSystemInfo
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
ReleaseSemaphore
GetCommandLineA
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetConsoleCP
CreateProcessA
GetExitCodeProcess
HeapReAlloc
SetConsoleMode
ReadConsoleInputA
SetConsoleCtrlHandler
RtlUnwind
GetModuleFileNameW
LoadLibraryExW
InterlockedFlushSList
SetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW

user32

GetDC
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
GetForegroundWindow
WaitForInputIdle
wsprintfW
WindowFromDC
GetClientRect
GetWindowRect
EnumDisplayDevicesA
MonitorFromRect
GetMonitorInfoA
GetMonitorInfoW
EnumDisplayMonitors
GetCursorPos
SetRectEmpty

advapi32

CryptDestroyKey
DeregisterEventSource
RegisterEventSourceW
ReportEventW
SystemFunction036
CryptAcquireContextW
CryptGenRandom
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
IsValidSid
CryptReleaseContext
CryptGenKey
CryptExportKey
CryptEncrypt
CryptImportKey

ole32

CoSetProxyBlanket
CoTaskMemAlloc
CoFreeUnusedLibraries
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree

shell32

SHCreateDirectoryExW
SHGetFolderPathW
ord165
ShellExecuteExW
ShellExecuteW

oleaut32

SysFreeString
SysStringLen
VariantInit
VariantClear
SysAllocString

gdi32

DeleteObject
DeleteDC
CreateFontIndirectW
CreateCompatibleDC
SelectObject
GetFontData
EnumFontFamiliesExW
CreateDCW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

htonl
ntohs
WSASetLastError
shutdown
send
select
gethostname
ioctlsocket
WSAIoctl
WSAGetLastError
setsockopt
recv
getsockopt
getsockname
bind
WSACleanup
closesocket
ntohl
htons

psapi

GetProcessMemoryInfo

winmm

timeGetTime
timeSetEvent
timeKillEvent

Exports

Exports

IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule
PPP_GetInterface
PPP_InitializeBroker
PPP_InitializeModule
PPP_ShutdownBroker
PPP_ShutdownModule
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape

Sections

.text
Size: 12.2MB - Virtual size: 12.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 796KB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 13B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 660B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 495KB - Virtual size: 494KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/VisualElements/logo.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/VisualElements/smalllogo.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/WidevineCdm/_platform_specific/win_x86/widevinecdm.dll
.dll windows x86

Password: sussy

968adcd6e5c66ae9297479cb5f318a06

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

af:e3:00:6f:62:d4:d3:ea:11:6a:16:21:5b:21:75:1c:66:45:e9:c5:c0:92:0a:d5:59:86:99:5a:f6:f5:24:f8
Signer

Actual PE Digest

af:e3:00:6f:62:d4:d3:ea:11:6a:16:21:5b:21:75:1c:66:45:e9:c5:c0:92:0a:d5:59:86:99:5a:f6:f5:24:f8

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

04/05/2016, 22:35
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateEventW
CreateSemaphoreW
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
WaitForSingleObject
Sleep
SetEvent
SetThreadPriority
GetSystemInfo
TryEnterCriticalSection
QueryPerformanceCounter
IsDebuggerPresent
GetCurrentProcess
CreateThread
GetCurrentThreadId
CreateFileW
WriteFile
SetLastError
GetCurrentProcessId
GetModuleFileNameW
GetSystemTimeAsFileTime
GetModuleHandleExW
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SwitchToThread
SetEndOfFile
CloseHandle
GetVersionExW
GetProcAddress
GetModuleHandleW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
DecodePointer
IsValidCodePage
GetACP
GetOEMCP
FlushFileBuffers
SetStdHandle
SetFilePointerEx
WriteConsoleW
ReadConsoleW
SetEnvironmentVariableA
HeapSize
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetModuleFileNameA
GetFileType
GetStdHandle
GetProcessHeap
LCMapStringW
CompareStringW
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
ReadFile
AreFileApisANSI
ExitProcess
WideCharToMultiByte
EncodePointer
MultiByteToWideChar
GetStringTypeW
OutputDebugStringW
GetCommandLineA
IsProcessorFeaturePresent
HeapFree
RtlUnwind
HeapAlloc
HeapReAlloc
ExitThread
LoadLibraryExW
GetConsoleCP
GetConsoleMode

ole32

CoTaskMemFree

user32

EnumDisplayMonitors
GetMonitorInfoW

Exports

Exports

CreateCdmInstance
DeinitializeCdmModule
GetCdmVersion
InitializeCdmModule_4

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 651KB - Virtual size: 651KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 921KB - Virtual size: 968KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 954KB - Virtual size: 954KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/WidevineCdm/_platform_specific/win_x86/widevinecdmadapter.dll
.dll windows x86

Password: sussy

e9bbf41289fa2ac583cb3ff35a8d9b72

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

26:6f:a5:99:49:45:2c:bc:88:cb:72:6d:72:cc:be:33:85:11:53:b5:a8:ac:29:bd:74:ce:9c:b0:ca:e0:91:e6
Signer

Actual PE Digest

26:6f:a5:99:49:45:2c:bc:88:cb:72:6d:72:cc:be:33:85:11:53:b5:a8:ac:29:bd:74:ce:9c:b0:ca:e0:91:e6

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

e8:99:c5:a3:2d:d4:76:a2:0d:a1:e2:45:b8:5a:95:08:8e:8b:bb:98
Signer

Actual PE Digest

e8:99:c5:a3:2d:d4:76:a2:0d:a1:e2:45:b8:5a:95:08:8e:8b:bb:98

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

widevinecdm

CreateCdmInstance
DeinitializeCdmModule
InitializeCdmModule_4

kernel32

EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
GetLastError
GetModuleFileNameW
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapFree
HeapReAlloc
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
CloseHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
WriteConsoleW
ReadConsoleW
HeapSize
CreateFileW

advapi32

SystemFunction036

Exports

Exports

PPP_GetInterface
PPP_InitializeModule
PPP_ShutdownModule

Sections

.text
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 55KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/WidevineCdm/manifest.json
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/chrome.dll
.dll windows x86

Password: sussy

227ebd1e4985034ec155476539f8fbb7

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bf:53:f1:71:dc:f4:ba:3a:0d:2f:68:cc:4b:c2:ce:26:84:da:f0:a5:b8:b0:0a:84:c1:35:ea:3a:04:c2:d1:83
Signer

Actual PE Digest

bf:53:f1:71:dc:f4:ba:3a:0d:2f:68:cc:4b:c2:ce:26:84:da:f0:a5:b8:b0:0a:84:c1:35:ea:3a:04:c2:d1:83

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

44:af:a0:4b:5a:f0:cd:89:3c:09:08:ac:1c:e2:50:0a:4f:79:08:a2
Signer

Actual PE Digest

44:af:a0:4b:5a:f0:cd:89:3c:09:08:ac:1c:e2:50:0a:4f:79:08:a2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

EnumProcessModules
GetMappedFileNameW
QueryWorkingSetEx
GetModuleInformation
QueryWorkingSet
GetProcessMemoryInfo

shlwapi

AssocQueryStringW
PathRemoveExtensionW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW
ord437

userenv

UnregisterGPNotification
RegisterGPNotification
GetAppliedGPOListW
FreeGPOListW
DestroyEnvironmentBlock
CreateEnvironmentBlock

hid

HidD_GetProductString
HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetAttributes
HidP_GetValueCaps
HidP_GetButtonCaps
HidP_GetCaps
HidD_GetSerialNumberString

kernel32

ResumeThread
AttachConsole
CreateProcessW
HeapSetInformation
GetUserDefaultUILanguage
GetLocaleInfoW
SetUnhandledExceptionFilter
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetSystemDirectoryW
GetWindowsDirectoryW
QueueUserWorkItem
lstrcmpiA
GetUserDefaultLangID
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
ReleaseSRWLockShared
AcquireSRWLockShared
HeapLock
HeapWalk
GetProcessHeaps
HeapUnlock
VirtualFree
VirtualAlloc
OpenFileMappingW
GetProcessIoCounters
GetSystemInfo
VirtualQueryEx
HeapAlloc
HeapReAlloc
HeapFree
InitializeSRWLock
InitOnceExecuteOnce
LockFileEx
UnlockFileEx
GetFileType
GetNamedPipeInfo
FormatMessageW
GlobalFree
CancelIo
SetFilePointer
ReleaseSemaphore
CreateSemaphoreW
ExitProcess
InitializeCriticalSection
ReleaseMutex
CreateMutexW
GetModuleFileNameA
CreateFileA
GetFullPathNameW
HeapCreate
AreFileApisANSI
GetSystemTime
GetProcessHeap
GetFileSize
CreateFileMappingA
HeapDestroy
HeapCompact
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
GetFullPathNameA
GetDiskFreeSpaceW
TryEnterCriticalSection
IsProcessInJob
AssignProcessToJobObject
ConnectNamedPipe
CreateNamedPipeW
GetTimeZoneInformation
GetThreadTimes
GetTempFileNameA
IsWow64Process
CreateSemaphoreA
CreateEventA
SuspendThread
GetThreadContext
OpenThread
SetThreadExecutionState
PowerCreateRequest
PowerSetRequest
FlushFileBuffers
GetSystemPowerStatus
GetGeoInfoW
GetUserGeoID
GetOverlappedResult
DeviceIoControl
VirtualAllocEx
DebugActiveProcess
GetComputerNameW
SetFilePointerEx
UnlockFile
SetEndOfFile
LockFile
SetFileTime
GetFileSizeEx
SetEvent
WaitForMultipleObjects
FindCloseChangeNotification
FindFirstChangeNotificationW
GetPriorityClass
OpenProcess
TerminateProcess
SetPriorityClass
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetModuleHandleExA
CreateThread
WideCharToMultiByte
FindClose
FindNextFileW
FindFirstFileExW
FindFirstFileW
GetNativeSystemInfo
GetVersionExW
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
ExpandEnvironmentStringsW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
GetModuleHandleExW
RtlCaptureStackBackTrace
GetEnvironmentVariableW
SetEnvironmentVariableW
MoveFileW
MapViewOfFile
CreateFileMappingW
GetTempFileNameW
CopyFileW
ReplaceFileW
MoveFileExW
SetCurrentDirectoryW
GetFileAttributesExW
GetLogicalDriveStringsW
SetFileAttributesW
DefineDosDeviceW
GetConsoleDisplayMode
MulDiv
FlushInstructionCache
InterlockedPopEntrySList
SetHandleInformation
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
UnregisterWaitEx
QueryInformationJobObject
RegisterWaitForSingleObject
UnmapViewOfFile
GetFileAttributesW
GetVolumePathNameW
GetTempPathW
GetLongPathNameW
GetFileInformationByHandleEx
GetVolumeInformationW
QueryDosDeviceW
ReadFile
CreateDirectoryW
GetTickCount
FormatMessageA
GetCurrentDirectoryW
DeleteFileW
OutputDebugStringA
WriteFile
VirtualQuery
GetCurrentProcessId
GetModuleHandleA
GetProcessId
VirtualProtect
GetProcessTimes
QueryPerformanceCounter
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetThreadPriority
QueryPerformanceFrequency
GetCurrentThread
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
Sleep
QueryThreadCycleTime
SetThreadPriority
GetCommandLineW
IsDebuggerPresent
LocalFree
LoadLibraryW
RemoveDirectoryW
CloseHandle
CreateFileW
LockResource
CompareStringW
GetDateFormatW
GetExitCodeProcess
WaitForSingleObject
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
MultiByteToWideChar
lstrcmpiW
FindResourceW
SizeofResource
LoadResource
LoadLibraryExW
FreeLibrary
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetComputerNameExW
CreateEventW
ResetEvent
SetLastError
QueryFullProcessImageNameW
GetModuleFileNameW
WriteConsoleW
ReadConsoleW
AllocConsole
FreeConsole
SetConsoleTextAttribute
GetStdHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetErrorMode
GetLastError
RaiseException
GetModuleHandleW
GetProcAddress
DecodePointer
LoadLibraryExA
EncodePointer
LCMapStringW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
SetConsoleCtrlHandler
GetConsoleCP
GetConsoleMode
SetStdHandle
GetDriveTypeW
PeekNamedPipe
GetACP
ExitThread
FreeLibraryAndExitThread
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetOEMCP
FindFirstFileExA
FindNextFileA
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
OpenEventW
Module32FirstW
Module32NextW
GlobalSize
GlobalLock
GlobalUnlock
WTSGetActiveConsoleSessionId
GetLocaleInfoA
GetNumberFormatW
GetCurrencyFormatW
GetThreadLocale
GlobalAlloc
GetPrivateProfileStringW
GetProcessAffinityMask
TerminateThread
SetThreadAffinityMask
SleepEx
SwitchToThread
ClearCommBreak
ClearCommError
EscapeCommFunction
GetCommModemStatus
GetCommState
PurgeComm
SetCommBreak
SetCommMask
SetCommState
SetCommTimeouts
WaitCommEvent
LocalAlloc
GetLocalTime
ContinueDebugEvent
WaitForDebugEvent
SetThreadContext
ReadProcessMemory
WriteProcessMemory
GetThreadSelectorEntry
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
PowerClearRequest

gdi32

SetRectRgn
GetICMProfileW
SetDIBits
SetBrushOrgEx
SetArcDirection
SetStretchBltMode
SetROP2
SetDCPenColor
SetDCBrushColor
AddFontMemResourceEx
GetFontUnicodeRanges
EnumFontFamiliesExW
GdiFlush
GetFontData
SetBkMode
GetTextExtentPointI
GetGlyphIndicesW
GetCharABCWidthsW
GetGlyphOutlineW
RemoveFontMemResourceEx
GetOutlineTextMetricsW
CreatePolygonRgn
ExtEscape
StretchDIBits
EnumEnhMetaFile
GetEnhMetaFileBits
GetEnhMetaFileHeader
PlayEnhMetaFile
PlayEnhMetaFileRecord
SetEnhMetaFileBits
CreateDIBSection
CancelDC
SetAbortProc
CombineRgn
CreateRectRgn
CreateRectRgnIndirect
EqualRgn
GetRgnBox
SelectClipRgn
GetDIBits
SetDIBitsToDevice
GdiAlphaBlend
PtInRegion
ModifyWorldTransform
GetWorldTransform
SetTextColor
StretchBlt
SetBkColor
CreateSolidBrush
CreateCompatibleBitmap
CreateBitmap
BitBlt
ExtTextOutW
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
GetStockObject
GetTextMetricsW
SetMapMode
GetTextExtentPoint32W
CreateCompatibleDC
GetTextFaceW
GetObjectW
SelectObject
DeleteObject
CreateFontW
CreateFontIndirectW
EndPage
StartPage
EndDoc
StartDocW
SetWorldTransform
SetGraphicsMode
SaveDC
RestoreDC
GetDeviceCaps
DeleteDC
CreateDCW
SetTextAlign

ole32

CoAllowSetForegroundWindow
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CreateStreamOnHGlobal
DoDragDrop
RevokeDragDrop
GetHGlobalFromStream
CoSetProxyBlanket
CoGetClassObject
CoGetObject
PropVariantClear
CoUninitialize
CoInitializeEx
CLSIDFromString
CoCreateGuid
RegisterDragDrop
OleUninitialize
OleInitialize
ReleaseStgMedium
OleDuplicateData
StringFromGUID2

oleaut32

LoadRegTypeLi
LoadTypeLi
VariantClear
SysAllocString
SysStringLen
VarUI4FromStr
VariantTimeToSystemTime
SysFreeString

rpcrt4

UuidCreateSequential
UuidToStringW
RpcStringFreeW
UuidCreate

advapi32

SetFileSecurityW
RevertToSelf
StartTraceW
ControlTraceW
ImpersonateAnonymousToken
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptGetHashParam
CryptSetHashParam
CryptDestroyKey
CryptGenKey
CryptReleaseContext
CloseTrace
ProcessTrace
OpenTraceW
RegQueryValueExA
RegOpenKeyExA
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumValueW
GetTokenInformation
ConvertSidToStringSidW
OpenProcessToken
GetSidSubAuthority
GetSidSubAuthorityCount
RegQueryValueExW
RegNotifyChangeKeyValue
CreateProcessAsUserW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
SystemFunction036
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupAccountNameW
LogonUserW
CryptAcquireContextW
GetFileSecurityW
ConvertSecurityDescriptorToStringSecurityDescriptorW
RegEnumValueA

secur32

QuerySecurityPackageInfoW
AcquireCredentialsHandleW
DeleteSecurityContext
InitializeSecurityContextW
GetUserNameExW
FreeContextBuffer
FreeCredentialsHandle

winmm

midiOutOpen
timeBeginPeriod
timeGetTime
timeEndPeriod
midiInGetID
midiInReset
midiInStart
midiInAddBuffer
midiInUnprepareHeader
midiInPrepareHeader
midiInClose
midiInOpen
midiInGetDevCapsW
midiInGetNumDevs
midiOutGetID
midiOutReset
midiOutLongMsg
midiOutShortMsg
waveInGetNumDevs
waveInMessage
waveOutGetDevCapsW
waveInGetDevCapsW
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
waveOutOpen
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutPause
waveOutRestart
waveOutReset
midiOutGetNumDevs
midiOutGetDevCapsW
waveOutGetNumDevs
midiOutClose
midiOutPrepareHeader
midiOutUnprepareHeader

comctl32

InitCommonControlsEx

wtsapi32

WTSQueryUserToken
WTSUnRegisterSessionNotification
WTSFreeMemory
WTSQuerySessionInformationW
WTSRegisterSessionNotification

chrome_elf

SuccessfullyBlocked
GetBlacklistIndex
IsBlacklistInitialized

usp10

ScriptShape
ScriptStringAnalyse
ScriptStringFree
ScriptStringOut
ScriptFreeCache
ScriptItemize

netapi32

NetApiBufferFree
NetUserGetInfo

credui

CredUIPromptForCredentialsW

oleacc

LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

Exports

Exports

ChromeMain
GetHandleVerifier
RelaunchChromeBrowserWithNewCommandLineIfNeeded
nacl_global_xlate_base
nacl_thread_ids
nacl_user

Sections

.text
Size: 28.5MB - Virtual size: 28.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 486KB - Virtual size: 700KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.syzygy
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/chrome_100_percent.pak
.js
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/chrome_200_percent.pak
.js
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/chrome_child.dll
.dll windows x86

Password: sussy

da69ca76e5ac2f284b12eb4c42025f03

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

9b:af:fc:05:e1:1e:e7:40:f7:d7:b8:8b:8c:df:1b:1b:3b:54:13:01:fb:b0:da:91:c3:b2:f1:e2:e1:18:91:ee
Signer

Actual PE Digest

9b:af:fc:05:e1:1e:e7:40:f7:d7:b8:8b:8c:df:1b:1b:3b:54:13:01:fb:b0:da:91:c3:b2:f1:e2:e1:18:91:ee

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

e3:60:88:b1:cd:2f:ad:2a:a6:cb:c3:bd:da:92:7c:80:24:24:00:a0
Signer

Actual PE Digest

e3:60:88:b1:cd:2f:ad:2a:a6:cb:c3:bd:da:92:7c:80:24:24:00:a0

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

EnumProcessModules
GetProcessMemoryInfo
QueryWorkingSet

shlwapi

PathGetCharTypeW

gdi32

SetPolyFillMode
SetStretchBltMode
BeginPath
CloseFigure
EndPath
FillPath
SelectClipPath
SetMiterLimit
StrokeAndFillPath
StrokePath
WidenPath
ExtCreatePen
MoveToEx
SetDIBitsToDevice
GetTextFaceA
GetTextExtentPointI
SetBkMode
SetTextColor
GdiFlush
EnumFontFamiliesExW
GetFontUnicodeRanges
AddFontMemResourceEx
SetBkColor
SetDCBrushColor
SetDCPenColor
SetROP2
SetArcDirection
SetBrushOrgEx
ChoosePixelFormat
SetPixelFormat
SwapBuffers
StretchBlt
LineTo
GetObjectType
GetDIBits
GetClipBox
CreateSolidBrush
CreatePen
CreateFontA
CreateCompatibleBitmap
CreateBitmap
GetOutlineTextMetricsW
GetFontData
GetCharWidthW
CreateFontIndirectA
EnumFontFamiliesExA
CreateDIBSection
SetWorldTransform
GetWorldTransform
SetEnhMetaFileBits
PlayEnhMetaFileRecord
PlayEnhMetaFile
GetEnhMetaFileHeader
GetEnhMetaFileBits
EnumEnhMetaFile
DeleteEnhMetaFile
CreateEnhMetaFileW
CloseEnhMetaFile
ExtEscape
BitBlt
GetStockObject
GetTextMetricsW
DeleteDC
ModifyWorldTransform
SetGraphicsMode
GetTextFaceW
SelectObject
DeleteObject
CreateFontW
CreateFontIndirectW
StretchDIBits
SaveDC
RestoreDC
IntersectClipRect
GetDeviceCaps
GetObjectW
GetCurrentObject
CreateCompatibleDC
GetGlyphIndicesW
GetCharABCWidthsW
CreateRectRgnIndirect
SelectClipRgn
GdiAlphaBlend
GetGlyphOutlineW
RemoveFontMemResourceEx
PolyBezierTo
ExtTextOutW
SetTextAlign

kernel32

RtlCaptureStackBackTrace
GetModuleHandleExW
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ExpandEnvironmentStringsW
CreateEventW
lstrcmpiA
CreateThread
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetFileSizeEx
SetFileTime
LockFile
SetEndOfFile
UnlockFile
SetFilePointerEx
FlushFileBuffers
GlobalMemoryStatusEx
FindFirstFileW
FindFirstFileExW
FindNextFileW
FindClose
GetVersionExW
GetNativeSystemInfo
WideCharToMultiByte
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
SleepConditionVariableSRW
GetStdHandle
ResumeThread
AttachConsole
AllocConsole
HeapSetInformation
TerminateProcess
OpenProcess
GetUserDefaultUILanguage
GetLocaleInfoW
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
SetUnhandledExceptionFilter
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
CreateIoCompletionPort
GetSystemDirectoryW
GetWindowsDirectoryW
QueueUserWorkItem
WaitForMultipleObjects
QueryPerformanceFrequency
RegisterWaitForSingleObject
UnregisterWaitEx
GetUserDefaultLangID
ReleaseSRWLockShared
AcquireSRWLockShared
GetModuleHandleExA
HeapLock
HeapWalk
GetProcessHeaps
HeapUnlock
VirtualFree
VirtualAlloc
GetSystemInfo
GetProcessTimes
HeapAlloc
HeapReAlloc
HeapFree
InitializeCriticalSection
LockFileEx
UnlockFileEx
GetFileType
GetNamedPipeInfo
GetLocaleInfoA
GetNumberFormatW
GetCurrencyFormatW
LoadLibraryA
GetThreadLocale
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
CreateFileA
ReleaseSemaphore
CreateSemaphoreW
ExitProcess
ReleaseMutex
CreateMutexW
GetModuleFileNameA
GetFullPathNameW
HeapCreate
AreFileApisANSI
GetSystemTime
GetProcessHeap
GetFileSize
CreateFileMappingA
HeapDestroy
HeapCompact
DeleteFileA
WaitForSingleObjectEx
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapSize
HeapValidate
GetFullPathNameA
SetFilePointer
GetDiskFreeSpaceW
ConnectNamedPipe
CreateNamedPipeW
WaitNamedPipeW
CancelIo
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetProcessAffinityMask
GetACP
GetThreadTimes
GetTempFileNameA
IsWow64Process
CreateSemaphoreA
CreateEventA
SuspendThread
GetThreadContext
OpenThread
GlobalSize
GetEnvironmentVariableW
GlobalUnlock
GlobalAlloc
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
SetThreadContext
MapViewOfFileEx
SwitchToThread
FlushInstructionCache
DisconnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
GetNamedPipeHandleStateW
FindFirstFileExA
FindNextFileA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentThread
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
Sleep
QueryThreadCycleTime
SetThreadPriority
MapViewOfFile
CreateFileMappingW
GetTempFileNameW
MoveFileExW
SetCurrentDirectoryW
GetLocalTime
QueueUserAPC
SleepEx
LocaleNameToLCID
InitializeSRWLock
InitOnceExecuteOnce
GetEnvironmentVariableA
GetSystemPowerStatus
GetOverlappedResult
QueryUnbiasedInterruptTime
GetCommandLineA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
WriteConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
HeapQueryInformation
ReadConsoleW
GetCurrentDirectoryA
SetCurrentDirectoryA
SetEnvironmentVariableA
GetFileAttributesExW
SetFileAttributesW
UnmapViewOfFile
GetFileAttributesW
GetTempPathW
RemoveDirectoryW
GetLongPathNameW
GetFileInformationByHandleEx
ReadFile
CreateDirectoryW
GetTickCount
FormatMessageA
GetCurrentDirectoryW
DeleteFileW
OutputDebugStringA
WriteFile
VirtualQuery
GetCurrentProcessId
GetModuleHandleA
GetProcessId
VirtualProtect
GetCommandLineW
IsDebuggerPresent
LocalFree
LockResource
CompareStringW
GetDateFormatW
WaitForSingleObject
GetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetComputerNameExW
MultiByteToWideChar
lstrcmpiW
FindResourceW
SizeofResource
LoadResource
GetModuleFileNameW
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
LoadLibraryW
SetEnvironmentVariableW
QueryPerformanceCounter
GetSystemTimeAsFileTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
FreeLibraryAndExitThread
ExitThread
GetDriveTypeW
SetStdHandle
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
RtlUnwind
InterlockedFlushSList
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
LCMapStringW
EncodePointer
LoadLibraryExA
FreeLibrary
GetFileTime
DeviceIoControl
SetLastError
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW
CloseHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetErrorMode
GetLastError
RaiseException
DecodePointer
GetProcAddress
GetModuleHandleW
GlobalLock
GetThreadPriority
ResetEvent
TryEnterCriticalSection

winspool.drv

OpenPrinterW
EnumPrintersW
DeviceCapabilitiesW
GetPrinterDriverW
ord203
ClosePrinter
DocumentPropertiesW
GetPrinterW

comdlg32

CommDlgExtendedError
GetSaveFileNameW
GetOpenFileNameW

ole32

GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitializeEx
CoCreateInstance
StringFromGUID2
CoCreateGuid
PropVariantClear
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoSetProxyBlanket
CoTaskMemRealloc

oleaut32

VariantInit
SysFreeString
VariantClear
SysAllocString
VarUI4FromStr

rpcrt4

UuidCreate

advapi32

RegQueryInfoKeyW
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExA
RegOpenKeyExA
SystemFunction036
TraceEvent
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
GetUserNameW
RegQueryValueExW
RegEnumValueW

iphlpapi

IpRenewAddress
IpReleaseAddress
GetInterfaceInfo
GetAdaptersAddresses

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod
timeGetDevCaps
timeSetEvent
timeKillEvent

ws2_32

WSACreateEvent
WSACleanup
WSAStartup
WSAWaitForMultipleEvents
WSASetEvent
WSCEnumProtocols
sendto
recvfrom
ioctlsocket
htons
htonl
ntohl
ntohs
accept
bind
closesocket
getsockname
listen
recv
select
send
setsockopt
shutdown
socket
gethostbyname
WSAGetLastError
WSACloseEvent
getsockopt
WSAEventSelect
gethostname
WSAResetEvent
getaddrinfo
freeaddrinfo
connect
WSAEnumNetworkEvents
getpeername

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory

usp10

ScriptFreeCache
ScriptShape
ScriptItemize

wintrust

WinVerifyTrust
WTHelperProvDataFromStateData

secur32

InitializeSecurityContextA
AcquireCredentialsHandleA
FreeCredentialsHandle
CompleteAuthToken
DeleteSecurityContext

Exports

Exports

ChromeMain
GetHandleVerifier
_ovly_debug_event
nacl_global_xlate_base
nacl_thread_ids
nacl_user

Sections

.text
Size: 34.3MB - Virtual size: 34.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9.4MB - Virtual size: 9.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 709KB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.syzygy
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/chrome_elf.dll
.dll windows x86

Password: sussy

e221d5924cf815c9fff22338772e1f0e

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d5:c9:53:da:f4:50:01:a5:74:2c:2d:0f:5d:73:7f:e7:f9:f7:88:b6:bb:66:b2:26:6e:6a:af:e3:c5:c5:bd:00
Signer

Actual PE Digest

d5:c9:53:da:f4:50:01:a5:74:2c:2d:0f:5d:73:7f:e7:f9:f7:88:b6:bb:66:b2:26:6e:6a:af:e3:c5:c5:bd:00

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

2c:f8:c6:f1:22:ea:2c:57:83:10:86:f1:27:65:80:c3:73:4d:da:0b
Signer

Actual PE Digest

2c:f8:c6:f1:22:ea:2c:57:83:10:86:f1:27:65:80:c3:73:4d:da:0b

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTempPathW
CloseHandle
GetCurrentProcess
GetModuleFileNameW
LocalFree
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CreateRemoteThread
IsDebuggerPresent
SetLastError
WriteFile
CreateFileW
GetCurrentDirectoryW
FormatMessageA
GetTickCount
WaitForSingleObject
GetCurrentThreadId
Sleep
RaiseException
CreateThread
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
GetModuleHandleExW
GetSystemTimeAsFileTime
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
LoadLibraryW
WaitForMultipleObjects
SetEvent
ResetEvent
GetVersionExW
VirtualQueryEx
GetEnvironmentVariableW
ReadFile
ReadConsoleW
SetFilePointerEx
FlushFileBuffers
FindClose
HeapAlloc
HeapReAlloc
HeapFree
RtlCaptureContext
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ReleaseSemaphore
CreateSemaphoreW
FreeLibrary
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
ReadProcessMemory
WriteProcessMemory
VirtualProtectEx
GetStdHandle
GetFileType
SleepEx
TerminateProcess
WriteConsoleW
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
GetCommandLineW
GetProcAddress
GetProcessId
GetCurrentProcessId
GetModuleHandleW
VirtualProtect
GetCommandLineA
HeapSize
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
IsValidLocale
GetStringTypeW
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetConsoleCP
GetConsoleMode
SetStdHandle
GetProcessHeap
GetModuleFileNameA
GetACP

advapi32

ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegEnumValueW
RegCreateKeyExW
RegCloseKey
SystemFunction036

Exports

Exports

AddDllToBlacklist
ClearCrashKeyValueImpl
CrashForException
DumpProcessWithoutCrash
GetBlacklistIndex
GetHandleVerifier
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IsBlacklistInitialized
SetCrashKeyValueImpl
SignalChromeElf
SuccessfullyBlocked

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crthunk
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

CPADinfo
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/chrome_watcher.dll
.dll windows x86

b32f3f2f9a03b3c0fcacc6d12e9df95d

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:ef:d3:9d:ba:45:ec:55:68:3a:1c:e5:af:f1:75:6a:d0:7f:df:23:fb:8a:0a:16:3c:67:da:c8:52:ef:e7:f4
Signer

Actual PE Digest

32:ef:d3:9d:ba:45:ec:55:68:3a:1c:e5:af:f1:75:6a:d0:7f:df:23:fb:8a:0a:16:3c:67:da:c8:52:ef:e7:f4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

c2:c6:f3:17:1a:43:66:80:ec:35:bd:cd:a2:c2:d9:b5:19:23:54:d6
Signer

Actual PE Digest

c2:c6:f3:17:1a:43:66:80:ec:35:bd:cd:a2:c2:d9:b5:19:23:54:d6

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime

kernel32

WaitForSingleObject
GetCurrentThreadId
DuplicateHandle
Sleep
GetCurrentThread
GetThreadPriority
CloseHandle
RaiseException
CreateThread
GetCommandLineW
LocalFree
RtlCaptureStackBackTrace
GetProcAddress
GetModuleHandleW
TerminateProcess
GetExitCodeProcess
CreateEventW
ResetEvent
WriteFile
GetModuleFileNameW
CreateFileW
GetCurrentDirectoryW
GetCurrentProcessId
FormatMessageA
GetTickCount
QueryThreadCycleTime
QueryPerformanceFrequency
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleExW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
SetUnhandledExceptionFilter
GetProcessId
GetVersionExW
GetNativeSystemInfo
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
ReleaseSRWLockShared
AcquireSRWLockShared
LoadLibraryW
GetModuleHandleExA
SetThreadPriority
ReadFile
HeapSize
VirtualQuery
SetFilePointerEx
FlushFileBuffers
FindClose
GetSystemInfo
GetProcessTimes
HeapAlloc
HeapReAlloc
HeapFree
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetStdHandle
GetACP
GetModuleFileNameA
GetProcessHeap
GetCurrentProcess
IsDebuggerPresent
SetProcessShutdownParameters
SetEvent
SetLastError
GetLastError
WriteConsoleW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
ReadConsoleW
VirtualProtect
FreeLibrary
LoadLibraryExA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetConsoleCP
GetConsoleMode
SetStdHandle
GetFileType

ole32

CoInitializeEx
CoUninitialize

user32

CreateWindowExW
DefWindowProcW
DestroyWindow
GetWindowLongW
SetWindowLongW
UnregisterClassW
RegisterClassExW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
TraceEvent
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
RegisterTraceGuidsW
UnregisterTraceGuids
SystemFunction036

Exports

Exports

GetHandleVerifier
WatcherMain

Sections

.text
Size: 339KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/d3dcompiler_47.dll
.dll windows x86

323b4a980be6850b6d140bd6363118e2

Code Sign

33:00:00:00:8d:40:3b:3c:2f:ad:c6:7b:b8:00:00:00:00:00:8d
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/10/2015, 18:14

Not After

06/01/2017, 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/06/2015, 17:42

Not After

04/09/2016, 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:ef:d8:87:2e:35:a3:82:8a:2f:00:00:00:00:00:ef
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d1:0a:fd:3d:bb:57:c9:b1:e6:71:de:c1:96:3f:cf:e6:e2:9a:9c:bd:68:c5:94:77:3e:03:53:3c:86:8b:7a:4b
Signer

Actual PE Digest

d1:0a:fd:3d:bb:57:c9:b1:e6:71:de:c1:96:3f:cf:e6:e2:9a:9c:bd:68:c5:94:77:3e:03:53:3c:86:8b:7a:4b

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

15/12/2022, 14:00
Valid: false

29:f7:54:62:e0:86:50:d7:b3:7d:b3:8f:03:0f:e0:8a:ab:bb:b0:0c
Signer

Actual PE Digest

29:f7:54:62:e0:86:50:d7:b3:7d:b3:8f:03:0f:e0:8a:ab:bb:b0:0c

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

20/11/2015, 12:47
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__dllonexit
_unlock
_lock
??1type_info@@UAE@XZ
_initterm
_amsg_exit
_XcptFilter
_callnewh
_isnan
__isascii
_clearfp
_controlfp
_strdup
_mbstrlen
_purecall
_vsnwprintf
strtoul
isxdigit
atof
strchr
setlocale
strnlen
modf
strrchr
tolower
_finite
_fpclass
memmove
strncmp
strncpy_s
isspace
wcsncmp
wcsncpy_s
_wcsicmp
memcpy
memset
fclose
bsearch
qsort
strcat_s
_onexit
_CxxThrowException
_snwprintf_s
__unDName
fread
fseek
_wfsopen
wcstoul
_fileno
sscanf_s
_filelengthi64
towlower
_wcsnicmp
_wsplitpath_s
wcscpy_s
wcsncat_s
wcsrchr
swprintf_s
_wmakepath_s
time
_wcsdup
_wgetenv
_wfullpath
_chsize_s
_close
_read
_write
_lseeki64
_get_osfhandle
_open_osfhandle
wcscat_s
ftell
_mbscmp
_memicmp
toupper
_atoi64
strtod
_errno
_strtoui64
?terminate@@YAXXZ
_except_handler4_common
strstr
malloc
_strnicmp
atoi
isdigit
isalpha
strcpy_s
memcpy_s
isalnum
getenv
free
_stricmp
sprintf_s
_vsnprintf
_wsopen
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
__CxxFrameHandler3
_ftol2
_ftol2_sse
ceil
floor

advapi32

RegOpenKeyExW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExW

kernel32

MapViewOfFileEx
SetFilePointer
InitializeCriticalSectionAndSpinCount
ExpandEnvironmentStringsW
DeviceIoControl
SetFilePointerEx
SetEndOfFile
GetFileType
DeleteFileW
FlushViewOfFile
SetFileAttributesW
GetFileAttributesW
SetLastError
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
LocalFree
LocalAlloc
LoadLibraryExW
GetProcAddress
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
lstrcmpiA
HeapCreate
GetEnvironmentVariableA
GetModuleFileNameA
LCMapStringW
DisableThreadLibraryCalls
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
HeapAlloc
GetProcessHeap
HeapFree
FreeLibrary
WriteFile
VirtualFree
VirtualAlloc
GetSystemInfo
CreateFileW
GetLastError
GetFileSizeEx
ReadFile
CloseHandle
Sleep
TlsAlloc
TlsSetValue
HeapDestroy
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
CreateFileA

rpcrt4

UuidCreate

Exports

Exports

D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DCreateFunctionLinkingGraph
D3DCreateLinker
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DLoadModule
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReflectLibrary
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/default_apps/docs.crx
.zip
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/default_apps/drive.crx
.zip
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/default_apps/external_extensions.json
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/default_apps/gmail.crx
.zip
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/default_apps/youtube.crx
.zip
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/icudtl.dat
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/libegl.dll
.dll windows x86

bcbdf3e207bfdc1c9f033a8662f90f29

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cb:60:0f:a1:ce:b6:58:60:4e:a4:84:5d:e2:53:fd:5f:13:ba:48:2c:f6:52:aa:af:f8:58:da:db:a2:25:3c:72
Signer

Actual PE Digest

cb:60:0f:a1:ce:b6:58:60:4e:a4:84:5d:e2:53:fd:5f:13:ba:48:2c:f6:52:aa:af:f8:58:da:db:a2:25:3c:72

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

05:40:58:aa:17:14:c6:7e:3c:7f:b3:d4:fc:9c:f9:68:10:70:f9:ab
Signer

Actual PE Digest

05:40:58:aa:17:14:c6:7e:3c:7f:b3:d4:fc:9c:f9:68:10:70:f9:ab

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

libglesv2

?StreamPostD3DTextureNV12ANGLE@egl@@YGIPAX00PBH@Z
?CreateStreamProducerD3DTextureNV12ANGLE@egl@@YGIPAX0PBH@Z
?StreamConsumerGLTextureExternalAttribsNV@egl@@YGIPAX0PBH@Z
?StreamConsumerReleaseKHR@egl@@YGIPAX0@Z
?StreamConsumerAcquireKHR@egl@@YGIPAX0@Z
?StreamConsumerGLTextureExternalKHR@egl@@YGIPAX0@Z
?QueryStreamu64KHR@egl@@YGIPAX0IPA_K@Z
?QueryStreamKHR@egl@@YGIPAX0IPAH@Z
?StreamAttribKHR@egl@@YGIPAX0IH@Z
?DestroyStreamKHR@egl@@YGIPAX0@Z
?CreateStreamKHR@egl@@YGPAXPAXPBH@Z
?ReleaseDeviceANGLE@egl@@YGIPAX@Z
?CreateDeviceANGLE@egl@@YGPAXHPAXPBH@Z
?DestroyImageKHR@egl@@YGIPAX0@Z
?CreateImageKHR@egl@@YGPAXPAX0I0PBH@Z
?QueryDeviceStringEXT@egl@@YGPBDPAXH@Z
?QueryDeviceAttribEXT@egl@@YGIPAXHPAH@Z
?QueryDisplayAttribEXT@egl@@YGIPAXHPAH@Z
?GetPlatformDisplayEXT@egl@@YGPAXIPAXPBH@Z
?PostSubBufferNV@egl@@YGIPAX0HHHH@Z
?QuerySurfacePointerANGLE@egl@@YGIPAX0HPAPAX@Z
?WaitSync@egl@@YGIPAX0H@Z
?CreatePlatformPixmapSurface@egl@@YGPAXPAX00PBH@Z
?CreatePlatformWindowSurface@egl@@YGPAXPAX00PBH@Z
?GetPlatformDisplay@egl@@YGPAXIPAXPBH@Z
?DestroyImage@egl@@YGIPAX0@Z
?CreateImage@egl@@YGPAXPAX0I0PBH@Z
?GetSyncAttrib@egl@@YGIPAX0HPAH@Z
?ClientWaitSync@egl@@YGHPAX0H_K@Z
?DestroySync@egl@@YGIPAX0@Z
?CreateSync@egl@@YGPAXPAXIPBH@Z
?GetCurrentContext@egl@@YGPAXXZ
?WaitClient@egl@@YGIXZ
?ReleaseThread@egl@@YGIXZ
?CreatePbufferFromClientBuffer@egl@@YGPAXPAXI00PBH@Z
?QueryAPI@egl@@YGIXZ
?BindAPI@egl@@YGII@Z
?SwapInterval@egl@@YGIPAXH@Z
?SurfaceAttrib@egl@@YGIPAX0HH@Z
?ReleaseTexImage@egl@@YGIPAX0H@Z
?BindTexImage@egl@@YGIPAX0H@Z
?WaitNative@egl@@YGIH@Z
?WaitGL@egl@@YGIXZ
?Terminate@egl@@YGIPAX@Z
?SwapBuffers@egl@@YGIPAX0@Z
?QuerySurface@egl@@YGIPAX0HPAH@Z
?QueryString@egl@@YGPBDPAXH@Z
?QueryContext@egl@@YGIPAX0HPAH@Z
?MakeCurrent@egl@@YGIPAX000@Z
?Initialize@egl@@YGIPAXPAH1@Z
?GetProcAddress@egl@@YGP6AXXZPBD@Z
?GetError@egl@@YGHXZ
?GetDisplay@egl@@YGPAXPAUHDC__@@@Z
?GetCurrentSurface@egl@@YGPAXH@Z
?GetCurrentDisplay@egl@@YGPAXXZ
?GetConfigs@egl@@YGIPAXPAPAXHPAH@Z
?GetConfigAttrib@egl@@YGIPAX0HPAH@Z
?DestroySurface@egl@@YGIPAX0@Z
?DestroyContext@egl@@YGIPAX0@Z
?CreateWindowSurface@egl@@YGPAXPAX0PAUHWND__@@PBH@Z
?CreatePixmapSurface@egl@@YGPAXPAX0PAUHBITMAP__@@PBH@Z
?CreatePbufferSurface@egl@@YGPAXPAX0PBH@Z
?CreateContext@egl@@YGPAXPAX00PBH@Z
?CopyBuffers@egl@@YGIPAX0PAUHBITMAP__@@@Z
?ChooseConfig@egl@@YGIPAXPBHPAPAXHPAH@Z

kernel32

RaiseException
CreateFileW
DecodePointer
WriteConsoleW
CloseHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
LCMapStringW
HeapAlloc
HeapFree
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
SetLastError
RtlUnwind
LoadLibraryExW
GetProcAddress
FreeLibrary
TlsFree
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
GetLastError
GetModuleFileNameW
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue

advapi32

SystemFunction036

Exports

Exports

eglBindAPI
eglBindTexImage
eglChooseConfig
eglClientWaitSync
eglCopyBuffers
eglCreateContext
eglCreateDeviceANGLE
eglCreateImage
eglCreateImageKHR
eglCreatePbufferFromClientBuffer
eglCreatePbufferSurface
eglCreatePixmapSurface
eglCreatePlatformPixmapSurface
eglCreatePlatformWindowSurface
eglCreateStreamKHR
eglCreateStreamProducerD3DTextureNV12ANGLE
eglCreateSync
eglCreateWindowSurface
eglDestroyContext
eglDestroyImage
eglDestroyImageKHR
eglDestroyStreamKHR
eglDestroySurface
eglDestroySync
eglGetConfigAttrib
eglGetConfigs
eglGetCurrentContext
eglGetCurrentDisplay
eglGetCurrentSurface
eglGetDisplay
eglGetError
eglGetPlatformDisplay
eglGetPlatformDisplayEXT
eglGetProcAddress
eglGetSyncAttrib
eglInitialize
eglMakeCurrent
eglPostSubBufferNV
eglQueryAPI
eglQueryContext
eglQueryDeviceAttribEXT
eglQueryDeviceStringEXT
eglQueryDisplayAttribEXT
eglQueryStreamKHR
eglQueryStreamu64KHR
eglQueryString
eglQuerySurface
eglQuerySurfacePointerANGLE
eglReleaseDeviceANGLE
eglReleaseTexImage
eglReleaseThread
eglStreamAttribKHR
eglStreamConsumerAcquireKHR
eglStreamConsumerGLTextureExternalAttribsNV
eglStreamConsumerGLTextureExternalKHR
eglStreamConsumerReleaseKHR
eglStreamPostD3DTextureNV12ANGLE
eglSurfaceAttrib
eglSwapBuffers
eglSwapInterval
eglTerminate
eglWaitClient
eglWaitGL
eglWaitNative
eglWaitSync

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 168B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/libglesv2.dll
.dll windows x86

807536dd8272959725ab5516e8fa6f28

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:24:73:b2:cc:33:e2:69:d2:94:8c:09:d6:be:7b:1e:fe:8f:26:43:10:6c:d4:33:1c:c7:be:a8:93:70:33:0c
Signer

Actual PE Digest

ab:24:73:b2:cc:33:e2:69:d2:94:8c:09:d6:be:7b:1e:fe:8f:26:43:10:6c:d4:33:1c:c7:be:a8:93:70:33:0c

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

36:38:28:5b:7b:1d:a7:54:4e:d1:19:ac:24:6b:8a:9b:b4:13:e1:bc
Signer

Actual PE Digest

36:38:28:5b:7b:1d:a7:54:4e:d1:19:ac:24:6b:8a:9b:b4:13:e1:bc

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VerifyVersionInfoW
GetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
TlsAlloc
VerSetConditionMask
TlsSetValue
TlsFree
GetTempPathA
GetTempFileNameA
Sleep
LoadLibraryW
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleW
TlsGetValue
SetEndOfFile
HeapSize
ReadConsoleW
WriteConsoleW
CreateFileW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
MultiByteToWideChar
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
GetModuleFileNameW
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
HeapReAlloc
GetModuleFileNameA
GetACP
GetStdHandle
GetFileType
CloseHandle
WriteFile
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
ReadFile
SetFilePointerEx
GetProcessHeap
FindClose
FindFirstFileExA
GetCurrentProcessId

gdi32

SwapBuffers
SetPixelFormat
DescribePixelFormat
ChoosePixelFormat
GetPixelFormat

user32

WindowFromDC
DefWindowProcW
RegisterClassA
UnregisterClassA
CreateWindowExA
InvalidateRect
IsIconic
GetClientRect
CreateWindowExW
LoadCursorA
GetWindowThreadProcessId
ReleaseDC
GetDC
DestroyWindow
IsWindow

d3d9

D3DPERF_BeginEvent
D3DPERF_EndEvent
D3DPERF_SetMarker
D3DPERF_GetStatus
Direct3DCreate9

advapi32

SystemFunction036

Exports

Exports

?ActiveTexture@gl@@YGXI@Z
?AttachShader@gl@@YGXII@Z
?BeginQuery@gl@@YGXII@Z
?BeginQueryEXT@gl@@YGXII@Z
?BeginTransformFeedback@gl@@YGXI@Z
?BindAPI@egl@@YGII@Z
?BindAttribLocation@gl@@YGXIIPBD@Z
?BindBuffer@gl@@YGXII@Z
?BindBufferBase@gl@@YGXIII@Z
?BindBufferRange@gl@@YGXIIIJJ@Z
?BindFramebuffer@gl@@YGXII@Z
?BindRenderbuffer@gl@@YGXII@Z
?BindSampler@gl@@YGXII@Z
?BindTexImage@egl@@YGIPAX0H@Z
?BindTexture@gl@@YGXII@Z
?BindTransformFeedback@gl@@YGXII@Z
?BindUniformLocationCHROMIUM@gl@@YGXIHPBD@Z
?BindVertexArray@gl@@YGXI@Z
?BindVertexArrayOES@gl@@YGXI@Z
?BlendColor@gl@@YGXMMMM@Z
?BlendEquation@gl@@YGXI@Z
?BlendEquationSeparate@gl@@YGXII@Z
?BlendFunc@gl@@YGXII@Z
?BlendFuncSeparate@gl@@YGXIIII@Z
?BlitFramebuffer@gl@@YGXHHHHHHHHII@Z
?BlitFramebufferANGLE@gl@@YGXHHHHHHHHII@Z
?BufferData@gl@@YGXIJPBXI@Z
?BufferSubData@gl@@YGXIJJPBX@Z
?CheckFramebufferStatus@gl@@YGII@Z
?ChooseConfig@egl@@YGIPAXPBHPAPAXHPAH@Z
?Clear@gl@@YGXI@Z
?ClearBufferfi@gl@@YGXIHMH@Z
?ClearBufferfv@gl@@YGXIHPBM@Z
?ClearBufferiv@gl@@YGXIHPBH@Z
?ClearBufferuiv@gl@@YGXIHPBI@Z
?ClearColor@gl@@YGXMMMM@Z
?ClearDepthf@gl@@YGXM@Z
?ClearStencil@gl@@YGXH@Z
?ClientWaitSync@egl@@YGHPAX0H_K@Z
?ClientWaitSync@gl@@YGIPAU__GLsync@@I_K@Z
?ColorMask@gl@@YGXEEEE@Z
?CompileShader@gl@@YGXI@Z
?CompressedTexImage2D@gl@@YGXIHIHHHHPBX@Z
?CompressedTexImage3D@gl@@YGXIHIHHHHHPBX@Z
?CompressedTexSubImage2D@gl@@YGXIHHHHHIHPBX@Z
?CompressedTexSubImage3D@gl@@YGXIHHHHHHHIHPBX@Z
?CopyBufferSubData@gl@@YGXIIJJJ@Z
?CopyBuffers@egl@@YGIPAX0PAUHBITMAP__@@@Z
?CopyTexImage2D@gl@@YGXIHIHHHHH@Z
?CopyTexSubImage2D@gl@@YGXIHHHHHHH@Z
?CopyTexSubImage3D@gl@@YGXIHHHHHHHH@Z
?CoverFillPathCHROMIUM@gl@@YGXII@Z
?CoverStrokePathCHROMIUM@gl@@YGXII@Z
?CoverageModulationCHROMIUM@gl@@YGXI@Z
?CreateContext@egl@@YGPAXPAX00PBH@Z
?CreateDeviceANGLE@egl@@YGPAXHPAXPBH@Z
?CreateImage@egl@@YGPAXPAX0I0PBH@Z
?CreateImageKHR@egl@@YGPAXPAX0I0PBH@Z
?CreatePbufferFromClientBuffer@egl@@YGPAXPAXI00PBH@Z
?CreatePbufferSurface@egl@@YGPAXPAX0PBH@Z
?CreatePixmapSurface@egl@@YGPAXPAX0PAUHBITMAP__@@PBH@Z
?CreatePlatformPixmapSurface@egl@@YGPAXPAX00PBH@Z
?CreatePlatformWindowSurface@egl@@YGPAXPAX00PBH@Z
?CreateProgram@gl@@YGIXZ
?CreateShader@gl@@YGII@Z
?CreateStreamKHR@egl@@YGPAXPAXPBH@Z
?CreateStreamProducerD3DTextureNV12ANGLE@egl@@YGIPAX0PBH@Z
?CreateSync@egl@@YGPAXPAXIPBH@Z
?CreateWindowSurface@egl@@YGPAXPAX0PAUHWND__@@PBH@Z
?CullFace@gl@@YGXI@Z
?DebugMessageCallbackKHR@gl@@YGXP6GXIIIIHPBDPBX@Z1@Z
?DebugMessageControlKHR@gl@@YGXIIIHPBIE@Z
?DebugMessageInsertKHR@gl@@YGXIIIIHPBD@Z
?DeleteBuffers@gl@@YGXHPBI@Z
?DeleteFencesNV@gl@@YGXHPBI@Z
?DeleteFramebuffers@gl@@YGXHPBI@Z
?DeletePathsCHROMIUM@gl@@YGXIH@Z
?DeleteProgram@gl@@YGXI@Z
?DeleteQueries@gl@@YGXHPBI@Z
?DeleteQueriesEXT@gl@@YGXHPBI@Z
?DeleteRenderbuffers@gl@@YGXHPBI@Z
?DeleteSamplers@gl@@YGXHPBI@Z
?DeleteShader@gl@@YGXI@Z
?DeleteSync@gl@@YGXPAU__GLsync@@@Z
?DeleteTextures@gl@@YGXHPBI@Z
?DeleteTransformFeedbacks@gl@@YGXHPBI@Z
?DeleteVertexArrays@gl@@YGXHPBI@Z
?DeleteVertexArraysOES@gl@@YGXHPBI@Z
?DepthFunc@gl@@YGXI@Z
?DepthMask@gl@@YGXE@Z
?DepthRangef@gl@@YGXMM@Z
?DestroyContext@egl@@YGIPAX0@Z
?DestroyImage@egl@@YGIPAX0@Z
?DestroyImageKHR@egl@@YGIPAX0@Z
?DestroyStreamKHR@egl@@YGIPAX0@Z
?DestroySurface@egl@@YGIPAX0@Z
?DestroySync@egl@@YGIPAX0@Z
?DetachShader@gl@@YGXII@Z
?Disable@gl@@YGXI@Z
?DisableVertexAttribArray@gl@@YGXI@Z
?DiscardFramebufferEXT@gl@@YGXIHPBI@Z
?DrawArrays@gl@@YGXIHH@Z
?DrawArraysInstanced@gl@@YGXIHHH@Z
?DrawArraysInstancedANGLE@gl@@YGXIHHH@Z
?DrawBuffers@gl@@YGXHPBI@Z
?DrawBuffersEXT@gl@@YGXHPBI@Z
?DrawElements@gl@@YGXIHIPBX@Z
?DrawElementsInstanced@gl@@YGXIHIPBXH@Z
?DrawElementsInstancedANGLE@gl@@YGXIHIPBXH@Z
?DrawRangeElements@gl@@YGXIIIHIPBX@Z
?EGLImageTargetRenderbufferStorageOES@gl@@YGXIPAX@Z
?EGLImageTargetTexture2DOES@gl@@YGXIPAX@Z
?Enable@gl@@YGXI@Z
?EnableVertexAttribArray@gl@@YGXI@Z
?EndQuery@gl@@YGXI@Z
?EndQueryEXT@gl@@YGXI@Z
?EndTransformFeedback@gl@@YGXXZ
?FenceSync_@gl@@YGPAU__GLsync@@II@Z
?Finish@gl@@YGXXZ
?FinishFenceNV@gl@@YGXI@Z
?Flush@gl@@YGXXZ
?FlushMappedBufferRange@gl@@YGXIJJ@Z
?FlushMappedBufferRangeEXT@gl@@YGXIJJ@Z
?FramebufferRenderbuffer@gl@@YGXIIII@Z
?FramebufferTexture2D@gl@@YGXIIIIH@Z
?FramebufferTextureLayer@gl@@YGXIIIHH@Z
?FrontFace@gl@@YGXI@Z
?GenBuffers@gl@@YGXHPAI@Z
?GenFencesNV@gl@@YGXHPAI@Z
?GenFramebuffers@gl@@YGXHPAI@Z
?GenPathsCHROMIUM@gl@@YGIH@Z
?GenQueries@gl@@YGXHPAI@Z
?GenQueriesEXT@gl@@YGXHPAI@Z
?GenRenderbuffers@gl@@YGXHPAI@Z
?GenSamplers@gl@@YGXHPAI@Z
?GenTextures@gl@@YGXHPAI@Z
?GenTransformFeedbacks@gl@@YGXHPAI@Z
?GenVertexArrays@gl@@YGXHPAI@Z
?GenVertexArraysOES@gl@@YGXHPAI@Z
?GenerateMipmap@gl@@YGXI@Z
?GetActiveAttrib@gl@@YGXIIHPAH0PAIPAD@Z
?GetActiveUniform@gl@@YGXIIHPAH0PAIPAD@Z
?GetActiveUniformBlockName@gl@@YGXIIHPAHPAD@Z
?GetActiveUniformBlockiv@gl@@YGXIIIPAH@Z
?GetActiveUniformsiv@gl@@YGXIHPBIIPAH@Z
?GetAttachedShaders@gl@@YGXIHPAHPAI@Z
?GetAttribLocation@gl@@YGHIPBD@Z
?GetBooleanv@gl@@YGXIPAE@Z
?GetBufferParameteri64v@gl@@YGXIIPA_J@Z
?GetBufferParameteriv@gl@@YGXIIPAH@Z
?GetBufferPointerv@gl@@YGXIIPAPAX@Z
?GetBufferPointervOES@gl@@YGXIIPAPAX@Z
?GetConfigAttrib@egl@@YGIPAX0HPAH@Z
?GetConfigs@egl@@YGIPAXPAPAXHPAH@Z
?GetCurrentContext@egl@@YGPAXXZ
?GetCurrentDisplay@egl@@YGPAXXZ
?GetCurrentSurface@egl@@YGPAXH@Z
?GetDebugMessageLogKHR@gl@@YGIIHPAI000PAHPAD@Z
?GetDisplay@egl@@YGPAXPAUHDC__@@@Z
?GetError@egl@@YGHXZ
?GetError@gl@@YGIXZ
?GetFenceivNV@gl@@YGXIIPAH@Z
?GetFloatv@gl@@YGXIPAM@Z
?GetFragDataLocation@gl@@YGHIPBD@Z
?GetFramebufferAttachmentParameteriv@gl@@YGXIIIPAH@Z
?GetGraphicsResetStatusEXT@gl@@YGIXZ
?GetInteger64i_v@gl@@YGXIIPA_J@Z
?GetInteger64v@gl@@YGXIPA_J@Z
?GetIntegeri_v@gl@@YGXIIPAH@Z
?GetIntegerv@gl@@YGXIPAH@Z
?GetInternalformativ@gl@@YGXIIIHPAH@Z
?GetObjectLabelKHR@gl@@YGXIIHPAHPAD@Z
?GetObjectPtrLabelKHR@gl@@YGXPBXHPAHPAD@Z
?GetPathParameterfCHROMIUM@gl@@YGXIIPAM@Z
?GetPathParameteriCHROMIUM@gl@@YGXIIPAH@Z
?GetPlatformDisplay@egl@@YGPAXIPAXPBH@Z
?GetPlatformDisplayEXT@egl@@YGPAXIPAXPBH@Z
?GetPointervKHR@gl@@YGXIPAPAX@Z
?GetProcAddress@egl@@YGP6AXXZPBD@Z
?GetProgramBinary@gl@@YGXIHPAHPAIPAX@Z
?GetProgramBinaryOES@gl@@YGXIHPAHPAIPAX@Z
?GetProgramInfoLog@gl@@YGXIHPAHPAD@Z
?GetProgramiv@gl@@YGXIIPAH@Z
?GetQueryObjecti64vEXT@gl@@YGXIIPA_J@Z
?GetQueryObjectivEXT@gl@@YGXIIPAH@Z
?GetQueryObjectui64vEXT@gl@@YGXIIPA_K@Z
?GetQueryObjectuiv@gl@@YGXIIPAI@Z
?GetQueryObjectuivEXT@gl@@YGXIIPAI@Z
?GetQueryiv@gl@@YGXIIPAH@Z
?GetQueryivEXT@gl@@YGXIIPAH@Z
?GetRenderbufferParameteriv@gl@@YGXIIPAH@Z
?GetSamplerParameterfv@gl@@YGXIIPAM@Z
?GetSamplerParameteriv@gl@@YGXIIPAH@Z
?GetShaderInfoLog@gl@@YGXIHPAHPAD@Z
?GetShaderPrecisionFormat@gl@@YGXIIPAH0@Z
?GetShaderSource@gl@@YGXIHPAHPAD@Z
?GetShaderiv@gl@@YGXIIPAH@Z
?GetString@gl@@YGPBEI@Z
?GetStringi@gl@@YGPBEII@Z
?GetSyncAttrib@egl@@YGIPAX0HPAH@Z
?GetSynciv@gl@@YGXPAU__GLsync@@IHPAH1@Z
?GetTexParameterfv@gl@@YGXIIPAM@Z
?GetTexParameteriv@gl@@YGXIIPAH@Z
?GetTransformFeedbackVarying@gl@@YGXIIHPAH0PAIPAD@Z
?GetTranslatedShaderSourceANGLE@gl@@YGXIHPAHPAD@Z
?GetUniformBlockIndex@gl@@YGIIPBD@Z
?GetUniformIndices@gl@@YGXIHPBQBDPAI@Z
?GetUniformLocation@gl@@YGHIPBD@Z
?GetUniformfv@gl@@YGXIHPAM@Z
?GetUniformiv@gl@@YGXIHPAH@Z
?GetUniformuiv@gl@@YGXIHPAI@Z
?GetVertexAttribIiv@gl@@YGXIIPAH@Z
?GetVertexAttribIuiv@gl@@YGXIIPAI@Z
?GetVertexAttribPointerv@gl@@YGXIIPAPAX@Z
?GetVertexAttribfv@gl@@YGXIIPAM@Z
?GetVertexAttribiv@gl@@YGXIIPAH@Z
?GetnUniformfvEXT@gl@@YGXIHHPAM@Z
?GetnUniformivEXT@gl@@YGXIHHPAH@Z
?Hint@gl@@YGXII@Z
?Initialize@egl@@YGIPAXPAH1@Z
?InsertEventMarkerEXT@gl@@YGXHPBD@Z
?InvalidateFramebuffer@gl@@YGXIHPBI@Z
?InvalidateSubFramebuffer@gl@@YGXIHPBIHHHH@Z
?IsBuffer@gl@@YGEI@Z
?IsEnabled@gl@@YGEI@Z
?IsFenceNV@gl@@YGEI@Z
?IsFramebuffer@gl@@YGEI@Z
?IsPathCHROMIUM@gl@@YGEI@Z
?IsProgram@gl@@YGEI@Z
?IsQuery@gl@@YGEI@Z
?IsQueryEXT@gl@@YGEI@Z
?IsRenderbuffer@gl@@YGEI@Z
?IsSampler@gl@@YGEI@Z
?IsShader@gl@@YGEI@Z
?IsSync@gl@@YGEPAU__GLsync@@@Z
?IsTexture@gl@@YGEI@Z
?IsTransformFeedback@gl@@YGEI@Z
?IsVertexArray@gl@@YGEI@Z
?IsVertexArrayOES@gl@@YGEI@Z
?LineWidth@gl@@YGXM@Z
?LinkProgram@gl@@YGXI@Z
?MakeCurrent@egl@@YGIPAX000@Z
?MapBufferOES@gl@@YGPAXII@Z
?MapBufferRange@gl@@YGPAXIJJI@Z
?MapBufferRangeEXT@gl@@YGPAXIJJI@Z
?MatrixLoadIdentityCHROMIUM@gl@@YGXI@Z
?MatrixLoadfCHROMIUM@gl@@YGXIPBM@Z
?ObjectLabelKHR@gl@@YGXIIHPBD@Z
?ObjectPtrLabelKHR@gl@@YGXPBXHPBD@Z
?PathCommandsCHROMIUM@gl@@YGXIHPBEHIPBX@Z
?PathParameterfCHROMIUM@gl@@YGXIIM@Z
?PathParameteriCHROMIUM@gl@@YGXIIH@Z
?PathStencilFuncCHROMIUM@gl@@YGXIHI@Z
?PauseTransformFeedback@gl@@YGXXZ
?PixelStorei@gl@@YGXIH@Z
?PolygonOffset@gl@@YGXMM@Z
?PopDebugGroupKHR@gl@@YGXXZ
?PopGroupMarkerEXT@gl@@YGXXZ
?PostSubBufferNV@egl@@YGIPAX0HHHH@Z
?ProgramBinary@gl@@YGXIIPBXH@Z
?ProgramBinaryOES@gl@@YGXIIPBXH@Z
?ProgramParameteri@gl@@YGXIIH@Z
?PushDebugGroupKHR@gl@@YGXIIHPBD@Z
?PushGroupMarkerEXT@gl@@YGXHPBD@Z
?QueryAPI@egl@@YGIXZ
?QueryContext@egl@@YGIPAX0HPAH@Z
?QueryCounterEXT@gl@@YGXII@Z
?QueryDeviceAttribEXT@egl@@YGIPAXHPAH@Z
?QueryDeviceStringEXT@egl@@YGPBDPAXH@Z
?QueryDisplayAttribEXT@egl@@YGIPAXHPAH@Z
?QueryStreamKHR@egl@@YGIPAX0IPAH@Z
?QueryStreamu64KHR@egl@@YGIPAX0IPA_K@Z
?QueryString@egl@@YGPBDPAXH@Z
?QuerySurface@egl@@YGIPAX0HPAH@Z
?QuerySurfacePointerANGLE@egl@@YGIPAX0HPAPAX@Z
?ReadBuffer@gl@@YGXI@Z
?ReadPixels@gl@@YGXHHHHIIPAX@Z
?ReadnPixelsEXT@gl@@YGXHHHHIIHPAX@Z
?ReleaseDeviceANGLE@egl@@YGIPAX@Z
?ReleaseShaderCompiler@gl@@YGXXZ
?ReleaseTexImage@egl@@YGIPAX0H@Z
?ReleaseThread@egl@@YGIXZ
?RenderbufferStorage@gl@@YGXIIHH@Z
?RenderbufferStorageMultisample@gl@@YGXIHIHH@Z
?RenderbufferStorageMultisampleANGLE@gl@@YGXIHIHH@Z
?ResumeTransformFeedback@gl@@YGXXZ
?SampleCoverage@gl@@YGXME@Z
?SamplerParameterf@gl@@YGXIIM@Z
?SamplerParameterfv@gl@@YGXIIPBM@Z
?SamplerParameteri@gl@@YGXIIH@Z
?SamplerParameteriv@gl@@YGXIIPBH@Z
?Scissor@gl@@YGXHHHH@Z
?SetFenceNV@gl@@YGXII@Z
?ShaderBinary@gl@@YGXHPBIIPBXH@Z
?ShaderSource@gl@@YGXIHPBQBDPBH@Z
?StencilFillPathCHROMIUM@gl@@YGXIII@Z
?StencilFunc@gl@@YGXIHI@Z
?StencilFuncSeparate@gl@@YGXIIHI@Z
?StencilMask@gl@@YGXI@Z
?StencilMaskSeparate@gl@@YGXII@Z
?StencilOp@gl@@YGXIII@Z
?StencilOpSeparate@gl@@YGXIIII@Z
?StencilStrokePathCHROMIUM@gl@@YGXIHI@Z
?StencilThenCoverFillPathCHROMIUM@gl@@YGXIIII@Z
?StencilThenCoverStrokePathCHROMIUM@gl@@YGXIHII@Z
?StreamAttribKHR@egl@@YGIPAX0IH@Z
?StreamConsumerAcquireKHR@egl@@YGIPAX0@Z
?StreamConsumerGLTextureExternalAttribsNV@egl@@YGIPAX0PBH@Z
?StreamConsumerGLTextureExternalKHR@egl@@YGIPAX0@Z
?StreamConsumerReleaseKHR@egl@@YGIPAX0@Z
?StreamPostD3DTextureNV12ANGLE@egl@@YGIPAX00PBH@Z
?SurfaceAttrib@egl@@YGIPAX0HH@Z
?SwapBuffers@egl@@YGIPAX0@Z
?SwapInterval@egl@@YGIPAXH@Z
?Terminate@egl@@YGIPAX@Z
?TestFenceNV@gl@@YGEI@Z
?TexImage2D@gl@@YGXIHHHHHIIPBX@Z
?TexImage3D@gl@@YGXIHHHHHHIIPBX@Z
?TexParameterf@gl@@YGXIIM@Z
?TexParameterfv@gl@@YGXIIPBM@Z
?TexParameteri@gl@@YGXIIH@Z
?TexParameteriv@gl@@YGXIIPBH@Z
?TexStorage2D@gl@@YGXIHIHH@Z
?TexStorage2DEXT@gl@@YGXIHIHH@Z
?TexStorage3D@gl@@YGXIHIHHH@Z
?TexSubImage2D@gl@@YGXIHHHHHIIPBX@Z
?TexSubImage3D@gl@@YGXIHHHHHHHIIPBX@Z
?TransformFeedbackVaryings@gl@@YGXIHPBQBDI@Z
?Uniform1f@gl@@YGXHM@Z
?Uniform1fv@gl@@YGXHHPBM@Z
?Uniform1i@gl@@YGXHH@Z
?Uniform1iv@gl@@YGXHHPBH@Z
?Uniform1ui@gl@@YGXHI@Z
?Uniform1uiv@gl@@YGXHHPBI@Z
?Uniform2f@gl@@YGXHMM@Z
?Uniform2fv@gl@@YGXHHPBM@Z
?Uniform2i@gl@@YGXHHH@Z
?Uniform2iv@gl@@YGXHHPBH@Z
?Uniform2ui@gl@@YGXHII@Z
?Uniform2uiv@gl@@YGXHHPBI@Z
?Uniform3f@gl@@YGXHMMM@Z
?Uniform3fv@gl@@YGXHHPBM@Z
?Uniform3i@gl@@YGXHHHH@Z
?Uniform3iv@gl@@YGXHHPBH@Z
?Uniform3ui@gl@@YGXHIII@Z
?Uniform3uiv@gl@@YGXHHPBI@Z
?Uniform4f@gl@@YGXHMMMM@Z
?Uniform4fv@gl@@YGXHHPBM@Z
?Uniform4i@gl@@YGXHHHHH@Z
?Uniform4iv@gl@@YGXHHPBH@Z
?Uniform4ui@gl@@YGXHIIII@Z
?Uniform4uiv@gl@@YGXHHPBI@Z
?UniformBlockBinding@gl@@YGXIII@Z
?UniformMatrix2fv@gl@@YGXHHEPBM@Z
?UniformMatrix2x3fv@gl@@YGXHHEPBM@Z
?UniformMatrix2x4fv@gl@@YGXHHEPBM@Z
?UniformMatrix3fv@gl@@YGXHHEPBM@Z
?UniformMatrix3x2fv@gl@@YGXHHEPBM@Z
?UniformMatrix3x4fv@gl@@YGXHHEPBM@Z
?UniformMatrix4fv@gl@@YGXHHEPBM@Z
?UniformMatrix4x2fv@gl@@YGXHHEPBM@Z
?UniformMatrix4x3fv@gl@@YGXHHEPBM@Z
?UnmapBuffer@gl@@YGEI@Z
?UnmapBufferOES@gl@@YGEI@Z
?UseProgram@gl@@YGXI@Z
?ValidateProgram@gl@@YGXI@Z
?VertexAttrib1f@gl@@YGXIM@Z
?VertexAttrib1fv@gl@@YGXIPBM@Z
?VertexAttrib2f@gl@@YGXIMM@Z
?VertexAttrib2fv@gl@@YGXIPBM@Z
?VertexAttrib3f@gl@@YGXIMMM@Z
?VertexAttrib3fv@gl@@YGXIPBM@Z
?VertexAttrib4f@gl@@YGXIMMMM@Z
?VertexAttrib4fv@gl@@YGXIPBM@Z
?VertexAttribDivisor@gl@@YGXII@Z
?VertexAttribDivisorANGLE@gl@@YGXII@Z
?VertexAttribI4i@gl@@YGXIHHHH@Z
?VertexAttribI4iv@gl@@YGXIPBH@Z
?VertexAttribI4ui@gl@@YGXIIIII@Z
?VertexAttribI4uiv@gl@@YGXIPBI@Z
?VertexAttribIPointer@gl@@YGXIHIHPBX@Z
?VertexAttribPointer@gl@@YGXIHIEHPBX@Z
?Viewport@gl@@YGXHHHH@Z
?WaitClient@egl@@YGIXZ
?WaitGL@egl@@YGIXZ
?WaitNative@egl@@YGIH@Z
?WaitSync@egl@@YGIPAX0H@Z
?WaitSync@gl@@YGXPAU__GLsync@@I_K@Z
ANGLEPlatformCurrent
ANGLEPlatformInitialize
ANGLEPlatformShutdown
glActiveTexture
glAttachShader
glBeginQuery
glBeginQueryEXT
glBeginTransformFeedback
glBindAttribLocation
glBindBuffer
glBindBufferBase
glBindBufferRange
glBindFramebuffer
glBindRenderbuffer
glBindSampler
glBindTexture
glBindTransformFeedback
glBindUniformLocationCHROMIUM
glBindVertexArray
glBindVertexArrayOES
glBlendColor
glBlendEquation
glBlendEquationSeparate
glBlendFunc
glBlendFuncSeparate
glBlitFramebuffer
glBlitFramebufferANGLE
glBufferData
glBufferSubData
glCheckFramebufferStatus
glClear
glClearBufferfi
glClearBufferfv
glClearBufferiv
glClearBufferuiv
glClearColor
glClearDepthf
glClearStencil
glClientWaitSync
glColorMask
glCompileShader
glCompressedTexImage2D
glCompressedTexImage3D
glCompressedTexSubImage2D
glCompressedTexSubImage3D
glCopyBufferSubData
glCopyTexImage2D
glCopyTexSubImage2D
glCopyTexSubImage3D
glCoverFillPathCHROMIUM
glCoverStrokePathCHROMIUM
glCoverageModulationCHROMIUM
glCreateProgram
glCreateShader
glCullFace
glDebugMessageCallbackKHR
glDebugMessageControlKHR
glDebugMessageInsertKHR
glDeleteBuffers
glDeleteFencesNV
glDeleteFramebuffers
glDeletePathsCHROMIUM
glDeleteProgram
glDeleteQueries
glDeleteQueriesEXT
glDeleteRenderbuffers
glDeleteSamplers
glDeleteShader
glDeleteSync
glDeleteTextures
glDeleteTransformFeedbacks
glDeleteVertexArrays
glDeleteVertexArraysOES
glDepthFunc
glDepthMask
glDepthRangef
glDetachShader
glDisable
glDisableVertexAttribArray
glDiscardFramebufferEXT
glDrawArrays
glDrawArraysInstanced
glDrawArraysInstancedANGLE
glDrawBuffers
glDrawBuffersEXT
glDrawElements
glDrawElementsInstanced
glDrawElementsInstancedANGLE
glDrawRangeElements
glEGLImageTargetRenderbufferStorageOES
glEGLImageTargetTexture2DOES
glEnable
glEnableVertexAttribArray
glEndQuery
glEndQueryEXT
glEndTransformFeedback
glFenceSync
glFinish
glFinishFenceNV
glFlush
glFlushMappedBufferRange
glFlushMappedBufferRangeEXT
glFramebufferRenderbuffer
glFramebufferTexture2D
glFramebufferTextureLayer
glFrontFace
glGenBuffers
glGenFencesNV
glGenFramebuffers
glGenPathsCHROMIUM
glGenQueries
glGenQueriesEXT

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 320KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/nacl64.exe
.exe windows x64

682e365b5398d986e8cda170a6807ae8

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:70:cc:22:85:4a:21:06:47:df:04:26:57:24:8f:60:80:db:39:83:16:20:2e:66:ee:d9:48:0c:65:08:02:a5
Signer

Actual PE Digest

29:70:cc:22:85:4a:21:06:47:df:04:26:57:24:8f:60:80:db:39:83:16:20:2e:66:ee:d9:48:0c:65:08:02:a5

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

87:8f:b9:43:20:63:6a:55:34:5d:3d:34:27:c8:f9:d3:9e:67:b6:c3
Signer

Actual PE Digest

87:8f:b9:43:20:63:6a:55:34:5d:3d:34:27:c8:f9:d3:9e:67:b6:c3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

WSAStartup
WSACleanup
WSACreateEvent
WSACloseEvent
WSAGetLastError
gethostbyname
socket
shutdown
setsockopt
send
select
recv
ntohs
listen
htons
WSAEventSelect
accept
htonl
getsockname
closesocket
bind

winmm

timeEndPeriod
timeBeginPeriod
timeGetTime
timeGetDevCaps

userenv

DestroyEnvironmentBlock
GetProfileType
CreateEnvironmentBlock

kernel32

GetLongPathNameW
CloseHandle
GetCurrentProcess
ResumeThread
IsProcessInJob
QueryInformationJobObject
GetModuleFileNameW
GetModuleHandleW
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetFileAttributesW
GetTempPathW
OutputDebugStringW
GetLastError
GetProcAddress
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLangID
IsDebuggerPresent
LocalFree
GetCurrentDirectoryW
CreateFileW
DeleteFileW
WriteFile
OutputDebugStringA
SetLastError
GetCurrentProcessId
GetTickCount
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentThread
SetThreadPriority
GetThreadPriority
GetSystemTimeAsFileTime
QueryThreadCycleTime
SystemTimeToTzSpecificLocalTime
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
DuplicateHandle
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
OpenProcess
GetStdHandle
ReadFile
SetHandleInformation
CreateProcessW
AssignProcessToJobObject
SetInformationJobObject
AttachConsole
AllocConsole
RaiseException
CreateThread
GetCurrentThreadId
GetVersionExW
GetNativeSystemInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetProcessId
GetModuleHandleExW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryW
CreateEventW
GetModuleHandleA
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
UnregisterWaitEx
RegisterWaitForSingleObject
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
SetEvent
VirtualQuery
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
EnumSystemLocalesW
GetFileAttributesExW
QueryDosDeviceW
RemoveDirectoryW
SetFileAttributesW
MoveFileExW
ResetEvent
WaitForMultipleObjects
ReleaseSRWLockShared
AcquireSRWLockShared
GetModuleHandleExA
FlushFileBuffers
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
SetFileTime
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetProcessTimes
GetSystemInfo
VirtualQueryEx
RtlAddFunctionTable
RtlDeleteFunctionTable
CreateRemoteThread
VirtualProtect
FormatMessageW
DebugActiveProcess
ConnectNamedPipe
GetConsoleMode
WaitNamedPipeW
GetNamedPipeInfo
CancelIo
HeapSetInformation
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TerminateJobObject
GetUserDefaultLCID
GetThreadContext
WriteProcessMemory
FreeLibrary
GetFileType
ProcessIdToSessionId
GetProcessHandleCount
SignalObjectAndWait
CreateMutexW
VirtualProtectEx
VirtualAllocEx
VirtualFreeEx
CreateJobObjectW
ReadProcessMemory
DebugBreak
lstrlenW
SearchPathW
GetThreadId
InitializeCriticalSectionAndSpinCount
InitOnceExecuteOnce
ContinueDebugEvent
WaitForDebugEvent
SuspendThread
SetThreadContext
FlushInstructionCache
ExitProcess
CreateFileA
LockFileEx
UnlockFileEx
MapViewOfFileEx
GetThreadTimes
SwitchToThread
GetSystemTime
DisconnectNamedPipe
SetNamedPipeHandleState
PeekNamedPipe
GetNamedPipeHandleStateW
WriteConsoleW
GetTimeZoneInformation
HeapSize
ReadConsoleW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
SetStdHandle
GetFullPathNameW
GetFullPathNameA
GetDriveTypeW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetProcessHeap
GetCommandLineA
InitializeConditionVariable
WakeConditionVariable
SleepConditionVariableSRW
GetSystemPowerStatus
GetSystemDirectoryW
GetWindowsDirectoryW
ReleaseSemaphore
CreateSemaphoreW
TransactNamedPipe
SetCurrentDirectoryA
GetCurrentDirectoryA
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapFree
HeapReAlloc
GetACP
CreateNamedPipeW
IsValidLocale
GetConsoleCP
LoadLibraryExW
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
LCMapStringW
LoadLibraryExA
GetStringTypeW
EncodePointer
DecodePointer
CompareStringW

advapi32

SetEntriesInAclW
ConvertSidToStringSidW
SetThreadToken
LookupPrivilegeValueW
EqualSid
DuplicateTokenEx
DuplicateToken
CreateRestrictedToken
CreateWellKnownSid
CopySid
RegDisablePredefinedCache
RevertToSelf
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertStringSidToSidW
SetSecurityInfo
SetTokenInformation
SetKernelObjectSecurity
GetSecurityDescriptorSacl
GetLengthSid
GetKernelObjectSecurity
GetAce
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
InitializeAcl
SystemFunction036
RegCreateKeyExW
CreateProcessAsUserW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
GetSecurityInfo

ole32

CoUninitialize
CoInitializeEx
CoTaskMemFree

user32

CreateDesktopW
CloseWindowStation
CloseDesktop
wsprintfW
MessageBoxW
GetThreadDesktop
CreateWindowStationW
SetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
DefWindowProcW
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow

Exports

Exports

ClearBreakpadPipeEnvironmentVariable
ClearCrashKeyValueImpl
CrashForException
DumpProcess
DumpProcessWithoutCrash
GetHandleVerifier
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IsSandboxedProcess
RegisterNonABICompliantCodeRange
SetCrashKeyValueImpl
TerminateProcessWithoutDump
UnregisterNonABICompliantCodeRange
_ovly_debug_event
nacl_global_xlate_base
nacl_thread_ids
nacl_user

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/nacl_irt_x86_32.nexe
.elf linux x86
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/nacl_irt_x86_64.nexe
.elf linux x64
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/natives_blob.bin
.js
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/resources.pak
.js
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/secondarytile.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/53.0.2785.116/snapshot_blob.bin
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/chrome.exe
.exe windows x86

1b4ab2a8bd7a0711a28c96838f5c141d

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1d:84:aa:3a:78:97:e8:c6:b1:ac:49:b0:a2:78:d7:96:48:0a:4d:74:c9:ae:bf:82:f4:1d:7d:23:2d:32:a4:db
Signer

Actual PE Digest

1d:84:aa:3a:78:97:e8:c6:b1:ac:49:b0:a2:78:d7:96:48:0a:4d:74:c9:ae:bf:82:f4:1d:7d:23:2d:32:a4:db

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

08:26:bb:91:0f:2c:e5:7d:46:ff:fd:a4:35:6f:49:f6:55:cd:2f:c3
Signer

Actual PE Digest

08:26:bb:91:0f:2c:e5:7d:46:ff:fd:a4:35:6f:49:f6:55:cd:2f:c3

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

chrome_elf

SignalChromeElf

rpcrt4

UuidCreate

advapi32

ImpersonateNamedPipeClient
GetUserNameW
GetSecurityInfo
RegSetValueExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegDeleteValueW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
GetTokenInformation
OpenProcessToken
ConvertSidToStringSidW
CreateProcessAsUserW
SystemFunction036
GetAce
GetKernelObjectSecurity
GetLengthSid
GetSecurityDescriptorSacl
SetKernelObjectSecurity
SetTokenInformation
SetSecurityInfo
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RevertToSelf
RegDisablePredefinedCache
CopySid
CreateWellKnownSid
CreateRestrictedToken
DuplicateToken
DuplicateTokenEx
EqualSid
LookupPrivilegeValueW
SetThreadToken
SetEntriesInAclW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeGetTime

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

wtsapi32

WTSFreeMemory
WTSQuerySessionInformationW

user32

CloseDesktop
CloseWindowStation
CreateDesktopW
GetThreadDesktop
CreateWindowStationW
SetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
SendMessageTimeoutW
FindWindowExW
GetWindowThreadProcessId
AllowSetForegroundWindow
IsWindow

kernel32

SuspendThread
GetThreadLocale
GetSystemDefaultLCID
CreateSemaphoreW
ReleaseSemaphore
DisconnectNamedPipe
ConnectNamedPipe
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
HeapSize
ReadConsoleW
GetDriveTypeW
WriteConsoleW
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetACP
GetProcessHeap
SetStdHandle
GetFullPathNameW
ExitProcess
GetConsoleMode
GetConsoleCP
RtlUnwind
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
LCMapStringW
EncodePointer
GetStringTypeW
LoadLibraryExA
VirtualProtect
WaitNamedPipeW
TransactNamedPipe
SetNamedPipeHandleState
GetVersion
SleepEx
UnlockFileEx
LockFileEx
GetComputerNameExW
GetModuleHandleA
GetProcAddress
GetLastError
SetLastError
CreateEventW
GetCurrentThreadId
DuplicateHandle
WaitForSingleObject
GetCurrentProcess
GetProcessId
SetCurrentDirectoryW
SetProcessShutdownParameters
LoadLibraryExW
GetCommandLineA
GetCurrentProcessId
GetModuleHandleW
VirtualAlloc
VirtualFree
GetFileInformationByHandle
GetExitCodeProcess
CompareStringW
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetCommandLineW
GetEnvironmentVariableW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
CreateDirectoryW
GetFileAttributesW
GetTempPathW
OutputDebugStringW
MultiByteToWideChar
WideCharToMultiByte
GetUserDefaultLangID
WriteFile
CreateFileW
DeleteFileW
CloseHandle
GetCurrentDirectoryW
FormatMessageA
GetTickCount
SetThreadPriority
Sleep
FileTimeToSystemTime
GetCurrentThread
QueryPerformanceFrequency
GetThreadPriority
SystemTimeToTzSpecificLocalTime
GetSystemTimeAsFileTime
QueryPerformanceCounter
LocalFree
TerminateProcess
OpenProcess
IsDebuggerPresent
GetProcessTimes
CreateThread
GetVersionExW
GetNativeSystemInfo
ReadFile
QueryDosDeviceW
PeekNamedPipe
GetLongPathNameW
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
FlushFileBuffers
lstrlenW
LoadLibraryW
SetInformationJobObject
SetHandleInformation
GetStdHandle
AssignProcessToJobObject
CreatePipe
ResumeThread
CreateProcessW
GetUserDefaultUILanguage
GetLocaleInfoW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetSystemDirectoryW
GetWindowsDirectoryW
RegisterWaitForSingleObject
UnregisterWaitEx
TlsSetValue
TlsAlloc
TlsGetValue
TlsFree
RtlCaptureStackBackTrace
SetUnhandledExceptionFilter
GetModuleHandleExW
FindFirstFileExW
FindNextFileW
FindClose
VirtualQuery
SetEvent
ResetEvent
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
GetSystemInfo
VirtualQueryEx
CreateRemoteThread
HeapSetInformation
VirtualAllocEx
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateJobObject
GetUserDefaultLCID
GetThreadContext
WriteProcessMemory
FreeLibrary
GetFileType
ProcessIdToSessionId
GetProcessHandleCount
SignalObjectAndWait
CreateMutexW
VirtualProtectEx
VirtualFreeEx
CreateJobObjectW
CreateNamedPipeW
ReadProcessMemory
DebugBreak
GetThreadId
SearchPathW
HeapAlloc
HeapReAlloc
HeapFree

winhttp

WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpen
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetTimeouts
WinHttpReadData
WinHttpConnect

Exports

Exports

ClearCrashKeyValueImpl
CrashForException
DumpProcessWithoutCrash
GetCrashReportsImpl
GetHandleVerifier
InjectDumpForHangDebugging
InjectDumpProcessWithoutCrash
IsSandboxedProcess
SetCrashKeyValueImpl

Sections

.text
Size: 580KB - Virtual size: 580KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CPADinfo
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 2B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 141KB - Virtual size: 141KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/debug.log
Ugoku E.C.M. Collection (1-5) [FIXED]/chrome32_53.0.2785.116/wow_helper.exe
.exe windows x64

025a914d0b20e8ede3d03f8d871e5c36

Code Sign

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

13/04/2011, 10:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

Issuer

CN=GlobalSign Timestamping CA - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for MS Authenticode - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

14/12/2015, 00:00

Not After

14/12/2016, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

16/12/2015, 00:00

Not After

16/12/2018, 23:59

Subject

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

24/05/2016, 00:00

Not After

24/06/2027, 00:00

Subject

CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:70:66:b4:06:22:2c:e1:bb:f9:1c:71:5e:03:e9:24:bb:d8:5b:21:aa:8b:de:f6:90:bc:0a:5e:24:d0:68:f2
Signer

Actual PE Digest

20:70:66:b4:06:22:2c:e1:bb:f9:1c:71:5e:03:e9:24:bb:d8:5b:21:aa:8b:de:f6:90:bc:0a:5e:24:d0:68:f2

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

5a:8b:61:c2:b5:96:21:19:ff:e8:61:0d:fd:24:f0:f9:3b:ae:6d:17
Signer

Actual PE Digest

5a:8b:61:c2:b5:96:21:19:ff:e8:61:0d:fd:24:f0:f9:3b:ae:6d:17

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Google Inc,O=Google Inc,L=Mountain View,ST=California,C=US

14/09/2016, 00:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetProcAddress
GetModuleHandleW
VirtualProtectEx
WriteProcessMemory
ReadProcessMemory
OpenProcess
WideCharToMultiByte
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
RaiseException
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetLastError
GetModuleHandleA
FlsGetValue
FlsSetValue
TlsFree
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
ExitProcess
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapSetInformation
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
HeapSize
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSection
HeapReAlloc
RtlVirtualUnwind

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Ugoku E.C.M. Collection (1-5) [FIXED]/ecm1.html
.html
Ugoku E.C.M. Collection (1-5) [FIXED]/ecm2.html
.html
Ugoku E.C.M. Collection (1-5) [FIXED]/ecm3.html
.html
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/01.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/02.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/03.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/04.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/05.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/06.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/07.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/08.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/09.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/10.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/11.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/12.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/memo.html
.html
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM1/s1.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/01.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/02.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/03.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/04.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/05.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/06.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/07.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/08.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/09.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/10.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/aecm1.gif
.gif
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/bar.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM2/note.html
.html
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/01.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/02.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/03.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/04.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/05.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/06.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/07.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/08.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/09.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/10.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/bar.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM3/note.html
.html
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/E.C.M.4.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/01.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/02.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/02F.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/03.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/06.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/07.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/09.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/10.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/Ap.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/Lk.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/bgm.mp3
Ugoku E.C.M. Collection (1-5) [FIXED]/flash/ECM4/files/title.swf
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/0.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/1.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/10.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/11.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/12.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/2.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/3.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/4.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/5.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/6.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/7.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/8.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM1/9.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/0.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/1.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/10.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/2.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/3.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/4.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/5.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/6.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/7.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/8.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM2/9.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/0.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/1.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/10.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/2.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/3.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/4.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/5.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/6.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/7.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/8.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ECM3/9.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ecm1.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ecm2.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ecm3.png
.png
Ugoku E.C.M. Collection (1-5) [FIXED]/images/ecm4.jpg
.jpg
Ugoku E.C.M. Collection (1-5) [FIXED]/★README★.txt

Sharing

General

Malware Config

Signatures

Files

Password: sussy

Password: sussy

e6f39b3587ab9278fb99290006fa6b09

Headers

File Characteristics

Imports

oleaut32

ole32

user32

shell32

msvcrt

kernel32

Sections

.text Size: 152KB - Virtual size: 151KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 512B - Virtual size: 17KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 8KB - Virtual size: 8KB

Password: sussy

fb7edbaed2049fb3a26bdfb89c534f53

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

advapi32

Exports

Exports

Sections

.text Size: 10.0MB - Virtual size: 10.0MB

.rodata Size: 4KB - Virtual size: 4KB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 863KB - Virtual size: 1.8MB

.rsrc Size: 1.9MB - Virtual size: 1.9MB

.reloc Size: 489KB - Virtual size: 489KB

Password: sussy

596c9b606aaebbc44b78357d784a061f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49Certificate

Extended Key Usages

Key Usages

4e:a1:e8:9e:15:ea:4f:fa:93:79:84:d8:8f:54:5f:baCertificate

Extended Key Usages

Key Usages

9a:14:a3:bb:92:84:2b:38:ca:86:36:e4:dc:e6:ac:e8:3f:23:c9:64Signer

Signature Validations

Verification

30/08/2016, 00:38 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

shlwapi

gdiplus

kernel32

user32

advapi32

ole32

shell32

oleaut32

gdi32

version

ws2_32

psapi

winmm

Exports

Exports

Sections

.text
Size: 152KB - Virtual size: 151KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 512B - Virtual size: 17KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 8KB - Virtual size: 8KB

.text
Size: 10.0MB - Virtual size: 10.0MB

.rodata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 863KB - Virtual size: 1.8MB

.rsrc
Size: 1.9MB - Virtual size: 1.9MB

.reloc
Size: 489KB - Virtual size: 489KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

19:1a:32:cb:75:9c:97:b8:cf:ac:11:8d:d5:12:7f:49
Certificate

4e:a1:e8:9e:15:ea:4f:fa:93:79:84:d8:8f:54:5f:ba
Certificate

9a:14:a3:bb:92:84:2b:38:ca:86:36:e4:dc:e6:ac:e8:3f:23:c9:64
Signer

30/08/2016, 00:38
Valid: false

.text
Size: 12.2MB - Virtual size: 12.2MB

.rodata
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3.4MB - Virtual size: 3.4MB

.data
Size: 796KB - Virtual size: 1.7MB

.tls
Size: 512B - Virtual size: 13B

.gfids
Size: 1024B - Virtual size: 660B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 495KB - Virtual size: 494KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

af:e3:00:6f:62:d4:d3:ea:11:6a:16:21:5b:21:75:1c:66:45:e9:c5:c0:92:0a:d5:59:86:99:5a:f6:f5:24:f8
Signer

04/05/2016, 22:35
Valid: false

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 651KB - Virtual size: 651KB

.data
Size: 921KB - Virtual size: 968KB

.rodata
Size: 4KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 512B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 74KB - Virtual size: 74KB

.text
Size: 332KB - Virtual size: 332KB

.data
Size: 954KB - Virtual size: 954KB

04:00:00:00:00:01:2f:4e:e1:52:d7
Certificate

11:21:d6:99:a7:64:97:3e:f1:f8:42:7e:e9:19:cc:53:41:14
Certificate

4c:40:db:a5:f9:88:fa:e5:7a:57:d6:45:74:95:f9:8b
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2a:9c:21:ac:aa:a6:3a:3c:58:a7:b9:32:2b:ee:94:8d
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

26:6f:a5:99:49:45:2c:bc:88:cb:72:6d:72:cc:be:33:85:11:53:b5:a8:ac:29:bd:74:ce:9c:b0:ca:e0:91:e6
Signer