0fce4b732ce10c72093587e82ca9747a885430e366934ddc27e437443ff0cc0e

BENIGN

AI Legitimate Microsoft Graph client binary

Mal-ecule

K₂(McLi)H₇(Cm₅Cr₁₁DbF₇Os₅Po₄Ti₂)Md₂(Bi₃)

Size 6.1 MB download

First seen 14 days ago

Analyzed 12 days ago

Source malshare.com

Also detected by 2 sources

Dynamic pointer arithmetic (memory): upload:0x628

upload pe

0x5c8	243848895c2428c744243020000000c7	$8H.\$(.D$0 ....
0x5d8	44242050c300004989f8ffd083f80175	D$ P...I.......u
0x5e8	65488b45084883f8107248488b55f048	eH.E.H...rHH.U.H
0x5f8	8d48014881f900100000721b488b4af8	.H.H......r.H.J.
0x608	4883c2f84829ca4883fa200f83d00000	H...H).H.. .....
0x618	004883c028eb064889c84889d14889c2	.H..(..H..H..H..
0x628	48b8fe93847877cbc9b54803050ffe5c	H....xw...H....\Dynamic pointer arithmetic (memory)
0x638	00ffd04889f04881c4980000005b5f5e	...H..H......[_^
0x648	415e415f5dc38b051cef5d0065488b0c	A^A_].....].eH..
0x658	2558000000488b04c180b82c00000000	%X...H.....,....
0x668	0f848e0000008b05fcee5d0065488b0c	..........].eH..
0x678	2558000000488b04c1488d881d000000	%X...H...H......
0x688	488b05a1fd5c0048befe93847877cbc9	H....\.H....xw..
0x698	b54801f0ffd0488d0da34e460048894d	.H....H...NF.H.M
0x6a8	d8488d55e00f57c00f1145e0488945c8	.H.U..W...E.H.E.
0x6b8	c645d001488b0575fd5c004801f0488d	.E..H..u.\.H..H.
0x6c8	4dc8ffd0488d05b54e4600488945d890	M...H...NF.H.E..
0x6d8	488d15b1c15800488d4dd8e8dcdc4200	H....X.H.M....B.
0x6e8	9048b8fe93847877cbc9b548030546fd	.H....xw...H..F.
0x6f8	5c00ffd08b056eee5d0065488b0c2558	\.....n.].eH..%X
0x708	000000488b04c1c6802c00000001488b	...H.....,....H.
0x718	050bfd5c0048b9fe93847877cbc9b548	...\.H....xw...H
0x728	01c8488d0d7f200000ffd0e936ffffff	..H... .....6...
0x738	0f1f8400000000004889542410554157	........H.T$.UAW
0x748	41565657534883ec48488daa80000000	AVVWSH..HH......
0x758	48b8fe93847877cbc9b54803059ffc5c	H....xw...H....\
0x768	00488d4df0ffd0904883c4485b5f5e41	.H.M....H..H[_^A
0x778	5e415f5dc30f1f004889542410554157	^A_]....H.T$.UAW
0x788	41565657534883ec48488daa80000000	AVVWSH..HH......
0x798	48b8fe93847877cbc9b54803055ffc5c	H....xw...H.._.\
0x7a8	00488d4df0ffd0904883c4485b5f5e41	.H.M....H..H[_^A
0x7b8	5e415f5dc30f1f004889c880790e0074	^A_]....H...y..t
0x7c8	3b8030e4	;.0.

0xaa440	c84889d14889c2e894e9130048c74500	.H..H.......H.E.
0xaa450	0000000048c745080700000066c745f0	....H.E.....f.E.
0xaa460	0000488b85800000004883f808724148	..H......H...rAH
0xaa470	8b5568488d0c45020000004881f90010	.UhH..E....H....
0xaa480	0000721e488b4af84883c2f84829ca48	..r.H.J.H...H).HExported ServiceMain func (Win Service)
0xaa490	83fa200f83ab0200004801c04883c029	.. ......H..H..)
0xaa4a0	eb064889c84889d14889c2e830e91300	..H..H..H...0...
0xaa4b0	48c745780000000048c7858000000007	H.Ex....H.......
0xaa4c0	00000066c745680000488b45d84883f8	...f.Eh..H.E.H..
0xaa4d0	087241488b55c0488d0c450200000048	.rAH.U.H..E....H
0xaa4e0	81f900100000721e488b4af84883c2f8	......r.H.J.H...
0xaa4f0	4829ca4883fa200f83470200004801c0	H).H.. ..G...H..
0xaa500	4883c029eb064889c84889	H..)..H..H.

0xc6661	4d8b6be04d8b63e8498b6bf0498b5bf8	M.k.M.c.I.k.I.[.
0xc6671	498d23488b7c2408488b742410f3c353	I.#H.\|$.H.t$...S
0xc6681	48413120626c6f636b207472616e7366	HA1 block transf
0xc6691	6f726d20666f72207838365f36342c20	orm for x86_64,
0xc66a1	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0xc66b1	747470733a2f2f6769746875622e636f	ttps://github.co
0xc66c1	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0xc66d1	90909090909090909090909090909090	................
0xc66e1	90909090909090909090909090909090	................
0xc66f1	90909090909090909090909090909056	...............V
0xc6701	57535541544155415641579c4883ec40	WSUATAUAVAW.H..@
0xc6711	498b4078498b98f80000004c8d153eb6	I.@xI......L..>.
0xc6721	ffff4c39d30f8256010000498b809800	..L9...V...I....
0xc6731	00004c8d151fc6ffff4c39d30f833f01	..L......L9...?.
0xc6741	0000488b4040488b58f8	..H.@@H.X.

0xd1b89	8b66e8488b6ef0488b5ef8488d26488b	.f.H.n.H.^.H.&H.
0xd1b99	7c2408488b742410f3c34d6f6e74676f	\|$.H.t$...Montgo
0xd1ba9	6d657279204d756c7469706c69636174	mery Multiplicat
0xd1bb9	696f6e20666f72207838365f36342c20	ion for x86_64,
0xd1bc9	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0xd1bd9	747470733a2f2f6769746875622e636f	ttps://github.co
0xd1be9	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0xd1bf9	90909090909090565753554154415541	.......VWSUATAUA
0xd1c09	5641579c4883ec40498b4078498b98f8	VAW.H..@I.@xI...
0xd1c19	000000498b71084d8b5938458b134e8d	...I.q.M.Y8E..N.
0xd1c29	14164c39d30f82c3000000498b809800	..L9.......I....
0xd1c39	0000458b53044e8d14164c39d30f83ab	..E.S.N...L9....
0xd1c49	0000004d8b90c00000004a8b44d008eb	...M......J.D...
0xd1c59	5b909090909090565753554154415541	[......VWSUATAUA
0xd1c69	5641579c4883ec40498b	VAW.H..@I.

0xd9ae6	0c0fbae21e730a4883c019f3c34883c0	.....s.H.....H..
0xd9af6	0cf3c390909090909090726334283878	..........rc4(8x
0xd9b06	2c696e7429007263342838782c636861	,int).rc4(8x,cha
0xd9b16	722900726334283136782c696e742900	r).rc4(16x,int).
0xd9b26	52433420666f72207838365f36342c20	RC4 for x86_64,
0xd9b36	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0xd9b46	747470733a2f2f6769746875622e636f	ttps://github.co
0xd9b56	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0xd9b66	90909090909090909090909090909090	................
0xd9b76	90909090909090909090565753554154	..........VWSUAT
0xd9b86	4155415641579c4883ec40498b407849	AUAVAW.H..@I.@xI
0xd9b96	8b98f80000004c8d15d0f7ffff4c39d3	......L......L9.
0xd9ba6	7238498b80980000004c8d1517feffff	r8I......L......
0xd9bb6	4c39d37325488d4018488b58f84c8b60	L9.s%H.@.H.X.L.`
0xd9bc6	f04c8b68e8498998900000004d89a0d8	.L.h.I......M...
0xd9bd6	0000004d89a8e0000000	...M......

Well-known

0x5c8	243848895c2428c744243020000000c7	$8H.\$(.D$0 ....
0x5d8	44242050c300004989f8ffd083f80175	D$ P...I.......u
0x5e8	65488b45084883f8107248488b55f048	eH.E.H...rHH.U.H
0x5f8	8d48014881f900100000721b488b4af8	.H.H......r.H.J.
0x608	4883c2f84829ca4883fa200f83d00000	H...H).H.. .....
0x618	004883c028eb064889c84889d14889c2	.H..(..H..H..H..
0x628	48b8fe93847877cbc9b54803050ffe5c	H....xw...H....\
0x638	00ffd04889f04881c4980000005b5f5e	...H..H......[_^
0x648	415e415f5dc38b051cef5d0065488b0c	A^A_].....].eH..
0x658	2558000000488b04c180b82c00000000	%X...H.....,....
0x668	0f848e0000008b05fcee5d0065488b0c	..........].eH..
0x678	2558000000488b04c1488d881d000000	%X...H...H......
0x688	488b05a1fd5c0048befe93847877cbc9	H....\.H....xw..
0x698	b54801f0ffd0488d0da34e460048894d	.H....H...NF.H.M
0x6a8	d8488d55e00f57c00f1145e0488945c8	.H.U..W...E.H.E.
0x6b8	c645d001488b0575fd5c004801f0488d	.E..H..u.\.H..H.
0x6c8	4dc8ffd0488d05b54e4600488945d890	M...H...NF.H.E..
0x6d8	488d15b1c15800488d4dd8e8dcdc4200	H....X.H.M....B.
0x6e8	9048b8fe93847877cbc9b548030546fd	.H....xw...H..F.
0x6f8	5c00ffd08b056eee5d0065488b0c2558	\.....n.].eH..%X
0x708	000000488b04c1c6802c00000001488b	...H.....,....H.
0x718	050bfd5c0048b9fe93847877cbc9b548	...\.H....xw...H
0x728	01c8488d0d7f200000ffd0e936ffffff	..H... .....6...
0x738	0f1f8400000000004889542410554157	........H.T$.UAW
0x748	41565657534883ec48488daa80000000	AVVWSH..HH......
0x758	48b8fe93847877cbc9b54803059ffc5c	H....xw...H....\
0x768	00488d4df0ffd0904883c4485b5f5e41	.H.M....H..H[_^A
0x778	5e415f5dc30f1f004889542410554157	^A_]....H.T$.UAW
0x788	41565657534883ec48488daa80000000	AVVWSH..HH......
0x798	48b8fe93847877cbc9b54803055ffc5c	H....xw...H.._.\
0x7a8	00488d4df0ffd0904883c4485b5f5e41	.H.M....H..H[_^A
0x7b8	5e415f5dc30f1f004889c880790e0074	^A_]....H...y..t
0x7c8	3b8030e4	;.0.

0xc6661	4d8b6be04d8b63e8498b6bf0498b5bf8	M.k.M.c.I.k.I.[.
0xc6671	498d23488b7c2408488b742410f3c353	I.#H.\|$.H.t$...S
0xc6681	48413120626c6f636b207472616e7366	HA1 block transf
0xc6691	6f726d20666f72207838365f36342c20	orm for x86_64,
0xc66a1	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0xc66b1	747470733a2f2f6769746875622e636f	ttps://github.co
0xc66c1	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0xc66d1	90909090909090909090909090909090	................
0xc66e1	90909090909090909090909090909090	................
0xc66f1	90909090909090909090909090909056	...............V
0xc6701	57535541544155415641579c4883ec40	WSUATAUAVAW.H..@
0xc6711	498b4078498b98f80000004c8d153eb6	I.@xI......L..>.
0xc6721	ffff4c39d30f8256010000498b809800	..L9...V...I....
0xc6731	00004c8d151fc6ffff4c39d30f833f01	..L......L9...?.
0xc6741	0000488b4040488b58f8	..H.@@H.X.

0xd1b89	8b66e8488b6ef0488b5ef8488d26488b	.f.H.n.H.^.H.&H.
0xd1b99	7c2408488b742410f3c34d6f6e74676f	\|$.H.t$...Montgo
0xd1ba9	6d657279204d756c7469706c69636174	mery Multiplicat
0xd1bb9	696f6e20666f72207838365f36342c20	ion for x86_64,
0xd1bc9	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0xd1bd9	747470733a2f2f6769746875622e636f	ttps://github.co
0xd1be9	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0xd1bf9	90909090909090565753554154415541	.......VWSUATAUA
0xd1c09	5641579c4883ec40498b4078498b98f8	VAW.H..@I.@xI...
0xd1c19	000000498b71084d8b5938458b134e8d	...I.q.M.Y8E..N.
0xd1c29	14164c39d30f82c3000000498b809800	..L9.......I....
0xd1c39	0000458b53044e8d14164c39d30f83ab	..E.S.N...L9....
0xd1c49	0000004d8b90c00000004a8b44d008eb	...M......J.D...
0xd1c59	5b909090909090565753554154415541	[......VWSUATAUA
0xd1c69	5641579c4883ec40498b	VAW.H..@I.

0xd9ae6	0c0fbae21e730a4883c019f3c34883c0	.....s.H.....H..
0xd9af6	0cf3c390909090909090726334283878	..........rc4(8x
0xd9b06	2c696e7429007263342838782c636861	,int).rc4(8x,cha
0xd9b16	722900726334283136782c696e742900	r).rc4(16x,int).
0xd9b26	52433420666f72207838365f36342c20	RC4 for x86_64,
0xd9b36	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0xd9b46	747470733a2f2f6769746875622e636f	ttps://github.co
0xd9b56	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0xd9b66	90909090909090909090909090909090	................
0xd9b76	90909090909090909090565753554154	..........VWSUAT
0xd9b86	4155415641579c4883ec40498b407849	AUAVAW.H..@I.@xI
0xd9b96	8b98f80000004c8d15d0f7ffff4c39d3	......L......L9.
0xd9ba6	7238498b80980000004c8d1517feffff	r8I......L......
0xd9bb6	4c39d37325488d4018488b58f84c8b60	L9.s%H.@.H.X.L.`
0xd9bc6	f04c8b68e8498998900000004d89a0d8	.L.h.I......M...
0xd9bd6	0000004d89a8e0000000	...M......

0xdaae6	38488d34244889d9e90dfeffffb80100	8H.4$H..........
0xdaaf6	0000488d6424085b5d488b7c2408488b	..H.d$.[]H.\|$.H.
0xdab06	742410f3c3564941205061646c6f636b	t$...VIA Padlock
0xdab16	207838365f3634206d6f64756c652c20	x86_64 module,
0xdab26	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0xdab36	747470733a2f2f6769746875622e636f	ttps://github.co
0xdab46	6d2f646f742d61736d3e009090909090	m/dot-asm>......
0xdab56	90909090909090909090cccccccccccc	................
0xdab66	cccccccccccccccccccccccccccccccc	................
0xdab76	cccccccccccccccccccc48897c240848	..........H.\|$.H
0xdab86	897424104889e04889cf4889d6415441	.t$.H..H..H..ATA
0xdab96	554c8b064d31ed4c8b4e084d01c04c8b	UL..M1.L.N.M..L.
0xdaba6	56104d11c94c8b5e18488d354a684100	V.M..L.^.H.5JhA.
0xdabb6	4c89c04d11d24d11db4c89ca4983d500	L..M..M..L..I...
0xdabc6	4c2b064c89d14c1b4e08	L+.L..L.N.

0xdfcc0	4883d0004c8d1c0048c1f83f49d1eb48	H...L...H..?I..H
0xdfcd0	f7d04883e0134929c04983d9004983da	..H...I).I...I..
0xdfce0	004983db004c89074c894f084c895710	.I...L..L.O.L.W.
0xdfcf0	4c895f18488b7c2408488b742410f3c3	L._.H.\|$.H.t$...
0xdfd00	583235353139207072696d6974697665	X25519 primitive
0xdfd10	7320666f72207838365f36342c204352	s for x86_64, CR
0xdfd20	5950544f47414d53206279203c687474	YPTOGAMS by <htt
0xdfd30	70733a2f2f6769746875622e636f6d2f	ps://github.com/
0xdfd40	646f742d61736d3e0090909090909090	dot-asm>........
0xdfd50	5657535541544155415641579c4883ec	VWSUATAUAVAW.H..
0xdfd60	40498b4078498b98f8000000498b7108	@I.@xI......I.q.
0xdfd70	4d8b5938458b134e8d14164c39d30f82	M.Y8E..N...L9...
0xdfd80	9a000000498b8098000000e98e000000	....I...........
0xdfd90	5657535541544155415641579c4883ec	VWSUATAUAVAW.H..
0xdfda0	40498b4078498b98f8000000498b7108	@I.@xI......I.q.
0xdfdb0	4d8b5938458b134e8d14164c39d3725e	M.Y8E..N...L9.r^
0xdfdc0	498b809800000045	I......E

0x10b132	6fabc000000066450f6fb3d000000066	o.....fE.o.....f
0x10b142	450f6fbbe0000000498da3f800000048	E.o.....I......H
0x10b152	8b7c2408488b742410f3c3506f6c7931	.\|$.H.t$...Poly1
0x10b162	33303520666f72207838365f36342c20	305 for x86_64,
0x10b172	43525950544f47414d53206279203c68	CRYPTOGAMS by <h
0x10b182	747470733a2f2f6769746875622e636f	ttps://github.co
0x10b192	6d2f646f742d61736d3e009090904c29	m/dot-asm>....L)
0x10b1a2	c24c29c14d89ca49c1e904742690f342	.L).M..I...t&..B
0x10b1b2	0f6f040266410fef00f3420f7f040166	.o..fA....B....f
0x10b1c2	410f7f004d8d401049ffc975e14983e2	A...M.@.I..u.I..
0x10b1d2	0f743041b9100000004d29d131c0428a	.t0A.....M).1.B.
0x10b1e2	0402413200428804014188004d8d4001	..A2.B...A..M.@.
0x10b1f2	49ffca75e931c04188004d8d400149ff	I..u.1.A..M.@.I.
0x10b202	c975f44c89c0f3c39090909090904c29	.u.L..........L)
0x10b212	c24c29c14d89ca49c1e9	.L).M..I..

Micro-behaviors

0x541a63	6f6e656e74207369676e00696e76616c	onent sign.inval
0x541a73	696420424f4d3b206d75737420626520	id BOM; must be
0x541a83	30784546203078424220307842462069	0xEF 0xBB 0xBF i
0x541a93	6620676976656e0068747470733a2f2f	f given.https://
0x541aa3	67726170682e6d6963726f736f66742e	graph.microsoft.
0x541ab3	636f6d2f76312e302f6d652f64726976	com/v1.0/me/driv
0x541ac3	652f726f6f742f6368696c6472656e00	e/root/children.
0x541ad3	416c7265616479206f70656e00616363	Already open.acc
0x541ae3	6573735f746f6b656e00266772616e74	ess_token.&grant
0x541af3	5f747970653d726566726573685f746f	_type=refresh_to
0x541b03	6b656e002f6f61757468322f76322e30	ken./oauth2/v2.0
0x541b13	2f746f6b656e00756e6b6e6f776e2074	/token.unknown t
0x541b23	6f6b656e004c6f636b2d546f6b656e00	oken.Lock-Token.
0x541b33	626f6f6c65616e00432d4d616e00696e	boolean.C-Man.in
0x541b43	76616c696420737472696e673a20636f	valid string: co
0x541b53	6e74726f6c2063686172616374657220	ntrol character
0x541b63	552b3030304120284c4629206d757374	U+000A (LF) must
0x541b73	206265206573636170656420746f205c	be escaped to \
0x541b83	7530303041206f72205c6e	u000A or \n

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0x545364	41534349490000005244490052480000	ASCII...RDI.RH..
0x545374	4849474800000000604548006b454448	HIGH....`EH.kEDH
0x545384	00000000454448006b45454344480000	....EDH.kEECDH..
0x545394	45454344480000004145434448000000	EECDH...AECDH...
0x5453a4	45434448000000004144480044480000	ECDH....ADH.DH..
0x5453b4	5041544348000000415547004f524700	PATCH...AUG.ORG.
0x5453c4	6e6f2d524e47000050494e4700000000	no-RNG..PING....
0x5453d4	434f4e46000000003123494e46000000	CONF....1#INF...
0x5453e4	494e46004f464600554e444546000000	INF.OFF.UNDEF...
0x5453f4	53534b444600000050564b4b44460000	SSKDF...PVKKDF..
0x545404	5353484b44460000484b444600000000	SSHKDF..HKDF....
0x545414	4b424b44460000004246000052534153	KBKDF...BF..RSAS
0x545424	56450000545545005452554500000000	VE..TUE.TRUE....
0x545434	46414c534500000053544f5245000000	FALSE...STORE...
0x545444	434f4e4e45000000534d494d45000000	CONNE...SMIME...
0x545454	532f4d494d4500004b78444845000000	S/MIME..KxDHE...
0x545464	6b444845000000006b45434448450000	kDHE....kECDHE..
0x545474	45434448450000004448450049454545	ECDHE...DHE.IEEE
0x545484	000000005452414345000000	....TRACE...

0x547b54	7065637465642063656e7472616c2067	pected central g
0x547b64	656e206b657900000000000065787065	en key......expe
0x547b74	6374696e672061207369706861736820	cting a siphash
0x547b84	6b6579006d697373696e6720746d7020	key.missing tmp
0x547b94	65636468206b6579000000006d697373	ecdh key....miss
0x547ba4	696e6720746d70206468206b65790000	ing tmp dh key..
0x547bb4	0000000063616e277420636865636b20	....can't check
0x547bc4	6468206b657900000000000065787065	dh key......expe
0x547bd4	6374696e672061206468206b65790000	cting a dh key..
0x547be4	000000006572726f722073657474696e	....error settin
0x547bf4	67206b6579000000000000006c6f6720	g key.......log
0x547c04	636f6e66206d697373696e67206b6579	conf missing key
0x547c14	00000000	....

0x54fc80	6464457874656e73696f6e7300000000	ddExtensions....
0x54fc90	5472757374656420436f6d707574696e	Trusted Computin
0x54fca0	672047726f7570204365727469666963	g Group Certific
0x54fcb0	61746520457874656e73696f6e730000	ate Extensions..
0x54fcc0	53696745643235353139206e6f204564	SigEd25519 no Ed
0x54fcd0	323535313920636f6c6c6973696f6e73	25519 collisions
0x54fce0	0000000000000000696e76616c696420	........invalid
0x54fcf0	6d756c7469706c652072646e73000000	multiple rdns...
0x54fd00	696e636f6e73697374656e7420657874	inconsistent ext
0x54fd10	6d7300000000000064656661756c745f	ms......default_
0x54fd20	616c676f726974686d73000000000000	algorithms......
0x54fd30	58353030616c676f726974686d730000	X500algorithms..
0x54fd40	69642d746332362d616c676f72697468	id-tc26-algorith
0x54fd50	6d730000000000006e6f207368617265	ms......no share

0x57b6b8	69642d6d6f642d636d70323032312d38	id-mod-cmp2021-8
0x57b6c8	38000000000000005832353531394d4c	8.......X25519ML
0x57b6d8	4b454d37363800005365635032353672	KEM768..SecP256r
0x57b6e8	314d4c4b454d37363800000000000000	1MLKEM768.......
0x57b6f8	4d4c4b454d3736380000000000000000	MLKEM768........
0x57b708	69642d616c672d6d6c2d6b656d2d3736	id-alg-ml-kem-76
0x57b718	38000000000000004d4c2d4b454d2d37	8.......ML-KEM-7
0x57b728	3638000000000000706b65795f656364	68......pkey_ecd
0x57b738	5f646967657374766572696679343438	_digestverify448
0x57b748	0000000000000000706b65795f656364	........pkey_ecd
0x57b758	5f6469676573747369676e3434380000	_digestsign448..
0x57b768	53696745643434380000000000000000	SigEd448........
0x57b778	6666646865323034	ffdhe204

0x57ec50	686d6163576974685348413531322d32	hmacWithSHA512-2
0x57ec60	3234000000000000583434384d4c4b45	24......X448MLKE
0x57ec70	4d313032340000005365635033383472	M1024...SecP384r
0x57ec80	314d4c4b454d31303234000000000000	1MLKEM1024......
0x57ec90	4d4c4b454d3130323400000000000000	MLKEM1024.......
0x57eca0	69642d616c672d6d6c2d6b656d2d3130	id-alg-ml-kem-10
0x57ecb0	32340000000000004d4c2d4b454d2d31	24......ML-KEM-1
0x57ecc0	303234000000000043414d454c4c4941	024.....CAMELLIA
0x57ecd0	2d3139322d4346423a302e332e343430	-192-CFB:0.3.440
0x57ece0	312e352e332e312e392e323400000000	1.5.3.1.9.24....
0x57ecf0	534c482d4453412d534841322d323536	SLH-DSA-SHA2-256
0x57ed00	733a69642d736c682d6473612d736861	s:id-slh-dsa-sha
0x57ed10	322d323536733a322e	2-256s:2.

0x580100	342d776974682d736861353132000000	4-with-sha512...
0x580110	686b64662d7368613531320000000000	hkdf-sha512.....
0x580120	6d645f676f737431325f353132000000	md_gost12_512...
0x580130	676f7374323031325f35313200000000	gost2012_512....
0x580140	4d4c4b454d3531320000000000000000	MLKEM512........
0x580150	686d6163576974685348413531320000	hmacWithSHA512..
0x580160	6473615f776974685f53484135313200	dsa_with_SHA512.
0x580170	65636473612d776974682d5348413531	ecdsa-with-SHA51
0x580180	3200000000000000534c482d4453412d	2.......SLH-DSA-
0x580190	534841322d323536732d574954482d53	SHA2-256s-WITH-S
0x5801a0	4841353132000000534c482d4453412d	HA512...SLH-DSA-
0x5801b0	534841322d313932732d574954482d53	SHA2-192s-WITH-S
0x5801c0	4841353132000000	HA512...

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0x58ab3c	650035004365727446696e6443657274	e.5.CertFindCert
0x58ab4c	69666963617465496e53746f72650000	ificateInStore..
0x58ab5c	40004365727446726565436572746966	@.CertFreeCertif
0x58ab6c	6963617465436f6e7465787400004600	icateContext..F.
0x58ab7c	43657274476574436572746966696361	CertGetCertifica
0x58ab8c	7465436f6e7465787450726f70657274	teContextPropert
0x58ab9c	79005900436572744f70656e53746f72	y.Y.CertOpenStor
0x58abac	65005a00436572744f70656e53797374	e.Z.CertOpenSyst
0x58abbc	656d53746f72654100005b0043657274	emStoreA..[.Cert
0x58abcc	4f70656e53797374656d53746f726557	OpenSystemStoreW
0x58abdc	00003b00575341496f63746c00004900	..;.WSAIoctl..I.
0x58abec	57534152656376004e0057534153656e	WSARecv.N.WSASen
0x58abfc	64005700575341536f636b6574410000	d.W.WSASocketA..
0x58ac0c	5800575341536f636b65745700005b00	X.WSASocketW..[.
0x58ac1c	57	W

0x5464f0	0000000000000000667269656e646c79	........friendly
0x546500	436f756e7472790066696c655f6c6f61	Country.file_loa
0x546510	645f6469725f656e7472790000000000	d_dir_entry.....
0x546520	583530395f4e414d455f6164645f656e	X509_NAME_add_en
0x546530	747279000000000063685f7265747279	try.....ch_retry
0x546540	0000000000000000706f72745f73656e	........port_sen
0x546550	645f7265747279006261642077726974	d_retry.bad writ
0x546560	652072657472790073686f756c642072	e retry.should r
0x546570	657472790000000052455452595f5343	etry....RETRY_SC
0x546580	4944207365	ID se

0x5478b8	655f6b65790000006f73736c5f64685f	e_key...ossl_dh_
0x5478c8	636f6d707574655f6b65790000000000	compute_key.....
0x5478d8	6f73736c5f656364685f73696d706c65	ossl_ecdh_simple
0x5478e8	5f636f6d707574655f6b657900000000	_compute_key....
0x5478f8	454344485f636f6d707574655f6b6579	ECDH_compute_key
0x547908	00000000000000006f73736c5f783530	........ossl_x50
0x547918	395f636865636b5f707269766174655f	9_check_private_
0x547928	6b65790000000000583530395f636865	key.....X509_che
0x547938	636b5f707269766174655f6b65790000	ck_private_key..
0x547948	6765745f7061796c6f61645f70726976	get_payload_priv
0x547958	6174655f6b6579006f73736c5f6d6c5f	ate_key.ossl_ml_
0x547968	6473615f67656e65726174655f6b6579	dsa_generate_key
0x547978	000000000000000045435f4b45595f67	........EC_KEY_g
0x547988	656e65726174655f6b65790000000000	enerate_key.....
0x547998	67656e65726174655f6b657900000000	generate_key....
0x5479a8	746c7331335f7570646174655f6b6579	tls13_update_key
0x5479b8	0000000000000000656e635f6b657900	........enc_key.
0x5479c8	6765745f7061796c6f61645f7075626c	get_payload_publ
0x5479d8	69635f6b657900007075626c69635f6b	ic_key..public_k
0x5479e8	657900000000000044485f636865636b	ey......DH_check
0x5479f8	5f7075625f6b65790000000000000000	_pub_key........
0x547a08	7075625f6b6579006f7373	pub_key.oss

0x548ca0	63727970745f65780000000000000000	crypt_ex........
0x548cb0	504b435331325f7062655f6372797074	PKCS12_pbe_crypt
0x548cc0	5f6578000000000055495f7365745f72	_ex.....UI_set_r
0x548cd0	6573756c745f65780000000000000000	esult_ex........
0x548ce0	4556505f504b45595f6465726976655f	EVP_PKEY_derive_
0x548cf0	696e69745f6578004556505f5042455f	init_ex.EVP_PBE_
0x548d00	436970686572496e69745f6578000000	CipherInit_ex...
0x548d10	504b4353355f7062655f7365745f6578	PKCS5_pbe_set_ex
0x548d20	0000000000000000504b4353355f7062	........PKCS5_pb
0x548d30	6b6466325f7365745f65780000000000	kdf2_set_ex.....
0x548d40	6765745f636572745f62795f7375626a	get_cert_by_subj
0x548d50	6563745f6578000044485f636865636b	ect_ex..DH_check
0x548d60	5f706172616d735f6578000000000000	_params_ex......
0x548d70	52414e445f707269765f62797465735f	RAND_priv_bytes_
0x548d80	657800000000000052414e445f627974	ex......RAND_byt
0x548d90	65735f6578000000504b4353355f7062	es_ex...PKCS5_pb
0x548da0	655f736574305f616c676f725f657800	e_set0_algor_ex.
0x548db0	4556505f504b45595f6465726976655f	EVP_PKEY_derive_
0x548dc0	7365745f706565725f65780000000000	set_peer_ex.....
0x548dd0	42494f5f6c6f6f6b75705f6578000000	BIO_lookup_ex...
0x548de0	50454d5f583530395f494e464f5f7265	PEM_X509_INFO_re
0x548df0	61645f62696f5f657800000000000000	ad_bio_ex.......
0x548e00	50454d5f726561645f62696f5f657800	PEM_read_bio_ex.
0x548e10	6932625f50564b5f62696f5f65780000	i2b_PVK_bio_ex..
0x548e20	53534c5f4354585f7573655f73657276	SSL_CTX_use_serv
0x548e30	6572696e666f5f657800000000000000	erinfo_ex.......
0x548e40	45434453415f646f5f	ECDSA_do_

0x548ff0	7970745f6432695f6578000000000000	ypt_d2i_ex......
0x549000	45435f47524f55505f6e65775f62795f	EC_GROUP_new_by_
0x549010	63757276655f6e616d655f6578000000	curve_name_ex...
0x549020	583530395f6c6f61645f636572745f66	X509_load_cert_f
0x549030	696c655f65780000583530395f6c6f61	ile_ex..X509_loa
0x549040	645f636572745f63726c5f66696c655f	d_cert_crl_file_
0x549050	6578000000000000504b4353385f7365	ex......PKCS8_se
0x549060	74305f7062655f657800000000000000	t0_pbe_ex.......
0x549070	746c7331335f686b64665f657870616e	tls13_hkdf_expan
0x549080	645f6578000000006f73736c5f64685f	d_ex....ossl_dh_
0x549090	6e65775f62795f6e69645f6578	new_by_nid_ex

0x55ba03	2d686d61632d7368613531322d65746d	-hmac-sha512-etm
0x55ba13	00000000006165732d3139322d636263	.....aes-192-cbc
0x55ba23	2d686d61632d7368613531322d65746d	-hmac-sha512-etm
0x55ba33	00000000006165732d3132382d636263	.....aes-128-cbc
0x55ba43	2d686d61632d736861312d65746d0000	-hmac-sha1-etm..
0x55ba53	00000000006165732d3235362d636263	.....aes-256-cbc
0x55ba63	2d686d61632d736861312d65746d0000	-hmac-sha1-etm..
0x55ba73	00000000006165732d3139322d636263	.....aes-192-cbc
0x55ba83	2d686d61632d736861312d65746d0000	-hmac-sha1-etm..
0x55ba93	0000000000696e76616c696420666f72	.....invalid for
0x55baa3	6d00000000752e7632466f726d000000	m....u.v2Form...
0x55bab3	0000000000752e7631466f726d000000	.....u.v1Form...
0x55bac3	000000000069642d69742d	.....id-it-

0x57774b	2d484d41432d5348413531322d45544d	-HMAC-SHA512-ETM
0x57775b	00000000004145532d3139322d434243	.....AES-192-CBC
0x57776b	2d484d41432d5348413531322d45544d	-HMAC-SHA512-ETM
0x57777b	00000000004145532d3132382d434243	.....AES-128-CBC
0x57778b	2d484d41432d534841312d45544d0000	-HMAC-SHA1-ETM..
0x57779b	00000000004145532d3235362d434243	.....AES-256-CBC
0x5777ab	2d484d41432d534841312d45544d0000	-HMAC-SHA1-ETM..
0x5777bb	00000000004145532d3139322d434243	.....AES-192-CBC
0x5777cb	2d484d41432d534841312d45544d0000	-HMAC-SHA1-ETM..
0x5777db	0000000000583530395f41434552545f	.....X509_ACERT_
0x5777eb	4953535545525f5632464f524d000000	ISSUER_V2FORM...
0x5777fb	0000000000434c49454e545f52414e44	.....CLIENT_RAND
0x57780b	4f4d0000004f53534c5f41	OM...OSSL_A

0x580e55	68613100000000000000007273615f70	ha1........rsa_p
0x580e65	6b6373315f6d64355f73686131000000	kcs1_md5_sha1...
0x580e75	0000007273615f706b6373315f736861	...rsa_pkcs1_sha
0x580e85	31000069642d616c672d64682d736967	1..id-alg-dh-sig
0x580e95	2d686d61632d73686131006165732d31	-hmac-sha1.aes-1
0x580ea5	32382d6362632d686d61632d73686131	28-cbc-hmac-sha1
0x580eb5	0000006165732d3235362d6362632d68	...aes-256-cbc-h
0x580ec5	6d61632d736861310000006165732d31	mac-sha1...aes-1
0x580ed5	39322d6362632d686d61632d73686131	92-cbc-hmac-sha1
0x580ee5	000000686d61632d7368613100000000	...hmac-sha1....
0x580ef5	0000006d64352d736861310000000000	...md5-sha1.....
0x580f05	00000073736c332d7368613100000000	...ssl3-sha1....
0x580f15	0000005f5f73776966745f3100000000	...__swift_1....
0x580f25	0000005253415f70616464696e675f63	...RSA_padding_c
0x580f35	6865636b5f504b4353315f747970655f	heck_PKCS1_type_
0x580f45	3100005253415f70616464696e675f61	1..RSA_padding_a
0x580f55	64645f504b4353315f747970655f3100	dd_PKCS1_type_1.
0x580f65	0000006e6f5f746c73315f31	...no_tls1_1

0x58114b	0000000000686d616357697468534841	.....hmacWithSHA
0x58115b	31000000006473615769746853484131	1....dsaWithSHA1
0x58116b	000000000065636473612d776974682d	.....ecdsa-with-
0x58117b	53484131004145532d3132382d434243	SHA1.AES-128-CBC
0x58118b	2d484d41432d53484131000000414553	-HMAC-SHA1...AES
0x58119b	2d3235362d4342432d484d41432d5348	-256-CBC-HMAC-SH
0x5811ab	41310000004145532d3139322d434243	A1...AES-192-CBC
0x5811bb	2d484d41432d53484131000000484d41	-HMAC-SHA1...HMA
0x5811cb	432d5348413100000000000000525341	C-SHA1.......RSA
0x5811db	2d534841310000000000000000445341	-SHA1........DSA
0x5811eb	2d5348413100000000000000004d4435	-SHA1........MD5
0x5811fb	2d534841310000000000000000525341	-SHA1........RSA
0x58120b	2b534841310000000000000000454344	+SHA1........ECD
0x58121b	53412b53484131000000000000445341	SA+SHA1......DSA
0x58122b	2b53484131000000000000000043414d	+SHA1........CAM
0x58123b	454c4c49412d3235362d4543423a302e	ELLIA-256-ECB:0.
0x58124b	332e34343031	3.4401

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0x5472e0	69635f76657269667900000000000000	ic_verify.......
0x5472f0	706b65795f7273615f76657269667900	pkey_rsa_verify.
0x547300	6f73736c5f7273615f76657269667900	ossl_rsa_verify.
0x547310	7273615f766572696679000000000000	rsa_verify......
0x547320	4556505f504b45595f76657269667900	EVP_PKEY_verify.
0x547330	5343545f4354585f7665726966790000	SCT_CTX_verify..
0x547340	45434453415f76657269667900000000	ECDSA_verify....
0x547350	656432353531395f7665726966790000	ed25519_verify..
0x547360	65643434385f76657269667900000000	ed448_verify....
0x547370	62696e64657220646f6573206e6f7420	binder does not
0x547380	76657269667900006e6f206365727420	verify..no cert
0x547390	73657420666f7220757320746f207665	set for us to ve
0x5473a0	7269667900000000	rify....

0x54806f	20656e63207075626c6963206b657900	enc public key.
0x54807f	006e6f742061207075626c6963206b65	.not a public ke
0x54808f	79000000000000000069737375657220	y........issuer
0x54809f	636572746966696361746520646f6573	certificate does
0x5480af	6e277420686176652061207075626c69	n't have a publi
0x5480bf	63206b65790000000065787065637469	c key....expecti
0x5480cf	6e6720616e206563206b657900000000	ng an ec key....
0x5480df	00657870656374696e6720616e20686d	.expecting an hm
0x5480ef	6163206b657900000064696765737420	ac key...digest
0x5480ff	746f6f2062696720666f722072736120	too big for rsa
0x54810f	6b657900000000000065787065637469	key......expecti
0x54811f	6e6720616e20727361206b6579000000	ng an rsa key...
0x54812f	00657870656374696e67206120647361	.expecting a dsa
0x54813f	206b6579000000000054686520706173	key.....The pas
0x54814f	736564204556505f504b4559206d7573	sed EVP_PKEY mus
0x54815f	742062652061737369676e6564206120	t be assigned a
0x54816f	6b6579000000000000525341206b6579	key......RSA key
0x54817f	00657870656374696e67206120706f6c	.expecting a pol
0x54818f	7931333035206b657900000000000000	y1305 key.......
0x54819f	0076616c75652e62794b657900000000	.value.byKey....
0x5481af	0069642d7265674374726c2d70726f74	.id-regCtrl-prot
0x5481bf	6f636f6c456e63724b65790000000000	ocolEncrKey.....
0x5481cf	00707269766174654b657900	.privateKey.

0x548ca0	63727970745f65780000000000000000	crypt_ex........
0x548cb0	504b435331325f7062655f6372797074	PKCS12_pbe_crypt
0x548cc0	5f6578000000000055495f7365745f72	_ex.....UI_set_r
0x548cd0	6573756c745f65780000000000000000	esult_ex........
0x548ce0	4556505f504b45595f6465726976655f	EVP_PKEY_derive_
0x548cf0	696e69745f6578004556505f5042455f	init_ex.EVP_PBE_
0x548d00	436970686572496e69745f6578000000	CipherInit_ex...
0x548d10	504b4353355f7062655f7365745f6578	PKCS5_pbe_set_ex
0x548d20	0000000000000000504b4353355f7062	........PKCS5_pb
0x548d30	6b6466325f7365745f65780000000000	kdf2_set_ex.....
0x548d40	6765745f636572745f62795f7375626a	get_cert_by_subj
0x548d50	6563745f6578000044485f636865636b	ect_ex..DH_check
0x548d60	5f706172616d735f6578000000000000	_params_ex......
0x548d70	52414e445f707269765f62797465735f	RAND_priv_bytes_
0x548d80	657800000000000052414e445f627974	ex......RAND_byt
0x548d90	65735f6578000000504b4353355f7062	es_ex...PKCS5_pb
0x548da0	655f736574305f616c676f725f657800	e_set0_algor_ex.
0x548db0	4556505f504b45595f6465726976655f	EVP_PKEY_derive_
0x548dc0	7365745f706565725f65780000000000	set_peer_ex.....
0x548dd0	42494f5f6c6f6f6b75705f6578000000	BIO_lookup_ex...
0x548de0	50454d5f583530395f494e464f5f7265	PEM_X509_INFO_re
0x548df0	61645f62696f5f657800000000000000	ad_bio_ex.......
0x548e00	50454d5f726561645f62696f5f657800	PEM_read_bio_ex.
0x548e10	6932625f50564b5f62696f5f65780000	i2b_PVK_bio_ex..
0x548e20	53534c5f4354585f7573655f73657276	SSL_CTX_use_serv
0x548e30	6572696e666f5f657800000000000000	erinfo_ex.......
0x548e40	45434453415f646f5f	ECDSA_do_

0x54956c	5f696e7374616e63655f6e6577000000	_instance_new...
0x54957c	000000004f4353505f636572745f6964	....OCSP_cert_id
0x54958c	5f6e657700000000000000006b64665f	_new........kdf_
0x54959c	6172676f6e3269645f6e657700000000	argon2id_new....
0x5495ac	0000000061736e315f6974656d5f656d	....asn1_item_em
0x5495bc	6265645f6e657700000000006b64665f	bed_new.....kdf_
0x5495cc	6172676f6e32645f6e65770073656564	argon2d_new.seed
0x5495dc	5f7372635f6e6577000000006f73736c	_src_new....ossl
0x5495ec	5f717569635f6e65770000006f73736c	_quic_new...ossl
0x5495fc	5f706f6c6963795f646174615f6e6577	_policy_data_new
0x54960c	000000004556505f504b45595f6e6577	....EVP_PKEY_new
0x54961c	00000000583530395f504b45595f6e65	....X509_PKEY_ne
0x54962c	770000004556505f4b44465f4354585f	w...EVP_KDF_CTX_
0x54963c	6e6577004556505f52414e445f435458	new.EVP_RAND_CTX
0x54964c	5f6e657700000000000000004556505f	_new........EVP_
0x54965c	4d41435f4354585f6e65770045435f50	MAC_CTX_new.EC_P
0x54966c	4f494e545f6e65770000000053534c5f	OINT_new....SSL_
0x54967c	6e657700424e5f424c494e44494e475f	new.BN_BLINDING_
0x54968c	6e657700583530395f53544f52455f6e	new.X509_STORE_n
0x54969c	65770000454e47494e455f6e65770000	ew..ENGINE_new..
0x5496ac	0000000042494f5f70617273655f686f	....BIO_parse_ho
0x5496bc	7374736572760000000000006f73736c	stserv......ossl
0x5496cc	5f6465636f6465725f696e7374616e63	_decoder_instanc
0x5496dc	655f6e65775f666f7270726f76000000	e_new_forprov...
0x5496ec	00000000746c736976	....tlsiv

0x54aae8	31322d706172616d5365745465737400	12-paramSetTest.
0x54aaf8	424e5f6d6f645f737172740000000000	BN_mod_sqrt.....
0x54ab08	6d6c785f6b656d5f6578706f72740000	mlx_kem_export..
0x54ab18	6d6c5f6b656d5f6578706f7274000000	ml_kem_export...
0x54ab28	4556505f504b45595f6578706f727400	EVP_PKEY_export.
0x54ab38	6e6f74206b6579207472616e73706f72	not key transpor
0x54ab48	740000000000000074666f206e6f206b	t.......tfo no k
0x54ab58	65726e656c20737570706f7274000000	ernel support...
0x54ab68	44796e616d696320656e67696e65206c	Dynamic engine l
0x54ab78	6f6164696e6720737570706f72740000	oading support..
0x54ab88	536f66747761726520656e67696e6520	Software engine
0x54ab98	737570706f7274006576705f6b65796d	support.evp_keym
0x54aba8	676d745f7574696c	gmt_util

0x5008c0	10000000100000001000000010000000	................
0x5008d0	10000000100000001000000010000000	................
0x5008e0	10000000100000001000000010000000	................
0x5008f0	10000000100000001000000010000000	................
0x500900	657870616e642033322d62797465206b	expand 32-byte k
0x500910	00436861436861323020666f72207838	.ChaCha20 for x8
0x500920	365f36342c2043525950544f47414d53	6_64, CRYPTOGAMS
0x500930	206279203c68747470733a2f2f676974	by <https://git
0x500940	6875622e636f6d2f646f742d61736d3e	hub.com/dot-asm>
0x500950	00000000000000000000000000000000	................
0x500960	00000000000000000000000000000000	................
0x500970	00000000000000000000000000000000	................
0x500980	ffffff0000000000ffffff0000000000	................
0x500990	ffffff0000000000ff	.........

0x57d850	2e3431302e3230303034362e312e312e	.410.200046.1.1.
0x57d860	31350000000000006368616368613230	15......chacha20
0x57d870	2d706f6c793133303500000000000000	-poly1305.......
0x57d880	706f6c79313330350000000000000000	poly1305........
0x57d890	43686143686132302d506f6c79313330	ChaCha20-Poly130
0x57d8a0	3500000000000000506f6c7931333035	5.......Poly1305
0x57d8b0	000000000000000045434448452d5053	........ECDHE-PS
0x57d8c0	4b2d43484143484132302d504f4c5931	K-CHACHA20-POLY1
0x57d8d0	33303500000000004448452d50534b2d	305.....DHE-PSK-
0x57d8e0	43484143484132302d504f4c59313330	CHACHA20-POLY130
0x57d8f0	35000000000000005253412d50534b2d	5.......RSA-PSK-
0x57d900	43484143484132302d504f4c59313330	CHACHA20-POLY130
0x57d910	350000000000000050534b2d43484143	5.......PSK-CHAC
0x57d920	48	H

0x553458	74720000000000006165732d3132382d	tr......aes-128-
0x553468	6374720000000000617269612d313238	ctr.....aria-128
0x553478	2d6374720000000063616d656c6c6961	-ctr....camellia
0x553488	2d3132382d6374720000000000000000	-128-ctr........
0x553498	6165732d3235362d6374720000000000	aes-256-ctr.....
0x5534a8	617269612d3235362d63747200000000	aria-256-ctr....
0x5534b8	63616d656c6c69612d3235362d637472	camellia-256-ctr
0x5534c8	0000000000000000736d342d63747200	........sm4-ctr.
0x5534d8	6165732d3139322d6374720000000000	aes-192-ctr.....
0x5534e8	617269612d3139322d63747200000000	aria-192-ctr....
0x5534f8	63616d656c6c69612d3139322d637472	camellia-192-ctr
0x553508	00000000000000007463672d61742d70	........tcg-at-p
0x553518	6c6174666f726d4d616e75	latformManu

0x576df0	2d544253000000004145532d3132382d	-TBS....AES-128-
0x576e00	4354520000000000415249412d313238	CTR.....ARIA-128
0x576e10	2d4354520000000043414d454c4c4941	-CTR....CAMELLIA
0x576e20	2d3132382d4354520000000000000000	-128-CTR........
0x576e30	4145532d3235362d4354520000000000	AES-256-CTR.....
0x576e40	415249412d3235362d43545200000000	ARIA-256-CTR....
0x576e50	43414d454c4c49412d3235362d435452	CAMELLIA-256-CTR
0x576e60	0000000000000000534d342d43545200	........SM4-CTR.
0x576e70	4145532d3139322d4354520000000000	AES-192-CTR.....
0x576e80	415249412d3139322d43545200000000	ARIA-192-CTR....
0x576e90	43414d454c4c49412d3139322d435452	CAMELLIA-192-CTR
0x576ea0	00000000000000004f53534c5f415454	........OSSL_ATT
0x576eb0	5249425554455f44455343	RIBUTE_DESC

0x48fe80	824141c3824141c3299999b0299999b0	.AA..AA.)...)...
0x48fe90	5a2d2d775a2d2d771e0f0f111e0f0f11	Z--wZ--w........
0x48fea0	7bb0b0cb7bb0b0cba85454fca85454fc	{...{....TT..TT.
0x48feb0	6dbbbbd66dbbbbd62c16163a2c16163a	m...m...,..:,..:
0x48fec0	637c777bf26b6fc53001672bfed7ab76	c\|w{.ko.0.g+...v
0x48fed0	ca82c97dfa5947f0add4a2af9ca472c0	...}.YG.......r.
0x48fee0	b7fd9326363ff7cc34a5e5f171d83115	...&6?..4...q.1.
0x48fef0	04c723c31896059a071280e2eb27b275	..#..........'.u
0x48ff00	09832c1a1b6e5aa0523bd6b329e32f84	..,..nZ.R;..)./.
0x48ff10	53d100ed20fcb15b6acbbe394a4c58cf	S... ..[j..9JLX.
0x48ff20	d0efaafb434d338545f9027f503c9fa8	....CM3.E...P<..
0x48ff30	51a3408f929d38f5bcb6da2110fff3d2	Q.@...8....!....
0x48ff40	cd0c13ec5f974417c4a77e3d645d1973	...._.D...~=d].s
0x48ff50	60814fdc222a90	`.O."*.

0x5d2170	6e7440737464404040626f6f73744040	nt@std@@@boost@@
0x5d2180	0000000000000000ffffffffffffffff	................
0x5d2190	01000000000000000000000000000000	................
0x5d21a0	483c4780010000000000000000000000	H<G.............
0x5d21b0	2e3f415666696c6573797374656d5f65	.?AVfilesystem_e
0x5d21c0	72726f724066696c6573797374656d40	rror@filesystem@
0x5d21d0	7374644040000000ffffffff00000000	std@@...........
0x5d21e0	02000800000000008058578001000000	.........XW.....
0x5d21f0	03000800000000005867548001000000	........XgT.....
0x5d2200	04000800000000000059578001000000	.........YW.....
0x5d2210	05000800000000006867548001000000	........hgT.....
0x5d2220	0600080000000000a858578001000000	.........XW.....
0x5d2230	0700080000000000d858578001000000	.........XW.....
0x5d2240	0800080000000000d058578001000000	.........XW.....
0x5d2250	0900080000	.....

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0xaa440	c84889d14889c2e894e9130048c74500	.H..H.......H.E.
0xaa450	0000000048c745080700000066c745f0	....H.E.....f.E.
0xaa460	0000488b85800000004883f808724148	..H......H...rAH
0xaa470	8b5568488d0c45020000004881f90010	.UhH..E....H....
0xaa480	0000721e488b4af84883c2f84829ca48	..r.H.J.H...H).H
0xaa490	83fa200f83ab0200004801c04883c029	.. ......H..H..)
0xaa4a0	eb064889c84889d14889c2e830e91300	..H..H..H...0...
0xaa4b0	48c745780000000048c7858000000007	H.Ex....H.......
0xaa4c0	00000066c745680000488b45d84883f8	...f.Eh..H.E.H..
0xaa4d0	087241488b55c0488d0c450200000048	.rAH.U.H..E....H
0xaa4e0	81f900100000721e488b4af84883c2f8	......r.H.J.H...
0xaa4f0	4829ca4883fa200f83470200004801c0	H).H.. ..G...H..
0xaa500	4883c029eb064889c84889	H..)..H..H.

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0x58b76c	fe0556657269667956657273696f6e49	..VerifyVersionI
0x58b77c	6e666f57000002065669727475616c46	nfoW....VirtualF
0x58b78c	726565000e0657616974466f724d756c	ree...WaitForMul
0x58b79c	7469706c654f626a6563747300001006	tipleObjects....
0x58b7ac	57616974466f7253696e676c654f626a	WaitForSingleObj
0x58b7bc	65637400110657616974466f7253696e	ect...WaitForSin
0x58b7cc	676c654f626a65637445780018065761	gleObjectEx...Wa
0x58b7dc	6b65416c6c436f6e646974696f6e5661	keAllConditionVa
0x58b7ec	726961626c6500003706576964654368	riable..7.WideCh
0x58b7fc	6172546f4d756c746942797465004a06	arToMultiByte.J.
0x58b80c	5772697465436f6e736f6c6557004b06	WriteConsoleW.K.
0x58b81c	577269746546696c6500b00147657450	WriteFile...GetP
0x58b82c	726f6365737357696e646f7753746174	rocessWindowStat
0x58b83c	696f6e00da01476574557365724f626a	ion...GetUserObj
0x58b84c	656374496e666f726d6174696f6e5700	ectInformationW.
0x58b85c	8b024d657373616765426f7857004950	..MessageBoxW.IP
0x58b86c	484c504150492e444c4c006e74646c6c	HLPAPI.DLL.ntdll
0x58b87c	2e646c6c0041445641504933322e646c	.dll.ADVAPI32.dl
0x58b88c	6c00435259505433322e646c6c005753	l.CRYPT32.dll.WS
0x58b89c	325f33322e646c6c004b45524e454c33	2_32.dll.KERNEL3
0x58b8ac	322e646c6c005553455233322e646c6c	2.dll.USER32.dll
0x58b8bc	00000000000000000000000000000000	................
0x58b8cc	00000000000000000000000000000000	................
0x58b8dc	000000001917098517030f0113000830	...............0
0x58b8ec	0770066005e003f00150000098fe4200	.p.`.....P....B.
0x58b8fc	28d158000118070011820d300c700b60	(.X........0.p.`
0x58b90c	0ae008f0065000000118070011820d30	.....P.........0
0x58b91c	0c700b600ae008f00650000022059319	.p.`.....P.."...
0x58b92c	0200000050d158000000000000000000	....P.X.........
0x58b93c	0700000060d158009000000000000000	....`.X.........
0x58b94c	01000000ffffffff40130000ffffffff	........@.......
0x58b95c	8013000030100000ffffffff7e100000	....0.......~...
0x58b96c	0000000088100000ffffffff51110000	............Q...
0x58b97c	000000005f110000ffffffffd8120000	...._...........
0x58b98c	01000000e9120000ffffffff01050200	................
0x58b99c	05720160010502000532016001050200	.r.`.....2.`....
0x58b9ac	05320160010502000532016019150885	.2.`.....2.`....
0x58b9bc	15030d01340006300570046003e00150	....4..0.p.`...P
0x58b9cc	98fe4200f4d15800011606000f520b30	..B...X......R.0
0x58b9dc	0a70096008e00650011606000f520b30	.p.`...P.....R.0
0x58b9ec	0a70096008e006502205931902000000	.p.`...P".......
0x58b9fc	1cd25800000000000000000008000000	..X.............
0x58ba0c	2cd25800980100000000000001000000	,.X.............
0x58ba1c	ffffffffa01c000000000000701c0000	............p...
0x58ba2c	90150000ffffffffa417000000000000	................
0x58ba3c	2118000001000000ae180000ffffffff	!...............
0x58ba4c	8a1a000000000000d51b0000ffffffff	................
0x58ba5c	e01b000001000000e61b0000ffffffff	................

0x5443c0	686f737400000000656d636f73740000	host....emcost..
0x5443d0	65717565737400006469676573740000	equest..digest..
0x5443e0	69676573740000006361737400000000	igest...cast....
0x5443f0	73717274000000006365727400000000	sqrt....cert....
0x544400	537461727400000069642d7174000000	Start...id-qt...
0x544410	73637279707400005f6879706f740000	scrypt.._hypot..
0x544420	70696c6f74000000636c69656e740000	pilot...client..
0x544430	6e7374616e7400006d676d7400000000	nstant..mgmt....
0x544440	73616c7400000000616c7400696e6974	salt....alt.init
0x544450	000000006c696d697400000069642d69	....limit...id-i
0x544460	740000006f6666736574000069642d73	t...offset..id-s
0x544470	65740000736574007365637265740000	et..set.secret..
0x544480	6372657400	cret.

0x58ac54	6972655352574c6f636b4578636c7573	ireSRWLockExclus
0x58ac64	69766500010041637175697265535257	ive...AcquireSRW
0x58ac74	4c6f636b536861726564000024004172	LockShared..$.Ar
0x58ac84	6546696c6541706973414e5349009400	eFileApisANSI...
0x58ac94	436c6f736548616e646c6500aa00436f	CloseHandle...Co
0x58aca4	6d70617265537472696e67570000b000	mpareStringW....
0x58acb4	436f6e766572744669626572546f5468	ConvertFiberToTh
0x58acc4	726561640000b400436f6e7665727454	read....ConvertT
0x58acd4	6872656164546f466962657245780000	hreadToFiberEx..
0x58ace4	bc00436f707946696c655700c9004372	..CopyFileW...Cr
0x58acf4	656174654469726563746f7279570000	eateDirectoryW..
0x58ad04	cb004372656174654576656e74410000	..CreateEventA..
0x58ad14	ce00437265617465457665	..CreateEve

Metadata

0x4ae2c0	009b328001000000609b328001000000	..2.....`.2.....
0x4ae2d0	0000000000000000007c2a8001000000	.........\|*.....
0x4ae2e0	0000000000000000207d2a8001000000	........ }*.....
0x4ae2f0	307e2a80010000000000000000000000	0~*.............
0x4ae300	36363636363636363636363636363636	6666666666666666
0x4ae310	36363636363636363636363636363636	6666666666666666
0x4ae320	36363636363636363636363636363636	6666666666666666
0x4ae330	5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c	\\\\\\\\\\\\\\\\
0x4ae340	5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c	\\\\\\\\\\\\\\\\
0x4ae350	5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c	\\\\\\\\\\\\\\\\
0x4ae360	f09c32800100000030a2328001000000	..2.....0.2.....
0x4ae370	70ab328001000000a06e2a8001000000	p.2......n*.....
0x4ae380	c0602a800100000000642a8001000000	.`......d.....
0x4ae390	b06e2a800100	.n*...

0x5763a0	4f53534c5f41415f444953545f504f49	OSSL_AA_DIST_POI
0x5763b0	4e54000000000000504b4353375f454e	NT......PKCS7_EN
0x5763c0	435f434f4e54454e5400000000000000	C_CONTENT.......
0x5763d0	424f4f4c20414253454e540000000000	BOOL ABSENT.....
0x5763e0	25732025326420253032643a25303264	%s %2d %02d:%02d
0x5763f0	3a253032642e252e2a7320256420474d	:%02d.%.*s %d GM
0x576400	54000000000000002573202532642025	T.......%s %2d %
0x576410	3032643a253032643a25303264202564	02d:%02d:%02d %d
0x576420	20474d5400000000434f4d504c454d45	GMT....COMPLEME
0x576430	4e544f4644454641554c540000000000	NTOFDEFAULT.....
0x576440	44454641554c5400544c535f474f5354	DEFAULT.TLS_GOST
0x576450	523334313030315f574954485f323831	R341001_WITH_281
0x576460	34375f434e545f494d49540000000000	47_CNT_IMIT.....
0x576470	4558504c494349540000000000000000	EXPLICIT........
0x576480	494d504c494349540000000000000000	IMPLICIT........
0x576490	7273614f414550456e6372797074696f	rsaOAEPEncryptio
0x5764a0	6e534554000000004541524c595f4558	nSET....EARLY_EX
0x5764b0	504f525445525f53	PORTER_S

20 of 48 traits shown

Identity

SHA-256	0fce4b732ce10c72093587e82ca9747a885430e366934ddc27e437443ff0cc0e
Filename	upload
Package	0fce4b732ce10c72093587e82ca9747a885430e366934ddc27e437443ff0cc0e

Origin

Source	harvest
Feed	malshare
Domain	malshare.com

Timeline

First seen	10 Aug 2026 06:18 UTC
First analyzed	10 Aug 2026 08:06 UTC
Last analyzed	12 Aug 2026 01:30 UTC
Last updated	12 Aug 2026 01:30 UTC

Labeling

Label	bad
Label source	harvest
Traits version	73866

Not seeing what you expected? Let us know

0x58b4ac	53746174757300007004517565727950	Status..p.QueryP
0x58b4bc	6572666f726d616e6365436f756e7465	erformanceCounte
0x58b4cc	720071045175657279506572666f726d	r.q.QueryPerform
0x58b4dc	616e63654672657175656e6379007a04	anceFrequency.z.
0x58b4ec	51756575655573657241504300008704	QueueUserAPC....
0x58b4fc	5261697365457863657074696f6e0000	RaiseException..
0x58b50c	8b0452656164436f6e736f6c65410000	..ReadConsoleA..
0x58b51c	950452656164436f6e736f6c65570000	..ReadConsoleW..
0x58b52c	98045265616446696c650000d5045265	..ReadFile....Re
0x58b53c	6c656173654d757465780000d8045265	leaseMutex....Re
0x58b54c	6c656173655352574c6f636b4578636c	leaseSRWLockExcl
0x58b55c	757369766500d90452656c6561736553	usive...ReleaseS
0x58b56c	52574c6f636b536861726564	RWLockShared