2a0d0488b52f6b28c5adbc91d80d31d0a75a2118aaffa758ea28fd465372df65

SUSPICIOUS

2a0d0488b52f6b28c5adbc91d80d31d0a75a2118aaffa758ea28fd465372df65 · 54%

AI Google Chrome installer binary

Mal-ecule

K₂(Li₂Te)O₆(C₂PAsEr₂PrDy)H₁₀(Cm₆Cr₃Db₅F₈HfMg₂Os₁₇Po₁₆TiU₂)Md₄(Bi₃Pt)

Size 7.7 MB download

First seen 16 days ago

Analyzed 14 days ago

Source virussign.com

Also detected by 2 sources

Resource loader with registry and anti-debug: virussign.com_d10695f8baf68e63d1a72afc34f91000.vir:0x5bef10

Unsigned native Run-key replacement persistence: virussign.com_d10695f8baf68e63d1a72afc34f91000.vir:0x5d117e

PE copies a file and installs Run or RunOnce persistence: virussign.com_d10695f8baf68e63d1a72afc34f91000.vir:0x5f9240

virussign.com_d10695f8baf68e63d1a72afc34f91000.vir pe

0x5bee90	69006d0065002d006c0031002d003100	i.m.e.-.l.1.-.1.
0x5beea0	2d003200000000007500730065007200	-.2.....u.s.e.r.
0x5beeb0	33003200000000006100700069002d00	3.2.....a.p.i.-.
0x5beec0	6d0073002d0000006500780074002d00	m.s.-...e.x.t.-.
0x5beed0	6d0073002d0000001200000000000000	m.s.-...........
0x5beee0	41726546696c6541706973414e534900	AreFileApisANSI.
0x5beef0	0800000012000000436f6d7061726553	........CompareS
0x5bef00	7472696e674578000500000012000000	tringEx.........
0x5bef10	456e756d53797374656d4c6f63616c65	EnumSystemLocaleResource loader with registry and anti-debug
0x5bef20	73457800000000000100000013000000	sEx.............
0x5bef30	466c7347657456616c75653200000000	FlsGetValue2....
0x5bef40	00000000120000004765744461746546	........GetDateF
0x5bef50	6f726d61744578000500000012000000	ormatEx.........
0x5bef60	4765744c6f63616c65496e666f457800	GetLocaleInfoEx.
0x5bef70	000000001200000047657454696d6546	........GetTimeF
0x5bef80	6f726d61744578000500000012000000	ormatEx.........
0x5bef90	4765745573657244656661756c744c6f	GetUserDefaultLo
0x5befa0	63616c654e616d650000000000000000	caleName........
0x5befb0	0500000012000000497356616c69644c	........IsValidL
0x5befc0	6f63616c654e616d6500000000000000	ocaleName.......
0x5befd0	05000000120000004c434d6170537472	........LCMapStr
0x5befe0	696e6745780000000600000012000000	ingEx...........
0x5beff0	4c434944546f4c6f63616c654e616d65	LCIDToLocaleName
0x5bf000	00000000000000000500000012000000	................
0x5bf010	4c6f63616c654e616d65546f4c434944	LocaleNameToLCID
0x5bf020	000000	...

0x5d108c	6368696c64007365742d657374696d61	child.set-estima
0x5d109c	7465642d73697a652d76616c75650076	ted-size-value.v
0x5d10ac	6563746f720053004f00460054005700	ector.S.O.F.T.W.
0x5d10bc	4100520045005c004d00690063007200	A.R.E.\.M.i.c.r.
0x5d10cc	6f0073006f00660074005c0057006900	o.s.o.f.t.\.W.i.
0x5d10dc	6e0064006f00770073005c0043007500	n.d.o.w.s.\.C.u.
0x5d10ec	7200720065006e007400560065007200	r.r.e.n.t.V.e.r.
0x5d10fc	730069006f006e005c0049006e007300	s.i.o.n.\.I.n.s.
0x5d110c	740061006c006c00650072005c005500	t.a.l.l.e.r.\.U.
0x5d111c	73006500720044006100740061005c00	s.e.r.D.a.t.a.\.
0x5d112c	0000000053002d0031002d0035002d00	....S.-.1.-.5.-.
0x5d113c	3100380000005c00500072006f006400	1.8...\.P.r.o.d.
0x5d114c	75006300740073005c0000005c004900	u.c.t.s.\...\.I.
0x5d115c	6e007300740061006c006c0050007200	n.s.t.a.l.l.P.r.
0x5d116c	6f007000650072007400690065007300	o.p.e.r.t.i.e.s.
0x5d117c	000053004f0046005400570041005200	..S.O.F.T.W.A.R.Unsigned native Run-key replacement persistence
0x5d118c	45005c004d006900630072006f007300	E.\.M.i.c.r.o.s.
0x5d119c	6f00660074005c00570069006e006400	o.f.t.\.W.i.n.d.
0x5d11ac	6f00770073005c004300750072007200	o.w.s.\.C.u.r.r.
0x5d11bc	65006e00740056006500720073006900	e.n.t.V.e.r.s.i.
0x5d11cc	6f006e005c0055006e0069006e007300	o.n.\.U.n.i.n.s.
0x5d11dc	740061006c006c005c007b0000007d00	t.a.l.l.\.{...}.
0x5d11ec	0000536b697070696e6720696e737461	..Skipping insta
0x5d11fc	6c6c65722070726f7065727469657320	ller properties
0x5d120c	75706461746520626563617573652072	update because r
0x5d121c	65676973747279206b6579200020646f	egistry key . do
0x5d122c	6573206e6f7420657869737420696e20	es not exist in
0x5d123c	00363400333200626974206869766500	.64.32.bit hive.
0x5d124c	0000000044006900730070006c006100	....D.i.s.p.l.a.
0x5d125c	7900560065007200730069006f006e00	y.V.e.r.s.i.o.n.
0x5d126c	00004661696c656420746f2073657420	..Failed to set
0x5d127c	446973706c617956657273696f6e3a20	DisplayVersion:
0x5d128c	00206e6f7420666f756e6420756e6465	. not found unde
0x5d129c	72200020636f756c64206e6f74206265	r . could not be
0x5d12ac	2077726974	writ

0x5f91c0	73696f6e2d6d616a6f720057696e646f	sion-major.Windo
0x5f91d0	777356657273696f6e2d6d696e6f7200	wsVersion-minor.
0x5f91e0	57696e646f777356657273696f6e2d62	WindowsVersion-b
0x5f91f0	75696c640000000055284c9f799f394b	uild....U(L.y.9K
0x5f9200	a8d0e1d42de1d5f30500000055284c9f	....-.......U(L.
0x5f9210	799f394ba8d0e1d42de1d5f31a000000	y.9K....-.......
0x5f9220	2e2e5c2e2e5c626173655c77696e5c77	..\..\base\win\w
0x5f9230	696e5f7574696c2e6363000000000000	in_util.cc......
0x5f9240	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.Unsigned native Run-key replacement persistence
0x5f9250	5c004d006900630072006f0073006f00	\.M.i.c.r.o.s.o.
0x5f9260	660074005c00570069006e0064006f00	f.t.\.W.i.n.d.o.
0x5f9270	770073005c0043007500720072006500	w.s.\.C.u.r.r.e.
0x5f9280	6e007400560065007200730069006f00	n.t.V.e.r.s.i.o.
0x5f9290	6e005c00520075006e0000007b002500	n.\.R.u.n...{.%.
0x5f92a0	300038006c0058002d00250030003400	0.8.l.X.-.%.0.4.
0x5f92b0	58002d0025003000340058002d002500	X.-.%.0.4.X.-.%.
0x5f92c0	30003200580025003000320058002d00	0.2.X.%.0.2.X.-.
0x5f92d0	25003000320058002500300032005800	%.0.2.X.%.0.2.X.
0x5f92e0	25003000320058002500300032005800	%.0.2.X.%.0.2.X.
0x5f92f0	25003000320058002500300032005800	%.0.2.X.%.0.2.X.
0x5f9300	7d0000004d0044004d00520065006700	}...M.D.M.R.e.g.
0x5f9310	69007300740072006100740069006f00	i.s.t.r.a.t.i.o.
0x5f9320	6e002e0064006c006c00000049734465	n...d.l.l...IsDe
0x5f9330	76696365526567697374657265645769	viceRegisteredWi
0x5f9340	74684d616e6167656d656e7400000000	thManagement....
0x5f9350	00000000000000000003000002000000	................
0x5f9360	0300000006000000070000000a	.............

0x601bd5	00650076006100740069006f006e0020	.e.v.a.t.i.o.n.
0x601be5	00530065007200760069006300650000	.S.e.r.v.i.c.e..
0x601bf5	00000000000000000000002000540072	........... .T.r
0x601c05	006100630069006e0067002000530065	.a.c.i.n.g. .S.e
0x601c15	0072007600690063006500000053006f	.r.v.i.c.e...S.o
0x601c25	006600740077006100720065005c004d	.f.t.w.a.r.e.\.M
0x601c35	006900630072006f0073006f00660074	.i.c.r.o.s.o.f.tUnsigned native Run-key replacement persistence
0x601c45	005c0041006300740069007600650020	.\.A.c.t.i.v.e.
0x601c55	00530065007400750070005c0049006e	.S.e.t.u.p.\.I.n
0x601c65	007300740061006c006c006500640020	.s.t.a.l.l.e.d.
0x601c75	0043006f006d0070006f006e0065006e	.C.o.m.p.o.n.e.n
0x601c85	00740073005c00000053004f00460054	.t.s.\...S.O.F.T
0x601c95	0057004100520045005c0050006f006c	.W.A.R.E.\.P.o.l
0x601ca5	00690063006900650073005c00000065	.i.c.i.e.s.\...e
0x601cb5	007800740065006e0064006500640000	.x.t.e.n.d.e.d..
0x601cc5	006100700000006e0061006d00650000	.a.p...n.a.m.e..
0x601cd5	005c0063006f0068006f007200740000	.\.c.o.h.o.r.t..
0x601ce5	0073007400610062006c006500000000	.s.t.a.b.l.e....
0x601cf5	0000000000000000000000650078	...........e.x

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLoResource loader with registry and anti-debug
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.Unsigned native Run-key replacement persistence
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetComPE copies a file and installs Run or RunOnce persistence
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

Well-known

0x5043	4c8b66e8488b6ef0488b5ef8488d2648	L.f.H.n.H.^.H.&H
0x5053	8b7c2408488b742410c34d6f6e74676f	.\|$.H.t$..Montgo
0x5063	6d657279204d756c7469706c69636174	mery Multiplicat
0x5073	696f6e20666f72207838365f36342c20	ion for x86_64,
0x5083	43525950544f47414d53206279203c61	CRYPTOGAMS by <a
0x5093	7070726f406f70656e73736c2e6f7267	ppro@openssl.org
0x50a3	3e009090909090909090909090565753	>............VWS
0x50b3	5541544155415641579c4883ec40498b	UATAUAVAW.H..@I.
0x50c3	4078498b98f8000000498b71084d8b59	@xI......I.q.M.Y
0x50d3	38458b134e8d14164c39d30f82c30000	8E..N...L9......
0x50e3	00498b8098000000458b53044e8d1416	.I......E.S.N...
0x50f3	4c39d30f83ab0000004d8b90c0000000	L9.......M......
0x5103	4a8b44d008eb5b909090909090565753	J.D...[......VWS
0x5113	5541544155415641579c4883ec40498b	UATAUAVAW.H..@I.
0x5123	40	@

0x5a05e0	cccccccccccccccccccccccccccccccc	................
0x5a05f0	cccccccccccccccccccccccccccccccc	................
0x5a0600	00000000000000000100000001000000	................
0x5a0610	02000000020000000200000002000000	................
0x5a0620	4d6f6e74676f6d657279204d756c7469	Montgomery Multi
0x5a0630	706c69636174696f6e20776974682073	plication with s
0x5a0640	6361747465722f67617468657220666f	catter/gather fo
0x5a0650	72207838365f36342c2043525950544f	r x86_64, CRYPTO
0x5a0660	47414d53206279203c617070726f406f	GAMS by <appro@o
0x5a0670	70656e73736c2e6f72673e0000000000	penssl.org>.....
0x5a0680	8001080d0f06050e020c0b0a09030704	................
0x5a0690	80070b0f060a0401090805020c0e0d03	................
0x5a06a0	0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f0f	................
0x5a06b0	00702a5a98e8b2c20878225290e0baca	.p*Z.....x"R....
0x5a06c0	004d7c317d30014c81ccfdb0fcb180cd	.M\|1}0.L........
0x5a06d0	003e50cb8fe19bb144f52a146e7adfa5	.>P.....D.*.nz..
0x5a06e0	0023e2fa15d41836efd92e0dc1ccf73b	.#.....6.......;
0x5a06f0	0024710bc6937ae2cd2f98	.$q...z../.

0x5a0f43	04030201000f0e0d0c0b0a0908070605	................
0x5a0f53	04030201000f0e0d0c0b0a0908534841	.............SHA
0x5a0f63	35313220626c6f636b207472616e7366	512 block transf
0x5a0f73	6f726d20666f72207838365f36342c20	orm for x86_64,
0x5a0f83	43525950544f47414d53206279203c61	CRYPTOGAMS by <a
0x5a0f93	7070726f406f70656e73736c2e6f7267	ppro@openssl.org
0x5a0fa3	3e000000000000000000000000000000	>...............
0x5a0fb3	00000000000000000000000000982f8a	............../.
0x5a0fc3	4291443771cffbc0b5a5dbb5e9982f8a	B.D7q........./.
0x5a0fd3	4291443771cffbc0b5a5dbb5e95bc256	B.D7q........[.V
0x5a0fe3	39f111f159a4823f92d55e1cab5bc256	9...Y..?..^..[.V
0x5a0ff3	39f111f159a4823f92d55e1cab98aa07	9...Y..?..^.....
0x5a1003	d8015b8312be853124c37d0c5598aa07	..[....1$.}.U...
0x5a1013	d8015b8312be853124c37d0c55745dbe	..[....1$.}.Ut].
0x5a1023	72	r

0x5a1203	ffffffffff0001020308090a0bffffff	................
0x5a1213	ffffffffff0001020308090a0b534841	.............SHA
0x5a1223	32353620626c6f636b207472616e7366	256 block transf
0x5a1233	6f726d20666f72207838365f36342c20	orm for x86_64,
0x5a1243	43525950544f47414d53206279203c61	CRYPTOGAMS by <a
0x5a1253	7070726f406f70656e73736c2e6f7267	ppro@openssl.org
0x5a1263	3e000000000000000000000000000000	>...............
0x5a1273	00000000000000000000000000997982	..............y.
0x5a1283	5a9979825a9979825a9979825a997982	Z.y.Z.y.Z.y.Z.y.
0x5a1293	5a9979825a9979825a9979825aa1ebd9	Z.y.Z.y.Z.y.Z...
0x5a12a3	6ea1ebd96ea1ebd96ea1ebd96ea1ebd9	n...n...n...n...
0x5a12b3	6ea1ebd96ea1ebd96ea1ebd96edcbc1b	n...n...n...n...
0x5a12c3	8fdcbc1b8fdcbc1b8fdcbc1b8fdcbc1b	................
0x5a12d3	8fdcbc1b8fdcbc1b8fdcbc1b8fd6c162	...............b
0x5a12e3	ca	.

tool PE ProductName Google Chrome Installer

Objectives

0x5bee90	69006d0065002d006c0031002d003100	i.m.e.-.l.1.-.1.
0x5beea0	2d003200000000007500730065007200	-.2.....u.s.e.r.
0x5beeb0	33003200000000006100700069002d00	3.2.....a.p.i.-.
0x5beec0	6d0073002d0000006500780074002d00	m.s.-...e.x.t.-.
0x5beed0	6d0073002d0000001200000000000000	m.s.-...........
0x5beee0	41726546696c6541706973414e534900	AreFileApisANSI.
0x5beef0	0800000012000000436f6d7061726553	........CompareS
0x5bef00	7472696e674578000500000012000000	tringEx.........
0x5bef10	456e756d53797374656d4c6f63616c65	EnumSystemLocale
0x5bef20	73457800000000000100000013000000	sEx.............
0x5bef30	466c7347657456616c75653200000000	FlsGetValue2....
0x5bef40	00000000120000004765744461746546	........GetDateF
0x5bef50	6f726d61744578000500000012000000	ormatEx.........
0x5bef60	4765744c6f63616c65496e666f457800	GetLocaleInfoEx.
0x5bef70	000000001200000047657454696d6546	........GetTimeF
0x5bef80	6f726d61744578000500000012000000	ormatEx.........
0x5bef90	4765745573657244656661756c744c6f	GetUserDefaultLo
0x5befa0	63616c654e616d650000000000000000	caleName........
0x5befb0	0500000012000000497356616c69644c	........IsValidL
0x5befc0	6f63616c654e616d6500000000000000	ocaleName.......
0x5befd0	05000000120000004c434d6170537472	........LCMapStr
0x5befe0	696e6745780000000600000012000000	ingEx...........
0x5beff0	4c434944546f4c6f63616c654e616d65	LCIDToLocaleName
0x5bf000	00000000000000000500000012000000	................
0x5bf010	4c6f63616c654e616d65546f4c434944	LocaleNameToLCID
0x5bf020	000000	...

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x5f91c0	73696f6e2d6d616a6f720057696e646f	sion-major.Windo
0x5f91d0	777356657273696f6e2d6d696e6f7200	wsVersion-minor.
0x5f91e0	57696e646f777356657273696f6e2d62	WindowsVersion-b
0x5f91f0	75696c640000000055284c9f799f394b	uild....U(L.y.9K
0x5f9200	a8d0e1d42de1d5f30500000055284c9f	....-.......U(L.
0x5f9210	799f394ba8d0e1d42de1d5f31a000000	y.9K....-.......
0x5f9220	2e2e5c2e2e5c626173655c77696e5c77	..\..\base\win\w
0x5f9230	696e5f7574696c2e6363000000000000	in_util.cc......
0x5f9240	53006f00660074007700610072006500	S.o.f.t.w.a.r.e.
0x5f9250	5c004d006900630072006f0073006f00	\.M.i.c.r.o.s.o.
0x5f9260	660074005c00570069006e0064006f00	f.t.\.W.i.n.d.o.
0x5f9270	770073005c0043007500720072006500	w.s.\.C.u.r.r.e.
0x5f9280	6e007400560065007200730069006f00	n.t.V.e.r.s.i.o.
0x5f9290	6e005c00520075006e0000007b002500	n.\.R.u.n...{.%.
0x5f92a0	300038006c0058002d00250030003400	0.8.l.X.-.%.0.4.
0x5f92b0	58002d0025003000340058002d002500	X.-.%.0.4.X.-.%.
0x5f92c0	30003200580025003000320058002d00	0.2.X.%.0.2.X.-.
0x5f92d0	25003000320058002500300032005800	%.0.2.X.%.0.2.X.
0x5f92e0	25003000320058002500300032005800	%.0.2.X.%.0.2.X.
0x5f92f0	25003000320058002500300032005800	%.0.2.X.%.0.2.X.
0x5f9300	7d0000004d0044004d00520065006700	}...M.D.M.R.e.g.
0x5f9310	69007300740072006100740069006f00	i.s.t.r.a.t.i.o.
0x5f9320	6e002e0064006c006c00000049734465	n...d.l.l...IsDe
0x5f9330	76696365526567697374657265645769	viceRegisteredWi
0x5f9340	74684d616e6167656d656e7400000000	thManagement....
0x5f9350	00000000000000000003000002000000	................
0x5f9360	0300000006000000070000000a	.............

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x601bd5	00650076006100740069006f006e0020	.e.v.a.t.i.o.n.
0x601be5	00530065007200760069006300650000	.S.e.r.v.i.c.e..
0x601bf5	00000000000000000000002000540072	........... .T.r
0x601c05	006100630069006e0067002000530065	.a.c.i.n.g. .S.e
0x601c15	0072007600690063006500000053006f	.r.v.i.c.e...S.o
0x601c25	006600740077006100720065005c004d	.f.t.w.a.r.e.\.M
0x601c35	006900630072006f0073006f00660074	.i.c.r.o.s.o.f.t
0x601c45	005c0041006300740069007600650020	.\.A.c.t.i.v.e.
0x601c55	00530065007400750070005c0049006e	.S.e.t.u.p.\.I.n
0x601c65	007300740061006c006c006500640020	.s.t.a.l.l.e.d.
0x601c75	0043006f006d0070006f006e0065006e	.C.o.m.p.o.n.e.n
0x601c85	00740073005c00000053004f00460054	.t.s.\...S.O.F.T
0x601c95	0057004100520045005c0050006f006c	.W.A.R.E.\.P.o.l
0x601ca5	00690063006900650073005c00000065	.i.c.i.e.s.\...e
0x601cb5	007800740065006e0064006500640000	.x.t.e.n.d.e.d..
0x601cc5	006100700000006e0061006d00650000	.a.p...n.a.m.e..
0x601cd5	005c0063006f0068006f007200740000	.\.c.o.h.o.r.t..
0x601ce5	0073007400610062006c006500000000	.s.t.a.b.l.e....
0x601cf5	0000000000000000000000650078	...........e.x

0x5d108c	6368696c64007365742d657374696d61	child.set-estima
0x5d109c	7465642d73697a652d76616c75650076	ted-size-value.v
0x5d10ac	6563746f720053004f00460054005700	ector.S.O.F.T.W.
0x5d10bc	4100520045005c004d00690063007200	A.R.E.\.M.i.c.r.
0x5d10cc	6f0073006f00660074005c0057006900	o.s.o.f.t.\.W.i.
0x5d10dc	6e0064006f00770073005c0043007500	n.d.o.w.s.\.C.u.
0x5d10ec	7200720065006e007400560065007200	r.r.e.n.t.V.e.r.
0x5d10fc	730069006f006e005c0049006e007300	s.i.o.n.\.I.n.s.
0x5d110c	740061006c006c00650072005c005500	t.a.l.l.e.r.\.U.
0x5d111c	73006500720044006100740061005c00	s.e.r.D.a.t.a.\.
0x5d112c	0000000053002d0031002d0035002d00	....S.-.1.-.5.-.
0x5d113c	3100380000005c00500072006f006400	1.8...\.P.r.o.d.
0x5d114c	75006300740073005c0000005c004900	u.c.t.s.\...\.I.
0x5d115c	6e007300740061006c006c0050007200	n.s.t.a.l.l.P.r.
0x5d116c	6f007000650072007400690065007300	o.p.e.r.t.i.e.s.
0x5d117c	000053004f0046005400570041005200	..S.O.F.T.W.A.R.
0x5d118c	45005c004d006900630072006f007300	E.\.M.i.c.r.o.s.
0x5d119c	6f00660074005c00570069006e006400	o.f.t.\.W.i.n.d.
0x5d11ac	6f00770073005c004300750072007200	o.w.s.\.C.u.r.r.
0x5d11bc	65006e00740056006500720073006900	e.n.t.V.e.r.s.i.
0x5d11cc	6f006e005c0055006e0069006e007300	o.n.\.U.n.i.n.s.
0x5d11dc	740061006c006c005c007b0000007d00	t.a.l.l.\.{...}.
0x5d11ec	0000536b697070696e6720696e737461	..Skipping insta
0x5d11fc	6c6c65722070726f7065727469657320	ller properties
0x5d120c	75706461746520626563617573652072	update because r
0x5d121c	65676973747279206b6579200020646f	egistry key . do
0x5d122c	6573206e6f7420657869737420696e20	es not exist in
0x5d123c	00363400333200626974206869766500	.64.32.bit hive.
0x5d124c	0000000044006900730070006c006100	....D.i.s.p.l.a.
0x5d125c	7900560065007200730069006f006e00	y.V.e.r.s.i.o.n.
0x5d126c	00004661696c656420746f2073657420	..Failed to set
0x5d127c	446973706c617956657273696f6e3a20	DisplayVersion:
0x5d128c	00206e6f7420666f756e6420756e6465	. not found unde
0x5d129c	72200020636f756c64206e6f74206265	r . could not be
0x5d12ac	2077726974	writ

0x74dfa0	2231302e302e31383336322e30222f3e	"10.0.18362.0"/>
0x74dfb0	3c2f6170706c69636174696f6e3e3c2f	</application></
0x74dfc0	636f6d7061746962696c6974793e3c2f	compatibility></
0x74dfd0	617373656d626c793e0a000000000000	assembly>.......
0x74dfe0	00000000000000000000000000000000	................
0x74dff0	00000000000000000000000000000000	................
0x74e000	2eee752e722e2e2e9688ee88e688fe88	..u.r...........
0x74e010	4689ae89a689be899e8906861e861686	F...............
0x74e020	6e865686ae86a6868e863e840e841e84	n.V.......>.....
0x74e030	16846e8466847e8476844e8446845684	..n.f.~.v.N.F.V.
0x74e040	ae84a684be84b6848e8486849e84e684	................
0x74e050	f684c684de84d6842e8526852ece752e	..........&...u.
0x74e060	f62e2e2e7e8c768c4e8c468c5e8c568c	....~.v.N.F.^.V.
0x74e070	ae8ca68cbe8cb68c8e8c868c9e8c968c	................
0x74e080	ee8ce68cfe8cf68cce8cc68cde8cd68c	................
0x74e090	2e8d268d3e8d368d0e8d068d1e8d168d	..&.>.6.........
0x74e0a0	6e8d668d7e8d768d4e8d468d5e8d568d	n.f.~.v.N.F.^.V.
0x74e0b0	ae8da68dbe8db68d8e8d868d9e8d968d	................
0x74e0c0	ee8de68dfe8df68dce8dc68dde8dd68d	................
0x74e0d0	2e8a268a3e8a368a0e8a068a1e8a168a	..&.>.6.........
0x74e0e0	6e8a668a7e8a768a4e8a468a5e8a568a	n.f.~.v.N.F.^.V.

0x659359	5c7574696c5c6e65745c687474705f74	\util\net\http_t
0x659369	72616e73706f72745f77696e2e636300	ransport_win.cc.
0x659379	57696e487474704f70656e0057696e48	WinHttpOpen.WinH
0x659389	74747053657454696d656f7574730057	ttpSetTimeouts.W
0x659399	696e48747470437261636b55726c0057	inHttpCrackUrl.W
0x6593a9	696e48747470436f6e6e656374005769	inHttpConnect.Wi
0x6593b9	6e487474704f70656e52657175657374	nHttpOpenRequest
0x6593c9	00436f6e74656e742d4c656e67746800	.Content-Length.
0x6593d9	000d000a0000003a002000000057696e	.......:. ...Win
0x6593e9	48747470416464526571756573744865	HttpAddRequestHe
0x6593f9	616465727300005400720061006e0073	aders..T.r.a.n.s
0x659409	006600650072002d0045006e0063006f	.f.e.r.-.E.n.c.o
0x659419	00640069006e0067003a002000630068	.d.i.n.g.:. .c.h
0x659429	0075006e006b00650064000d000a0000	.u.n.k.e.d......
0x659439	0057696e4874747053656e6452657175	.WinHttpSendRequ
0x659449	65737400253038780057696e48747470	est.%08x.WinHttp
0x659459	5772697465446174610057696e487474	WriteData.WinHtt
0x659469	7052656365697665526573706f6e7365	pReceiveResponse
0x659479	0057696e487474705175657279486561	.WinHttpQueryHea
0x659489	64657273004854545020737461747573	ders.HTTP status
0x659499	20256c750057696e4874747052656164	%lu.WinHttpRead
0x6594a9	446174610025732f25732057696e4854	Data.%s/%s WinHT
0x6594b9	54500000000000770069006e00680074	TP.....w.i.n.h.t
0x6594c9	00740070002e0064006c006c0000002f	.t.p...d.l.l.../
0x6594d9	256c752e256c752e256c752e256c7500	%lu.%lu.%lu.%lu.
0x6594e9	2057696e646f77735f4e542f256c752e	Windows_NT/%lu.
0x6594f9	256c752e256c752e256c752028007836	%lu.%lu.%lu (.x6
0x659509	34003b20576f5736340025733a206572	4.; WoW64.%s: er
0x659519	726f72203078256c78207768696c6520	ror 0x%lx while
0x659529	72657472696576696e67206572726f72	retrieving error
0x659539	203078256c780025733a202573202830	0x%lx.%s: %s (0
0x659549	7825	x%

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x335fd0	ffff90b907000000e8effaffff8bcbe8	................
0x335fe0	54e70000908bcbe858e7000090cccccc	T.......X.......
0x335ff0	415757534bbf6000000000000000654b	AWWSK.`.......eK
0x336000	8b3f51488b4f104a83c7184a8b1f4e8b	.?QH.O.J...J..N.
0x336010	fb4f83c7104b8b3f45534c8b7f304983	.O...K.?ESL..0I.
0x336020	ff000f84230000004a8b5f604c8b1b43	....#...J._`L..C
0x336030	81e3df00df00488b5b0b4601dbc1e302	......H.[.F.....
0x336040	81eb2ccd14c94885db74084a8b1f488b	..,...H..t.J..H.
0x336050	fbebc7418b7f3c4903ff4c83c7108b5f	...A..<I..L...._
0x336060	784c01fb50468b5b204d03df438b034e	xL..PF.[ M..C..N
0x336070	01f88b780b81c79b9c8bff83ff007505	...x..........u.
0x336080	e90e00000049ffc34fffc34bffc34fff	.....I..O..K..O.
0x336090	c3ebd98b7b204d29fb4c2bdf41c1eb01	....{ M).L+.A...
0x3360a0	8b7b244b03ff4c01df468b1f8b7b1c41	.{$K..L..F...{.A
0x3360b0	81e3ffff000043c1e3024903fb4903ff	......C...I..I..
0x3360c0	468b1f4f01fbbf00607e0045574a01cf	F..O....`~.EWJ..
0x3360d0	5157505047574a8bcf43b8400000004e	QWPPGWJ..C.@...N
0x3360e0	8bccba00700b0043ffd35b58585f59bb	....p..C..[XX_Y.
0x3360f0	20ac	.

0x5f94cf	734572726f7200000000000000000000	sError..........
0x5f94df	0064697361626c652d627265616b7061	.disable-breakpa
0x5f94ef	64002e2e5c2e2e5c626173655c77696e	d...\..\base\win
0x5f94ff	5c6f626a6563745f776174636865722e	\object_watcher.
0x5f950f	63630053746f705761746368696e6700	cc.StopWatching.
0x5f951f	556e7265676973746572576169744578	UnregisterWaitEx
0x5f952f	005300650049006d0070006500720073	.S.e.I.m.p.e.r.s
0x5f953f	006f006e006100740065005000720069	.o.n.a.t.e.P.r.i
0x5f954f	00760069006c0065006700650000002e	.v.i.l.e.g.e....
0x5f955f	2e5c2e2e5c626173655c77696e5c656c	.\..\base\win\el
0x5f956f	65766174696f6e5f7574696c2e636300	evation_util.cc.
0x5f957f	52756e4465456c657661746564003a20	RunDeElevated.:
0x5f958f	537461727465642070726f636573732c	Started process,
0x5f959f	205049443a20003a203a3a416c6c6f77	PID: .: ::Allow
0x5f95af	536574466f726567726f756e6457696e	SetForegroundWin
0x5f95bf	646f77206661696c6564002200000000	dow failed."....
0x5f95cf	00666f7263652d686967682d7265732d	.force-high-res-
0x5f95df	74696d657469636b73002e2e5c2e2e5c	timeticks...\..\
0x5f95ef	626173655c74696d655c74696d655f77	base\time\time_w
0x5f95ff	696e2e636300	in.cc.

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x677efc	4d756c746942797465005006576f7736	MultiByte.P.Wow6
0x677f0c	34476574546872656164436f6e746578	4GetThreadContex
0x677f1c	74005f065772697465436f6e736f6c65	t._.WriteConsole
0x677f2c	57006006577269746546696c65006906	W.`.WriteFile.i.
0x677f3c	577269746550726f636573734d656d6f	WriteProcessMemo
0x677f4c	7279000085066c737472636d70695700	ry....lstrcmpiW.
0x677f5c	2b00436f437265617465496e7374616e	+.CoCreateInstan
0x677f6c	636500006100436f496e697469616c69	ce..a.CoInitiali
0x677f7c	7a65457800007700436f526567697374	zeEx..w.CoRegist
0x677f8c	6572496e697469616c697a6553707900	erInitializeSpy.
0x677f9c	8300436f5265766f6b65496e69746961	..CoRevokeInitia
0x677fac	6c697a65537079008b00436f5461736b	lizeSpy...CoTask
0x677fbc	4d656d416c6c6f6300008c00436f5461	MemAlloc....CoTa
0x677fcc	736b	sk

Micro-behaviors

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x659359	5c7574696c5c6e65745c687474705f74	\util\net\http_t
0x659369	72616e73706f72745f77696e2e636300	ransport_win.cc.
0x659379	57696e487474704f70656e0057696e48	WinHttpOpen.WinH
0x659389	74747053657454696d656f7574730057	ttpSetTimeouts.W
0x659399	696e48747470437261636b55726c0057	inHttpCrackUrl.W
0x6593a9	696e48747470436f6e6e656374005769	inHttpConnect.Wi
0x6593b9	6e487474704f70656e52657175657374	nHttpOpenRequest
0x6593c9	00436f6e74656e742d4c656e67746800	.Content-Length.
0x6593d9	000d000a0000003a002000000057696e	.......:. ...Win
0x6593e9	48747470416464526571756573744865	HttpAddRequestHe
0x6593f9	616465727300005400720061006e0073	aders..T.r.a.n.s
0x659409	006600650072002d0045006e0063006f	.f.e.r.-.E.n.c.o
0x659419	00640069006e0067003a002000630068	.d.i.n.g.:. .c.h
0x659429	0075006e006b00650064000d000a0000	.u.n.k.e.d......
0x659439	0057696e4874747053656e6452657175	.WinHttpSendRequ
0x659449	65737400253038780057696e48747470	est.%08x.WinHttp
0x659459	5772697465446174610057696e487474	WriteData.WinHtt
0x659469	7052656365697665526573706f6e7365	pReceiveResponse
0x659479	0057696e487474705175657279486561	.WinHttpQueryHea
0x659489	64657273004854545020737461747573	ders.HTTP status
0x659499	20256c750057696e4874747052656164	%lu.WinHttpRead
0x6594a9	446174610025732f25732057696e4854	Data.%s/%s WinHT
0x6594b9	54500000000000770069006e00680074	TP.....w.i.n.h.t
0x6594c9	00740070002e0064006c006c0000002f	.t.p...d.l.l.../
0x6594d9	256c752e256c752e256c752e256c7500	%lu.%lu.%lu.%lu.
0x6594e9	2057696e646f77735f4e542f256c752e	Windows_NT/%lu.
0x6594f9	256c752e256c752e256c752028007836	%lu.%lu.%lu (.x6
0x659509	34003b20576f5736340025733a206572	4.; WoW64.%s: er
0x659519	726f72203078256c78207768696c6520	ror 0x%lx while
0x659529	72657472696576696e67206572726f72	retrieving error
0x659539	203078256c780025733a202573202830	0x%lx.%s: %s (0
0x659549	7825	x%

0x6783c2	6472657373003a0057616b6542794164	dress.:.WakeByAd
0x6783d2	6472657373416c6c00003b0057616b65	dressAll..;.Wake
0x6783e2	42794164647265737353696e676c6500	ByAddressSingle.
0x6783f2	41445641504933322e646c6c00646267	ADVAPI32.dll.dbg
0x678402	68656c702e646c6c004f4c4541555433	help.dll.OLEAUT3
0x678412	322e646c6c005348454c4c33322e646c	2.dll.SHELL32.dl
0x678422	6c0053484c574150492e646c6c005553	l.SHLWAPI.dll.US
0x678432	455233322e646c6c0056455253494f4e	ER32.dll.VERSION
0x678442	2e646c6c0057494e4d4d2e646c6c004b	.dll.WINMM.dll.K
0x678452	45524e454c33322e646c6c006f6c6533	ERNEL32.dll.ole3
0x678462	322e646c6c006e74646c6c2e646c6c00	2.dll.ntdll.dll.
0x678472	55534552454e562e646c6c006e637279	USERENV.dll.ncry
0x678482	70742e646c6c006170692d6d732d7769	pt.dll.api-ms-wi
0x678492	6e2d636f72652d77696e72742d737472	n-core-winrt-str
0x6784a2	696e672d6c312d312d302e646c6c0061	ing-l1-1-0.dll.a
0x6784b2	70692d6d732d77696e2d636f72652d77	pi-ms-win-core-w
0x6784c2	696e72742d6c312d312d302e646c6c00	inrt-l1-1-0.dll.
0x6784d2	57494e485454502e646c6c0050524f50	WINHTTP.dll.PROP
0x6784e2	5359532e646c6c0075726c6d6f6e2e64	SYS.dll.urlmon.d
0x6784f2	6c6c006170692d6d732d77696e2d636f	ll.api-ms-win-co
0x678502	72652d73796e63682d6c312d322d302e	re-synch-l1-2-0.
0x678512	646c6c00000000000000000000000000	dll.............
0x678522	00000000000000000000000000000000	................
0x678532	00000000000009000000201900000900	.......... .....
0x678542	0000804b0000c71a0000c71a00008220	...K...........
0x678552	0000909090900900000080	...........

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x6780fe	79004f004e437279707446696e616c69	y.O.NCryptFinali
0x67810e	7a654b65790051004e43727970744672	zeKey.Q.NCryptFr
0x67811e	65654f626a656374000052004e437279	eeObject..R.NCry
0x67812e	707447657450726f7065727479005400	ptGetProperty.T.
0x67813e	4e4372797074496d706f72744b657900	NCryptImportKey.
0x67814e	55004e43727970744973416c67537570	U.NCryptIsAlgSup
0x67815e	706f72746564000059004e4372797074	ported..Y.NCrypt
0x67816e	4f70656e4b6579005b004e4372797074	OpenKey.[.NCrypt
0x67817e	4f70656e53746f7261676550726f7669	OpenStorageProvi
0x67818e	6465720062004e437279707453657450	der.b.NCryptSetP
0x67819e	726f70657274790063004e4372797074	roperty.c.NCrypt
0x6781ae	5369676e4861736800000b0057696e64	SignHash....Wind
0x6781be	6f7773437265617465537472696e6752	owsCreateStringR
0x6781ce	65666572656e636500000c0057696e64	eference....Wind
0x6781de	6f777344656c657465537472696e6700	owsDeleteString.
0x6781ee	100057696e646f777347657453747269	..WindowsGetStri
0x6781fe	6e67526177427566666572000000526f	ngRawBuffer...Ro
0x67820e	4163746976617465496e7374616e6365	ActivateInstance
0x67821e	00000300526f496e697469616c697a65	....RoInitialize
0x67822e	00000700526f556e	....RoUn

0x61c14b	686972645f70617274795c626f72696e	hird_party\borin
0x61c15b	6773736c5c7372635c63727970746f5c	gssl\src\crypto\
0x61c16b	6576705c6576705f61736e312e636300	evp\evp_asn1.cc.
0x61c17b	2e2e5c2e2e5c63727970746f5c756e65	..\..\crypto\une
0x61c18b	78706f727461626c655f6b65795f7769	xportable_key_wi
0x61c19b	6e2e6363004c6f616457726170706564	n.cc.LoadWrapped
0x61c1ab	4b657900004f00700061007100750065	Key..O.p.a.q.u.e
0x61c1bb	004b006500790042006c006f00620000	.K.e.y.B.l.o.b..
0x61c1cb	004d006900630072006f0073006f0066	.M.i.c.r.o.s.o.f
0x61c1db	007400200050006c006100740066006f	.t. .P.l.a.t.f.o
0x61c1eb	0072006d002000430072007900700074	.r.m. .C.r.y.p.t
0x61c1fb	006f002000500072006f007600690064	.o. .P.r.o.v.i.d
0x61c20b	006500720000004d006900630072006f	.e.r...M.i.c.r.o
0x61c21b	0073006f0066007400200053006f0066	.s.o.f.t. .S.o.f
0x61c22b	007400770061007200650020004b0065	.t.w.a.r.e. .K.e
0x61c23b	0079	.y

0x1d0592	00448b15ca8e4f008b0dc88e4f00894c	.D....O.....O..L
0x1d05a2	24208b0dc28e4f00894c2424448b05bf	$ ....O..L$$D...
0x1d05b2	8e4f008b15bd8e4f0041bb0a0000008b	.O.....O.A......
0x1d05c2	0db58e4f0044895c24304101e94431c8	...O.D.\$0A..D1.
0x1d05d2	c1c0104101c74431fdc1c50c4101e944	...A..D1....A..D
0x1d05e2	31c8c1c0084101c74431fdc1c5074401	1....A..D1....D.
0x1d05f2	f64131f041c1c0104501c24531d641c1	.A1.A...E..E1.A.
0x1d0602	c60c4401f64131f041c1c0084501c244	..D..A1.A...E..D
0x1d0612	895424344531d641c1c6074401eb31da	.T$4E1.A...D..1.
0x1d0622	c1c210448b5c24204101d34531dd41c1	...D.\$ A..E1.A.
0x1d0632	c50c4401eb31dac1c2084101d34531dd	..D..1....A..E1.
0x1d0642	41c1c5074401e731f9c1c110448b5424	A...D..1....D.T$
0x1d0652	244101ca4531d441c1c40c4401e731f9	$A..E1.A...D..1.
0x1d0662	c1c1084101ca4531d441c1c4074501f1	...A..E1.A...E..
0x1d0672	4431c9c1c1104101cb4531de41c1c60c	D1....A..E1.A...
0x1d0682	4501f14431c9c1c1084101cb44895c24	E..D1....A..D.\$
0x1d0692	204531de448b5c243041c1c6074401ee	E1.D.\$0A...D..
0x1d06a2	31f0c1c0104101c24531d541c1c50c44	1....A..E1.A...D
0x1d06b2	01ee31f0c1c0084101c2448954242445	..1....A..D.T$$E
0x1d06c2	31d5448b54243441c1c5074401e34131	1.D.T$4A...D..A1
0x1d06d2	d841c1c0104501c74531fc41c1c40c44	.A...E..E1.A...D
0x1d06e2	01e34131d841c1c0084501c74531fc41	..A1.A...E..E1.A
0x1d06f2	c1c40701ef31fac1c2104101d24431d5	.....1....A..D1.
0x1d0702	c1c50c01ef31fac1c2084101d24431d5	.....1....A..D1.
0x1d0712	c1c50741ffcb0f85a9feffff44030d1b	...A........D...
0x1d0722	8d4f0044890d548d4f000335128d4f00	.O.D..T.O..5..O.
0x1d0732	89354c8d4f00031d0a8d4f00891d448d	.5L.O.....O...D.
0x1d0742	4f00033d028d4f00893d3c8d4f00032d	O..=..O..=<.O..-
0x1d0752	fa8c4f00892d348d4f00440335	..O..-4.O.D.5

0x5a1820	08000000080000000800000008000000	................
0x5a1830	08000000080000000800000008000000	................
0x5a1840	02030001060704050a0b08090e0f0c0d	................
0x5a1850	03000102070405060b08090a0f0c0d0e	................
0x5a1860	657870616e642033322d62797465206b	expand 32-byte k
0x5a1870	00909090909090909090909090909090	................
0x5a1880	00000000000000000000000000000000	................
0x5a1890	01000000000000000000000000000000	................
0x5a18a0	02000000000000000000000000000000	................
0x5a18b0	03000000000000000000000000000000	................
0x5a18c0	04000000000000000000000000000000	................
0x5a18d0	04000000000000000000000000000000	................
0x5a18e0	04000000000000000000000000000000	................

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x5e9fda	657276696365200044656c6574655365	ervice .DeleteSe
0x5e9fea	7276696365206661696c65642000256c	rvice failed .%l
0x5e9ffa	78256c780053657475702e496e737461	x%lx.Setup.Insta
0x5ea00a	6c6c2e53434d2e002e526573756c7400	ll.SCM...Result.
0x5ea01a	4368616e676553657276696365436f6e	ChangeServiceCon
0x5ea02a	666967004368616e6765536572766963	fig.ChangeServic
0x5ea03a	65436f6e666967320043726561746553	eConfig2.CreateS
0x5ea04a	6572766963650044656c657465536572	ervice.DeleteSer
0x5ea05a	76696365004f70656e53434d616e6167	vice.OpenSCManag
0x5ea06a	6572004f70656e536572766963650051	er.OpenService.Q
0x5ea07a	7565727953657276696365436f6e6669	ueryServiceConfi
0x5ea08a	6700517565727953657276696365436f	g.QueryServiceCo
0x5ea09a	6e666967320043004c00530049004400	nfig2.C.L.S.I.D.
0x5ea0aa	000053006f0066007400770061007200	..S.o.f.t.w.a.r.
0x5ea0ba	65005c0043006c006100730073006500	e.\.C.l.a.s.s.e.
0x5ea0ca	73005c00000049006e00740065007200	s.\...I.n.t.e.r.
0x5ea0da	66006100630065000000540079007000	f.a.c.e...T.y.p.
0x5ea0ea	65004c00690062000000210de2ff2a0d	e.L.i.b...!...*.
0x5ea0fa	e2ff4f0de2ff410de2ff5d0de2ff130d	..O...A...].....
0x5ea10a	e2	.

0x676586	746f72008901497356616c6964536964	tor...IsValidSid
0x676596	00009a014c6f6f6b757050726976696c	....LookupPrivil
0x6765a6	65676556616c756557000f024f70656e	egeValueW...Open
0x6765b6	50726f63657373546f6b656e00001102	ProcessToken....
0x6765c6	4f70656e53434d616e61676572570000	OpenSCManagerW..
0x6765d6	13024f70656e53657276696365570000	..OpenServiceW..
0x6765e6	4502517565727953657276696365436f	E.QueryServiceCo
0x6765f6	6e66696757005502526567436c6f7365	nfigW.U.RegClose
0x676606	4b6579005e025265674372656174654b	Key.^.RegCreateK
0x676616	657945785700640252656744656c6574	eyExW.d.RegDelet
0x676626	654b6579457857006d0252656744656c	eKeyExW.m.RegDel
0x676636	65746556616c75655700740252656745	eteValueW.t.RegE
0x676646	6e756d4b657945785700760252656745	numKeyExW.v.RegE
0x676656	6e756d56616c75654100770252656745	numValueA.w.RegE
0x676666	6e756d56616c756557007f025265674c	numValueW...RegL
0x676676	6f61644b65	oadKe

0x676266	7944657363726970746f725700005800	yDescriptorW..X.
0x676276	4275696c645472757374656557697468	BuildTrusteeWith
0x676286	5369645700005b004368616e67655365	SidW..[.ChangeSe
0x676296	7276696365436f6e6669673257005d00	rviceConfig2W.].
0x6762a6	4368616e676553657276696365436f6e	ChangeServiceCon
0x6762b6	6669675700005f00436865636b546f6b	figW.._.CheckTok
0x6762c6	656e4d656d6265727368697000006500	enMembership..e.
0x6762d6	436c6f73655365727669636548616e64	CloseServiceHand
0x6762e6	6c6500007b00436f6e76657274536964	le..{.ConvertSid
0x6762f6	546f537472696e675369645700008100	ToStringSidW....
0x676306	436f6e76657274537472696e67536563	ConvertStringSec
0x676316	757269747944657363726970746f7254	urityDescriptorT
0x676326	6f536563757269747944657363726970	oSecurityDescrip
0x676336	746f725700008300436f6e7665727453	torW....ConvertS
0x676346	7472696e67536964546f536964570000	tringSidToSidW..
0x676356	8b0043726561746550726f6365737341	..CreateProcessA
0x676366	73557365725700008d00437265617465	sUserW....Create
0x676376	50726f6365737357697468546f6b656e	ProcessWithToken
0x676386	57009100437265617465536572766963	W...CreateServic
0x676396	65570000930043726561746557656c6c	eW....CreateWell
0x6763a6	4b6e6f776e5369640000ec0044656c65	KnownSid....Dele
0x6763b6	74655365727669636500ed0044657265	teService...Dere
0x6763c6	6769737465724576656e74536f757263	gisterEventSourc
0x6763d6	6500f1004475706c6963617465546f6b	e...DuplicateTok
0x6763e6	656e4578000036014765744c656e6774	enEx..6.GetLengt
0x6763f6	68536964000042014765744e616d6564	hSid..B.GetNamed
0x676406	53	S

0x617ce2	72006f0074006f0063006f006c005600	r.o.t.o.c.o.l.V.
0x617cf2	69006500770000005c00440065006600	i.e.w...\.D.e.f.
0x617d02	610075006c007400490063006f006e00	a.u.l.t.I.c.o.n.
0x617d12	00005c007300680065006c006c000000	..\.s.h.e.l.l...
0x617d22	5c007300680065006c006c005c006f00	\.s.h.e.l.l.\.o.
0x617d32	700065006e005c0063006f006d006d00	p.e.n.\.c.o.m.m.
0x617d42	61006e006400000053006f0066007400	a.n.d...S.o.f.t.
0x617d52	77006100720065005c0043006c006900	w.a.r.e.\.C.l.i.
0x617d62	65006e00740073005c00530074006100	e.n.t.s.\.S.t.a.
0x617d72	720074004d0065006e00750049006e00	r.t.M.e.n.u.I.n.
0x617d82	7400650072006e006500740000005300	t.e.r.n.e.t...S.
0x617d92	6f006600740077006100720065005c00	o.f.t.w.a.r.e.\.
0x617da2	43006c00610073007300650073000000	C.l.a.s.s.e.s...
0x617db2	53006f	S.o

0x5d990e	696365007072696f726974790075726c	ice.priority.url
0x5d991e	00706172656e74007374617475730066	.parent.status.f
0x5d992e	6c616773006d6f646500257500000000	lags.mode.%u....
0x5d993e	00000000000000408f405c62005c6600	.......@.@\b.\f.
0x5d994e	537461727400556e6b6e6f776e004372	Start.Unknown.Cr
0x5d995e	6561746546696c6500436c6f73650057	eateFile.Close.W
0x5d996e	7269746546696c6500466c7573680050	riteFile.Flush.P
0x5d997e	4552464554544f5f434845434b282173	ERFETTO_CHECK(!s
0x5d998e	6c696365735f2e656d70747928292900	lices_.empty()).
0x5d999e	2e2e5c2e2e5c74686972645f70617274	..\..\third_part
0x5d99ae	795c706572666574746f5c7372635c74	y\perfetto\src\t
0x5d99be	726163655f70726f636573736f725c69	race_processor\i
0x5d99ce	6d706f7274657273	mporters

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x601e53	4f4d455f43524153485041445f504950	OME_CRASHPAD_PIP
0x601e63	455f4e414d4500000000000000434852	E_NAME.......CHR
0x601e73	4f4d455f43524153485041445f534552	OME_CRASHPAD_SER
0x601e83	5645525f55524c002d2d747970653d00	VER_URL.--type=.
0x601e93	2d2d757365722d646174612d6469723d	--user-data-dir=
0x601ea3	00630072006100730068007000610064	.c.r.a.s.h.p.a.d
0x601eb3	005f00680061006e0064006c00650072	._.h.a.n.d.l.e.r
0x601ec3	002e0065007800650000002d2d6d6f6e	...e.x.e...--mon
0x601ed3	69746f722d73656c66002d2d6d6f6e69	itor-self.--moni
0x601ee3	746f722d73656c662d617267756d656e	tor-self-argumen
0x601ef3	743d002d2d6d6f6e69746f722d73656c	t=.--monitor-sel
0x601f03	662d616e6e6f746174696f6e3d707479	f-annotation=pty
0x601f13	70653d006f7361726368000000637261	pe=.osarch...cra

0x61c6be	74795c63726173687061645c63726173	ty\crashpad\cras
0x61c6ce	687061645c636c69656e745c63726173	hpad\client\cras
0x61c6de	687061645f636c69656e745f77696e2e	hpad_client_win.
0x61c6ee	63630043726561746554687265616400	cc.CreateThread.
0x61c6fe	57616974466f7253696e676c654f626a	WaitForSingleObj
0x61c70e	656374006e6f7420636f6e6e65637465	ect.not connecte
0x61c71e	64006372617368207365727665722066	d.crash server f
0x61c72e	61696c656420746f206c61756e63682c	ailed to launch,
0x61c73e	206e6f2064756d702063617074757265	no dump capture
0x61c74e	64005365744576656e74005c5c2e5c70	d.SetEvent.\\.\p
0x61c75e	6970655c63726173687061645f256c75	ipe\crashpad_%lu
0x61c76e	5f004372656174654e616d6564506970	_.CreateNamedPip
0x61c77e	65006461746162617365006d65747269	e.database.metri
0x61c78e	63732d	cs-

0x61c8a0	6461746550726f635468726561644174	dateProcThreadAt
0x61c8b0	7472696275746500720075006e006400	tribute.r.u.n.d.
0x61c8c0	6c006c00330032002e00650078006500	l.l.3.2...e.x.e.
0x61c8d0	000043726561746550726f6365737300	..CreateProcess.
0x61c8e0	436c6f736548616e646c652074687265	CloseHandle thre
0x61c8f0	616400436c6f736548616e646c652070	ad.CloseHandle p
0x61c900	726f63657373003a3a44656c65746550	rocess.::DeleteP
0x61c910	726f6354687265616441747472696275	rocThreadAttribu
0x61c920	74654c69737400637261736820736572	teList.crash ser
0x61c930	766572206661696c656420746f206c61	ver failed to la
0x61c940	756e63682c2073656c662d7465726d69	unch, self-termi
0x61c950	6e6174696e6700637261736820736572	nating.crash ser
0x61c960	76657220646964206e6f74	ver did not

0x676da0	496f436f6e74726f6c00450144697363	IoControl.E.Disc
0x676db0	6172645669727475616c4d656d6f7279	ardVirtualMemory
0x676dc0	00004601446973636f6e6e6563744e61	..F.DisconnectNa
0x676dd0	6d656450697065004f014475706c6963	medPipe.O.Duplic
0x676de0	61746548616e646c65005301456e636f	ateHandle.S.Enco
0x676df0	6465506f696e746572005701456e7465	dePointer.W.Ente
0x676e00	72437269746963616c53656374696f6e	rCriticalSection
0x676e10	00007b01456e756d53797374656d4c6f	..{.EnumSystemLo
0x676e20	63616c65735700008601457869745072	calesW....ExitPr
0x676e30	6f63657373008a01457870616e64456e	ocess...ExpandEn
0x676e40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676e50	5700920146696c6554696d65546f5379	W...FileTimeToSy
0x676e60	7374656d54696d6500009d0146696e64	stemTime....Find
0x676e70	436c6f736500a30146696e6446697273	Close...FindFirs
0x676e80	7446696c654578570000a80146696e64	tFileExW....Find
0x676e90	466972737446696c65570000b4014669	FirstFileW....Fi
0x676ea0	6e644e65787446696c655700be014669	ndNextFileW...Fi
0x676eb0	6e645265736f757263655700c201466c	ndResourceW...Fl
0x676ec0	73416c6c6f630000c301466c73467265	sAlloc....FlsFre
0x676ed0	6500c401466c7347657456616c756500	e...FlsGetValue.
0x676ee0	c601466c7353657456616c756500c801	..FlsSetValue...
0x676ef0	466c75736846696c6542756666657273	FlushFileBuffers
0x676f00	0000cb01466c757368566965774f6646	....FlushViewOfF
0x676f10	696c6500cf01466f726d61744d657373	ile...FormatMess
0x676f20	616765410000d001466f726d61744d65	ageA....FormatMe
0x676f30	7373616765570000d30146726565456e	ssageW....FreeEn
0x676f40	7669726f6e6d656e74537472696e6773	vironmentStrings
0x676f50	5700d401467265654c69627261727900	W...FreeLibrary.
0x676f60	db014765744143500000ea0147657443	..GetACP....GetC
0x676f70	50496e666f00ff01476574436f6d6d61	PInfo...GetComma
0x676f80	6e644c696e6541000002476574436f6d	ndLineA...GetCom
0x676f90	6d616e644c696e655700250247657443	mandLineW.%.GetC
0x676fa0	6f6e736f6c654d6f6465000029024765	onsoleMode..).Ge
0x676fb0	74436f6e736f6c654f75747075744350	tConsoleOutputCP
0x676fc0	00003a0247657443757272656e744469	..:.GetCurrentDi
0x676fd0	726563746f7279570000410247657443	rectoryW..A.GetC
0x676fe0	757272656e7450726f63657373004202	urrentProcess.B.
0x676ff0	47657443757272656e7450726f636573	GetCurrentProces
0x677000	73496400450247657443757272656e74	sId.E.GetCurrent
0x677010	54687265616400004602476574437572	Thread..F.GetCur
0x677020	72656e74546872656164496400004c02	rentThreadId..L.
0x677030	47657444617465466f726d6174570000	GetDateFormatW..
0x677040	5a024765744472697665547970655700	Z.GetDriveTypeW.
0x677050	6202476574456e7669726f6e6d656e74	b.GetEnvironment
0x677060	537472696e6773570000640247657445	StringsW..d.GetE
0x677070	6e7669726f6e6d656e74566172696162	nvironmentVariab
0x677080	6c655700670247657445786974436f64	leW.g.GetExitCod
0x677090	6550726f6365737300006d0247657446	eProcess..m.GetF

0x677efc	4d756c746942797465005006576f7736	MultiByte.P.Wow6
0x677f0c	34476574546872656164436f6e746578	4GetThreadContex
0x677f1c	74005f065772697465436f6e736f6c65	t._.WriteConsole
0x677f2c	57006006577269746546696c65006906	W.`.WriteFile.i.
0x677f3c	577269746550726f636573734d656d6f	WriteProcessMemo
0x677f4c	7279000085066c737472636d70695700	ry....lstrcmpiW.
0x677f5c	2b00436f437265617465496e7374616e	+.CoCreateInstan
0x677f6c	636500006100436f496e697469616c69	ce..a.CoInitiali
0x677f7c	7a65457800007700436f526567697374	zeEx..w.CoRegist
0x677f8c	6572496e697469616c697a6553707900	erInitializeSpy.
0x677f9c	8300436f5265766f6b65496e69746961	..CoRevokeInitia
0x677fac	6c697a65537079008b00436f5461736b	lizeSpy...CoTask
0x677fbc	4d656d416c6c6f6300008c00436f5461	MemAlloc....CoTa
0x677fcc	736b	sk

Metadata

0x74dc9c	736f66742d636f6d3a61736d2e763322	soft-com:asm.v3"
0x74dcac	3e3c73656375726974793e3c72657175	><security><requ
0x74dcbc	657374656450726976696c656765733e	estedPrivileges>
0x74dccc	3c726571756573746564457865637574	<requestedExecut
0x74dcdc	696f6e4c6576656c206c6576656c3d22	ionLevel level="
0x74dcec	6173496e766f6b657222207569416363	asInvoker" uiAcc
0x74dcfc	6573733d2266616c7365222f3e3c2f72	ess="false"/></r
0x74dd0c	657175657374656450726976696c6567	equestedPrivileg
0x74dd1c	65733e3c2f73656375726974793e3c2f	es></security></
0x74dd2c	7472757374496e666f3e3c646570656e	trustInfo><depen
0x74dd3c	64656e63793e3c646570656e64656e74	dency><dependent
0x74dd4c	417373656d626c793e3c617373656d62	Assembly><assemb
0x74dd5c	6c794964656e74697479207479	lyIdentity ty

0x6ca75b	7f0000007f8000007fffc061ff000001	...........a....
0x6ca76b	0001002020100001000400e802000001	... ...........
0x6ca77b	000000000089504e470d0a1a0a000000	......PNG.......
0x6ca78b	0d494844520000002000000020080200	.IHDR... ... ...
0x6ca79b	0000fc18eda30000001974455874536f	..........tEXtSo
0x6ca7ab	6674776172650041646f626520496d61	ftware.Adobe Ima
0x6ca7bb	6765526561647971c9653c0000052849	geReadyq.e<...(I
0x6ca7cb	44415478dab4565b6c1455183e9799bd	DATx..V[l.U.>...
0x6ca7db	75bbbd6d6929b4502a94855211a2a1c6	u..mi).P*..R....
0x6ca7eb	2b628cc883128d468821d107	+b.....F.!..

0x6caf80	3b0a7d0a2e627574746f6e73207b0a20	;.}..buttons {.
0x6caf90	206d617267696e3a3870782035707820	margin:8px 5px
0x6cafa0	307078203570783b0a2020746578742d	0px 5px;. text-
0x6cafb0	616c69676e3a72696768743b0a7d0000	align:right;.}..
0x6cafc0	66756e6374696f6e20736574496e6e65	function setInne
0x6cafd0	724672616d652829207b0a2020766172	rFrame() {. var
0x6cafe0	20696e6e65725f6672616d65203d2077	inner_frame = w
0x6caff0	696e646f772e6469616c6f6741726775	indow.dialogArgu
0x6cb000	6d656e74733b0a202069662028696e6e	ments;. if (inn
0x6cb010	65725f6672616d6529207b0a20202020	er_frame) {.
0x6cb020	646f63756d656e742e676574456c656d	document.getElem
0x6cb030	656e7442794964282769667227292e73	entById('ifr').s
0x6cb040	7263203d20696e6e65725f6672616d65	rc = inner_frame
0x6cb050	3b0a20207d0a7d0a0a66756e6374696f	;. }.}..functio
0x6cb060	6e20636865636b416363657074286629	n checkAccept(f)
0x6cb070	207b0a202069662028662e6163636570	{. if (f.accep
0x6cb080	742e636865636b656429207b0a202020	t.checked) {.
0x6cb090	2077696e646f772e72657475726e5661	window.returnVa
0x6cb0a0	6c7565203d20363b0a20207d20656c73	lue = 6;. } els
0x6cb0b0	65207b0a2020202077696e646f772e72	e {. window.r
0x6cb0c0	657475726e56616c7565203d20313b0a	eturnValue = 1;.
0x6cb0d0	20207d0a202077696e646f772e636c6f	}. window.clo
0x6cb0e0	736528293b0a7d0a0a66756e6374696f	se();.}..functio
0x6cb0f0	6e20726573697a652829207b0a202076	n resize() {. v
0x6cb100	617220696672203d20646f63756d656e	ar ifr = documen
0x6cb110	742e676574456c656d656e7442794964	t.getElementById
0x6cb120	282769667227293b0a20207661722066	('ifr');. var f
0x6cb130	6f6f746572203d20646f63756d656e74	ooter = document
0x6cb140	2e676574456c656d656e744279496428	.getElementById(
0x6cb150	27666f6f74657227293b0a20200a2020	'footer');. .
0x6cb160	6966722e686569676874203d20666f6f	ifr.height = foo
0x6cb170	7465722e6f6666736574546f70202d20	ter.offsetTop -
0x6cb180	6966722e6f6666736574546f703b0a20	ifr.offsetTop;.
0x6cb190	20736574496e6e65724672616d652829	setInnerFrame()
0x6cb1a0	3b0a7d0a0a77696e646f772e6f6e7265	;.}..window.onre
0x6cb1b0	73697a65203d20726573697a653b0a77	size = resize;.w
0x6cb1c0	696e646f772e6f6e6c6f6164203d2072	indow.onload = r
0x6cb1d0	6573697a653b00003c68746d6c206c61	esize;..<html la
0x6cb1e0	6e673d226172223e0a3c686561643e0a	ng="ar">.<head>.
0x6cb1f0	3c6d65746120687474702d6571756976	<meta http-equiv
0x6cb200	3d22436f6e74656e742d547970652220	="Content-Type"
0x6cb210	636f6e74656e743d22746578742f6874	content="text/ht
0x6cb220	6d6c3b20636861727365743d5554462d	ml; charset=UTF-
0x6cb230	38223e0a3c7469746c653ed8a7d8aad9	8">.<title>.....
0x6cb240	81d8a7d982d98ad8a920d8aad8b1	......... ....

20 of 74 traits shown

Identity

SHA-256	2a0d0488b52f6b28c5adbc91d80d31d0a75a2118aaffa758ea28fd465372df65
Filename	virussign.com_d10695f8baf68e63d1a72afc34f91000.vir
Package	2a0d0488b52f6b28c5adbc91d80d31d0a75a2118aaffa758ea28fd465372df65

Origin

Source	harvest
Feed	virussign
Domain	virussign.com

Timeline

First seen	3 Aug 2026 13:37 UTC
First analyzed	5 Aug 2026 11:08 UTC
Last analyzed	5 Aug 2026 11:08 UTC
Last updated	5 Aug 2026 11:08 UTC

Labeling

Label	bad
Label source	harvest
Traits version	b5ca8

Not seeing what you expected? Let us know

0x61cd0f	686972645f70617274795c6372617368	hird_party\crash
0x61cd1f	7061645c63726173687061645c757469	pad\crashpad\uti
0x61cd2f	6c5c77696e5c73636f7065645f70726f	l\win\scoped_pro
0x61cd3f	636573735f73757370656e642e636300	cess_suspend.cc.
0x61cd4f	4e7453757370656e6450726f63657373	NtSuspendProcess
0x61cd5f	004e74526573756d6550726f63657373	.NtResumeProcess
0x61cd6f	00436c6f736548616e646c650046696e	.CloseHandle.Fin
0x61cd7f	64436c6f7365002e2e5c2e2e5c746869	dClose...\..\thi
0x61cd8f	72645f70617274795c63726173687061	rd_party\crashpa
0x61cd9f	645c63726173687061645c7574696c5c	d\crashpad\util\
0x61cdaf	77696e5c73636f7065645f68616e646c	win\scoped_handl
0x61cdbf	652e6363002e2e5c2e2e5c7468697264	e.cc...\..\third
0x61cdcf	5f70617274795c63726173687061645c	_party\crashpad\
0x61cddf	63726173687061645c7574696c5c7769	crashpad\util\wi

0x64c248	01000100010001000100010001000100	................
0x64c258	01000100010001000100010001000100	................
0x64c268	b100b100b100b100b100b100b1000100	................
0x64c278	01000100010001000100010001000100	................
0x64c288	41004100410041004100410041004100	A.A.A.A.A.A.A.A.
0x64c298	41004100410041004100410041004100	A.A.A.A.A.A.A.A.
0x64c2a8	41004100410041004100410041004100	A.A.A.A.A.A.A.A.
0x64c2b8	41004100410041004100410041004100	A.A.A.A.A.A.A.A.
0x64c2c8	b100b100b100b100b100b100b100a100	................
0x64c2d8	01000100010001000100010001000100	................
0x64c2e8	01000100010001000100010001000100	................
0x64c2f8	01000100010001000d000d000d000d00	................
0x64c308	0d000d000d000d000d000d000d000d00	................
0x64c318	0d000d000d000d00	........

0x5a1311	020100070605040b0a09080f0e0d0c0f	................
0x5a1321	0e0d0c0b0a0908070605040302010053	...............S
0x5a1331	48413120626c6f636b207472616e7366	HA1 block transf
0x5a1341	6f726d20666f72207838365f36342c20	orm for x86_64,
0x5a1351	43525950544f47414d53206279203c61	CRYPTOGAMS by <a
0x5a1361	7070726f406f70656e73736c2e6f7267	ppro@openssl.org
0x5a1371	3e0090909090909090909090909090ff	>...............
0x5a1381	ffff1f00000000ffffff1f00000000ff	................
0x5a1391	ffff1f00000000ffffff1f0000000000	................
0x5a13a1	00000002000000040000000600000007	................
0x5a13b1	00000007000000070000000700000000	................
0x5a13c1	00000007000000010000000700000002	................
0x5a13d1	00000007000000030000000700000000	................
0x5a13e1	00000000000000000000000000000001	................
0x5a13f1	00	.

0x5a1452	00000000000000000000000000c20700	................
0x5a1462	00000000000007000000000000009090	................
0x5a1472	90909090909090909090909090904748	..............GH
0x5a1482	41534820666f72207838365f36342c20	ASH for x86_64,
0x5a1492	43525950544f47414d53206279203c61	CRYPTOGAMS by <a
0x5a14a2	7070726f406f70656e73736c2e6f7267	ppro@openssl.org
0x5a14b2	3e009090909090909090909090900f0e	>...............
0x5a14c2	0d0c0b0a090807060504030201000f0f	................
0x5a14d2	0f0f0f0f0f0f0f0f0f0f0f0f0f0f0000	................
0x5a14e2	00000000000000000000000000000000	................
0x5a14f2	00000000000000000000000000000f0e	................
0x5a1502	0d0c0b0a090807060504030201000600	................
0x5a1512	00000600000006000000000000000100	................
0x5a1522	00000000000000000000000000008700	................
0x5a1532	00	.

0x5a1940	10000000100000001000000010000000	................
0x5a1950	10000000100000001000000010000000	................
0x5a1960	10000000100000001000000010000000	................
0x5a1970	10000000100000001000000010000000	................
0x5a1980	436861436861323020666f7220783836	ChaCha20 for x86
0x5a1990	5f36342c2043525950544f47414d5320	_64, CRYPTOGAMS
0x5a19a0	6279203c617070726f406f70656e7373	by <appro@openss
0x5a19b0	6c2e6f72673e00000000000000000000	l.org>..........
0x5a19c0	657870616e642033322d62797465206b	expand 32-byte k
0x5a19d0	657870616e642033322d62797465206b	expand 32-byte k
0x5a19e0	03000102070405060b08090a0f0c0d0e	................
0x5a19f0	03000102070405060b08090a0f0c0d0e	................
0x5a1a00	02030001060704050a0b08090e0f0c0d	................
0x5a1a10	02030001060704050a0b08090e0f0c0d	................
0x5a1a20	00000000000000000000000000000000	................
0x5a1a30	01000000000000000000000000000000	................
0x5a1a40	02000000000000000000000000000000	................