c1dfd3712d6f927acf98a78f1b77367d0b57aefbcd6ea8a7120d61a2b8a76525

HOSTILE

c1dfd3712d6f927acf98a78f1b77367d0b57aefbcd6ea8a7120d61a2b8a76525 · 92%

Mal-ecule

O₄(As₂Er₅PrLa)H₉(Cm₉Cr₇Db₄F₂Hf₂Mg₂Os₅Po₅U)Md₂(Bi₃Pa)

Size 11.9 MB download

First seen 2 days ago

Analyzed 1 day ago

Ecosystem windows

Source abuse.ch

Also detected by 1 source

Go base64 payload decoded then executed: RiotClientServices.exe:0x7d55a2

Unsigned Microsoft-claim PE combines TLS callbacks with packed data: RiotClientServices.exe:0x0

Go local shellcode execution via Proc.Call: RiotClientServices.exe:0x7d55a2

RiotClientServices.exe pe

0x0	4d5a90000300000004000000ffff0000	MZ..............Unsigned Microsoft-claim PE combines TLS callbacks with packed data
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000080000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	5045000064860b000000000000000000	PE..d...........
0x90	00000000f0002e020b02022e00366400	.............6d.
0xa0	00c2590000141500a014000000100000	..Y.............
0xb0	00000040010000000010000000020000	...@............
0xc0	06000100000000000600010000000000	................
0xd0	0080d300000400009fb8be0002006081	..............`.
0xe0	00002000000000000010000000000000	.. .............
0xf0	00001000000000000010000000000000	................
0x100	000000001000000000a0d1006e060000	............n...
0x110	00b0d100d815000000e0d10078	............x

0x7d5522	6f72202554746c733a20696e7465726e	or %Ttls: intern
0x7d5532	616c206572726f723a2068616e647368	al error: handsh
0x7d5542	616b652072657475726e656420616e20	ake returned an
0x7d5552	6572726f7220627574206973206d6172	error but is mar
0x7d5562	6b6564207375636365737366756c5b75	ked successful[u
0x7d5572	61635d206e6f7420656c657661746564	ac] not elevated
0x7d5582	2c20554143206279706173732068616e	, UAC bypass hanUAC bypass indicators combined
0x7d5592	646c6564206279207061796c6f616420	dled by payload
0x7d55a2	7368656c6c636f646520e2809420636f	shellcode ... coGo base64 payload decoded then executed
0x7d55b2	6e74696e75696e676d616c666f726d65	ntinuingmalforme
0x7d55c2	6420726573706f6e73652066726f6d20	d response from
0x7d55d2	7365727665723a206d616c666f726d65	server: malforme
0x7d55e2	64206e6f6e2d6e756d65726963207374	d non-numeric st
0x7d55f2	617475732070736575646f2068656164	atus pseudo head
0x7d5602	65726e65742f687474703a2073657276	ernet/http: serv
0x7d5612	6572207265706c696564207769746820	er replied with
0x7d5622	6d6f7265207468616e206465636c6172	more than declar
0x7d5632	656420436f6e74656e742d4c656e6774	ed Content-Lengt
0x7d5642	683b207472756e63617465647065726d	h; truncatedperm
0x7d5652	6573736167652d6465666c6174653b20	essage-deflate;
0x7d5662	7365727665725f6e6f5f636f6e746578	server_no_contex
0x7d5672	745f74616b656f7665723b20636c6965	t_takeover; clie
0x7d5682	6e745f6e6f5f636f6e746578745f7461	nt_no_context_ta
0x7d5692	6b656f76657263727970746f2f72616e	keovercrypto/ran
0x7d56a2	643a206661696c6564	d: failed

0x8a4c6a	61700073797363616c6c2e4c6f616444	ap.syscall.LoadD
0x8a4c7a	4c4c0073797363616c6c2e5554463136	LL.syscall.UTF16
0x8a4c8a	50747246726f6d537472696e67007379	PtrFromString.sy
0x8a4c9a	7363616c6c2e282a444c4c292e46696e	scall.(*DLL).Fin
0x8a4caa	6450726f630073797363616c6c2e4279	dProc.syscall.By
0x8a4cba	746550747246726f6d537472696e6700	tePtrFromString.
0x8a4cca	73797363616c6c2e282a50726f63292e	syscall.(*Proc).Go base64 payload decoded then executed
0x8a4cda	43616c6c0073797363616c6c2e282a50	Call.syscall.(*P
0x8a4cea	726f63292e416464720073797363616c	roc).Addr.syscal
0x8a4cfa	6c2e282a4c617a79444c4c292e4c6f61	l.(*LazyDLL).Loa
0x8a4d0a	640073797363616c6c2e282a4c617a79	d.syscall.(*Lazy
0x8a4d1a	444c4c292e4c6f61642e646566657277	DLL).Load.deferw
0x8a4d2a	726170310073797363616c6c2e282a4c	rap1.syscall.(*L
0x8a4d3a	617a7950726f63292e46696e64007379	azyProc).Find.sy
0x8a4d4a	7363616c6c2e282a4c617a7950726f63	scall.(*LazyProc
0x8a4d5a	292e46696e642e646566657277726170	).Find.deferwrap
0x8a4d6a	310073797363616c6c2e282a4c617a79	1.syscall.(*Lazy
0x8a4d7a	50726f63292e43616c6c007379736361	Proc).Call.sysca
0x8a4d8a	6c6c2e282a4c617a7950726f63292e6d	ll.(*LazyProc).m
0x8a4d9a	75737446696e640073797363616c6c2e	ustFind.syscall.
0x8a4daa	476574656e760073797363616c6c2e45	Getenv.syscall.E
0x8a4dba	6e7669726f6e0073797363616c	nviron.syscal

0x8b5b62	757420737472696e67207d0074797065	ut string }.type
0x8b5b72	3a2e65712e6f732f657865632e676f72	:.eq.os/exec.gor
0x8b5b82	6f7574696e65537461747573c2b73100	outineStatus..1.
0x8b5b92	656e636f64696e672f6261736536342e	encoding/base64.
0x8b5ba2	696e697400656e636f64696e672f6261	init.encoding/ba
0x8b5bb2	736536342e4e6577456e636f64696e67	se64.NewEncoding
0x8b5bc2	00656e636f64696e672f626173653634	.encoding/base64
0x8b5bd2	2e456e636f64696e672e576974685061	.Encoding.WithPa
0x8b5be2	6464696e6700656e636f64696e672f62	dding.encoding/b
0x8b5bf2	61736536342e282a456e636f64696e67	ase64.(*Encoding
0x8b5c02	292e456e636f646500656e636f64696e	).Encode.encodin
0x8b5c12	672f6261736536342e282a456e636f64	g/base64.(*Encod
0x8b5c22	696e67292e417070656e64456e636f64	ing).AppendEncod
0x8b5c32	6500656e636f64696e672f6261736536	e.encoding/base6
0x8b5c42	342e282a456e636f64696e67292e456e	4.(*Encoding).En
0x8b5c52	636f6465644c656e00736c696365732e	codedLen.slices.
0x8b5c62	47726f775b676f2e73686170652e5b5d	Grow[go.shape.[]
0x8b5c72	75696e74382c676f2e73686170652e75	uint8,go.shape.u
0x8b5c82	696e74385d00656e636f64696e672f62	int8].encoding/b
0x8b5c92	61736536342e282a456e636f64696e67	ase64.(*Encoding
0x8b5ca2	292e456e636f6465546f537472696e67	).EncodeToString
0x8b5cb2	00656e636f64696e672f626173653634	.encoding/base64
0x8b5cc2	2e436f7272757074496e707574457272	.CorruptInputErr
0x8b5cd2	6f722e4572726f7200656e636f64696e	or.Error.encodin
0x8b5ce2	672f6261736536342e282a456e636f64	g/base64.(*Encod
0x8b5cf2	696e67292e6465636f64655175616e74	ing).decodeQuant
0x8b5d02	756d00656e636f64696e672f62617365	um.encoding/baseGo base64 payload decoded then executed
0x8b5d12	36342e282a456e636f64696e67292e44	64.(*Encoding).D
0x8b5d22	65636f6465537472696e6700656e636f	ecodeString.enco
0x8b5d32	64696e672f6261736536342e282a456e	ding/base64.(*En
0x8b5d42	636f64696e67292e4465636f6465644c	coding).DecodedL
0x8b5d52	656e00656e636f64696e672f62617365	en.encoding/base
0x8b5d62	36342e6465636f6465644c656e00656e	64.decodedLen.en
0x8b5d72	636f64696e672f6261736536342e282a	coding/base64.(*
0x8b5d82	456e636f64696e67292e4465636f6465	Encoding).Decode
0x8b5d92	00656e636f64696e672f62696e617279	.encoding/binary
0x8b5da2	2e626967456e6469616e2e5075745569	.bigEndian.PutUi
0x8b5db2	6e74363400656e636f64696e672f6261	nt64.encoding/ba
0x8b5dc2	736536342e617373656d626c65363400	se64.assemble64.
0x8b5dd2	656e636f64696e672f6261736536342e	encoding/base64.
0x8b5de2	617373656d626c65333200747970653a	assemble32.type:
0x8b5df2	2e65712e656e636f64696e672f626173	.eq.encoding/bas
0x8b5e02	6536342e456e636f64696e6700656e63	e64.Encoding.enc
0x8b5e12	6f64696e672f6261736536342e282a43	oding/base64.(*C
0x8b5e22	6f7272757074496e7075744572726f72	orruptInputError
0x8b5e32	292e4572726f7200656e636f64696e67	).Error.encoding
0x8b5e42	2f6865782e496e76616c696442797465	/hex.InvalidByte
0x8b5e52	4572726f722e4572726f7200656e636f	Error.Error.enco

0xbc6476	01000000000090000000a0e0d1003803	..............8.
0xbc6486	00000000000000000000d8e3d1008f04	................
0xbc6496	00000000000000000000380334000000	..........8.4...
0xbc64a6	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0xbc64b6	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0xbc64c6	0000bd04effe00000100770057007e05	..........w.W.~.
0xbc64d6	0703770057007e0507033f0000000000	..w.W.~...?.....
0xbc64e6	00000400040001000000000000000000	................
0xbc64f6	00000000000098020000010053007400	............S.t.
0xbc6506	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0xbc6516	49006e0066006f000000740200000100	I.n.f.o...t.....
0xbc6526	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0xbc6536	00004c001600010043006f006d007000	..L.....C.o.m.p.
0xbc6546	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0xbc6556	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.Unsigned Microsoft-claim PE combines TLS callbacks with packed data
0xbc6566	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0xbc6576	72006100740069006f006e0000005000	r.a.t.i.o.n...P.
0xbc6586	13000100460069006c00650044006500	....F.i.l.e.D.e.
0xbc6596	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0xbc65a6	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0xbc65b6	73006f006600740020004f006e006500	s.o.f.t. .O.n.e.
0xbc65c6	44007200690076006500000000004000	D.r.i.v.e.....@.
0xbc65d6	10000100460069006c00650056006500	....F.i.l.e.V.e.
0xbc65e6	7200730069006f006e00000000003800	r.s.i.o.n.....8.
0xbc65f6	37002e003100310039002e0037003700	7...1.1.9...7.7.
0xbc6606	35002e00310034003000360000003400	5...1.4.0.6...4.
0xbc6616	0900010049006e007400650072006e00	....I.n.t.e.r.n.
0xbc6626	61006c004e0061006d00650000004f00	a.l.N.a.m.e...O.
0xbc6636	6e006500440072006900760065000000	n.e.D.r.i.v.e...
0xbc6646	00007c002c0001004c00650067006100	..\|.,...L.e.g.a.
0xbc6656	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0xbc6666	6800740000004d006900630072006f00	h.t...M.i.c.r.o.
0xbc6676	73006f0066007400200043006f007200	s.o.f.t. .C.o.r.
0xbc6686	70006f0072006100740069006f006e00	p.o.r.a.t.i.o.n.
0xbc6696	2e00200041006c006c00200072006900	.. .A.l.l. .r.i.
0xbc66a6	67006800740073002000720065007300	g.h.t.s. .r.e.s.
0xbc66b6	650072007600650064002e0000004400	e.r.v.e.d.....D.
0xbc66c6	0d0001004f0072006900670069006e00	....O.r.i.g.i.n.
0xbc66d6	61006c00460069006c0065006e006100	a.l.F.i.l.e.n.a.
0xbc66e6	6d00650000004f006e00650044007200	m.e...O.n.e.D.r.
0xbc66f6	6900760065002e006500780065000000	i.v.e...e.x.e...
0xbc6706	0000480013000100500072006f006400	..H.....P.r.o.d.
0xbc6716	7500630074004e0061006d0065000000	u.c.t.N.a.m.e...
0xbc6726	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6736	6600740020004f006e00650044007200	f.t. .O.n.e.D.r.
0xbc6746	69007600650000000000440010000100	i.v.e.....D.....
0xbc6756	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0xbc6766	65007200730069006f006e0000003800	e.r.s.i.o.n...8.

Objectives

0x0	4d5a90000300000004000000ffff0000	MZ..............
0x10	b8000000000000004000000000000000	........@.......
0x20	00000000000000000000000000000000	................
0x30	00000000000000000000000080000000	................
0x40	0e1fba0e00b409cd21b8014ccd215468	........!..L.!Th
0x50	69732070726f6772616d2063616e6e6f	is program canno
0x60	742062652072756e20696e20444f5320	t be run in DOS
0x70	6d6f64652e0d0d0a2400000000000000	mode....$.......
0x80	5045000064860b000000000000000000	PE..d...........
0x90	00000000f0002e020b02022e00366400	.............6d.
0xa0	00c2590000141500a014000000100000	..Y.............
0xb0	00000040010000000010000000020000	...@............
0xc0	06000100000000000600010000000000	................
0xd0	0080d300000400009fb8be0002006081	..............`.
0xe0	00002000000000000010000000000000	.. .............
0xf0	00001000000000000010000000000000	................
0x100	000000001000000000a0d1006e060000	............n...
0x110	00b0d100d815000000e0d10078	............x

0xbc6476	01000000000090000000a0e0d1003803	..............8.
0xbc6486	00000000000000000000d8e3d1008f04	................
0xbc6496	00000000000000000000380334000000	..........8.4...
0xbc64a6	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0xbc64b6	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0xbc64c6	0000bd04effe00000100770057007e05	..........w.W.~.
0xbc64d6	0703770057007e0507033f0000000000	..w.W.~...?.....
0xbc64e6	00000400040001000000000000000000	................
0xbc64f6	00000000000098020000010053007400	............S.t.
0xbc6506	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0xbc6516	49006e0066006f000000740200000100	I.n.f.o...t.....
0xbc6526	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0xbc6536	00004c001600010043006f006d007000	..L.....C.o.m.p.
0xbc6546	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0xbc6556	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6566	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0xbc6576	72006100740069006f006e0000005000	r.a.t.i.o.n...P.
0xbc6586	13000100460069006c00650044006500	....F.i.l.e.D.e.
0xbc6596	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0xbc65a6	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0xbc65b6	73006f006600740020004f006e006500	s.o.f.t. .O.n.e.
0xbc65c6	44007200690076006500000000004000	D.r.i.v.e.....@.
0xbc65d6	10000100460069006c00650056006500	....F.i.l.e.V.e.
0xbc65e6	7200730069006f006e00000000003800	r.s.i.o.n.....8.
0xbc65f6	37002e003100310039002e0037003700	7...1.1.9...7.7.
0xbc6606	35002e00310034003000360000003400	5...1.4.0.6...4.
0xbc6616	0900010049006e007400650072006e00	....I.n.t.e.r.n.
0xbc6626	61006c004e0061006d00650000004f00	a.l.N.a.m.e...O.
0xbc6636	6e006500440072006900760065000000	n.e.D.r.i.v.e...
0xbc6646	00007c002c0001004c00650067006100	..\|.,...L.e.g.a.
0xbc6656	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0xbc6666	6800740000004d006900630072006f00	h.t...M.i.c.r.o.
0xbc6676	73006f0066007400200043006f007200	s.o.f.t. .C.o.r.
0xbc6686	70006f0072006100740069006f006e00	p.o.r.a.t.i.o.n.
0xbc6696	2e00200041006c006c00200072006900	.. .A.l.l. .r.i.
0xbc66a6	67006800740073002000720065007300	g.h.t.s. .r.e.s.
0xbc66b6	650072007600650064002e0000004400	e.r.v.e.d.....D.
0xbc66c6	0d0001004f0072006900670069006e00	....O.r.i.g.i.n.
0xbc66d6	61006c00460069006c0065006e006100	a.l.F.i.l.e.n.a.
0xbc66e6	6d00650000004f006e00650044007200	m.e...O.n.e.D.r.
0xbc66f6	6900760065002e006500780065000000	i.v.e...e.x.e...
0xbc6706	0000480013000100500072006f006400	..H.....P.r.o.d.
0xbc6716	7500630074004e0061006d0065000000	u.c.t.N.a.m.e...
0xbc6726	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6736	6600740020004f006e00650044007200	f.t. .O.n.e.D.r.
0xbc6746	69007600650000000000440010000100	i.v.e.....D.....
0xbc6756	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0xbc6766	65007200730069006f006e0000003800	e.r.s.i.o.n...8.

0x7d5522	6f72202554746c733a20696e7465726e	or %Ttls: intern
0x7d5532	616c206572726f723a2068616e647368	al error: handsh
0x7d5542	616b652072657475726e656420616e20	ake returned an
0x7d5552	6572726f7220627574206973206d6172	error but is mar
0x7d5562	6b6564207375636365737366756c5b75	ked successful[u
0x7d5572	61635d206e6f7420656c657661746564	ac] not elevated
0x7d5582	2c20554143206279706173732068616e	, UAC bypass han
0x7d5592	646c6564206279207061796c6f616420	dled by payload
0x7d55a2	7368656c6c636f646520e2809420636f	shellcode ... co
0x7d55b2	6e74696e75696e676d616c666f726d65	ntinuingmalforme
0x7d55c2	6420726573706f6e73652066726f6d20	d response from
0x7d55d2	7365727665723a206d616c666f726d65	server: malforme
0x7d55e2	64206e6f6e2d6e756d65726963207374	d non-numeric st
0x7d55f2	617475732070736575646f2068656164	atus pseudo head
0x7d5602	65726e65742f687474703a2073657276	ernet/http: serv
0x7d5612	6572207265706c696564207769746820	er replied with
0x7d5622	6d6f7265207468616e206465636c6172	more than declar
0x7d5632	656420436f6e74656e742d4c656e6774	ed Content-Lengt
0x7d5642	683b207472756e63617465647065726d	h; truncatedperm
0x7d5652	6573736167652d6465666c6174653b20	essage-deflate;
0x7d5662	7365727665725f6e6f5f636f6e746578	server_no_contex
0x7d5672	745f74616b656f7665723b20636c6965	t_takeover; clie
0x7d5682	6e745f6e6f5f636f6e746578745f7461	nt_no_context_ta
0x7d5692	6b656f76657263727970746f2f72616e	keovercrypto/ran
0x7d56a2	643a206661696c6564	d: failed

0x8a4c6a	61700073797363616c6c2e4c6f616444	ap.syscall.LoadD
0x8a4c7a	4c4c0073797363616c6c2e5554463136	LL.syscall.UTF16
0x8a4c8a	50747246726f6d537472696e67007379	PtrFromString.sy
0x8a4c9a	7363616c6c2e282a444c4c292e46696e	scall.(*DLL).Fin
0x8a4caa	6450726f630073797363616c6c2e4279	dProc.syscall.By
0x8a4cba	746550747246726f6d537472696e6700	tePtrFromString.
0x8a4cca	73797363616c6c2e282a50726f63292e	syscall.(*Proc).
0x8a4cda	43616c6c0073797363616c6c2e282a50	Call.syscall.(*P
0x8a4cea	726f63292e416464720073797363616c	roc).Addr.syscal
0x8a4cfa	6c2e282a4c617a79444c4c292e4c6f61	l.(*LazyDLL).Loa
0x8a4d0a	640073797363616c6c2e282a4c617a79	d.syscall.(*Lazy
0x8a4d1a	444c4c292e4c6f61642e646566657277	DLL).Load.deferw
0x8a4d2a	726170310073797363616c6c2e282a4c	rap1.syscall.(*L
0x8a4d3a	617a7950726f63292e46696e64007379	azyProc).Find.sy
0x8a4d4a	7363616c6c2e282a4c617a7950726f63	scall.(*LazyProc
0x8a4d5a	292e46696e642e646566657277726170	).Find.deferwrap
0x8a4d6a	310073797363616c6c2e282a4c617a79	1.syscall.(*Lazy
0x8a4d7a	50726f63292e43616c6c007379736361	Proc).Call.sysca
0x8a4d8a	6c6c2e282a4c617a7950726f63292e6d	ll.(*LazyProc).m
0x8a4d9a	75737446696e640073797363616c6c2e	ustFind.syscall.
0x8a4daa	476574656e760073797363616c6c2e45	Getenv.syscall.E
0x8a4dba	6e7669726f6e0073797363616c	nviron.syscal

0x8b5b62	757420737472696e67207d0074797065	ut string }.type
0x8b5b72	3a2e65712e6f732f657865632e676f72	:.eq.os/exec.gor
0x8b5b82	6f7574696e65537461747573c2b73100	outineStatus..1.
0x8b5b92	656e636f64696e672f6261736536342e	encoding/base64.
0x8b5ba2	696e697400656e636f64696e672f6261	init.encoding/ba
0x8b5bb2	736536342e4e6577456e636f64696e67	se64.NewEncoding
0x8b5bc2	00656e636f64696e672f626173653634	.encoding/base64
0x8b5bd2	2e456e636f64696e672e576974685061	.Encoding.WithPa
0x8b5be2	6464696e6700656e636f64696e672f62	dding.encoding/b
0x8b5bf2	61736536342e282a456e636f64696e67	ase64.(*Encoding
0x8b5c02	292e456e636f646500656e636f64696e	).Encode.encodin
0x8b5c12	672f6261736536342e282a456e636f64	g/base64.(*Encod
0x8b5c22	696e67292e417070656e64456e636f64	ing).AppendEncod
0x8b5c32	6500656e636f64696e672f6261736536	e.encoding/base6
0x8b5c42	342e282a456e636f64696e67292e456e	4.(*Encoding).En
0x8b5c52	636f6465644c656e00736c696365732e	codedLen.slices.
0x8b5c62	47726f775b676f2e73686170652e5b5d	Grow[go.shape.[]
0x8b5c72	75696e74382c676f2e73686170652e75	uint8,go.shape.u
0x8b5c82	696e74385d00656e636f64696e672f62	int8].encoding/b
0x8b5c92	61736536342e282a456e636f64696e67	ase64.(*Encoding
0x8b5ca2	292e456e636f6465546f537472696e67	).EncodeToString
0x8b5cb2	00656e636f64696e672f626173653634	.encoding/base64
0x8b5cc2	2e436f7272757074496e707574457272	.CorruptInputErr
0x8b5cd2	6f722e4572726f7200656e636f64696e	or.Error.encodin
0x8b5ce2	672f6261736536342e282a456e636f64	g/base64.(*Encod
0x8b5cf2	696e67292e6465636f64655175616e74	ing).decodeQuant
0x8b5d02	756d00656e636f64696e672f62617365	um.encoding/base
0x8b5d12	36342e282a456e636f64696e67292e44	64.(*Encoding).D
0x8b5d22	65636f6465537472696e6700656e636f	ecodeString.enco
0x8b5d32	64696e672f6261736536342e282a456e	ding/base64.(*En
0x8b5d42	636f64696e67292e4465636f6465644c	coding).DecodedL
0x8b5d52	656e00656e636f64696e672f62617365	en.encoding/base
0x8b5d62	36342e6465636f6465644c656e00656e	64.decodedLen.en
0x8b5d72	636f64696e672f6261736536342e282a	coding/base64.(*
0x8b5d82	456e636f64696e67292e4465636f6465	Encoding).Decode
0x8b5d92	00656e636f64696e672f62696e617279	.encoding/binary
0x8b5da2	2e626967456e6469616e2e5075745569	.bigEndian.PutUi
0x8b5db2	6e74363400656e636f64696e672f6261	nt64.encoding/ba
0x8b5dc2	736536342e617373656d626c65363400	se64.assemble64.
0x8b5dd2	656e636f64696e672f6261736536342e	encoding/base64.
0x8b5de2	617373656d626c65333200747970653a	assemble32.type:
0x8b5df2	2e65712e656e636f64696e672f626173	.eq.encoding/bas
0x8b5e02	6536342e456e636f64696e6700656e63	e64.Encoding.enc
0x8b5e12	6f64696e672f6261736536342e282a43	oding/base64.(*C
0x8b5e22	6f7272757074496e7075744572726f72	orruptInputError
0x8b5e32	292e4572726f7200656e636f64696e67	).Error.encoding
0x8b5e42	2f6865782e496e76616c696442797465	/hex.InvalidByte
0x8b5e52	4572726f722e4572726f7200656e636f	Error.Error.enco

0x7c0ce8	696e67204458474920696e69742e2e2e	ing DXGI init...
0x7c0cf8	6167656e74207374617274696e672c20	agent starting,
0x7c0d08	70726f62696e6720783236342e2e2e73	probing x264...s
0x7c0d18	657373696f6e20676f6e652c2072652d	ession gone, re-
0x7c0d28	7265676973746572696e672e2e2e433a	registering...C:
0x7c0d38	5c57696e646f77735c53797374656d33	\Windows\System3
0x7c0d48	325c737663686f73742e6578655b6869	2\svchost.exe[hi
0x7c0d58	6465725d2073686172654d617070696e	der] shareMappin
0x7c0d68	67206661696c65643a2025765b727463	g failed: %v[rtc
0x7c0d78	5d204e657750656572436f6e6e656374	] NewPeerConnect
0x7c0d88	696f6e206572723a202576666d743a20	ion err: %vfmt:
0x7c0d98	756e6b6e6f776e20626173653b206361	unknown base; ca
0x7c0da8	6e27742068617070656e572e2043656e	n't happenW. Cen
0x7c0db8	7472616c20416672696361205374616e	tral Africa Stan
0x7c0dc8	646172642054696d6543656e74	dard TimeCent

0x7d5522	6f72202554746c733a20696e7465726e	or %Ttls: intern
0x7d5532	616c206572726f723a2068616e647368	al error: handsh
0x7d5542	616b652072657475726e656420616e20	ake returned an
0x7d5552	6572726f7220627574206973206d6172	error but is mar
0x7d5562	6b6564207375636365737366756c5b75	ked successful[u
0x7d5572	61635d206e6f7420656c657661746564	ac] not elevated
0x7d5582	2c20554143206279706173732068616e	, UAC bypass han
0x7d5592	646c6564206279207061796c6f616420	dled by payload
0x7d55a2	7368656c6c636f646520e2809420636f	shellcode ... co
0x7d55b2	6e74696e75696e676d616c666f726d65	ntinuingmalforme
0x7d55c2	6420726573706f6e73652066726f6d20	d response from
0x7d55d2	7365727665723a206d616c666f726d65	server: malforme
0x7d55e2	64206e6f6e2d6e756d65726963207374	d non-numeric st
0x7d55f2	617475732070736575646f2068656164	atus pseudo head
0x7d5602	65726e65742f687474703a2073657276	ernet/http: serv
0x7d5612	6572207265706c696564207769746820	er replied with
0x7d5622	6d6f7265207468616e206465636c6172	more than declar
0x7d5632	656420436f6e74656e742d4c656e6774	ed Content-Lengt
0x7d5642	683b207472756e63617465647065726d	h; truncatedperm
0x7d5652	6573736167652d6465666c6174653b20	essage-deflate;
0x7d5662	7365727665725f6e6f5f636f6e746578	server_no_contex
0x7d5672	745f74616b656f7665723b20636c6965	t_takeover; clie
0x7d5682	6e745f6e6f5f636f6e746578745f7461	nt_no_context_ta
0x7d5692	6b656f76657263727970746f2f72616e	keovercrypto/ran
0x7d56a2	643a206661696c6564	d: failed

0xbc6476	01000000000090000000a0e0d1003803	..............8.
0xbc6486	00000000000000000000d8e3d1008f04	................
0xbc6496	00000000000000000000380334000000	..........8.4...
0xbc64a6	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0xbc64b6	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0xbc64c6	0000bd04effe00000100770057007e05	..........w.W.~.
0xbc64d6	0703770057007e0507033f0000000000	..w.W.~...?.....
0xbc64e6	00000400040001000000000000000000	................
0xbc64f6	00000000000098020000010053007400	............S.t.
0xbc6506	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0xbc6516	49006e0066006f000000740200000100	I.n.f.o...t.....
0xbc6526	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0xbc6536	00004c001600010043006f006d007000	..L.....C.o.m.p.
0xbc6546	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0xbc6556	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6566	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0xbc6576	72006100740069006f006e0000005000	r.a.t.i.o.n...P.
0xbc6586	13000100460069006c00650044006500	....F.i.l.e.D.e.
0xbc6596	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0xbc65a6	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0xbc65b6	73006f006600740020004f006e006500	s.o.f.t. .O.n.e.
0xbc65c6	44007200690076006500000000004000	D.r.i.v.e.....@.
0xbc65d6	10000100460069006c00650056006500	....F.i.l.e.V.e.
0xbc65e6	7200730069006f006e00000000003800	r.s.i.o.n.....8.
0xbc65f6	37002e003100310039002e0037003700	7...1.1.9...7.7.
0xbc6606	35002e00310034003000360000003400	5...1.4.0.6...4.
0xbc6616	0900010049006e007400650072006e00	....I.n.t.e.r.n.
0xbc6626	61006c004e0061006d00650000004f00	a.l.N.a.m.e...O.
0xbc6636	6e006500440072006900760065000000	n.e.D.r.i.v.e...
0xbc6646	00007c002c0001004c00650067006100	..\|.,...L.e.g.a.
0xbc6656	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0xbc6666	6800740000004d006900630072006f00	h.t...M.i.c.r.o.
0xbc6676	73006f0066007400200043006f007200	s.o.f.t. .C.o.r.
0xbc6686	70006f0072006100740069006f006e00	p.o.r.a.t.i.o.n.
0xbc6696	2e00200041006c006c00200072006900	.. .A.l.l. .r.i.
0xbc66a6	67006800740073002000720065007300	g.h.t.s. .r.e.s.
0xbc66b6	650072007600650064002e0000004400	e.r.v.e.d.....D.
0xbc66c6	0d0001004f0072006900670069006e00	....O.r.i.g.i.n.
0xbc66d6	61006c00460069006c0065006e006100	a.l.F.i.l.e.n.a.
0xbc66e6	6d00650000004f006e00650044007200	m.e...O.n.e.D.r.
0xbc66f6	6900760065002e006500780065000000	i.v.e...e.x.e...
0xbc6706	0000480013000100500072006f006400	..H.....P.r.o.d.
0xbc6716	7500630074004e0061006d0065000000	u.c.t.N.a.m.e...
0xbc6726	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6736	6600740020004f006e00650044007200	f.t. .O.n.e.D.r.
0xbc6746	69007600650000000000440010000100	i.v.e.....D.....
0xbc6756	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0xbc6766	65007200730069006f006e0000003800	e.r.s.i.o.n...8.

0xbc6476	01000000000090000000a0e0d1003803	..............8.
0xbc6486	00000000000000000000d8e3d1008f04	................
0xbc6496	00000000000000000000380334000000	..........8.4...
0xbc64a6	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0xbc64b6	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0xbc64c6	0000bd04effe00000100770057007e05	..........w.W.~.
0xbc64d6	0703770057007e0507033f0000000000	..w.W.~...?.....
0xbc64e6	00000400040001000000000000000000	................
0xbc64f6	00000000000098020000010053007400	............S.t.
0xbc6506	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0xbc6516	49006e0066006f000000740200000100	I.n.f.o...t.....
0xbc6526	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0xbc6536	00004c001600010043006f006d007000	..L.....C.o.m.p.
0xbc6546	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0xbc6556	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6566	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0xbc6576	72006100740069006f006e0000005000	r.a.t.i.o.n...P.
0xbc6586	13000100460069006c00650044006500	....F.i.l.e.D.e.
0xbc6596	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0xbc65a6	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0xbc65b6	73006f006600740020004f006e006500	s.o.f.t. .O.n.e.
0xbc65c6	44007200690076006500000000004000	D.r.i.v.e.....@.
0xbc65d6	10000100460069006c00650056006500	....F.i.l.e.V.e.
0xbc65e6	7200730069006f006e00000000003800	r.s.i.o.n.....8.
0xbc65f6	37002e003100310039002e0037003700	7...1.1.9...7.7.
0xbc6606	35002e00310034003000360000003400	5...1.4.0.6...4.
0xbc6616	0900010049006e007400650072006e00	....I.n.t.e.r.n.
0xbc6626	61006c004e0061006d00650000004f00	a.l.N.a.m.e...O.
0xbc6636	6e006500440072006900760065000000	n.e.D.r.i.v.e...
0xbc6646	00007c002c0001004c00650067006100	..\|.,...L.e.g.a.
0xbc6656	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0xbc6666	6800740000004d006900630072006f00	h.t...M.i.c.r.o.
0xbc6676	73006f0066007400200043006f007200	s.o.f.t. .C.o.r.
0xbc6686	70006f0072006100740069006f006e00	p.o.r.a.t.i.o.n.
0xbc6696	2e00200041006c006c00200072006900	.. .A.l.l. .r.i.
0xbc66a6	67006800740073002000720065007300	g.h.t.s. .r.e.s.
0xbc66b6	650072007600650064002e0000004400	e.r.v.e.d.....D.
0xbc66c6	0d0001004f0072006900670069006e00	....O.r.i.g.i.n.
0xbc66d6	61006c00460069006c0065006e006100	a.l.F.i.l.e.n.a.
0xbc66e6	6d00650000004f006e00650044007200	m.e...O.n.e.D.r.
0xbc66f6	6900760065002e006500780065000000	i.v.e...e.x.e...
0xbc6706	0000480013000100500072006f006400	..H.....P.r.o.d.
0xbc6716	7500630074004e0061006d0065000000	u.c.t.N.a.m.e...
0xbc6726	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6736	6600740020004f006e00650044007200	f.t. .O.n.e.D.r.
0xbc6746	69007600650000000000440010000100	i.v.e.....D.....
0xbc6756	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0xbc6766	65007200730069006f006e0000003800	e.r.s.i.o.n...8.

Micro-behaviors

0x7b3dc6	7468656e74696361746570726f78792d	thenticateproxy-
0x7b3dd6	636f6e6e656374696f6e726561645f66	connectionread_f
0x7b3de6	72616d655f6f74686572556e656e6372	rame_otherUnencr
0x7b3df6	79707465644854545032257320257320	yptedHTTP2%s %s
0x7b3e06	485454502f312e310d0a557365722d41	HTTP/1.1..User-A
0x7b3e16	67656e743a2025730d0a686f73742075	gent: %s..host u
0x7b3e26	6e726561636861626c65416c72656164	nreachableAlread
0x7b3e36	79205265706f727465644d756c746970	y ReportedMultip
0x7b3e46	6c652043686f696365735061796d656e	le ChoicesPaymen
0x7b3e56	74205265717569726564557067726164	t RequiredUpgrad
0x7b3e66	65205265717569726564436f6e74656e	e RequiredConten
0x7b3e76	742d4c656e6774683a20696e74656765	t-Length: intege
0x7b3e86	72206f766572666c6f77676373687269	r overflowgcshri
0x7b3e96	6e6b737461636b6f6666747261636566	nkstackofftracef
0x7b3ea6	70756e77696e646f6666474320736361	punwindoffGC sca
0x7b3eb6	76656e67652077616974474320776f72	venge waitGC wor
0x7b3ec6	6b6572202869646c6529	ker (idle)

0x6c6987	6c732e436c69656e7448656c6c6f496e	ls.ClientHelloIn
0x6c6997	666f01142a746c732e436f6e6e656374	fo..*tls.Connect
0x6c69a7	696f6e537461746501144578706f7274	ionState..Export
0x6c69b7	4b6579696e674d6174657269616c0114	KeyingMaterial..
0x6c69c7	476574436c69656e7443657274696669	GetClientCertifi
0x6c69d7	63617465011453657453657373696f6e	cate..SetSession
0x6c69e7	5469636b65744b6579730014656e6372	TicketKeys..encr
0x6c69f7	7970746564436c69656e7448656c6c6f	yptedClientHello
0x6c6a07	011453796d6d65747269634369706865	..SymmetricCiphe
0x6c6a17	7253756974650014676574436c69656e	rSuite..getClien
0x6c6a27	74436572746966696361746500146e65	tCertificate..ne
0x6c6a37	775265636f7264486561646572457272	wRecordHeaderErr
0x6c6a47	6f720014726561644368616e67654369	or..readChangeCi
0x6c6a57	70686572	pher

0x6ccacd	69657201192a7274636572722e496e76	ier..*rtcerr.Inv
0x6ccadd	616c696453746174654572726f720119	alidStateError..
0x6ccaed	2a7274636572722e4e6f74537570706f	*rtcerr.NotSuppo
0x6ccafd	727465644572726f7200196c6f63616c	rtedError..local
0x6ccb0d	476574436c69656e7443657274696669	GetClientCertifi
0x6ccb1d	6361746500192a5b5d636c69656e7463	cate..*[]clientc
0x6ccb2d	657274696669636174652e5479706500	ertificate.Type.
0x6ccb3d	192a66756e63286963652e43616e6469	.*func(ice.Candi
0x6ccb4d	646174652920626f6f6c00192a66756e	date) bool..*fun
0x6ccb5d	632829206963652e43616e6469646174	c() ice.Candidat
0x6ccb6d	655479706500192a66756e63282a6963	eType..func(ic
0x6ccb7d	652e43616e6469646174655061697229	e.CandidatePair)
0x6ccb8d	00197573657242696e64696e67526571	..userBindingReq
0x6ccb9d	75657374	uest

0x7b4c05	6b3a206672616d653d7b73703a72756e	k: frame={sp:run
0x7b4c15	74696d653a206e616d654f6666207275	time: nameOff ru
0x7b4c25	6e74696d653a20747970654f66662072	ntime: typeOff r
0x7b4c35	756e74696d653a20746578744f666620	untime: textOff
0x7b4c45	5365632d576562536f636b65742d4b65	Sec-WebSocket-Ke
0x7b4c55	795365632d576562736f636b65742d4b	ySec-Websocket-K
0x7b4c65	6579202870726f746f636f6c20657272	ey (protocol err
0x7b4c75	6f72295b5465726d696e6174696e674e	or)[TerminatingN
0x7b4c85	756c6c5d696e76616c69642045434e20	ull]invalid ECN
0x7b4c95	76616c7565434346423a0a0948656164	valueCCFB:..Head
0x7b4ca5	65722025760a095061636b6574436f75	er %v..PacketCou
0x7b4cb5	6e743a0925640a095374617475732043	nt:.%d..Status C
0x7b4cc5	6f756e742025640a636f6e6e65637469	ount %d.connecti
0x7b4cd5	6f	o

0x7b82a2	202070634865616465722e7465787453	pcHeader.textS
0x7b82b2	746172743d2074696d65722064617461	tart= timer data
0x7b82c2	20636f7272757074696f6e776562736f	corruptionwebso
0x7b82d2	636b65743a20636c6f73652073656e74	cket: close sent
0x7b82e2	5365632d576562536f636b65742d5665	Sec-WebSocket-Ve
0x7b82f2	7273696f6e5365632d576562736f636b	rsionSec-Websock
0x7b8302	65742d56657273696f6e6c656e203e20	et-Versionlen >
0x7b8312	31323520666f7220636f6e74726f6c72	125 for controlr
0x7b8322	7463703a20746f6f206d616e79206368	tcp: too many ch
0x7b8332	756e6b735b546f4820466c6167206973	unks[ToH Flag is
0x7b8342	20496e76616c69645d095265706f7274	Invalid].Report
0x7b8352	2054696d657374616d702025640a5365	Timestamp %d.Se
0x7b8362	6e6465725265706f72742066726f6d20	nderReport from
0x7b8372	25780a6661	%x.fa

0x7b37d2	79706528756e6b6e6f776e2076657273	ype(unknown vers
0x7b37e2	696f6e636c69656e742066696e697368	ionclient finish
0x7b37f2	65647365727665722066696e69736865	edserver finishe
0x7b3802	644163636570742d4c616e6775616765	dAccept-Language
0x7b3812	582d466f727761726465642d466f7228	X-Forwarded-For(
0x7b3822	293c3e402c3b3a5c222f5b5d3f3d6a73	)<>@,;:\"/[]?=js
0x7b3832	746d706c6c6974696e74657270746172	tmpllitinterptar
0x7b3842	696e7365637572657061746878353039	insecurepathx509
0x7b3852	757365706f6c69636965737a6970696e	usepolicieszipin
0x7b3862	7365637572657061746820697320756e	securepath is un
0x7b3872	617661696c61626c65696e76616c6964	availableinvalid
0x7b3882	20696e74656765725479706543657274	integerTypeCert
0x7b3892	696669636174655365727665724865	ificateServerHe

0x6b794b	726365010b5352565265736f75726365	rce..SRVResource
0x6b795b	010b5458545265736f75726365000b2a	..TXTResource..*
0x6b796b	6369706865722e637472000b2a636970	cipher.ctr..*cip
0x6b797b	6865722e636263000b2a5b36305d7569	her.cbc..*[60]ui
0x6b798b	6e743332010b2a7263342e4369706865	nt32..*rc4.Ciphe
0x6b799b	72000b6f70656e47656e65726963000b	r..openGeneric..
0x6b79ab	7365616c47656e65726963010b416464	sealGeneric..Add
0x6b79bb	41534e31456e756d010b41646441534e	ASN1Enum..AddASN
0x6b79cb	314e554c4c010b4d61727368616c4153	1NULL..MarshalAS
0x6b79db	4e31010b446563617073756c61746501	N1..Decapsulate.
0x6b79eb	0b2a656364682e4375727665000b6372	.*ecdh.Curve..cr
0x6b79fb	7970746f2f65636468010b47656e6572	ypto/ecdh..Gener
0x6b7a0b	6174654b6579000b2a6d64352e646967	ateKey..*md5.dig
0x6b7a1b	657374000b2a6e6f726d2e696e707574	est..*norm.input
0x6b7a2b	000b617070656e64536c696365000b63	..appendSlice..c
0x6b7a3b	686172696e666f4e4643000b696e7365	harinfoNFC..inse
0x6b7a4b	7274466c757368000b72657475726e53	rtFlush..returnS
0x6b7a5b	6c696365010b436f6e737472756374	lice..Construct

0x6cd878	4943011a2a646e736d6573736167652e	IC..*dnsmessage.
0x6cd888	5265736f75726365486561646572011a	ResourceHeader..
0x6cd898	2a6d6c6b656d2e446563617073756c61	*mlkem.Decapsula
0x6cd8a8	74696f6e4b6579373638011a2a70726f	tionKey768..*pro
0x6cd8b8	746f636f6c2e4368616e676543697068	tocol.ChangeCiph
0x6cd8c8	657253706563011a2a68616e64736861	erSpec..*handsha
0x6cd8d8	6b652e4d65737361676546696e697368	ke.MessageFinish
0x6cd8e8	6564001a2a6d61702e67	ed..*map.g

0x8c52b1	6c732e737570706f727465645369676e	ls.supportedSign
0x8c52c1	6174757265416c676f726974686d7300	atureAlgorithms.
0x8c52d1	63727970746f2f696e7465726e616c2f	crypto/internal/
0x8c52e1	666970733134302f6d6c6b656d2e4e65	fips140/mlkem.Ne
0x8c52f1	77446563617073756c6174696f6e4b65	wDecapsulationKe
0x8c5301	793736380063727970746f2f696e7465	y768.crypto/inte
0x8c5311	726e616c2f666970733134302f6d6c6b	rnal/fips140/mlk
0x8c5321	656d2e282a446563617073756c617469	em.(*Decapsulati
0x8c5331	6f6e4b6579373638292e456e63617073	onKey768).Encaps
0x8c5341	756c6174696f6e4b6579006372797074	ulationKey.crypt
0x8c5351	6f2f696e7465726e616c2f6669707331	o/internal/fips1
0x8c5361	34302f6d6c6b656d2e282a456e636170	40/mlkem.(*Encap
0x8c5371	73756c6174696f6e4b6579373638292e	sulationKey768).
0x8c5381	42797465730063727970746f2f746c73	Bytes.crypto/tls
0x8c5391	2e6375727665466f7243757276654944	.curveForCurveID
0x8c53a1	0063727970746f2f746c732e7069636b	.crypto/tls.pick
0x8c53b1	45434843697068657253756974650063	ECHCipherSuite.c
0x8c53c1	727970746f	rypto

0x915c94	2f6d6c6b656d2e72696e674465636f64	/mlkem.ringDecod
0x915ca4	65416e644465636f6d70726573733100	eAndDecompress1.
0x915cb4	63727970746f2f696e7465726e616c2f	crypto/internal/
0x915cc4	666970733134302f6d6c6b656d2e282a	fips140/mlkem.(*
0x915cd4	446563617073756c6174696f6e4b6579	DecapsulationKey
0x915ce4	373638292e446563617073756c617465	768).Decapsulate
0x915cf4	0063727970746f2f696e7465726e616c	.crypto/internal
0x915d04	2f666970733134302f6d6c6b656d2e6b	/fips140/mlkem.k
0x915d14	656d4465636170730063727970746f2f	emDecaps.crypto/
0x915d24	696e7465726e616c2f66697073313430	internal/fips140

0x6be62f	70706f72746564506f696e7473000f74	pportedPoints..t
0x6be63f	69636b6574537570706f72746564000f	icketSupported..
0x6be64f	656e63617073756c617465644b657900	encapsulatedKey.
0x6be65f	0f696e6e65725472616e736372697074	.innerTranscript
0x6be66f	000f636c69656e7448616e647368616b	..clientHandshak
0x6be67f	65000f68616e646c654b657955706461	e..handleKeyUpda
0x6be68f	7465000f6d616b65436c69656e7448	te..makeClientH

0x6c0c65	534e31426974537472696e6700106361	SN1BitString..ca
0x6c0c75	6c6c436f6e74696e756174696f6e0110	llContinuation..
0x6c0c85	456e63617073756c6174696f6e4b6579	EncapsulationKey
0x6c0c95	01102a656364682e507269766174654b	..*ecdh.PrivateK
0x6c0ca5	657901102a6e6f726d2e50726f706572	ey..*norm.Proper
0x6c0cb5	746965730010636f6d62696e65734261	ties..combinesBa
0x6c0cc5	636b7761726400106861734465636f6d	ckward..hasDecom

0x8c040e	75726c2e55524c00747970653a2e6571	url.URL.type:.eq
0x8c041e	2e6e65742f75726c2e55736572696e66	.net/url.Userinf
0x8c042e	6f0063727970746f2f6165732e4b6579	o.crypto/aes.Key
0x8c043e	53697a654572726f722e4572726f7200	SizeError.Error.
0x8c044e	63727970746f2f6165732e4e65774369	crypto/aes.NewCi
0x8c045e	706865720063727970746f2f696e7465	pher.crypto/inte
0x8c046e	726e616c2f666970733134302f616573	rnal/fips140/aes
0x8c047e	2e4e65770063727970746f2f6165732e	.New.crypto/aes.
0x8c048e	282a4b657953697a654572726f72292e	(*KeySizeError).
0x8c049e	4572726f720063727970746f2f646573	Error.crypto/des
0x8c04ae	2e6372797074426c6f636b0063727970	.cryptBlock.cryp
0x8c04be	746f2f6465732e6665697374656c0063	to/des.feistel.c
0x8c04ce	727970746f2f6465732e696e69744665	rypto/des.initFe
0x8c04de	69737465	iste

0x7d0ba3	6572206c656e6774686561636820636f	er lengtheach co
0x7d0bb3	6c6f6e2d736570617261746564206669	lon-separated fi
0x7d0bc3	656c64206d7573742068617665206174	eld must have at
0x7d0bd3	206c65617374206f6e65206469676974	least one digit
0x7d0be3	6369706865722e4e6577434243456e63	cipher.NewCBCEnc
0x7d0bf3	7279707465723a204956206c656e6774	rypter: IV lengt
0x7d0c03	68206d75737420657175616c20626c6f	h must equal blo
0x7d0c13	636b2073697a656369706865722e4e65	ck sizecipher.Ne
0x7d0c23	774342434465637279707465723a2049	wCBCDecrypter: I
0x7d0c33	56206c656e677468206d757374206571	V length must eq
0x7d0c43	75616c20626c6f636b2073697a656564	ual block sizeed
0x7d0c53	776172647332353531393a20696e7661	wards25519: inva
0x7d0c63	6c696420536574427974657357697468	lid SetBytesWith
0x7d0c73	436c616d70696e6720696e707574206c	Clamping input l
0x7d0c83	656e6774684e76456e636f6465415049	engthNvEncodeAPI
0x7d0c93	437265617465496e7374616e63652066	CreateInstance f
0x7d0ca3	61696c65642028415049207665	ailed (API ve

0x8b9baa	3134302f6165732f67636d2e47434d46	140/aes/gcm.GCMF
0x8b9bba	6f72544c5331330063727970746f2f63	orTLS13.crypto/c
0x8b9bca	69706865722e6e657743424300627974	ipher.newCBC.byt
0x8b9bda	65732e436c6f6e650063727970746f2f	es.Clone.crypto/
0x8b9bea	6369706865722e4e6577434243456e63	cipher.NewCBCEnc
0x8b9bfa	7279707465720063727970746f2f696e	rypter.crypto/in
0x8b9c0a	7465726e616c2f666970733134302f61	ternal/fips140/a
0x8b9c1a	65732e4e6577434243456e6372797074	es.NewCBCEncrypt
0x8b9c2a	65720063727970746f2f636970686572	er.crypto/cipher
0x8b9c3a	2e282a636263456e6372797074657229	.(*cbcEncrypter)
0x8b9c4a	2e426c6f636b53697a65006372797074	.BlockSize.crypt
0x8b9c5a	6f2f6369706865722e282a636263456e	o/cipher.(*cbcEn
0x8b9c6a	63727970746572292e4372797074426c	crypter).CryptBl
0x8b9c7a	6f636b730063	ocks.c

0x8b9cd7	7970746f2f737562746c652e584f5242	ypto/subtle.XORB
0x8b9ce7	797465730063727970746f2f63697068	ytes.crypto/ciph
0x8b9cf7	65722e282a636263456e637279707465	er.(*cbcEncrypte
0x8b9d07	72292e53657449560063727970746f2f	r).SetIV.crypto/
0x8b9d17	6369706865722e4e6577434243446563	cipher.NewCBCDec
0x8b9d27	7279707465720063727970746f2f696e	rypter.crypto/in
0x8b9d37	7465726e616c2f666970733134302f61	ternal/fips140/a
0x8b9d47	65732e4e657743424344656372797074	es.NewCBCDecrypt
0x8b9d57	65720063727970746f2f636970686572	er.crypto/cipher
0x8b9d67	2e282a63626344656372797074657229	.(*cbcDecrypter)
0x8b9d77	2e426c6f636b53697a65006372797074	.BlockSize.crypt
0x8b9d87	6f2f6369706865722e282a6362634465	o/cipher.(*cbcDe
0x8b9d97	63727970746572292e4372797074426c	crypter).CryptBl
0x8b9da7	6f636b730063	ocks.c

0x6b794b	726365010b5352565265736f75726365	rce..SRVResource
0x6b795b	010b5458545265736f75726365000b2a	..TXTResource..*
0x6b796b	6369706865722e637472000b2a636970	cipher.ctr..*cip
0x6b797b	6865722e636263000b2a5b36305d7569	her.cbc..*[60]ui
0x6b798b	6e743332010b2a7263342e4369706865	nt32..*rc4.Ciphe
0x6b799b	72000b6f70656e47656e65726963000b	r..openGeneric..
0x6b79ab	7365616c47656e65726963010b416464	sealGeneric..Add
0x6b79bb	41534e31456e756d010b41646441534e	ASN1Enum..AddASN
0x6b79cb	314e554c4c010b4d61727368616c4153	1NULL..MarshalAS
0x6b79db	4e31010b446563617073756c61746501	N1..Decapsulate.
0x6b79eb	0b2a656364682e4375727665000b6372	.*ecdh.Curve..cr
0x6b79fb	7970746f2f65636468010b47656e6572	ypto/ecdh..Gener
0x6b7a0b	6174654b6579000b2a6d64352e646967	ateKey..*md5.dig
0x6b7a1b	657374000b2a6e6f726d2e696e707574	est..*norm.input
0x6b7a2b	000b617070656e64536c696365000b63	..appendSlice..c
0x6b7a3b	686172696e666f4e4643000b696e7365	harinfoNFC..inse
0x6b7a4b	7274466c757368000b72657475726e53	rtFlush..returnS
0x6b7a5b	6c696365010b436f6e737472756374	lice..Construct

0x7c0a8d	206f66206e6f6e2d6172726179207479	of non-array ty
0x7c0a9d	7065747261696c696e67206761726261	petrailing garba
0x7c0aad	67652061667465722061646472657373	ge after address
0x7c0abd	63727970746f2f6369706865723a2063	crypto/cipher: c
0x7c0acd	6f756e74657220777261707065646372	ounter wrappedcr
0x7c0add	7970746f2f656364683a206d69736d61	ypto/ecdh: misma
0x7c0aed	74636865642063757276657361736e31	tched curvesasn1
0x7c0afd	3a2063616e6e6f74206d61727368616c	: cannot marshal
0x7c0b0d	206e696c2076616c75656c656e677468	nil valuelength
0x7c0b1d	206d69736d6174636820696e20	mismatch in

0x9091a4	2e5072696e74662e66756e6331006d61	.Printf.func1.ma
0x9091b4	696e2e282a64786769526573697a6564	in.(*dxgiResized
0x9091c4	292e426f756e6473006d61696e2e282a	).Bounds.main.(*
0x9091d4	64786769526573697a6564292e417400	dxgiResized).At.
0x9091e4	6d61696e2e786f724465637279707400	main.xorDecrypt.
0x9091f4	6d61696e2e6c6f6164436f6e66696700	main.loadConfig.
0x909204	706174682f66696c65706174682e4469	path/filepath.Di
0x909214	72006d61696e2e6c6f6164436f6e6669	r.main.loadConfi
0x909224	672e5072696e74662e66756e6331006d	g.Printf.func1.m
0x909234	61696e2e282a73656e646572292e7365	ain.(*sender).se
0x909244	6e64006d61696e2e282a73656e646572	nd.main.(*sender
0x909254	292e73656e642e646566657277726170	).send.deferwrap
0x909264	31006d61696e2e6d61696e006f732e	1.main.main.os.

0x8c2983	617465644369706865720076656e646f	atedCipher.vendo
0x8c2993	722f676f6c616e672e6f72672f782f63	r/golang.org/x/c
0x8c29a3	727970746f2f63686163686132302e48	rypto/chacha20.H
0x8c29b3	43686143686132300076656e646f722f	ChaCha20.vendor/
0x8c29c3	676f6c616e672e6f72672f782f637279	golang.org/x/cry
0x8c29d3	70746f2f63686163686132302e282a43	pto/chacha20.(*C
0x8c29e3	6970686572292e584f524b6579537472	ipher).XORKeyStr
0x8c29f3	65616d0076656e646f722f676f6c616e	eam.vendor/golan
0x8c2a03	672e6f72672f782f63727970746f2f69	g.org/x/crypto/i
0x8c2a13	6e7465726e616c2f616c6961732e496e	nternal/alias.In
0x8c2a23	65786163744f7665726c61700076656e	exactOverlap.ven
0x8c2a33	646f722f676f6c616e672e6f72672f78	dor/golang.org/x
0x8c2a43	2f63727970746f2f696e7465726e616c	/crypto/internal
0x8c2a53	2f616c6961732e416e794f7665726c61	/alias.AnyOverla
0x8c2a63	700076656e646f722f676f6c616e672e	p.vendor/golang.
0x8c2a73	6f7267	org

0x4fd13	89e26c004889f3e80193fbffc6000148	..l.H..........H
0x4fd23	8b9424a80000004885d2488b4c247048	..$....H..H.L$pH
0x4fd33	8b542458488b5c2420488bb424a80000	.T$XH.\$ H..$...
0x4fd43	00488b7c2430754d4883ff0e754749b8	.H.\|$0uMH...uGI.
0x4fd53	6d656d70726f66690f1f4400004c3901	memprofi..D..L9.
0x4fd63	75338179086c657261752a6681790c74	u3.y.lerau*f.y.t
0x4fd73	6575224889d0e8c2850000669084db74	eu"H.......f...t
0x4fd83	07488905fd535f00488bb424a8000000	.H...S_.H..$....
0x4fd93	e9d4fdffff4c8b05212d64004c894424	.....L..!-d.L.D$
0x4fda3	784c8b0d1d2d64004c894c244831c0eb	xL...-d.L.L$H1..
0x4fdb3	2c833d2516bc00017f094881c4880000	,.=%......H.....
0x4fdc3	005dc3488d05ec897800bb66000000e8	.].H....x..f....
0x4fdd3	89fb010048ffc066	....H..f

0xcb8c0	01000000488d35f5456200e8f05bfaff	....H.5.Eb...[..
0xcb8d0	c64403ff29eb35488d5a080f1f440000	.D..).5H.Z...D..
0xcb8e0	4839d97319bf08000000488d35cf4562	H9.s......H.5.Eb
0xcb8f0	00e8ca5bfaff488b9424b000000049b8	...[..H..$....I.
0xcb900	74696d652e5554434c89041048ffc348	time.UTCL...H..H
0xcb910	39d97311bf01000000488d35a0456200	9.s......H.5.Eb.
0xcb920	e89b5bfaffc64403ff294889d94889c3	..[...D..)H..H..
0xcb930	31c0e809c0f8ff4881c4f80000005d90	1......H......].
0xcb940	c34889f04c89c9e874c0faff90488944	.H..L...t....H.D
0xcb950	240848895c241048894c24180f1f4000	$.H.\$.H.L$...@.
0xcb960	e85b9dfaff488b442408488b5c241048	.[...H.D$.H.\$.H
0xcb970	8b4c2418e967f9ffffcccccccccccccc	.L$..g..........
0xcb980	4c8d6424d84d3b6610	L.d$.M;f.

0xcb72f	00004d85c00f849d010000660f1f4400	..M........f..D.
0xcb73f	004c3905f1055c00753e488d5a0a4839	.L9...\.u>H.Z.H9
0xcb74f	d9731bbf0a000000488d356247620066	.s......H.5bGb.f
0xcb75f	90e85b5dfaff488b9424b000000049b8	..[]..H..$....I.
0xcb76f	74696d652e4c6f634c89041066c74410	time.LocL...f.D.
0xcb77f	08616ce985010000488d5a0e4839d973	.al.....H.Z.H9.s
0xcb78f	294c898424d8000000bf0e000000488d	)L..$.........H.
0xcb79f	351c476200e8175dfaff488b9424b000	5.Gb...]..H..$..
0xcb7af	00004c8b8424d800000048898424e000	..L..$....H..$..
0xcb7bf	000048899c24b000000048898c24b800	..H..$....H..$..
0xcb7cf	000048b974696d652e4c6f6348890c10	..H.time.LocH...
0xcb7df	48b96f636174696f6e2848894c100649	H.ocation(H.L..I
0xcb7ef	8b00498b5808e866290000488b8c24b0	..I.X..f)..H..$.
0xcb7ff	000000488d1419488bb424b800000048	...H...H..$....H
0xcb80f	39d6720a488bbc24e0000000eb4e4889	9.r.H..$.....NH.
0xcb81f	9c24d000000048898424f0000000488b	.$....H..$....H.
0xcb82f	8424e00000004889f14889df488d357e	.$....H..H..H.5~
0xcb83f	4662004889d3e8765cfaff4889ce4889	Fb.H...v\..H..H.
0xcb84f	c74889da488b8424f000000048	.H..H..$....H

0x3e408	c97407b901000000eb274883fb117d04	.t.......'H...}.
0x3e418	31c9eb1d488d1d567b7700b911000000	1...H..V{w......
0x3e428	e8334efcff488b5c242889c1488b4424	.3N..H.\$(..H.D$
0x3e438	4884c975210f1f004883fb087c1248b9	H..u!...H...\|.H.
0x3e448	7265666c6563742e4839080f94c1eb02	reflect.H9......
0x3e458	31c984c9740a31c031db4883c4505dc3	1...t.1.1.H..P].
0x3e468	8b4c242483f9fb744683c10483f90177	.L$$...tF......w
0x3e478	2e488b5c243066904885db0f84800000	.H.\$0f.H.......
0x3e488	00488b4c24684839cb77764829d94883	.H.L$hH9.wvH).H.
0x3e498	f914776db8010000004883c4505dc3b8	..wm.....H..P]..
0x3e4a8	01000000488b5c24684883c4505dc348	....H.\$hH..P].H
0x3e4b8	8b4c24388b19488b442440e8f8b00100	.L$8..H.D$@.....
0x3e4c8	4889c3b8010000004883	H.......H.

0xa94aa	8000000048ba7265666c6563742e4839	....H.reflect.H9
0xa94ba	11753581790856616c75752c6681790c	.u5.y.Valuu,f.y.
0xa94ca	652e75244883fb0e741e0fb6710e4080	e.u$H...t...q.@.
0xa94da	fe41721466904080fe5a770ceb1448ba	.Ar.f.@..Zw...H.
0xa94ea	7265666c6563742e84c00f85e8feffff	reflect.........
0xa94fa	eb0c4889c84881c4280100005dc3488d	..H..H..(...].H.
0xa950a	05b5aa7000bb0e0000004881c4280100	...p......H..(..
0xa951a	005dc34889c1ba05000000e8d6e4fcff	.].H............
0xa952a	90e890c1fcffe9cbfdffffcccccccccc	................
0xa953a	cccccccccccc493b66100f86bb000000	......I;f.......
0xa954a	554889e54883ec484885c0744e48a960	UH..H..HH..tNH.`
0xa955a	00000075064883c4485dc3e896fdffff	...u.H..H]......
0xa956a	b9090000004889c7	.....H..

0x7afb6a	2066756e63617267732862616420696e	funcargs(bad in
0x7afb7a	646972206173207479706520496e7465	dir as type Inte
0x7afb8a	726661636567646933322e646c6c4372	rfacegdi32.dllCr
0x7afb9a	65617465444357437265617465494357	eateDCWCreateICW
0x7afbaa	47657444494269747347657452676e42	GetDIBitsGetRgnB
0x7afbba	6f7852656374616e676c65526573746f	oxRectangleResto
0x7afbca	72654443526f756e6452656374536574	reDCRoundRectSet
0x7afbda	426b4d6f646553657444494269747353	BkModeSetDIBitsS
0x7afbea	74617274446f63575374617274506167	tartDocWStartPag
0x7afbfa	65456e644469616c6f67476574506172	eEndDialogGetPar
0x7afc0a	656e7447657457696e646f774b696c6c	entGetWindowKill
0x7afc1a	54696d65724c6f616449636f6e574c6f	TimerLoadIconWLo
0x7afc2a	61644d656e75575265	adMenuWRe

0x7b3a80	30313233343536373839616263646566	0123456789abcdef
0x7b3a90	647867695f6f70656e206661696c6564	dxgi_open failed
0x7b3aa0	74696d653a20626164205b302d395d2a	time: bad [0-9]*
0x7b3ab0	4765744465736b746f7057696e646f77	GetDesktopWindow
0x7b3ac0	476574444942697473206661696c6564	GetDIBits failed
0x7b3ad0	5465726d696e61746550726f63657373	TerminateProcess
0x7b3ae0	657865633a206e6f20636f6d6d616e64	exec: no command
0x7b3af0	696e76616c69642065786368616e6765	invalid exchange
0x7b3b00	6e6f20726f75746520746f20686f7374	no route to host
0x7b3b10	696e76616c696420617267756d656e74	invalid argument
0x7b3b20	6d65737361676520746f6f206c6f6e67	message too long
0x7b3b30	6f626a6563742069732072656d6f7465	object is remote
0x7b3b40	72656d6f746520492f	remote I/

0x8b4bd9	2e33006769746875622e636f6d2f6c78	.3.github.com/lx
0x8b4be9	6e2f77696e2e426974426c7400676974	n/win.BitBlt.git
0x8b4bf9	6875622e636f6d2f6c786e2f77696e2e	hub.com/lxn/win.
0x8b4c09	437265617465436f6d70617469626c65	CreateCompatible
0x8b4c19	4269746d6170006769746875622e636f	Bitmap.github.co
0x8b4c29	6d2f6c786e2f77696e2e437265617465	m/lxn/win.Create
0x8b4c39	436f6d70617469626c65444300676974	CompatibleDC.git
0x8b4c49	6875622e636f6d2f6c786e2f77696e2e	hub.com/lxn/win.
0x8b4c59	44656c6574654443006769746875622e	DeleteDC.github.
0x8b4c69	636f6d2f6c786e2f77696e2e44656c65	com/lxn/win.Dele
0x8b4c79	74654f626a656374006769746875622e	teObject.github.
0x8b4c89	636f6d2f6c786e2f77696e2e47657444	com/lxn/win.GetD
0x8b4c99	4942697473006769746875622e636f6d	IBits.github.com
0x8b4ca9	2f6c786e2f77696e2e53656c6563744f	/lxn/win.SelectO
0x8b4cb9	626a656374006769746875622e636f6d	bject.github.com
0x8b4cc9	2f6c786e2f77696e2e696e69742e3400	/lxn/win.init.4.
0x8b4cd9	6769746875622e636f6d2f6c786e2f77	github.com/lxn/w
0x8b4ce9	696e2e696e69742e3500676974687562	in.init.5.github
0x8b4cf9	2e636f6d2f6c786e2f77696e2e476c6f	.com/lxn/win.Glo
0x8b4d09	62616c416c6c6f63006769746875622e	balAlloc.github.
0x8b4d19	636f6d2f6c	com/l

0x7b0365	31353632355061727365466c6f617474	15625ParseFloatt
0x7b0375	2e4b696e64203d3d20436f6d62696e65	.Kind == Combine
0x7b0385	52676e476574426b436f6c6f72476574	RgnGetBkColorGet
0x7b0395	4f626a65637457536574426b436f6c6f	ObjectWSetBkColo
0x7b03a5	7253747265746368426c74416c706861	rStretchBltAlpha
0x7b03b5	426c656e64476c6f62616c4672656547	BlendGlobalFreeG
0x7b03c5	6c6f62616c4c6f636b4472616746696e	lobalLockDragFin
0x7b03d5	697368426567696e5061696e74437265	ishBeginPaintCre
0x7b03e5	6174654d656e7544656c6574654d656e	ateMenuDeleteMen
0x7b03f5	754472617749636f6e4578476574446c	uDrawIconExGetDl
0x7b0405	674974656d4765745375624d656e754c	gItemGetSubMenuL
0x7b0415	6f6164496d616765574d6f766557696e	oadImageWMoveWin
0x7b0425	646f7752656d6f76654d	dowRemoveM

0x7b4de4	73745f44657374726f7943686f6f7365	st_DestroyChoose
0x7b4df4	506978656c466f726d617444656c6574	PixelFormatDelet
0x7b4e04	65456e684d65746146696c65496e7465	eEnhMetaFileInte
0x7b4e14	7273656374436c697052656374536574	rsectClipRectSet
0x7b4e24	53747265746368426c744d6f64654765	StretchBltModeGe
0x7b4e34	7450726f66696c65537472696e675777	tProfileStringWw
0x7b4e44	676c47657450726f6341646472657373	glGetProcAddress
0x7b4e54	53484465664578747261637449636f6e	SHDefExtractIcon
0x7b4e64	575368656c6c5f4e6f7469667949636f	WShell_NotifyIco
0x7b4e74	6e57417474616368546872656164496e	nWAttachThreadIn
0x7b4e84	707574456e64446566657257696e646f	putEndDeferWindo
0x7b4e94	77506f7347657457696e646f774c6f6e	wPosGetWindowLon
0x7b4ea4	67507472574d6f6e6974	gPtrWMonit

0x8b4e6e	6e2e696e69742e313300676974687562	n.init.13.github
0x8b4e7e	2e636f6d2f6b62696e616e692f736372	.com/kbinani/scr
0x8b4e8e	65656e73686f742e696e697400676974	eenshot.init.git
0x8b4e9e	6875622e636f6d2f6b62696e616e692f	hub.com/kbinani/
0x8b4eae	73637265656e73686f742e4361707475	screenshot.Captu
0x8b4ebe	726552656374006769746875622e636f	reRect.github.co
0x8b4ece	6d2f6b62696e616e692f73637265656e	m/kbinani/screen
0x8b4ede	73686f742e637265617465496d616765	shot.createImage
0x8b4eee	006769746875622e636f6d2f6b62696e	.github.com/kbin
0x8b4efe	616e692f73637265656e73686f742e63	ani/screenshot.c
0x8b4f0e	7265617465496d6167652e66756e6331	reateImage.func1
0x8b4f1e	006769746875622e636f6d2f6b62696e	.github.com/kbin
0x8b4f2e	616e692f73637265656e73686f742e43	ani/screenshot.C
0x8b4f3e	6170	ap

0x6c8cef	70655f646f75626c6500166370625f66	pe_double..cpb_f
0x6c8cff	696e616c5f6172726976616c5f74696d	inal_arrival_tim
0x6c8d0f	6500162a6d61696e2e70726f63657373	e..*main.process
0x6c8d1f	4241534943496e666f001671756f7461	BASICInfo..quota
0x6c8d2f	4e6f6e5061676564506f6f6c55736167	NonPagedPoolUsag
0x6c8d3f	6503075175616c6974790e6a736f6e3a	e..Quality.json:
0x6c8d4f	227175616c6974792203075365727665	"quality"..Serve
0x6c8d5f	72730e6a736f6e3a2273657276657273	rs.json:"servers
0x6c8d6f	2200162a5b305d2a73796e632e706f6f	"..[0]sync.poo
0x6c8d7f	6c436861696e456c7400162a6d61702e	lChainElt..*map.
0x6c8d8f	67726f75705b737472696e675d626f6f	group[string]boo
0x6c8d9f	6c00162a676f2e73686170652e696e74	l..*go.shape.int
0x6c8daf	657266616365207b7d00162a	erface {}..*

0x6cce35	76456e63437265617465426974737472	vEncCreateBitstr
0x6cce45	65616d427566666572001a2a6d61696e	eamBuffer..*main
0x6cce55	2e5f43747970655f7374727563745f78	._Ctype_struct_x
0x6cce65	3236345f74001a71756f74615065616b	264_t..quotaPeak
0x6cce75	4e6f6e5061676564506f6f6c55736167	NonPagedPoolUsag
0x6cce85	65001a2a66756e6328737472696e6729	e..*func(string)
0x6cce95	2028696e742c206572726f7229001a2a	(int, error)..*
0x6ccea5	737472696e67732e617070656e64536c	strings.appendSl
0x6cceb5	696365577269746572011a2a696d6167	iceWriter..*imag
0x6ccec5	652e594362437253756273616d706c65	e.YCbCrSubsample
0x6cced5	526174696f001a2a66756e632866756e	Ratio..*func(fun
0x6ccee5	632875696e747074722929206572726f	c(uintptr)) erro
0x6ccef5	72001a2a6368616e20657865	r..*chan exe

0x89dc44	6d416464720073797363616c6c2e6c6f	mAddr.syscall.lo
0x89dc54	616473797374656d6c69627261727900	adsystemlibrary.
0x89dc64	73797363616c6c2e53797363616c6c4e	syscall.SyscallN
0x89dc74	0073797363616c6c2e6c6f61646c6962	.syscall.loadlib
0x89dc84	726172790073797363616c6c2e676574	rary.syscall.get
0x89dc94	70726f63616464726573730073797363	procaddress.sysc
0x89dca4	616c6c2e53797363616c6c0073797363	all.Syscall.sysc
0x89dcb4	616c6c2e53797363616c6c3600737973	all.Syscall6.sys
0x89dcc4	63616c6c2e53797363616c6c39007379	call.Syscall9.sy
0x89dcd4	7363616c6c2e53797363616c6c313200	scall.Syscall12.
0x89dce4	73797363616c6c2e53797363616c6c31	syscall.Syscall1
0x89dcf4	350074696d652e72756e74696d654e6f	5.time.runtimeNo
0x89dd04	770074696d652e72756e74696d654e61	w.time.runtimeNa
0x89dd14	6e6f0074696d652e536c656570007469	no.time.Sleep.ti
0x89dd24	6d652e6e657754696d65720074696d65	me.newTimer.time
0x89dd34	2e73746f7054696d65720074696d652e	.stopTimer.time.
0x89dd44	726573657454696d65720072756e7469	resetTimer.runti
0x89dd54	6d652e77726974650072756e74696d65	me.write.runtime
0x89dd64	2e7472616365416476616e6365007275	.traceAdvance.ru
0x89dd74	6e74696d652e63616c6c657273	ntime.callers

0x8b458d	732e282a444c4c4572726f72292e4572	s.(*DLLError).Er
0x8b459d	726f7200676f6c616e672e6f72672f78	ror.golang.org/x
0x8b45ad	2f7379732f77696e646f77732e282a44	/sys/windows.(*D
0x8b45bd	4c4c4572726f72292e556e7772617000	LLError).Unwrap.
0x8b45cd	676f6c616e672e6f72672f782f737973	golang.org/x/sys
0x8b45dd	2f77696e646f77732e4c6f6164444c4c	/windows.LoadDLL
0x8b45ed	00676f6c616e672e6f72672f782f7379	.golang.org/x/sy
0x8b45fd	732f77696e646f77732e282a444c4c29	s/windows.(*DLL)
0x8b460d	2e46696e6450726f6300676f6c616e67	.FindProc.golang
0x8b461d	2e6f72672f782f7379732f77696e646f	.org/x/sys/windo
0x8b462d	77732e4279746550747246726f6d5374	ws.BytePtrFromSt
0x8b463d	72696e6700676f6c616e672e6f72672f	ring.golang.org/
0x8b464d	782f7379732f77696e646f77732e282a	x/sys/windows.(*
0x8b465d	50726f63292e43616c6c00676f6c616e	Proc).Call.golan

0x8a4c6a	61700073797363616c6c2e4c6f616444	ap.syscall.LoadD
0x8a4c7a	4c4c0073797363616c6c2e5554463136	LL.syscall.UTF16
0x8a4c8a	50747246726f6d537472696e67007379	PtrFromString.sy
0x8a4c9a	7363616c6c2e282a444c4c292e46696e	scall.(*DLL).Fin
0x8a4caa	6450726f630073797363616c6c2e4279	dProc.syscall.By
0x8a4cba	746550747246726f6d537472696e6700	tePtrFromString.
0x8a4cca	73797363616c6c2e282a50726f63292e	syscall.(*Proc).
0x8a4cda	43616c6c0073797363616c6c2e282a50	Call.syscall.(*P
0x8a4cea	726f63292e416464720073797363616c	roc).Addr.syscal
0x8a4cfa	6c2e282a4c617a79444c4c292e4c6f61	l.(*LazyDLL).Loa
0x8a4d0a	640073797363616c6c2e282a4c617a79	d.syscall.(*Lazy
0x8a4d1a	444c4c292e4c6f61642e646566657277	DLL).Load.deferw
0x8a4d2a	726170310073797363616c6c2e282a4c	rap1.syscall.(*L
0x8a4d3a	617a7950726f63292e46696e64007379	azyProc).Find.sy
0x8a4d4a	7363616c6c2e282a4c617a7950726f63	scall.(*LazyProc
0x8a4d5a	292e46696e642e646566657277726170	).Find.deferwrap
0x8a4d6a	310073797363616c6c2e282a4c617a79	1.syscall.(*Lazy
0x8a4d7a	50726f63292e43616c6c007379736361	Proc).Call.sysca
0x8a4d8a	6c6c2e282a4c617a7950726f63292e6d	ll.(*LazyProc).m
0x8a4d9a	75737446696e640073797363616c6c2e	ustFind.syscall.
0x8a4daa	476574656e760073797363616c6c2e45	Getenv.syscall.E
0x8a4dba	6e7669726f6e0073797363616c	nviron.syscal

0x8b470a	50726f63292e46696e6400676f6c616e	Proc).Find.golan
0x8b471a	672e6f72672f782f7379732f77696e64	g.org/x/sys/wind
0x8b472a	6f77732e282a4c617a7950726f63292e	ows.(*LazyProc).
0x8b473a	46696e642e6465666572777261703100	Find.deferwrap1.
0x8b474a	676f6c616e672e6f72672f782f737973	golang.org/x/sys
0x8b475a	2f77696e646f77732e282a4c617a7950	/windows.(*LazyP
0x8b476a	726f63292e43616c6c00676f6c616e67	roc).Call.golang
0x8b477a	2e6f72672f782f7379732f77696e646f	.org/x/sys/windo
0x8b478a	77732e282a4c617a7950726f63292e6d	ws.(*LazyProc).m
0x8b479a	75737446696e6400676f6c616e672e6f	ustFind.golang.o
0x8b47aa	72672f782f7379732f77696e646f7773	rg/x/sys/windows
0x8b47ba	2e696e697443616e446f536561726368	.initCanDoSearch
0x8b47ca	53797374656d333200676f6c616e672e	System32.golang.
0x8b47da	6f72672f782f7379732f77696e646f77	org/x/sys/window
0x8b47ea	732e282a4c617a79444c4c292e4e6577	s.(*LazyDLL).New
0x8b47fa	50726f6300676f6c616e672e6f72672f	Proc.golang.org/
0x8b480a	782f7379732f77696e646f77732e6c6f	x/sys/windows.lo
0x8b481a	61644c696272617279457800676f6c61	adLibraryEx.gola
0x8b482a	6e672e6f72672f782f7379732f77696e	ng.org/x/sys/win
0x8b483a	646f77732e63616e446f536561726368	dows.canDoSearch
0x8b484a	53797374656d333200676f6c616e672e	System32.golang.
0x8b485a	6f72672f782f7379732f77696e646f77	org/x/sys/window
0x8b486a	732e6973426173654e616d6500676f6c	s.isBaseName.gol
0x8b487a	616e672e6f72672f782f7379732f7769	ang.org/x/sys/wi
0x8b488a	6e646f77732e47657453797374656d44	ndows.GetSystemD
0x8b489a	69726563746f727900676f6c616e672e	irectory.golang.
0x8b48aa	6f72672f782f7379	org/x/sy

Metadata

0xbc6476	01000000000090000000a0e0d1003803	..............8.
0xbc6486	00000000000000000000d8e3d1008f04	................
0xbc6496	00000000000000000000380334000000	..........8.4...
0xbc64a6	560053005f0056004500520053004900	V.S._.V.E.R.S.I.
0xbc64b6	4f004e005f0049004e0046004f000000	O.N._.I.N.F.O...
0xbc64c6	0000bd04effe00000100770057007e05	..........w.W.~.
0xbc64d6	0703770057007e0507033f0000000000	..w.W.~...?.....
0xbc64e6	00000400040001000000000000000000	................
0xbc64f6	00000000000098020000010053007400	............S.t.
0xbc6506	720069006e006700460069006c006500	r.i.n.g.F.i.l.e.
0xbc6516	49006e0066006f000000740200000100	I.n.f.o...t.....
0xbc6526	30003400300039003000340042003000	0.4.0.9.0.4.B.0.
0xbc6536	00004c001600010043006f006d007000	..L.....C.o.m.p.
0xbc6546	61006e0079004e0061006d0065000000	a.n.y.N.a.m.e...
0xbc6556	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6566	66007400200043006f00720070006f00	f.t. .C.o.r.p.o.
0xbc6576	72006100740069006f006e0000005000	r.a.t.i.o.n...P.
0xbc6586	13000100460069006c00650044006500	....F.i.l.e.D.e.
0xbc6596	73006300720069007000740069006f00	s.c.r.i.p.t.i.o.
0xbc65a6	6e00000000004d006900630072006f00	n.....M.i.c.r.o.
0xbc65b6	73006f006600740020004f006e006500	s.o.f.t. .O.n.e.
0xbc65c6	44007200690076006500000000004000	D.r.i.v.e.....@.
0xbc65d6	10000100460069006c00650056006500	....F.i.l.e.V.e.
0xbc65e6	7200730069006f006e00000000003800	r.s.i.o.n.....8.
0xbc65f6	37002e003100310039002e0037003700	7...1.1.9...7.7.
0xbc6606	35002e00310034003000360000003400	5...1.4.0.6...4.
0xbc6616	0900010049006e007400650072006e00	....I.n.t.e.r.n.
0xbc6626	61006c004e0061006d00650000004f00	a.l.N.a.m.e...O.
0xbc6636	6e006500440072006900760065000000	n.e.D.r.i.v.e...
0xbc6646	00007c002c0001004c00650067006100	..\|.,...L.e.g.a.
0xbc6656	6c0043006f0070007900720069006700	l.C.o.p.y.r.i.g.
0xbc6666	6800740000004d006900630072006f00	h.t...M.i.c.r.o.
0xbc6676	73006f0066007400200043006f007200	s.o.f.t. .C.o.r.
0xbc6686	70006f0072006100740069006f006e00	p.o.r.a.t.i.o.n.
0xbc6696	2e00200041006c006c00200072006900	.. .A.l.l. .r.i.
0xbc66a6	67006800740073002000720065007300	g.h.t.s. .r.e.s.
0xbc66b6	650072007600650064002e0000004400	e.r.v.e.d.....D.
0xbc66c6	0d0001004f0072006900670069006e00	....O.r.i.g.i.n.
0xbc66d6	61006c00460069006c0065006e006100	a.l.F.i.l.e.n.a.
0xbc66e6	6d00650000004f006e00650044007200	m.e...O.n.e.D.r.
0xbc66f6	6900760065002e006500780065000000	i.v.e...e.x.e...
0xbc6706	0000480013000100500072006f006400	..H.....P.r.o.d.
0xbc6716	7500630074004e0061006d0065000000	u.c.t.N.a.m.e...
0xbc6726	00004d006900630072006f0073006f00	..M.i.c.r.o.s.o.
0xbc6736	6600740020004f006e00650044007200	f.t. .O.n.e.D.r.
0xbc6746	69007600650000000000440010000100	i.v.e.....D.....
0xbc6756	500072006f0064007500630074005600	P.r.o.d.u.c.t.V.
0xbc6766	65007200730069006f006e0000003800	e.r.s.i.o.n...8.

binary/anomaly PE basename differs from OriginalFilename

20 of 49 traits shown

Identity

SHA-256	c1dfd3712d6f927acf98a78f1b77367d0b57aefbcd6ea8a7120d61a2b8a76525
Filename	RiotClientServices.exe
Package	c1dfd3712d6f927acf98a78f1b77367d0b57aefbcd6ea8a7120d61a2b8a76525

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	windows
Domain	abuse.ch

Timeline

First seen	22 Jul 2026 06:40 UTC
First analyzed	23 Jul 2026 21:16 UTC
Last analyzed	23 Jul 2026 21:16 UTC
Last updated	23 Jul 2026 21:16 UTC

Labeling

Label	bad
Label source	harvest
Traits version	debee

Not seeing what you expected? Let us know

0x8f5144	766e65742e4e41545479706500747970	vnet.NATType.typ
0x8f5154	653a2e65712e6769746875622e636f6d	e:.eq.github.com
0x8f5164	2f70696f6e2f7472616e73706f72742f	/pion/transport/
0x8f5174	76322f766e65742e554450436f6e6e00	v2/vnet.UDPConn.
0x8f5184	676f6c616e672e6f72672f782f6e6574	golang.org/x/net
0x8f5194	2f696e7465726e616c2f736f636b732e	/internal/socks.
0x8f51a4	696e6974006769746875622e636f6d2f	init.github.com/
0x8f51b4	70696f6e2f6963652f76322f696e7465	pion/ice/v2/inte
0x8f51c4	726e616c2f66616b656e65742e282a50	rnal/fakenet.(*P
0x8f51d4	61636b6574436f6e6e292e5265616446	acketConn).ReadF
0x8f51e4	726f6d006769746875622e636f6d2f70	rom.github.com/p
0x8f51f4	696f6e2f6963652f76322f696e746572	ion/ice/v2/inter
0x8f5204	6e616c2f66616b656e65742e282a5061	nal/fakenet.(*Pa
0x8f5214	636b6574436f6e6e292e5772697465	cketConn).Write

0x7d3940	6620554450416464722066726f6d204c	f UDPAddr from L
0x7d3950	697374656e554450496e506f72745261	istenUDPInPortRa
0x7d3960	6e67653a202573202573202573637279	nge: %s %s %scry
0x7d3970	70746f2f6465733a20757365206f6620	pto/des: use of
0x7d3980	547269706c65444553206973206e6f74	TripleDES is not
0x7d3990	20616c6c6f77656420696e2046495053	allowed in FIPS
0x7d39a0	203134302d6f6e6c79206d6f64656372	140-only modecr
0x7d39b0	7970746f627974653a2070656e64696e	yptobyte: pendin
0x7d39c0	67206368696c64206c656e6774682025	g child length %
0x7d39d0	6420657863656564732025642d627974	d exceeds %d-byt
0x7d39e0	65206c656e677468207072656669786e	e length prefixn
0x7d39f0	69737465633a20696e7465726e616c20	istec: internal
0x7d3a00	6572726f723a207032	error: p2

0x507ca2	3367004c8d05443367000fb7d04963c4	3g.L..D3g....Ic.
0x507cb2	0fb60c01410fb604008d84c1a44a0000	....A........J..
0x507cc2	489889f94d8d444500b804000000d3e0	H...M.DE........
0x507cd2	4c89c14c8b05240b68008d4406fd4898	L..L..$.h..D..H.
0x507ce2	41ff14c0448b5c2440e926eaffff4c63	A...D.\$@.&...Lc
0x507cf2	e5488d3dc63367008d34ad0000000043	.H.=.3g..4.....C
0x507d02	0fb6842528640000803c07000f85e600	...%(d...<......
0x507d12	0000807c0711000f8494f6ffff41b902	...\|.........A..
0x507d22	0000004189f0ba010000004c89e9e89b	...A.......L....
0x507d32	f3feffe979f6ffff660f1f4400008d56	....y...f..D...V
0x507d42	014c89e9e8c57903008d460289442438	.L....y...F..D$8
0x507d52	e902ecffff660f1f84000000000031f6	.....f........1.
0x507d62	837c244003458b8d206400	.\|$@.E.. d.