Benign windows Download

leaf-markdown-viewer

Dense x64 TLS-array pointer accessWindows I/O completion-port producer/consumer work queue

SHA-25635f55cd38aa61f4fc9f11d91372936adfced72b261af403c6b5f15cb05bbc154

URLhttps://github.com/RivoLink/leaf/releases/download/1.28.2/leaf-windows-x86_64.exe#/leaf.exe

MaleculeK(Li)O₃(AsCoDy)H₆(Cm₆DbF₅Os₅Po₅Ti)Md(Bi₂)

Evidence

English function-word token "this" 0x0–0xb0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000f8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯6 more rows

Dense x64 TLS-array pointer access 0x127b96–0x127c56

⋯3 more rows
0x127bc6cccccccccccccccccccc8b05f26fb000.............o..
0x127bd665488b0c2558000000488b04c1488d80eH..%X...H...H..
0x127be608000000c3cccccccccc554157415641..........UAWAVA
⋯7 more rows

English function-word token "for" 0x36b36c–0x36b44c

0x36b36c4c8b66e8488b6ef0488b5ef8488d2648L.f.H.n.H.^.H.&H
0x36b37c8b7c2408488b742410c34d6f6e74676f.|$.H.t$..Montgo
0x36b38c6d657279204d756c7469706c69636174mery Multiplicat
0x36b39c696f6e20666f72207838365f36342c20ion for x86_64, 
0x36b3ac43525950544f47414d53206279203c61CRYPTOGAMS by <a
0x36b3bc7070726f406f70656e73736c2e6f7267[email protected]
0x36b3cc3e009090565753554154415541564157>...VWSUATAUAVAW
0x36b3dc9c4883ec40498b4078498b98f8000000.H..@I.@xI......
⋯7 more rows

Tokio runtime worker thread 0x3b8db9–0x3b8e79

⋯3 more rows
0x3b8de965724889480748b9746f6b696f2d7274erH.H.H.tokio-rt
0x3b8df948890848c7060f0000004889460848c7H..H......H.F.H.
0x3b8e0946100f0000004889f04883c4205ec3b9F.....H..H.. ^..
⋯7 more rows

Hardcoded Windows root path (C:\, D:\, etc.) 0x3edb09–0x3edc99

⋯3 more rows
0x3edb39c24921d249f7da4f8d1492440fb65c24.I!.I..O...D..\$
0x3edb4927463a5cd1d8742f458d51ff664521ca'F:\..t/E.Q.fE!.
0x3edb594589d175d46690660f74ce66440fd7c9E..u.f.f.t.fD...
0x3edb694585c90f85280400004c01c04883c010E....(...L..H...
0x3edb794983c010eb99904a8d04d14c8b40f84d[email protected]
0x3edb8985c00f8409040000488b50f04c8d4a01........H.P.L.J.
0x3edb994c8b50e0488b48e84d39d14c0f42d649L.P.H.H.M9.L.B.I
0x3edba9f7da4e8d0c1249ffc14c8948f049ffc8..N...I..L.H.I..
0x3edbb94c8940f848c1e2040fb64411083c020f[email protected]..<..
0x3edbc984cc0300004801d14c8b394d39f70f86.....H..L.9M9...
0x3edbd900ffffff440fb66909a801488b542428....D..i...H.T$(
0x3edbe90f849d0200004939d60f83bb03000049......I9.......I
0x3edbf939d70f83c3030000498b4424184b8d0c9.......I.D$.K..
0x3edc097f48c1e104488b4c0b104839c80f95c3.H...H.L..H9....
0x3edc194084ed0f85710200004839c80f856e02@....q...H9...n.
0x3edc29000031dbe96f0200004889c34c8d7f20..1..o...H..L.. 
⋯7 more rows