On Feb 25, 2019, at 10:44, G.W. Haywood via clamav-users <clamav-users@lists.clamav.net> wrote:

Hi there,

On Mon, 25 Feb 2019, Al Varnell wrote:

... the strings you provided appear to contain an extra digit. I
thought hex strings always contain an even number of digits?

Just as decimal strings are strings composed of decimal digits and can
be any length, hexadecimal strings are strings composed of hexadecimal
digits - and can also be any length.  They usually present as an even
number of digits only because they generally represent the even numbers
of four-bit binary numbers found in machine registers: 8-bit bytes and
16-bit words from decades ago, 32-bit, 64-bit and even 128-bit words
(e.g. for IPv6 addresses) in more recent times.  I'm sure I did once
use 12-bit word lengths for some reason, but I can't now remember what
the hardware was.

Yes, of course that's correct and I said it wrong. When I analyzed those strings, they all appear to translate into four ascii characters, so I jumped to the conclusion that they were meant to all represent ascii and therefore would have an even number of digits. Here's what I found:

connhkey6509Relec:\\Conv1971locaWait6376hkey5286sleec:\\connhkeyc:\\svch6006c:\\1955c:\\conngetmSetC1939hkeyc:\\22265576hkeyhkeyhkeyhkeyhkeyhkeyhkeyhkey5106delec:\\c:\\hkeySendkyuflocaIMAGhkeyhkeyhkeyiesqsvch127060356098hkeyhkeyc:\\hkey3191hkeyCreahkeyGetT5612c:\\hkeyIntehkeyhkeyhkeyhkey?setc:\\GetSRpcBhkeyhkeyVerQ5605hkeyOpen5184Lookc:\\GetT6199c:\\hkey5683getpole3Peek4205SetW\\??RegOc:\\hkeyhkey

-Al-
-- 
Al Varnell
Mountain View, CA