I assume that my case is weird but I've the following information:
- IV: 0x263e or 0x3e26
- Auth tag: 0x25
- AES256-GCM encrypted payload: 0x4eec96df534ade4c013a
- AES256-GCM decrypted payload: 0x0041e36baf2648090174
Regarding the length of the IV and Auth tag, I'm wondering if it is possible to guess the key used to encrypt the payload ?