Benign Download

registry.go

Imports Go's unsafe packageConverts a Go pointer through unsafe.Pointer

SHA-256768d4259397b3514c66a08afa8be8ef3526203e183012445d9260fa3655bddcc

Evidence

Imports Go's unsafe package lines 1–13

⋯4 lines
5import (
6	"fmt"
7	"unsafe"
8)
9
⋯4 lines

Converts a Go pointer through unsafe.Pointer lines 31–35

12… ition uint32
r1, err := DirectSyscall("NtCreateKey",
uintptr(unsafe.Pointer(&keyHandle)), KEY_WRITE,
uintptr(unsafe.Pointer(&oa)), 0, 0,
REG_OPTION_NON_VOLATILE, uintptr(unsafe.Pointer(&disposition)) …

Go CurrentVersion Run path lines 78–83

78:49… tring) error {
79	return RegSetString(`Software\Microsoft\Windows\CurrentVersion\Run`, name, exePath)
80}
81
82func RemoveRunKeyPersistence(name string) error {
83	return RegDeleteValue(`Software\Microsoft\Windows\Curren …