Benign Download

841e619a0e57780663987feaaac1e623160cd534aa263c563423edcb91cafcc6.exe

Dynamic library loading via LoadLibraryWGo binary CombinedOutput text

SHA-256841e619a0e57780663987feaaac1e623160cd534aa263c563423edcb91cafcc6

Evidence

Go runtime markers 0xff655–0xff695

0xff6556d652e68657864756d70576f72647300me.hexdumpWords.
0xff66572756e74696d652e6d61696e2e66756eruntime.main.fun
0xff67563310072756e74696d652e6d61696e00c1.runtime.main.
0xff68572756e74696d652e6d61696e2e66756eruntime.main.fun
0xff69563320072756e74696d652e696e6974  c2.runtime.init 

TCPConn type 0x107077–0x1070a7

0x1070776e486f7374506f7274006e65742e282anHostPort.net.(*
0x107087544350436f6e6e292e5265616446726fTCPConn).ReadFro
0x1070976d006e65742e736f636b61646472546fm.net.sockaddrTo
0x1070a7544350006e6574                  TCP.net         

Go binary CombinedOutput text 0x107b71–0x107bb1

0x107b71735374617465292e7375636365737300sState).success.
0x107b816f732f657865632e282a436d64292e43os/exec.(*Cmd).C
0x107b916f6d62696e65644f7574707574006279ombinedOutput.by
0x107ba17465732e282a427566666572292e4279tes.(*Buffer).By
0x107bb1746573006f732f657865632e64      tes.os/exec.d   

Dynamic library loading via LoadLibraryW 0x16a0d0–0x16a220

⋯9 more rows
0x16a16001000000f0010e00ff0f0e0001000000................
0x16a17000000000000000000000000000000000................
0x16a1800034bf4d0100004efc9f01000efa0ffa.4.M...N........
0x16a190010011fa13fa020014fa1ffa0b0021fa..............!.
0x16a1a023fa020024fa27fa030028fa29fa0100#...$.'...(.)...
0x16a1b000000000000000000000000000000000................
0x16a1c0000000001f0000003b0000005a000000........;...Z...
0x16a1d07800000097000000b5000000d4000000x...............
0x16a1e0f300000011010000300100004e010000........0...N...
⋯4 more rows

.dll extension reference 0x216820–0x216860

0x21682000000000000000006b65726e656c3332........kernel32
0x2168302e646c6c00000000577269746546696c.dll....WriteFil
0x216840650000005772697465436f6e736f6c65e...WriteConsole
0x2168505700000057616974466f724d756c7469W...WaitForMulti
0x21686070                              p               