Benign windows Download

execute_cmd_dll.go

Go exec.Command callGo Cgo native interface

SHA-256fa0c676332c8b958540ec0f7f30c29b6261dc8d6bb27b5ead3c862916ee4e1c9

Evidence

Go Cgo native interface lines 3–5

3import "C"
4import (
5	"fmt"

Go exec.Command call lines 10–14

10func PopCalc() {
11	fmt.Println("Spawning calculator")
12	cmd := exec.Command("cmd.exe", "/C", "C:\\Windows\\System32\\calc.exe")
13	cmd.Run()
14}