f98e46fd4392e8f862317cf7a7ff96f92ddbb8f6399d9ba89f55e34bc131fe89

HOSTILE

f98e46fd4392e8f862317cf7a7ff96f92ddbb8f6399d9ba89f55e34bc131fe89 · 92%

AI Go shellcode loader with obfuscation

Mal-ecule

O₂(As₂Er)H₂(DbOs)Md₃(PtBiSi₃)

Size 2.7 MB download

First seen 3 days ago

Analyzed 3 days ago

Ecosystem windows

Source abuse.ch

Also detected by 1 source

Go dynamic x64 shellcode loader: QuickFetch.exe:0x3fd2

Go PE with opaque build identity and dynamic API dispatch: QuickFetch.exe:0x1cd5f1

QuickFetch.exe pe

0x3f52	5890904c0fbcce4d0fafc1458b4c1008	X..L...M...E.L..
0x3f62	4139f975db488b4b604c01c1488d0411	A9.u.H.K`L..H...
0x3f72	488d4008904883c4285dc3660fd7d190	H.@..H..(].f....
0x3f82	4885d27541488944243848895c244089	H..uAH.D$8H.\$@.
0x3f92	7c245048894c24186689542416488d05	\|$PH.L$.f.T$.H..
0x3fa2	106b1400bb35000000e8d0860600488b	.k...5........H.
0x3fb2	442438488b4c24180fb7542416488b5c	D$8H.L$...T$.H.\
0x3fc2	24408b7c2450488b73589090480fbcd2	$@.\|$PH.sX..H...
0x3fd2	41b840000000490f44d0480faff24883	A.@...I.D.H...H.Go dynamic x64 shellcode loader
0x3fe2	c6084803742420893e488b7358480faf	..H.t$ .>H.sXH..
0x3ff2	f248037360488b5c2420488d341e488d	.H.s`H.\$ H.4.H.
0x4002	76089090880c1348ff004889f04883c4	v......H..H..H..
0x4012	285dc3488944240848895c241048894c	(].H.D$.H.\$.H.L
0x4022	2418897c2420e8b3d90600488b442408	$..\|$ .....H.D$.
0x4032	488b5c2410488b4c24188b7c2420e9bb	H.\$.H.L$..\|$ ..
0x4042	feffffcccccccccccccccccccccccccc	................
0x4052	cccccccccccccccccccccccccccc493b	..............I;
0x4062	66100f860e010000554889e54883ec28	f.......UH..H..(
0x4072	488b50104889542420488b3283e17f66	H.P.H.T$ H.2...f
0x4082	480f6ec1660f60c0f20f70c00066480f	H.n.f.`...p..fH.
0x4092	6ece660f74c1660fd7f0400fb6f6eb08	n.f.t.f...@.....
0x40a2	4c8d46ff904c21c64885f6742e4c8b43	L.F..L!.H..t.L.C
0x40b2	5890904c0fbcce4d0fafc14d8b4c1008	X..L...M...M.L..
0x40c2	4939f975db488b4b604c01c1488d0411	I9.u.H.K`L..H...
0x40d2	488d	H.

0x465a	894b0848891a488b4c2460488b415848	.K.H..H.L$`H.AXH
0x466a	8b542430480fafc2480341604883c008	.T$0H...H.A`H...
0x467a	4803442440904883c4485dc3488b5424	H.D$@.H..H].H.T$
0x468a	40488b1266480f6ec2660fd7d04885d2	@H..fH.n.f...H..
0x469a	7534668954241e488d050e641400bb35	u4f.T$.H...d...5
0x46aa	000000e8ce7f0600488b442458488b4c	........H.D$XH.L
0x46ba	24200fb754241e488b5c2460488b7424	$ ..T$.H.\$`H.t$
0x46ca	78488b7c24704c8b43589090480fbcd2	xH.\|$pL.CX..H...
0x46da	41b940000000490f44d14c0fafc24983	A.@...I.D.L...I.Go dynamic x64 shellcode loader
0x46ea	c0084c0344244049897008833d84242c	..L.D$@I.p..=.$,
0x46fa	0000740f498b30e8faf1060049893b49	..t.I.0.....I.;I
0x470a	897308498938488b7358480faff24803	.s.I.8H.sXH...H.
0x471a	7360488b5c2440488d341e488d760890	s`H.\$@H.4.H.v..
0x472a	90880c1348ff004889f04883c4485dc3	....H..H..H..H].
0x473a	488944240848895c241048894c241848	H.D$.H.\$.H.L$.H
0x474a	897c24204889742428e888d20600488b	.\|$ H.t$(.....H.
0x475a	442408488b5c2410488b4c2418488b7c	D$.H.\$.H.L$.H.\|
0x476a	2420488b742428e9eafdffffcccccccc	$ H.t$(.........
0x477a	cccccccccccc493b66100f86a4000000	......I;f.......
0x478a	554889e54883ec20488944243048895c	UH..H.. H.D$0H.\
0x479a	243848894c244040887c2448488d0553	$8H.L$@@.\|$HH..S
0x47aa	0c1300e88e020100488b4c2440488948	........H.L$@H.H
0x47ba	080fb64c2448884806488b4c24384883	...L$H.H.H.L$8H.
0x47ca	f908ba08000000480f42ca4881f90004	.......H.B.H....
0x47da	0000	..

0x1cd571	652e6e6577496e6c696e65556e77696e	e.newInlineUnwin
0x1cd581	6465720073797363616c6c2e636f6d70	der.syscall.comp
0x1cd591	696c6543616c6c6261636b0072756e74	ileCallback.runt
0x1cd5a1	696d652e6362734c6f636b0072756e74	ime.cbsLock.runt
0x1cd5b1	696d652e63616c6c6261636b61736d41	ime.callbackasmA
0x1cd5c1	6464720072756e74696d652e63627355	ddr.runtime.cbsU
0x1cd5d1	6e6c6f636b0073797363616c6c2e6c6f	nlock.syscall.lo
0x1cd5e1	616473797374656d6c69627261727900	adsystemlibrary.
0x1cd5f1	73797363616c6c2e53797363616c6c4e	syscall.SyscallNGo dynamic x64 shellcode loader
0x1cd601	0073797363616c6c2e6c6f61646c6962	.syscall.loadlib
0x1cd611	726172790073797363616c6c2e676574	rary.syscall.get
0x1cd621	70726f63616464726573730073797363	procaddress.sysc
0x1cd631	616c6c2e53797363616c6c0073797363	all.Syscall.sysc
0x1cd641	616c6c2e53797363616c6c3600737973	all.Syscall6.sys
0x1cd651	63616c6c2e53797363616c6c39007469	call.Syscall9.ti
0x1cd661	6d652e72756e74696d654e6f77007469	me.runtimeNow.ti
0x1cd671	6d652e72756e74696d654e616e6f0074	me.runtimeNano.t
0x1cd681	696d652e536c6565700074696d652e6e	ime.Sleep.time.n
0x1cd691	657754696d65720074696d652e73746f	ewTimer.time.sto
0x1cd6a1	7054696d65720072756e74696d652e77	pTimer.runtime.w
0x1cd6b1	726974650072756e74696d652e747261	rite.runtime.tra
0x1cd6c1	6365416476616e63650072756e74696d	ceAdvance.runtim
0x1cd6d1	652f74726163652e72756e74696d655f	e/trace.runtime_
0x1cd6e1	7472616365436c6f636b556e69747350	traceClockUnitsP
0x1cd6f1	65725365636f6e640072756e74696d65	erSecond.runtime

0x1d03d1	292e4572726f720073797363616c6c2e	).Error.syscall.
0x1d03e1	282a444c4c4572726f72292e556e7772	(*DLLError).Unwr
0x1d03f1	61700073797363616c6c2e4c6f616444	ap.syscall.LoadD
0x1d0401	4c4c0073797363616c6c2e5554463136	LL.syscall.UTF16
0x1d0411	50747246726f6d537472696e67007379	PtrFromString.sy
0x1d0421	7363616c6c2e282a444c4c292e46696e	scall.(*DLL).Fin
0x1d0431	6450726f630073797363616c6c2e4279	dProc.syscall.By
0x1d0441	746550747246726f6d537472696e6700	tePtrFromString.
0x1d0451	73797363616c6c2e282a50726f63292e	syscall.(*Proc).Go dynamic x64 shellcode loader
0x1d0461	43616c6c0073797363616c6c2e282a50	Call.syscall.(*P
0x1d0471	726f63292e416464720073797363616c	roc).Addr.syscal
0x1d0481	6c2e282a4c617a79444c4c292e4c6f61	l.(*LazyDLL).Loa
0x1d0491	640073797363616c6c2e282a4c617a79	d.syscall.(*Lazy
0x1d04a1	444c4c292e4c6f61642e646566657277	DLL).Load.deferw
0x1d04b1	726170310073797363616c6c2e282a4c	rap1.syscall.(*L
0x1d04c1	617a7950726f63292e46696e64007379	azyProc).Find.sy
0x1d04d1	7363616c6c2e282a4c617a7950726f63	scall.(*LazyProc
0x1d04e1	292e46696e642e646566657277726170	).Find.deferwrap
0x1d04f1	310073797363616c6c2e282a4c617a79	1.syscall.(*Lazy
0x1d0501	50726f63292e43616c6c007379736361	Proc).Call.sysca
0x1d0511	6c6c2e282a4c617a7950726f63292e6d	ll.(*LazyProc).m
0x1d0521	75737446696e640073797363616c6c2e	ustFind.syscall.
0x1d0531	42797465536c69636546726f6d537472	ByteSliceFromStr
0x1d0541	696e670073797363616c6c2e55544631	ing.syscall.UTF1
0x1d0551	3646726f6d537472696e670073797363	6FromString.sysc
0x1d0561	616c6c2e5554463136546f537472696e	all.UTF16ToStrin
0x1d0571	670073797363616c6c2e4572726e6f2e	g.syscall.Errno.
0x1d0581	4572726f720073796e63	Error.sync

0x26c7e0	00000000000000000000000000000000	................
0x26c7f0	00000000000000000000000000000000	................
0x26c800	ff20476f206275696c64696e663a0802	. Go buildinf:..
0x26c810	00000000000000000000000000000000	................
0x26c820	08676f312e32352e34d2013077af0c92	.go1.25.4..0w...
0x26c830	74080241e1c107e6d618e67061746809	t..A.......path.
0x26c840	6f66486a46434c6f7957720a6d6f6409	ofHjFCLoyWr.mod.
0x26c850	6f66486a46434c6f7957720928646576	ofHjFCLoyWr.(dev
0x26c860	656c29090a6275696c64092d6275696c	el)..build.-buil
0x26c870	646d6f64653d6578650a6275696c6409	dmode=exe.build.
0x26c880	2d636f6d70696c65723d67630a627569	-compiler=gc.buiGo PE with opaque build identity and dynamic API dispatch
0x26c890	6c64092d7472696d706174683d747275	ld.-trimpath=tru
0x26c8a0	650a6275696c640943474f5f454e4142	e.build.CGO_ENAB
0x26c8b0	4c45443d300a6275696c6409474f4152	LED=0.build.GOAR
0x26c8c0	43483d616d6436340a6275696c640947	CH=amd64.build.G
0x26c8d0	4f4f533d77696e646f77730a6275696c	OOS=windows.buil
0x26c8e0	6409474f414d4436343d76310af93243	d.GOAMD64=v1..2C
0x26c8f0	3186182072008242104116d8f2000000	1.. r..B.A......
0x26c900	ff20476f2066697073696e666f20ff00	. Go fipsinfo ..
0x26c910	b2a9c0ff072765229bb840ac88a08e54	.....'e"..@....T
0x26c920	78f00e4cd640f9e1e674a6acf343bbe2	x..L.@...t...C..
0x26c930	00e12640010000002009104001000000	..&@.... ..@....
0x26c940	600f114001000000e2fe1b4001000000	`..@.......@....
0x26c950	e0011c40010000004068274001000000	...@....@h'@....
0x26c960	e08d2740010000007018284001000000	..'@....p.(@....
0x26c970	71182840010000000000000000000000	q.(@............
0x26c980	36402d000000000042402d0000000000	6@-.....B@-.....
0x26c990	52402d000000000060402d0000000000	R@-.....`@-.....
0x26c9a0	6e	n

Objectives

0x1cd571	652e6e6577496e6c696e65556e77696e	e.newInlineUnwin
0x1cd581	6465720073797363616c6c2e636f6d70	der.syscall.comp
0x1cd591	696c6543616c6c6261636b0072756e74	ileCallback.runt
0x1cd5a1	696d652e6362734c6f636b0072756e74	ime.cbsLock.runt
0x1cd5b1	696d652e63616c6c6261636b61736d41	ime.callbackasmA
0x1cd5c1	6464720072756e74696d652e63627355	ddr.runtime.cbsU
0x1cd5d1	6e6c6f636b0073797363616c6c2e6c6f	nlock.syscall.lo
0x1cd5e1	616473797374656d6c69627261727900	adsystemlibrary.
0x1cd5f1	73797363616c6c2e53797363616c6c4e	syscall.SyscallN
0x1cd601	0073797363616c6c2e6c6f61646c6962	.syscall.loadlib
0x1cd611	726172790073797363616c6c2e676574	rary.syscall.get
0x1cd621	70726f63616464726573730073797363	procaddress.sysc
0x1cd631	616c6c2e53797363616c6c0073797363	all.Syscall.sysc
0x1cd641	616c6c2e53797363616c6c3600737973	all.Syscall6.sys
0x1cd651	63616c6c2e53797363616c6c39007469	call.Syscall9.ti
0x1cd661	6d652e72756e74696d654e6f77007469	me.runtimeNow.ti
0x1cd671	6d652e72756e74696d654e616e6f0074	me.runtimeNano.t
0x1cd681	696d652e536c6565700074696d652e6e	ime.Sleep.time.n
0x1cd691	657754696d65720074696d652e73746f	ewTimer.time.sto
0x1cd6a1	7054696d65720072756e74696d652e77	pTimer.runtime.w
0x1cd6b1	726974650072756e74696d652e747261	rite.runtime.tra
0x1cd6c1	6365416476616e63650072756e74696d	ceAdvance.runtim
0x1cd6d1	652f74726163652e72756e74696d655f	e/trace.runtime_
0x1cd6e1	7472616365436c6f636b556e69747350	traceClockUnitsP
0x1cd6f1	65725365636f6e640072756e74696d65	erSecond.runtime

0x2b08d1	746166697073656e6400676f3a6d6169	tafipsend.go:mai
0x2b08e1	6e2e696e69747461736b7300676f3a72	n.inittasks.go:r
0x2b08f1	756e74696d652e696e69747461736b73	untime.inittasks
0x2b0901	0072756e74696d652e6275696c645665	.runtime.buildVe
0x2b0911	7273696f6e2e7374720072756e74696d	rsion.str.runtim
0x2b0921	652e6d6f64696e666f2e737472007275	e.modinfo.str.ru
0x2b0931	6e74696d652e747970656c696e6b0072	ntime.typelink.r
0x2b0941	756e74696d652e697461626c696e6b00	untime.itablink.
0x2b0951	676f3a6275696c64696e666f00676f3a	go:buildinfo.go:
0x2b0961	6275696c64696e666f2e726566007275	buildinfo.ref.ru
0x2b0971	6e74696d652e70636c6e746162007275	ntime.pclntab.ru
0x2b0981	6e74696d652e66696e6466756e637461	ntime.findfuncta
0x2b0991	620072756e74696d652e726f64617461	b.runtime.rodata
0x2b09a1	0072756e74696d652e65726f64617461	.runtime.erodata
0x2b09b1	0072756e74696d652e74797065730072	.runtime.types.r
0x2b09c1	756e74696d652e657479706573007275	untime.etypes.ru
0x2b09d1	6e74696d652e6e6f7074726461746100	ntime.noptrdata.
0x2b09e1	72756e74696d652e656e6f7074726461	runtime.enoptrda
0x2b09f1	74610072756e74696d652e6461746100	ta.runtime.data.
0x2b0a01	72756e74696d652e6564617461007275	runtime.edata.ru
0x2b0a11	6e74696d652e6273730072756e74696d	ntime.bss.runtim
0x2b0a21	652e656273730072756e74696d652e6e	e.ebss.runtime.n
0x2b0a31	6f7074726273730072756e74696d652e	optrbss.runtime.
0x2b0a41	656e6f7074726273730072756e74696d	enoptrbss.runtim
0x2b0a51	652e636f7663747273007275	e.covctrs.ru

0x26c7e0	00000000000000000000000000000000	................
0x26c7f0	00000000000000000000000000000000	................
0x26c800	ff20476f206275696c64696e663a0802	. Go buildinf:..
0x26c810	00000000000000000000000000000000	................
0x26c820	08676f312e32352e34d2013077af0c92	.go1.25.4..0w...
0x26c830	74080241e1c107e6d618e67061746809	t..A.......path.
0x26c840	6f66486a46434c6f7957720a6d6f6409	ofHjFCLoyWr.mod.
0x26c850	6f66486a46434c6f7957720928646576	ofHjFCLoyWr.(dev
0x26c860	656c29090a6275696c64092d6275696c	el)..build.-buil
0x26c870	646d6f64653d6578650a6275696c6409	dmode=exe.build.
0x26c880	2d636f6d70696c65723d67630a627569	-compiler=gc.bui
0x26c890	6c64092d7472696d706174683d747275	ld.-trimpath=tru
0x26c8a0	650a6275696c640943474f5f454e4142	e.build.CGO_ENAB
0x26c8b0	4c45443d300a6275696c6409474f4152	LED=0.build.GOAR
0x26c8c0	43483d616d6436340a6275696c640947	CH=amd64.build.G
0x26c8d0	4f4f533d77696e646f77730a6275696c	OOS=windows.buil
0x26c8e0	6409474f414d4436343d76310af93243	d.GOAMD64=v1..2C
0x26c8f0	3186182072008242104116d8f2000000	1.. r..B.A......
0x26c900	ff20476f2066697073696e666f20ff00	. Go fipsinfo ..
0x26c910	b2a9c0ff072765229bb840ac88a08e54	.....'e"..@....T
0x26c920	78f00e4cd640f9e1e674a6acf343bbe2	x..L.@...t...C..
0x26c930	00e12640010000002009104001000000	..&@.... ..@....
0x26c940	600f114001000000e2fe1b4001000000	`..@.......@....
0x26c950	e0011c40010000004068274001000000	...@....@h'@....
0x26c960	e08d2740010000007018284001000000	..'@....p.(@....
0x26c970	71182840010000000000000000000000	q.(@............
0x26c980	36402d000000000042402d0000000000	6@-.....B@-.....
0x26c990	52402d000000000060402d0000000000	R@-.....`@-.....
0x26c9a0	6e	n

0x1d03d1	292e4572726f720073797363616c6c2e	).Error.syscall.
0x1d03e1	282a444c4c4572726f72292e556e7772	(*DLLError).Unwr
0x1d03f1	61700073797363616c6c2e4c6f616444	ap.syscall.LoadD
0x1d0401	4c4c0073797363616c6c2e5554463136	LL.syscall.UTF16
0x1d0411	50747246726f6d537472696e67007379	PtrFromString.sy
0x1d0421	7363616c6c2e282a444c4c292e46696e	scall.(*DLL).Fin
0x1d0431	6450726f630073797363616c6c2e4279	dProc.syscall.By
0x1d0441	746550747246726f6d537472696e6700	tePtrFromString.
0x1d0451	73797363616c6c2e282a50726f63292e	syscall.(*Proc).
0x1d0461	43616c6c0073797363616c6c2e282a50	Call.syscall.(*P
0x1d0471	726f63292e416464720073797363616c	roc).Addr.syscal
0x1d0481	6c2e282a4c617a79444c4c292e4c6f61	l.(*LazyDLL).Loa
0x1d0491	640073797363616c6c2e282a4c617a79	d.syscall.(*Lazy
0x1d04a1	444c4c292e4c6f61642e646566657277	DLL).Load.deferw
0x1d04b1	726170310073797363616c6c2e282a4c	rap1.syscall.(*L
0x1d04c1	617a7950726f63292e46696e64007379	azyProc).Find.sy
0x1d04d1	7363616c6c2e282a4c617a7950726f63	scall.(*LazyProc
0x1d04e1	292e46696e642e646566657277726170	).Find.deferwrap
0x1d04f1	310073797363616c6c2e282a4c617a79	1.syscall.(*Lazy
0x1d0501	50726f63292e43616c6c007379736361	Proc).Call.sysca
0x1d0511	6c6c2e282a4c617a7950726f63292e6d	ll.(*LazyProc).m
0x1d0521	75737446696e640073797363616c6c2e	ustFind.syscall.
0x1d0531	42797465536c69636546726f6d537472	ByteSliceFromStr
0x1d0541	696e670073797363616c6c2e55544631	ing.syscall.UTF1
0x1d0551	3646726f6d537472696e670073797363	6FromString.sysc
0x1d0561	616c6c2e5554463136546f537472696e	all.UTF16ToStrin
0x1d0571	670073797363616c6c2e4572726e6f2e	g.syscall.Errno.
0x1d0581	4572726f720073796e63	Error.sync

0x3f52	5890904c0fbcce4d0fafc1458b4c1008	X..L...M...E.L..
0x3f62	4139f975db488b4b604c01c1488d0411	A9.u.H.K`L..H...
0x3f72	488d4008904883c4285dc3660fd7d190	H.@..H..(].f....
0x3f82	4885d27541488944243848895c244089	H..uAH.D$8H.\$@.
0x3f92	7c245048894c24186689542416488d05	\|$PH.L$.f.T$.H..
0x3fa2	106b1400bb35000000e8d0860600488b	.k...5........H.
0x3fb2	442438488b4c24180fb7542416488b5c	D$8H.L$...T$.H.\
0x3fc2	24408b7c2450488b73589090480fbcd2	$@.\|$PH.sX..H...
0x3fd2	41b840000000490f44d0480faff24883	A.@...I.D.H...H.
0x3fe2	c6084803742420893e488b7358480faf	..H.t$ .>H.sXH..
0x3ff2	f248037360488b5c2420488d341e488d	.H.s`H.\$ H.4.H.
0x4002	76089090880c1348ff004889f04883c4	v......H..H..H..
0x4012	285dc3488944240848895c241048894c	(].H.D$.H.\$.H.L
0x4022	2418897c2420e8b3d90600488b442408	$..\|$ .....H.D$.
0x4032	488b5c2410488b4c24188b7c2420e9bb	H.\$.H.L$..\|$ ..
0x4042	feffffcccccccccccccccccccccccccc	................
0x4052	cccccccccccccccccccccccccccc493b	..............I;
0x4062	66100f860e010000554889e54883ec28	f.......UH..H..(
0x4072	488b50104889542420488b3283e17f66	H.P.H.T$ H.2...f
0x4082	480f6ec1660f60c0f20f70c00066480f	H.n.f.`...p..fH.
0x4092	6ece660f74c1660fd7f0400fb6f6eb08	n.f.t.f...@.....
0x40a2	4c8d46ff904c21c64885f6742e4c8b43	L.F..L!.H..t.L.C
0x40b2	5890904c0fbcce4d0fafc14d8b4c1008	X..L...M...M.L..
0x40c2	4939f975db488b4b604c01c1488d0411	I9.u.H.K`L..H...
0x40d2	488d	H.

0x465a	894b0848891a488b4c2460488b415848	.K.H..H.L$`H.AXH
0x466a	8b542430480fafc2480341604883c008	.T$0H...H.A`H...
0x467a	4803442440904883c4485dc3488b5424	H.D$@.H..H].H.T$
0x468a	40488b1266480f6ec2660fd7d04885d2	@H..fH.n.f...H..
0x469a	7534668954241e488d050e641400bb35	u4f.T$.H...d...5
0x46aa	000000e8ce7f0600488b442458488b4c	........H.D$XH.L
0x46ba	24200fb754241e488b5c2460488b7424	$ ..T$.H.\$`H.t$
0x46ca	78488b7c24704c8b43589090480fbcd2	xH.\|$pL.CX..H...
0x46da	41b940000000490f44d14c0fafc24983	A.@...I.D.L...I.
0x46ea	c0084c0344244049897008833d84242c	..L.D$@I.p..=.$,
0x46fa	0000740f498b30e8faf1060049893b49	..t.I.0.....I.;I
0x470a	897308498938488b7358480faff24803	.s.I.8H.sXH...H.
0x471a	7360488b5c2440488d341e488d760890	s`H.\$@H.4.H.v..
0x472a	90880c1348ff004889f04883c4485dc3	....H..H..H..H].
0x473a	488944240848895c241048894c241848	H.D$.H.\$.H.L$.H
0x474a	897c24204889742428e888d20600488b	.\|$ H.t$(.....H.
0x475a	442408488b5c2410488b4c2418488b7c	D$.H.\$.H.L$.H.\|
0x476a	2420488b742428e9eafdffffcccccccc	$ H.t$(.........
0x477a	cccccccccccc493b66100f86a4000000	......I;f.......
0x478a	554889e54883ec20488944243048895c	UH..H.. H.D$0H.\
0x479a	243848894c244040887c2448488d0553	$8H.L$@@.\|$HH..S
0x47aa	0c1300e88e020100488b4c2440488948	........H.L$@H.H
0x47ba	080fb64c2448884806488b4c24384883	...L$H.H.H.L$8H.
0x47ca	f908ba08000000480f42ca4881f90004	.......H.B.H....
0x47da	0000	..

0x1cd571	652e6e6577496e6c696e65556e77696e	e.newInlineUnwin
0x1cd581	6465720073797363616c6c2e636f6d70	der.syscall.comp
0x1cd591	696c6543616c6c6261636b0072756e74	ileCallback.runt
0x1cd5a1	696d652e6362734c6f636b0072756e74	ime.cbsLock.runt
0x1cd5b1	696d652e63616c6c6261636b61736d41	ime.callbackasmA
0x1cd5c1	6464720072756e74696d652e63627355	ddr.runtime.cbsU
0x1cd5d1	6e6c6f636b0073797363616c6c2e6c6f	nlock.syscall.lo
0x1cd5e1	616473797374656d6c69627261727900	adsystemlibrary.
0x1cd5f1	73797363616c6c2e53797363616c6c4e	syscall.SyscallN
0x1cd601	0073797363616c6c2e6c6f61646c6962	.syscall.loadlib
0x1cd611	726172790073797363616c6c2e676574	rary.syscall.get
0x1cd621	70726f63616464726573730073797363	procaddress.sysc
0x1cd631	616c6c2e53797363616c6c0073797363	all.Syscall.sysc
0x1cd641	616c6c2e53797363616c6c3600737973	all.Syscall6.sys
0x1cd651	63616c6c2e53797363616c6c39007469	call.Syscall9.ti
0x1cd661	6d652e72756e74696d654e6f77007469	me.runtimeNow.ti
0x1cd671	6d652e72756e74696d654e616e6f0074	me.runtimeNano.t
0x1cd681	696d652e536c6565700074696d652e6e	ime.Sleep.time.n
0x1cd691	657754696d65720074696d652e73746f	ewTimer.time.sto
0x1cd6a1	7054696d65720072756e74696d652e77	pTimer.runtime.w
0x1cd6b1	726974650072756e74696d652e747261	rite.runtime.tra
0x1cd6c1	6365416476616e63650072756e74696d	ceAdvance.runtim
0x1cd6d1	652f74726163652e72756e74696d655f	e/trace.runtime_
0x1cd6e1	7472616365436c6f636b556e69747350	traceClockUnitsP
0x1cd6f1	65725365636f6e640072756e74696d65	erSecond.runtime

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x1d8cd3	61696e2e6d717276766a6573696b7a63	ain.mqrvvjesikzc
0x1d8ce3	7a6a7465767964686d006d61696e2e6f	zjtevydhm.main.o
0x1d8cf3	646a7772656270786a6373656778706a	djwrebpxjcsegxpj
0x1d8d03	61710073797363616c6c2e282a4c617a	aq.syscall.(*Laz
0x1d8d13	79444c4c292e4e657750726f63006d61	yDLL).NewProc.ma
0x1d8d23	696e2e4e6f656f7278616c7861776300	in.Noeorxalxawc.
0x1d8d33	6d61696e2e4d68777a6e76616279666d	main.Mhwznvabyfm
0x1d8d43	646b6d72666a766e006d61696e2e6c63	dkmrfjvn.main.lc
0x1d8d53	6d637177746c666d7766657079717963	mcqwtlfmwfepyqyc
0x1d8d63	6a7000656e636f64696e672f6865782e	jp.encoding/hex.
0x1d8d73	456e636f6465546f537472696e670065	EncodeToString.e
0x1d8d83	6e636f64696e672f6865782e456e636f	ncoding/hex.Enco
0x1d8d93	6465644c656e00656e636f64696e672f	dedLen.encoding/
0x1d8da3	6865782e456e636f6465006d61696e2e	hex.Encode.main.
0x1d8db3	7877666e76797669757a006d61696e2e	xwfnvyviuz.main.
0x1d8dc3	65656c6b767a6c7578756662006d6169	eelkvzluxufb.mai
0x1d8dd3	6e2e696271696465006d61696e2e7064	n.ibqide.main.pd
0x1d8de3	7762617a7076766a64656b706e767500	wbazpvvjdekpnvu.
0x1d8df3	6d61696e2e70647762617a7076766a64	main.pdwbazpvvjd
0x1d8e03	656b706e76752e66	ekpnvu.f

Micro-behaviors

0x1d03d1	292e4572726f720073797363616c6c2e	).Error.syscall.
0x1d03e1	282a444c4c4572726f72292e556e7772	(*DLLError).Unwr
0x1d03f1	61700073797363616c6c2e4c6f616444	ap.syscall.LoadD
0x1d0401	4c4c0073797363616c6c2e5554463136	LL.syscall.UTF16
0x1d0411	50747246726f6d537472696e67007379	PtrFromString.sy
0x1d0421	7363616c6c2e282a444c4c292e46696e	scall.(*DLL).Fin
0x1d0431	6450726f630073797363616c6c2e4279	dProc.syscall.By
0x1d0441	746550747246726f6d537472696e6700	tePtrFromString.
0x1d0451	73797363616c6c2e282a50726f63292e	syscall.(*Proc).
0x1d0461	43616c6c0073797363616c6c2e282a50	Call.syscall.(*P
0x1d0471	726f63292e416464720073797363616c	roc).Addr.syscal
0x1d0481	6c2e282a4c617a79444c4c292e4c6f61	l.(*LazyDLL).Loa
0x1d0491	640073797363616c6c2e282a4c617a79	d.syscall.(*Lazy
0x1d04a1	444c4c292e4c6f61642e646566657277	DLL).Load.deferw
0x1d04b1	726170310073797363616c6c2e282a4c	rap1.syscall.(*L
0x1d04c1	617a7950726f63292e46696e64007379	azyProc).Find.sy
0x1d04d1	7363616c6c2e282a4c617a7950726f63	scall.(*LazyProc
0x1d04e1	292e46696e642e646566657277726170	).Find.deferwrap
0x1d04f1	310073797363616c6c2e282a4c617a79	1.syscall.(*Lazy
0x1d0501	50726f63292e43616c6c007379736361	Proc).Call.sysca
0x1d0511	6c6c2e282a4c617a7950726f63292e6d	ll.(*LazyProc).m
0x1d0521	75737446696e640073797363616c6c2e	ustFind.syscall.
0x1d0531	42797465536c69636546726f6d537472	ByteSliceFromStr
0x1d0541	696e670073797363616c6c2e55544631	ing.syscall.UTF1
0x1d0551	3646726f6d537472696e670073797363	6FromString.sysc
0x1d0561	616c6c2e5554463136546f537472696e	all.UTF16ToStrin
0x1d0571	670073797363616c6c2e4572726e6f2e	g.syscall.Errno.
0x1d0581	4572726f720073796e63	Error.sync

0x1cd571	652e6e6577496e6c696e65556e77696e	e.newInlineUnwin
0x1cd581	6465720073797363616c6c2e636f6d70	der.syscall.comp
0x1cd591	696c6543616c6c6261636b0072756e74	ileCallback.runt
0x1cd5a1	696d652e6362734c6f636b0072756e74	ime.cbsLock.runt
0x1cd5b1	696d652e63616c6c6261636b61736d41	ime.callbackasmA
0x1cd5c1	6464720072756e74696d652e63627355	ddr.runtime.cbsU
0x1cd5d1	6e6c6f636b0073797363616c6c2e6c6f	nlock.syscall.lo
0x1cd5e1	616473797374656d6c69627261727900	adsystemlibrary.
0x1cd5f1	73797363616c6c2e53797363616c6c4e	syscall.SyscallN
0x1cd601	0073797363616c6c2e6c6f61646c6962	.syscall.loadlib
0x1cd611	726172790073797363616c6c2e676574	rary.syscall.get
0x1cd621	70726f63616464726573730073797363	procaddress.sysc
0x1cd631	616c6c2e53797363616c6c0073797363	all.Syscall.sysc
0x1cd641	616c6c2e53797363616c6c3600737973	all.Syscall6.sys
0x1cd651	63616c6c2e53797363616c6c39007469	call.Syscall9.ti
0x1cd661	6d652e72756e74696d654e6f77007469	me.runtimeNow.ti
0x1cd671	6d652e72756e74696d654e616e6f0074	me.runtimeNano.t
0x1cd681	696d652e536c6565700074696d652e6e	ime.Sleep.time.n
0x1cd691	657754696d65720074696d652e73746f	ewTimer.time.sto
0x1cd6a1	7054696d65720072756e74696d652e77	pTimer.runtime.w
0x1cd6b1	726974650072756e74696d652e747261	rite.runtime.tra
0x1cd6c1	6365416476616e63650072756e74696d	ceAdvance.runtim
0x1cd6d1	652f74726163652e72756e74696d655f	e/trace.runtime_
0x1cd6e1	7472616365436c6f636b556e69747350	traceClockUnitsP
0x1cd6f1	65725365636f6e640072756e74696d65	erSecond.runtime

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x2868fa	6e6d656e74537472696e677357000000	nmentStringsW...
0x28690a	4578697450726f636573730000004475	ExitProcess...Du
0x28691a	706c696361746548616e646c65000000	plicateHandle...
0x28692a	4372656174655761697461626c655469	CreateWaitableTi
0x28693a	6d657245785700000000437265617465	merExW....Create
0x28694a	54687265616400000000437265617465	Thread....Create
0x28695a	496f436f6d706c6574696f6e506f7274	IoCompletionPort
0x28696a	000000004372656174654576656e7441	....CreateEventA
0x28697a	00000000436c6f736548616e646c6500	....CloseHandle.
0x28698a	0000416464566563746f726564457863	..AddVectoredExc
0x28699a	657074696f6e48616e646c6572000000	eptionHandler...
0x2869aa	416464566563	AddVec

0x286608	0000000028402d0080e1260000000000	....(@-...&.....
0x286618	00000000000000000000000000000000	................
0x286628	6b65726e656c33322e646c6c00000000	kernel32.dll....
0x286638	577269746546696c6500000057726974	WriteFile...Writ
0x286648	65436f6e736f6c655700000057657253	eConsoleW...WerS
0x286658	6574466c616773000000576572476574	etFlags...WerGet
0x286668	466c61677300000057616974466f724d	Flags...WaitForM
0x286678	756c7469706c654f626a656374730000	ultipleObjects..
0x286688	000057616974466f7253696e676c654f	..WaitForSingleO
0x286698	626a6563740000005669727475616c51	bject...VirtualQ
0x2866a8	75657279000000005669727475616c46	uery....VirtualF
0x2866b8	7265650000005669727475616c416c6c	ree...VirtualAll
0x2866c8	6f6300000000546c73416c6c6f630000	oc....TlsAlloc..
0x2866d8	0000537769746368546f546872656164	..SwitchToThread
0x2866e8	0000000053757370656e645468726561	....SuspendThrea
0x2866f8	640000005365745761697461626c6554	d...SetWaitableT
0x286708	696d65720000000053657450726f6365	imer....SetProce
0x286718	73735072696f72697479426f6f737400	ssPriorityBoost.
0x286728	00005365744576656e74000000005365	..SetEvent....Se
0x286738	744572726f724d6f6465000000005365	tErrorMode....Se
0x286748	74436f6e736f6c654374726c48616e64	tConsoleCtrlHand
0x286758	6c657200000052746c5669727475616c	ler...RtlVirtual
0x286768	556e77696e640000000052746c4c6f6f	Unwind....RtlLoo
0x286778	6b757046756e6374696f6e456e747279	kupFunctionEntry
0x286788	00000000526573756d65546872656164	....ResumeThread
0x286798	00000000526169736546	....RaiseF

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

0x3f52	5890904c0fbcce4d0fafc1458b4c1008	X..L...M...E.L..
0x3f62	4139f975db488b4b604c01c1488d0411	A9.u.H.K`L..H...
0x3f72	488d4008904883c4285dc3660fd7d190	H.@..H..(].f....
0x3f82	4885d27541488944243848895c244089	H..uAH.D$8H.\$@.
0x3f92	7c245048894c24186689542416488d05	\|$PH.L$.f.T$.H..
0x3fa2	106b1400bb35000000e8d0860600488b	.k...5........H.
0x3fb2	442438488b4c24180fb7542416488b5c	D$8H.L$...T$.H.\
0x3fc2	24408b7c2450488b73589090480fbcd2	$@.\|$PH.sX..H...
0x3fd2	41b840000000490f44d0480faff24883	A.@...I.D.H...H.
0x3fe2	c6084803742420893e488b7358480faf	..H.t$ .>H.sXH..
0x3ff2	f248037360488b5c2420488d341e488d	.H.s`H.\$ H.4.H.
0x4002	76089090880c1348ff004889f04883c4	v......H..H..H..
0x4012	285dc3488944240848895c241048894c	(].H.D$.H.\$.H.L
0x4022	2418897c2420e8b3d90600488b442408	$..\|$ .....H.D$.
0x4032	488b5c2410488b4c24188b7c2420e9bb	H.\$.H.L$..\|$ ..
0x4042	feffffcccccccccccccccccccccccccc	................
0x4052	cccccccccccccccccccccccccccc493b	..............I;
0x4062	66100f860e010000554889e54883ec28	f.......UH..H..(
0x4072	488b50104889542420488b3283e17f66	H.P.H.T$ H.2...f
0x4082	480f6ec1660f60c0f20f70c00066480f	H.n.f.`...p..fH.
0x4092	6ece660f74c1660fd7f0400fb6f6eb08	n.f.t.f...@.....
0x40a2	4c8d46ff904c21c64885f6742e4c8b43	L.F..L!.H..t.L.C
0x40b2	5890904c0fbcce4d0fafc14d8b4c1008	X..L...M...M.L..
0x40c2	4939f975db488b4b604c01c1488d0411	I9.u.H.K`L..H...
0x40d2	488d	H.

0x465a	894b0848891a488b4c2460488b415848	.K.H..H.L$`H.AXH
0x466a	8b542430480fafc2480341604883c008	.T$0H...H.A`H...
0x467a	4803442440904883c4485dc3488b5424	H.D$@.H..H].H.T$
0x468a	40488b1266480f6ec2660fd7d04885d2	@H..fH.n.f...H..
0x469a	7534668954241e488d050e641400bb35	u4f.T$.H...d...5
0x46aa	000000e8ce7f0600488b442458488b4c	........H.D$XH.L
0x46ba	24200fb754241e488b5c2460488b7424	$ ..T$.H.\$`H.t$
0x46ca	78488b7c24704c8b43589090480fbcd2	xH.\|$pL.CX..H...
0x46da	41b940000000490f44d14c0fafc24983	A.@...I.D.L...I.
0x46ea	c0084c0344244049897008833d84242c	..L.D$@I.p..=.$,
0x46fa	0000740f498b30e8faf1060049893b49	..t.I.0.....I.;I
0x470a	897308498938488b7358480faff24803	.s.I.8H.sXH...H.
0x471a	7360488b5c2440488d341e488d760890	s`H.\$@H.4.H.v..
0x472a	90880c1348ff004889f04883c4485dc3	....H..H..H..H].
0x473a	488944240848895c241048894c241848	H.D$.H.\$.H.L$.H
0x474a	897c24204889742428e888d20600488b	.\|$ H.t$(.....H.
0x475a	442408488b5c2410488b4c2418488b7c	D$.H.\$.H.L$.H.\|
0x476a	2420488b742428e9eafdffffcccccccc	$ H.t$(.........
0x477a	cccccccccccc493b66100f86a4000000	......I;f.......
0x478a	554889e54883ec20488944243048895c	UH..H.. H.D$0H.\
0x479a	243848894c244040887c2448488d0553	$8H.L$@@.\|$HH..S
0x47aa	0c1300e88e020100488b4c2440488948	........H.L$@H.H
0x47ba	080fb64c2448884806488b4c24384883	...L$H.H.H.L$8H.
0x47ca	f908ba08000000480f42ca4881f90004	.......H.B.H....
0x47da	0000	..

0x26e150	591f010001000000606a0100696a0100	Y.......`j..ij..
0x26e160	01000000c06a0100c96a010001000000	.....j...j......
0x26e170	506b0100596b010001000000ced70100	Pk..Yk..........
0x26e180	ffd701000100000040e1010049e10100	........@...I...
0x26e190	01000000f0e20100f9e2010001000000	................
0x26e1a0	f0e40100f9e401000100000050e90100	............P...
0x26e1b0	59e9010001000000f0fb0100f9fb0100	Y...............
0x26e1c0	01000000000000000000000000000000	................
0x26e1d0	00000000000000000000000000000000	................
0x26e1e0	4b006b00530073006b002a2173007f01	K.k.S.s.k.*!s...
0x26e1f0	b5009c03c500e500df009e1ee5002b21	..............+!
0x26e200	30013001310131017f015300c401c501	0.0.1.1...S.....
0x26e210	c501c601c601c401c701c801c801c901	................
0x26e220	c901c701ca01cb01cb01cc01cc01ca01	................
0x26e230	f101f201f201f301f301f10145039903	............E...
0x26e240	9203b2039503b5039803b8039903b903	................
0x26e250	9a03ba039c03bc03a003c003a103c103	................
0x26e260	a303c203a603c603a903c903b203d003	................
0x26e270	b503f503b803d103b903be1fba03f003	................
0x26e280	bc03b500c003d603c103f103c203c303	................
0x26e290	c303a303c603d503c9032621d0039203	..........&!....
0x26e2a0	d103f403d503a603d603a003f0039a03	................
0x26e2b0	f103a103f4039803f503950312043204	..............2.
0x26e2c0	140434041e043e042104410422044204	..4...>.!.A.".B.
0x26e2d0	2a044a043204801c3404811c3e04821c	*.J.2...4...>...
0x26e2e0	4104831c4204841c4a04861c62046304	A...B...J...b.c.
0x26e2f0	6304871c801c1204811c1404821c1e04	c...............
0x26e300	831c2104841c851c851c2204861c2a04	..!......."...*.
0x26e310	871c6204881c4aa6601e611e611e9b1e	..b...J.`.a.a...
0x26e320	9b1e601e9e1edf00be1f45032621a903	..`.......E.&!..
0x26e330	2a214b002b21c5004aa64ba64ba6881c	*!K.+!..J.K.K...
0x26e340	c00c1c4001000000200d1c4001000000	...@.... ..@....
0x26e350	50a501000000000050a5010000000000	P.......P.......
0x26e360	80b21d40010000006811000000000000	...@....h.......
0x26e370	681100000000000000c41d4001000000	h..........@....
0x26e380	e01e000000000000e01e0000	............

Metadata

0x2b08d1	746166697073656e6400676f3a6d6169	tafipsend.go:mai
0x2b08e1	6e2e696e69747461736b7300676f3a72	n.inittasks.go:r
0x2b08f1	756e74696d652e696e69747461736b73	untime.inittasks
0x2b0901	0072756e74696d652e6275696c645665	.runtime.buildVe
0x2b0911	7273696f6e2e7374720072756e74696d	rsion.str.runtim
0x2b0921	652e6d6f64696e666f2e737472007275	e.modinfo.str.ru
0x2b0931	6e74696d652e747970656c696e6b0072	ntime.typelink.r
0x2b0941	756e74696d652e697461626c696e6b00	untime.itablink.
0x2b0951	676f3a6275696c64696e666f00676f3a	go:buildinfo.go:
0x2b0961	6275696c64696e666f2e726566007275	buildinfo.ref.ru
0x2b0971	6e74696d652e70636c6e746162007275	ntime.pclntab.ru
0x2b0981	6e74696d652e66696e6466756e637461	ntime.findfuncta
0x2b0991	620072756e74696d652e726f64617461	b.runtime.rodata
0x2b09a1	0072756e74696d652e65726f64617461	.runtime.erodata
0x2b09b1	0072756e74696d652e74797065730072	.runtime.types.r
0x2b09c1	756e74696d652e657479706573007275	untime.etypes.ru
0x2b09d1	6e74696d652e6e6f7074726461746100	ntime.noptrdata.
0x2b09e1	72756e74696d652e656e6f7074726461	runtime.enoptrda
0x2b09f1	74610072756e74696d652e6461746100	ta.runtime.data.
0x2b0a01	72756e74696d652e6564617461007275	runtime.edata.ru
0x2b0a11	6e74696d652e6273730072756e74696d	ntime.bss.runtim
0x2b0a21	652e656273730072756e74696d652e6e	e.ebss.runtime.n
0x2b0a31	6f7074726273730072756e74696d652e	optrbss.runtime.
0x2b0a41	656e6f7074726273730072756e74696d	enoptrbss.runtim
0x2b0a51	652e636f7663747273007275	e.covctrs.ru

0x28b9c0	00000000000000000000000000000000	................
0x28b9d0	00000000000000000000000000000000	................
0x28b9e0	00000000000000000000000000000000	................
0x28b9f0	00000000000000000000000000000000	................
0x28ba00	00000000040000000000000001002000	.............. .
0x28ba10	0300000000001100000070ff10000100	..........p.....
0x28ba20	20000300000000001f00000000000000	...............
0x28ba30	010020000200000000002a0000008000	.. .......*.....
0x28ba40	00000100200002000000000040000000	.... .......@...
0x28ba50	a0000000010020000200000000005900	...... .......Y.
0x28ba60	00000001000001002000020000000000	........ .......
0x28ba70	6d000000200100000100200002000000	m... ..... .....
0x28ba80	00008600000040	......@

signed Authenticode chain CN: giltipleva.in

signed/certificate PE leaf certificate self-issued metadata

0x26c7e0	00000000000000000000000000000000	................
0x26c7f0	00000000000000000000000000000000	................
0x26c800	ff20476f206275696c64696e663a0802	. Go buildinf:..
0x26c810	00000000000000000000000000000000	................
0x26c820	08676f312e32352e34d2013077af0c92	.go1.25.4..0w...
0x26c830	74080241e1c107e6d618e67061746809	t..A.......path.
0x26c840	6f66486a46434c6f7957720a6d6f6409	ofHjFCLoyWr.mod.
0x26c850	6f66486a46434c6f7957720928646576	ofHjFCLoyWr.(dev
0x26c860	656c29090a6275696c64092d6275696c	el)..build.-buil
0x26c870	646d6f64653d6578650a6275696c6409	dmode=exe.build.
0x26c880	2d636f6d70696c65723d67630a627569	-compiler=gc.bui
0x26c890	6c64092d7472696d706174683d747275	ld.-trimpath=tru
0x26c8a0	650a6275696c640943474f5f454e4142	e.build.CGO_ENAB
0x26c8b0	4c45443d300a6275696c6409474f4152	LED=0.build.GOAR
0x26c8c0	43483d616d6436340a6275696c640947	CH=amd64.build.G
0x26c8d0	4f4f533d77696e646f77730a6275696c	OOS=windows.buil
0x26c8e0	6409474f414d4436343d76310af93243	d.GOAMD64=v1..2C
0x26c8f0	3186182072008242104116d8f2000000	1.. r..B.A......
0x26c900	ff20476f2066697073696e666f20ff00	. Go fipsinfo ..
0x26c910	b2a9c0ff072765229bb840ac88a08e54	.....'e"..@....T
0x26c920	78f00e4cd640f9e1e674a6acf343bbe2	x..L.@...t...C..
0x26c930	00e12640010000002009104001000000	..&@.... ..@....
0x26c940	600f114001000000e2fe1b4001000000	`..@.......@....
0x26c950	e0011c40010000004068274001000000	...@....@h'@....
0x26c960	e08d2740010000007018284001000000	..'@....p.(@....
0x26c970	71182840010000000000000000000000	q.(@............
0x26c980	36402d000000000042402d0000000000	6@-.....B@-.....
0x26c990	52402d000000000060402d0000000000	R@-.....`@-.....
0x26c9a0	6e	n

Identity

SHA-256	f98e46fd4392e8f862317cf7a7ff96f92ddbb8f6399d9ba89f55e34bc131fe89
Filename	QuickFetch.exe
Package	f98e46fd4392e8f862317cf7a7ff96f92ddbb8f6399d9ba89f55e34bc131fe89

Origin

Source	harvest
Feed	malwarebazaar
Ecosystem	windows
Domain	abuse.ch

Timeline

First seen	21 Jul 2026 07:14 UTC
First analyzed	22 Jul 2026 03:36 UTC
Last analyzed	22 Jul 2026 03:36 UTC
Last updated	22 Jul 2026 03:36 UTC

Labeling

Label	bad
Label source	harvest
Traits version	7a129

Not seeing what you expected? Let us know