510095668ae91bb11e30854a7994a2983fbf5c17195ddce1fdf2e2f64de9dd4f

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Rose_Setup_1.2.4.exe
Size 20.4MB
Sample260422-phkhjsbs3t
SHA256 510095668ae91bb11e30854a7994a2983fbf5c17195ddce1fdf2e2f64de9dd4f
MD5 8b2cb525a673100153b7a4df8a440118
SHA1 81ccb06d2554b6ad7f01fe056a6ec26e16d35bf6
SHA512 ceba6ce28a7eff3d9708165d8c7f835692a023c304fc5d247befced021f7e8ffa144588ab1470c04857aaa0b1d980d5f4c4ee10f0fd8da5b7f75478c63fe268d
SSDEEP 393216:nx/hgKekwaPwuBH5HJc8K0u3LbXYd9UZFWTFmrMhnDyz6uWlnQYDGtoxT7YYfnEC:xJfw6BrUL7bod93FJND66l5YtaT7YMn3
TLSH
T15D27333FB28B653EF16A0A7979B6E200443BBA2065564C56D6F4C89CCF250711E3FB87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery installer pyinstaller spyware

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2484	Rose_Setup_1.2.4.tmp
1920	Rose.exe

Loads dropped DLL 27 IoCs

pid	Process
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe
1920	Rose.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
568	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Rose\_internal\charset_normalizer\is-0GYKMX6JDM.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\injection\tools\is-8UT5PUX5FB.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\is-RHKFG9S4GD.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\is-6FVMWWUYK8.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\is-5TWY9GWINI.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\PIL\is-FZYFQ1O9XW.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-ADH898AF94.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-0IS0S50MZX.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-SFTTNZ4GBD.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\injection\tools\is-MDG0UG8VE7.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-Jade\config\js\main\is-4YU39KUFYV.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\is-3274LVY44I.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\PIL\is-JVHJU3S2IG.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\utils\crypto\is-FC6CCDOBYV.tmp	Rose_Setup_1.2.4.tmp
File opened for modification	C:\Program Files\Rose\_internal\Pengu Loader\ModernWpf.dll	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-NCUGXVTLE4.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\kdasera_buttons\is-QCR0S6JK06.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\rrviego_buttons\is-V3Y5YSNGKQ.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\sbmorg_buttons\is-9SI7IN69AL.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\uzal_buttons\is-E3W51DMAL7.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-Jade\assets\is-0ZWQK60F0F.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-UI\is-J62NRAULE0.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\elementalist_buttons\is-C7E91QBVEV.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\elementalist_buttons\is-G1HUGB6I15.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\websockets-12.0.dist-info\is-CKERRW1UDC.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\websockets-12.0.dist-info\is-1FNE0WPEJX.tmp	Rose_Setup_1.2.4.tmp
File opened for modification	C:\Program Files\Rose\_internal\libssl-3.dll	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-8BMLMTPFEA.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-DJBT62JZJ8.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\radiantsett_buttons\is-M65T5JKKU1.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\rrviego_buttons\is-0U06ODHVP4.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-ChromaWheel\is-GPTF4WO9LZ.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-PartyMode\is-PRQOS7Q58I.tmp	Rose_Setup_1.2.4.tmp
File opened for modification	C:\Program Files\Rose\unins000.dat	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\is-IAWHKUOYO0.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-KHT2WV8P5Y.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-O6DQOGK1R2.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-LX2D0CDX51.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\rrviego_buttons\is-C4KSMNAD5G.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\is-EFJY67ZBG5.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\PIL\is-4HKHTRU8DO.tmp	Rose_Setup_1.2.4.tmp
File opened for modification	C:\Program Files\Rose\Rose.exe	Rose_Setup_1.2.4.tmp
File opened for modification	C:\Program Files\Rose\_internal\Pengu Loader\System.ValueTuple.dll	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-QY00JF3IYY.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-Z1ZZK87MA1.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\fakerahri_buttons\is-CVEB1D4OKH.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\is-FNS9A3GS88.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\PIL\is-VW0UR3G1BJ.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\utils\crypto\is-S4XGDMHX9X.tmp	Rose_Setup_1.2.4.tmp
File opened for modification	C:\Program Files\Rose\_internal\Pengu Loader\ModernWpf.Controls.dll	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\arcanejinx_buttons\is-UHST4SR222.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\kdasera_buttons\is-RVT8AMIDIR.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-CustomWheel\is-IAVAHIF7PZ.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-RandomSkin\is-JIZYGTC37E.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-WERAN30GXS.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\arcanejinx_buttons\is-DNT4TDVP0G.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\radiantsett_buttons\is-O3A3RRH35E.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\Pengu Loader\plugins\ROSE-UI\is-5BOPNICSQJ.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-T3HY5PH8QC.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-LO6ZY4IAEK.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-0AOW9Z4U9W.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\is-6OU0XFLSYZ.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\is-DCT2U28OWY.tmp	Rose_Setup_1.2.4.tmp
File created	C:\Program Files\Rose\_internal\assets\fakerahri_buttons\is-U9H9A33D4P.tmp	Rose_Setup_1.2.4.tmp

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x001900000002b372-358.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rose_Setup_1.2.4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Rose_Setup_1.2.4.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4004-0-0x0000000000280000-0x0000000000377000-memory.dmp	innosetup
behavioral2/memory/4004-7-0x0000000000280000-0x0000000000377000-memory.dmp	innosetup
behavioral2/memory/4004-399-0x0000000000280000-0x0000000000377000-memory.dmp	innosetup

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 8c00310000000000965c9462110050524f4752417e310000740009000400efbec5525961965c97622e0000003f0000000000010000000000000000004a000000000050e49300500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5c00310000000000965c956210005f494e5445527e310000440009000400efbe965c9462965c95622e00000073b302000000190000000000000000000000000000006d57c8005f0069006e007400650072006e0061006c00000018000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5c00310000000000965c95621000494e4a4543547e310000440009000400efbe965c9562965c95622e000000dcb302000000190000000000000000000000000000000055060169006e006a0065006300740069006f006e00000018000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\Registry\User\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 5000310000000000965c95621000746f6f6c73003c0009000400efbe965c9562965c95622e000000deb30200000019000000000000000000000000000000a72dff0074006f006f006c007300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e00310000000000965c94621000526f736500003a0009000400efbe965c9462965c94622e00000072b2020000001c0000000000000000000000000000005721510052006f0073006500000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1168	explorer.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2484	Rose_Setup_1.2.4.tmp
2484	Rose_Setup_1.2.4.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1168	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	tasklist.exe
Token: SeDebugPrivilege	1920	Rose.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2484	Rose_Setup_1.2.4.tmp

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1168	explorer.exe
1168	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 2484	4004	Rose_Setup_1.2.4.exe	80
PID 2484 wrote to memory of 1920	2484	Rose_Setup_1.2.4.tmp	81
PID 1920 wrote to memory of 568	1920	Rose.exe	82
PID 1920 wrote to memory of 2068	1920	Rose.exe	86

C:\Users\Admin\AppData\Local\Temp\Rose_Setup_1.2.4.exe
"C:\Users\Admin\AppData\Local\Temp\Rose_Setup_1.2.4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Users\Admin\AppData\Local\Temp\is-8PM5AKRNXP.tmp\Rose_Setup_1.2.4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8PM5AKRNXP.tmp\Rose_Setup_1.2.4.tmp" /SL5="$F005E,20048595,950784,C:\Users\Admin\AppData\Local\Temp\Rose_Setup_1.2.4.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files\Rose\Rose.exe
    "C:\Program Files\Rose\Rose.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SYSTEM32\tasklist.exe
      tasklist /FI "IMAGENAME eq explorer.exe" /FO CSV /NH
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:568
  - - C:\Windows\explorer.exe
      explorer "C:\Program Files\Rose\_internal\injection\tools"
      4⤵
      PID:2068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Rose.exe

Path C:\Program Files\Rose\Rose.exe
Size 5.5MB
SHA256 3344cd11a5c072c9a7801fc32a613d5ccc386d80fd6357f7f5d83930001583cc
MD5 8cb9e7f0677a79b55ebeb43bdc4fcf5a
SHA1 561d66b02c191a89f2fdfbef0605bc6cf3e8d40f
SHA512 0f6a48740919d4e0892bad509421940b5275509eca4aaf7a574f6ccb32fb97922c2470ecd5b39bd01b0af4919cf420b139ace1c2eab386cca2d2ed2da93f3fee
SSDEEP 98304:FRuKQA0fKtkT7LdObKJuWHHDyojmp+MTvdTBYSZiwocTEqVWpl6pd0lIU:FA6k3M+cWDJvYoGbd0CU
TLSH
T1F04633A83B5105FAD8E7423D8466C161DB3674F60375C6AF07E092AB2F4B7D49C3BA12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd

Path C:\Program Files\Rose\_internal\81d243bd2c585b0f4821__mypyc.cp311-win_amd64.pyd
Size 201KB
SHA256 967fcfd8d914e77798851d3230a4d5e4033bb72afbdccac0ad965dd56e8591b8
MD5 88d7d9160e038cbd0e43feb916629f73
SHA1 b020cc1d49b785fef9af28f553276a6be3c88081
SHA512 6c7af1810fb61335d6efa9eac74c2ef8314c0c05e167de43dab0e494c90410a61c5776de75071b7cd18a1472fc5bae0e29df99596d0f0ca3fbe2ea0c416c1aa2
SSDEEP 6144:u7eHvcmqjPWlMxkP8VXaVHaT8fyFmiGJZMzumgpypK:u7qUW3L
TLSH
T11214093A52480064DDB74279CC739622E5B2B652073256CF08D0CA755F2BBF6B7BDB0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_imaging.cp311-win_amd64.pyd

Path C:\Program Files\Rose\_internal\PIL\_imaging.cp311-win_amd64.pyd
Size 2.2MB
SHA256 eaad1713dbcae6191b925a12ce4065de247abbc06b8b1e6b36093b38d8703b29
MD5 b726a47fedc2f10fc6ad3c040a9b1188
SHA1 acf2d39739cda8ef314e0889924a39ca0cdf5cce
SHA512 3e1ffe28aa95556e14c60ff517bbe44c164ca030a836d39446e61bddcd2d8f39231b551a5e6d800289d28a259767694594484887026f2803408f12d1ea363fde
SSDEEP 49152:29Q79HlVQQ/ptaWa1f6yWKEPsoU0lP0h:3HI7fbEPsoU0y
TLSH
T19FB55A02E6A15596C6B68034CDABD616E3B1780D17F187F77284A7F83E23BD0363A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-M7KCD7CK9N.tmp

Path C:\Program Files\Rose\_internal\PIL\is-M7KCD7CK9N.tmp
Size 66B
SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
MD5 e82ce1a659755bafda7bc3e0e2d1b814
SHA1 7f0b9ccdf21682246966759e4006b013c26503dc
SHA512 a63ea8c91c8843f16bd7163ce1c570e8708ec5bbda66381cacdd53a53d8e9bf2e4cb475aa957c3c603ee9d9ce7427b137e5d5a188d1953a6ed0b496d23a3a034
TLSH
T165A00243583B74EC8BBD4D755D3F05B1552514845B115921A4C0A219B3CF478643536E
MD5 SHA1 SHA512 TLSH

Submit Download

ModernWpf.dll

Path C:\Program Files\Rose\_internal\Pengu Loader\ModernWpf.dll
Size 902KB
SHA256 dd9f01178911a942cbab963d311c675c298d288a0079b5a9bb47fc86f1a74ac3
MD5 ed8fda3862e6ba40152913254f1b558f
SHA1 304228b2acc2826d481a796bccb9587a6651e63e
SHA512 d6cd756b24b8f5015d9bcca2d1b23dbcfe2daef4693a96312678940e8c5616bd8230f3d5e3f205a12180b4666bf36a523c472567f115e36863e260330d8d2f2a
SSDEEP 6144:mNdgDpltEYomTM+oK6EzHgZmfslcMsRBY8iy7AocgBDEb24XJmtcUBpmZ9mZOmZc:mC/tDjdBDWMcU8/TkoRkujlxSys1ujl
TLSH
T1FC15D66023A14678E3E75E7F7660EC046A35B8626391CA4F76CD3F2A84C65550B3BF23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Rose\_internal\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_asyncio.pyd

Path C:\Program Files\Rose\_internal\_asyncio.pyd
Size 63KB
SHA256 746bc8fa88282afe19dc60e426cc0a75bea3bd137cca06a0b57a30bd31459403
MD5 07a6e6dcc30e1c4c7e0cdc41a457a887
SHA1 53bc820b63d88cbe889944e242b50662b4b2cb42
SHA512 837f1e40db9bdf1bc73b2a700df6086a3acdb7d52afc903239410b2d226ffd1dd5e8b5f317401bcf58dd042bd56787af6cdc49af96fcb588bcf0127d536b6c6d
SSDEEP 1536:/0f8MOytWQazE6XWpkJONIYOnsO7SyLzx1z:cf8X2sE6XWpkJONIYOndx
TLSH
T174538D83E2808595D957A074D8B30F56E771F6500B0403DE62A8D29E2F733229BFFB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Program Files\Rose\_internal\_bz2.pyd
Size 82KB
SHA256 00b8ca9a338d2b47285c9e56d6d893db2a999b47216756f18439997fb80a56e3
MD5 aa1083bde6d21cabfc630a18f51b1926
SHA1 e40e61dba19301817a48fd66ceeaade79a934389
SHA512 2df0d07065170fee50e0cd6208b0cc7baa3a295813f4ad02bec5315aa2a14b7345da4cdf7cac893da2c7fc21b201062271f655a85ceb51940f0acb99bb6a1d4c
SSDEEP 1536:CX8z7RFgpNVu5eYu00NI5OhgYNxx8bhm+uVIYCVH7Symxs:CszlF+uyIkNxebhEVIYCVHL
TLSH
T190839E93E3605AF5E45B92B9A6A04357E331BE49035093EFF75883162F13F813D6836A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Program Files\Rose\_internal\_ctypes.pyd
Size 121KB
SHA256 c148292328f0aab7863af82f54f613961e7cb95b7215f7a81cafaf45bd4c42b7
MD5 565d011ce1cee4d48e722c7421300090
SHA1 9dc300e04e5e0075de4c0205be2e8aae2064ae19
SHA512 5af370884b5f82903fd93b566791a22e5b0cded7f743e6524880ea0c41ee73037b71df0be9f07d3224c733b076bec3be756e7e77f9e7ed5c2dd9505f35b0e4f5
SSDEEP 3072:QjyeQXVhflFZtc/uTfLImTi6pX5DJIYLP0i:QGeI+/uTfLIm+cXxp
TLSH
T113C36B0B23581099EAA7807CC5B35F17C7B1B859171087CF02A4CAAD2F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Program Files\Rose\_internal\_decimal.pyd
Size 249KB
SHA256 980a63f2b39cf16910f44384398e25f24482346a482addb00de42555b17d4278
MD5 c88282908ba54510eda3887c488198eb
SHA1 94ed1b44f99642b689f5f3824d2e490252936899
SHA512 312b081a90a275465787a539e48412d07f1a4c32bab0f3aa024e6e3fe534ac9c07595238d51dc4d6f13c8d03c2441f788dff9fe3d7ca2aad3940609501d273bd
SSDEEP 6144:E7W/Dmi0FD5KaN7VqqO9a3juVQt07Ou9qWM53pLW1AT3Otjm1+Br:L/Ki0FdVI9a3juKeqcO+Br
TLSH
T11C446C57A2490CA4DE738474D89B9B47FBB278854320C3CF03A48AA76F577A323B9744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Program Files\Rose\_internal\_hashlib.pyd
Size 63KB
SHA256 87dd0c858620287454fd6d31d52b6a48eddbb2a08e09e8b2d9fdb0b92200d766
MD5 b4ff25b1aca23d48897fc616e102e9b6
SHA1 8295ee478191eb5f741a5f6a3f4ab4576ceec8d2
SHA512 a7adcf652bc88f8878dae2742a37af75599936d80223e62fe74755d6bafaafd985678595872fb696c715f69a1f963f12e3d52cd3d7e7a83747983b2ee244e8a2
SSDEEP 1536:r5m8HQNUbaxjTvKzl9mjNLOjxNHeuNIYOIa7Syuxrm:r5m8H79mJOjPHeuNIYOIaum
TLSH
T174538E46A69544A4D96781B9CDA34F57E9F2F1001710ABDF0368C18D2F233C3ABFA766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Program Files\Rose\_internal\_lzma.pyd
Size 155KB
SHA256 f5e01b516c2c23035f7703e23569dec26c5616c05a929b2580ae474a5c6722c5
MD5 b86b9f292af12006187ebe6c606a377d
SHA1 604224e12514c21ab6db4c285365b0996c7f2139
SHA512 d4e97f554d57048b488bf6515c35fddadeb9d101133ee27a449381ebe75ac3556930b05e218473eba5254f3c441436e12f3d0166fb1b1e3cd7b0946d5efab312
SSDEEP 3072:esdh8kZbsOb0Mt4zorT81qjznf09mNoqCPAaQVIYZ1Ncf:esdhBZbsm0hi78YOqtX6
TLSH
T122F33A92A394F4D5F7628C78D6624F17DBF678090310929A02CCC36D2B1FB759A2E727
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Program Files\Rose\_internal\_multiprocessing.pyd
Size 33KB
SHA256 975c1947798e3c39898c86675ca1eb68249f77361f41f172f9800275227213b9
MD5 cf0b31f01a95e9f181d87197786b96ca
SHA1 6214361452f7eaef5c710719a5cfb6109906975c
SHA512 d56b096780bb263e3f7282f163da02353ed5d8767f964937deaff997156e95749312180f25582d5963d3c351260b8ff196221652e7bf088a8c6a4e766118abd3
SSDEEP 768:z4MsRxarHWQXqTdywb7y9IYWt85YiSyv/AMxkEhERx:YzFQ6Tdywb7y9IYWtG7SyHxGRx
TLSH
T118F28D43AA54285AD837C97294A39E29D932F757075087DF2314C29E0F323837FEA75A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_overlapped.pyd

Path C:\Program Files\Rose\_internal\_overlapped.pyd
Size 50KB
SHA256 ca106e4dfdeafeabf9e98956d3d8d0cb73e109f1a96f1a7e35bc47dbd7c7e164
MD5 78e8049e26df6fd3a4011562ff8e74a0
SHA1 d5a91c720e4672c40e1dd6d54b3197b4a1f8b633
SHA512 ea7a54d38cefed870cee65dd9460b6c51131ae5219933ddc998a86d12bb093784242cb5471c77bc324ccf59fa42c2914865dcf582f74c440fa52b7d15d9faeac
SSDEEP 768:OiqKtLpqCvqlB1QIb1D1N+gpOUpEkCZ9hIYXth5YiSyveAMxkEs:+KzqC/A1hNekCZ9hIYXtP7SyExA
TLSH
T193337B02670404DADD67C2BDD8735F16EA71B4D2470183AF52A8CA4A0F737C16BEEB99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Program Files\Rose\_internal\_queue.pyd
Size 31KB
SHA256 3f8e7e6aa13b417acc78b63434fb1144e6319a010a9fc376c54d6e69b638fe4c
MD5 7f52ef40b083f34fd5e723e97b13382f
SHA1 626d47df812738f28bc87c7667344b92847fdf6a
SHA512 48f7723a8c039abd6ccb2906fbd310f0cfa170dcbdf89a6437dd02c8f77f20e6c7c402d29b922cdaabd357d3a33e34c3ad826127134f38d77a4d6d9c83371949
SSDEEP 768:R7Vej6rsdmxUnJIYQUA5YiSyvyAMxkEbF:R7LsdWUnJIYQUS7SyIx3F
TLSH
T1D1E29F83AA586C46C437C47594E25E39E876FA42570183EF2219C25D1F333427BBA765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Program Files\Rose\_internal\_socket.pyd
Size 77KB
SHA256 a19e3c7c03ef1b5625790b1c9c42594909311ab6df540fbf43c6aa93300ab166
MD5 b77017baa2004833ef3847a3a3141280
SHA1 39666f74bd076015b376fc81250dff89dff4b0a6
SHA512 6b24d0e038c433b995bd05de7c8fe7dd7b0a11152937c189b8854c95780b0220a9435de0db7ac796a7de11a59c61d56b1aef9a8dbaba62d02325122ceb8b003d
SSDEEP 1536:kHan8OG4wAM/Hh2JO9/s+S+pzpTzVs/tiTFVf77neJIYLw47Syt6xr:8an8OAF2JO9/sT+pzVVs/tYFVT7neJIh
TLSH
T1BE736B11A69011AAD2B3C07AC5634F23F774F4C1179597CF1264CA6E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Program Files\Rose\_internal\_ssl.pyd
Size 174KB
SHA256 ba5388d6a6557d431e086734a3323621dc447f63ba299b0a815e5837cf869678
MD5 0f02eccd7933b7a7c2bdedca2a72aab6
SHA1 0b4c551d8fe34d8128e5cf97daa19eb4c97db06e
SHA512 90a64082dab51380e05c76047ee40e259c719d7170fb4acb247b68a03b710461b350da3821b426fd13167895ded32f9c5ec0e07587ad4125683a18a3495f5ed5
SSDEEP 3072:mn5VVb4iZpIy+vgSf36XK7DapGB4JQELqOlh59YL48WKqgVl5pVIYC7Nb0CY:m5Vp4EaDD36XK7r4JkQY
TLSH
T10E047C47B59469B7E817E4FEC1230802EBB5F005331157CE49D6DA8A0F07746AEAAB73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_uuid.pyd

Path C:\Program Files\Rose\_internal\_uuid.pyd
Size 24KB
SHA256 e6aa7f1637e211251c9d6f467203b2b6d85e5bc2d901699f2a55af637fa89250
MD5 cc2fc10d528ec8eac403f3955a214d5b
SHA1 3eefd8e449532c13ae160aa631fdb0ad8f6f2ea4
SHA512 bf18089bd0b3a880930827d2035302060ea9db529ad1020879e5be6de42693bd0a01b40270b4e93ceaea3cfed20dad1e2942d983cde8bb2c99159b32209b34bb
SSDEEP 384:8ZL2/LE/t8Cfi/1VIYZwXmHQIYiSy1pCQgyaxPAM+o/8E9VF0Ny8/r:8qLadI1VIYZws5YiSyvXaxPAMxkEq
TLSH
T1B0B26C92DA605C55EC2789B1A4E54F1AE935FB824B90C3CB330CC2555F613C37AAA3B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Program Files\Rose\_internal\base_library.zip
Size 1.4MB
SHA256 f5908f37a3e301cfac1d435a9ea728097717f204155c881536b17e4e5c83e5b7
MD5 0cbf40b73eb279c2ea5b3d1c9c626cf4
SHA1 d142a7046b8871ca83dfde051c67bd1c836d0bbe
SHA512 96765b3b9303c96a2b1d9ad0ca099ecd5c86024f7a2f1f0f1715202427c1350ed851b6954603e1d52af87e4244051237666bc6b112786c0334b8da008b81b49d
SSDEEP 24576:mQR5pATG8/R5lUKdcubgAnyfbM3AKwjwhxdmzRPLaWHHN:mQR5pE/RtQDP
TLSH
T1626509817982B5B7F804F3BB4026090DB328C5B4FB44C75739ABC1A69F9E6A47E518DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Program Files\Rose\_internal\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Program Files\Rose\_internal\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Program Files\Rose\_internal\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_psutil_windows.pyd

Path C:\Program Files\Rose\_internal\psutil\_psutil_windows.pyd
Size 65KB
SHA256 e10b73d6e13a5ae2624630f3d8535c5091ef403db6a00a2798f30874938ee996
MD5 3cba71b6bc59c26518dc865241add80a
SHA1 7e9c609790b1de110328bbbcbb4cd09b7150e5bd
SHA512 3ef7e20e382d51d93c707be930e12781636433650d0a2c27e109ebebeba1f30ea3e7b09af985f87f67f6b9d2ac6a7a717435f94b9d1585a9eb093a83771b43f2
SSDEEP 1536:BWseNxkc7Xva0Y420G1UD+dS4QBeLmRy:BWkcbi0Y42bUD+dS44eiRy
TLSH
T145635C56B35800F4D95BA17C89B36A33E9B2B0521729A7CF05A0C69A0F63BD7633DF41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Program Files\Rose\_internal\pyexpat.pyd
Size 194KB
SHA256 c7c7564f7f874fb660a46384980a2cf28bc3e245ca83628a197ccf861eab5560
MD5 79561bc9f70383f8ae073802a321adfb
SHA1 5f378f47888e5092598c20c56827419d9f480fa7
SHA512 476c839f544b730c5b133e2ae08112144cac07b6dfb8332535058f5cbf54ce7ed4a72efb38e6d56007ae755694b05e81e247d0a10210c993376484a057f2217c
SSDEEP 6144:VK/lLDYZL1p13eiG7eDT9AmNfLVuOgOgOgOgOgOgNltwZSm:VglkZHLVuOgOgOgOgOgOgN0sm
TLSH
T131146C5BB1A2C0EBD8838038D6D34A0BDBB1B865039197CF52C4EB7D5F277523A69319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.dll

Path C:\Program Files\Rose\_internal\python3.dll
Size 65KB
SHA256 db84bc052cfb121fe4db36242ba5f1d2c031b600ef5d8d752cf25b7c02b6bac6
MD5 7e07c63636a01df77cd31cfca9a5c745
SHA1 593765bc1729fdca66dd45bbb6ea9fcd882f42a6
SHA512 8c538625be972481c495c7271398993cfe188e2f0a71d38fb51eb18b62467205fe3944def156d0ff09a145670af375d2fc974c6b18313fa275ce6b420decc729
SSDEEP 768:Iw/EsYpkVgBaz57kcDA7QKFmpz7cnzH/ks/KF61xubwmB1Cf//yhC74JFmpktJS0:v/5k8cnzeJWJIYL0D7Sy7x9
TLSH
T134636E529B58F8A6DAF665FC38D19DCE143B12CC87ED88DCA57893D30E1A310A62734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Program Files\Rose\_internal\python311.dll
Size 5.5MB
SHA256 0817a2a657a24c0d5fbb60df56960f42fc66b3039d522ec952dab83e2d869364
MD5 387bb2c1e40bde1517f06b46313766be
SHA1 601f83ef61c7699652dec17edd5a45d6c20786c4
SHA512 521cde6eaa5d4a2e0ef6bbfdea50b00750ae022c1c7bd66b20654c035552b49c9d2fac18ef503bbd136a7a307bdeb97f759d45c25228a0bf0c37739b6e897bad
SSDEEP 49152:4kkzsT7AzjUaeLdj6UTSGKzuePQaOviRvYD4Kus0GYr3jDKPpWjrM06biCnCIS7E:wsgreBltVe1EsJ5CrSQHyMAwdp09U
TLSH
T146467C22B2609460C9BB4172DB2F865ACB71BC505F10CF0B51A4B7AA2F73B531AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Program Files\Rose\_internal\select.pyd
Size 29KB
SHA256 bae0974390945520eb99ab32486c6a964691f8f4a028ac408d98fa8fb0db7d90
MD5 e4ab524f78a4cf31099b43b35d2faec3
SHA1 a9702669ef49b3a043ca5550383826d075167291
SHA512 5fccfb3523c87ad5ab2cde4b9c104649c613388bc35b6561517ae573d3324f9191dd53c0f118b9808ba2907440cbc92aecfc77d0512ef81534e970118294cdee
SSDEEP 384:oG0ICxeeLn0XHqYK/57AvB0KJIYQGFHQIYiSy1pCQuRWAM+o/8E9VF0NyMl+:tieOGHqlGxJIYQGp5YiSyvHAMxkEN
TLSH
T15ED28F57AF646845D923C9B2ACE28E1ADE31B6924710C2CB3368C15D1F317C27BB77A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Program Files\Rose\_internal\unicodedata.pyd
Size 1.1MB
SHA256 37c68617fa02a2cadced17ef724e2d450ef12a8a37215da789a4679fde1c5c02
MD5 fd9132f966ee6d214e0076bf0492fb30
SHA1 89b95957f002bf382435d015e26962a42032cb97
SHA512 e35729abc45e5561aae1fb9e0e7c711dd7d3c1491520aa5c44fcc50c955f549f81d90897959327e930d02a5356afe08d6195adf002c87801a7a11235670639b5
SSDEEP 12288:bdYbfjwR6nbYonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eD85U:RYbM10IDJcjEwPgPOG6Xyd4685U
TLSH
T195355BC9BB828D66D87B31B944D2212F1361C273476B133BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

backend_c.cp311-win_amd64.pyd

Path C:\Program Files\Rose\_internal\zstandard\backend_c.cp311-win_amd64.pyd
Size 512KB
SHA256 35f7bfe8d1965fc33c090febd216a4ef5c3a8b22ce02a689226a3776cc295317
MD5 271f3097fb3b128945e53ed215b2a7c2
SHA1 5e2e5f8e2dd5f05b853979d3db25c1b30c9c0bfd
SHA512 c7a361226d799debef16515ba141b94908aac53cd736f9218a72635428de0da01af25035a9052a5232dfd0797bdee19e99fe562b9efdfcaa5c07e01ad1f957d9
SSDEEP 12288:516JV+Txz0kSV6XiJ0P/eVh+Dd3ImWlCa:571zw6XiJ0PWVhWY
TLSH
T11EB47C83F29853EDD13BC478C66A9617FBB27409132466EF82D4DB653F13BA1963A700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModernWpf.Controls.dll

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\ModernWpf.Controls.dll
Size 694KB
SHA256 70bb5bb9b0268be973d13edca5eecddabbc07f58423c88c4f6eda6bedbca8e99
MD5 d15a185401ecd8375a0dcfa3d3c384e2
SHA1 0aaa6a4a1b113f9020b8d9895a7649ac9c078723
SHA512 29f3989d16eca7c95eb613006bd0ec6f8450d3f6855a8469405a594f639029660fe549aff076bbf53bbd5b2cb758848eccc6d89a934357fae8817b735b341da6
SSDEEP 6144:jKkexyhf67QfVsu51Nd3nLQ0X2M3aH5hAl5aCKF0sRK2tqZoKDB87VQe+8qkLD4n:jKTyc7Qd3ngoNosgwgEUg+
TLSH
T1C8E48D6533B8093ACABF6B36D0641914A771E80213FADB5F60856BAC1CD67834F426F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ookii.Dialogs.Wpf.dll

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\Ookii.Dialogs.Wpf.dll
Size 102KB
SHA256 c5c2b40eb870cf4f46e002a6c40656096cbbf7c062c19bc01ce26e503611553f
MD5 c124d6f1980a92e97518751605c98d4e
SHA1 a39b5e53f150ed608e6cae8265ef03dd5a97979e
SHA512 0cbfa12d84da80bd38a662a8b8eb79c01d5be74775e99cc258ab409c97139e94bd4f68746d29d1838b91b31a66ad234bb9339151a96dc952dee1ab816b54db3a
SSDEEP 1536:XKoPxbWbgXfuj4+fpcyMgefde4uS6a71xLqbK09B/XVbCsawYfE5bpzh8sm6b0Ee:XKwxbWEvj+hKde4ugqblxXVbWs5/q
TLSH
T1C2A36C76239C8AFAD9DF0DB4F92141D58330EA443566EB638889716D1CB33548AA37F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pengu Loader.exe

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\Pengu Loader.exe
Size 2.4MB
SHA256 228541eacbc6d806323157f5bedf28986c8745148899aea4adc89e96c18ca348
MD5 3530ac4dde5d4a1cde20f7803fba7066
SHA1 d1a1110256c70972978b0edd8ce58784bf69098c
SHA512 f3f3241c3a9e43eb0c584954bb21126c70cb1449e2d7713328384533797092f7825d036ba49348a02db0f7913ba3aed2b1345496eea6096db02c252b4b1e1244
SSDEEP 6144:Q/XfKS+Hb1PuuLAywB3puuLAywB3puuLAywB3puuLAywB3puuLAywB3puuLAywBV:wKbP7nnVeWZmVM9RtvnVeWZmVm
TLSH
T19AC54361A3EEA259F3F76F456EB812564E6BBD93BD39D20D1240004E9C75E40CDB8B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pengu Loader.exe.config

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\Pengu Loader.exe.config
Size 176B
SHA256 ad8267122c40d37dcd9d99e1412d763187a1825732f378db8867f3ecf675cf70
MD5 21fa0b1d75c0cc7369f1e735fe90c7a9
SHA1 e2d01a1b6aa66e5d3ed575aca79560b014bbfefe
SHA512 60f6704cd1b3035a1a3403ee3870c7cbc13d6e601172745336ebbffa2ee3dc21785702470ab006c69dbbde0d5525625bb25ade5c641c80c8165fbc46fdad2ad0
TLSH
T1D8C080154098BD274D334F176351C525EBB072526464040CF42F9657073104D4247326
MD5 SHA1 SHA512 TLSH

Submit Download

System.ValueTuple.dll

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\System.ValueTuple.dll
Size 24KB
SHA256 e905d102585b22c6df04f219af5cbdbfa7bc165979e9788b62df6dcc165e10f4
MD5 23ee4302e85013a1eb4324c414d561d5
SHA1 d1664731719e85aad7a2273685d77feb0204ec98
SHA512 6b223ce7f580a40a8864a762e3d5cccf1d34a554847787551e8a5d4d05d7f7a5f116f2de8a1c793f327a64d23570228c6e3648a541dd52f93d58f8f243591e32
SSDEEP 384:VyPa16oAL4D+wW9IWmDIW4IWYDMFm0GftpBjMIraQHRN7VlmTpF0:VWs6oqDjADKeDYViG+LN
TLSH
T1DBB23955DBFC5143EEA35E7066B4D6873C3EF7C35D21862E106AE14A1CA37C1AB20B29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\config
Size 62B
SHA256 aec2acdc12bd07bb1c9eb3970f523e6c94194ebe1948473d57a4a1ad26e8b7df
MD5 8fc59c2ea3fd5bd3c1f10c46fd71ef99
SHA1 e0e1832bd47eaf2293f0d45f172ad864c779a77b
SHA512 ae1c4d2192db5c2ecda60096d91c272934c1ef0c880c39021ddfc703b20c1449dd67e53a8ca0a3d6d9d87b9655aa3b85cc48db1b2ee0f6d276575adec3fe92eb
TLSH
T1A4A00252AAE25190D81AA510F8F7B8AB46F485EE05834E4C90599C753162D771075500
MD5 SHA1 SHA512 TLSH

Submit Download

core.dll

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\core.dll
Size 485KB
SHA256 0d87a88abe8f60de591e3443557cb29b707e446f5eaa95248ae56082273a0810
MD5 9ab23916200ce87b3d21d7e3d586744a
SHA1 93c2e892922114b11b0bd634160992e305e9775f
SHA512 012e71a08ee31d1f8bec45e309c2b059f997fd9ead6373a3d1682df9403c78676b6957f8fc30646ffa0c213e78c66a962de76234766cd009b172b5a12def77a9
SSDEEP 12288:W7sIiSeDE/DfQ0jJ41q3YgMujtSOv1MDWd+he:fIiSV/7lj/YgMujtSOv1MC0e
TLSH
T1B2B49D1A73A4117AD5B7C1B8C8B34906E7327C565B649ADF23A089AA1F33FD0863F711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-ChromaWheel\.git
Size 68B
SHA256 bec3d5bec4baa04a1332ec77eeb1896af607fbacdd0c752ec4dc371b273f7469
MD5 2d287d1dfa12148dd1ef5f74989ea07d
SHA1 65a66644645d25949f26d641590a51a34c912dc4
SHA512 0fac7e095826267262a14b2bf2081c02e978f83bfda8a6d59957d2525fdd62bac69089d52267f37b4f110269f3588ab95466d46a70c60314620ad16c1ddb1089
TLSH
T119A022B00B3C3E8E0C20A008F8008C20AFC0CFF03320CB03202C303C80800A8C280830
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-ChromaWheel\index.js
Size 133KB
SHA256 286a727f627906cbad02e9b9e644aa1abfe335018b2e1219ddc9b1321baae9c5
MD5 c1a16314ba923fd70e3725bdf590dd8c
SHA1 aa5acd9d72a89c7d163ad84037a127eaf5720ce8
SHA512 3ff9fd578747105228c99b0624cf88c5913c85b93dcc7a04aa04db8315ce9f771bc4380bdce7d4f7f353fdc08fb624c79c556a964680070aebe740000087df8d
SSDEEP 3072:IXQgH911VK/ISa01yiwOIzHz/eKJKNVR62moqZe:IVH1VK/IuyiwO2HLeKJYVR62moqZe
TLSH
T13FD385581112192EA573936C4F579054FBA6B03BA34082653DFD83482FB1994E2FEFEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-CustomWheel\.git
Size 68B
SHA256 887d10231c50451692026d0cbad4b0d6c12959b5503219ea81fb6e8825615729
MD5 8a4bae79d2cda2f00443ef13eba2d627
SHA1 f86058aaf90c16f2397386f304cb3fd9bc045261
SHA512 5ad58988d33506b97135a01a5fb2dbaaf6d7152a463614877b29fcd6db1fcf6f940d089a3b288beaeb141d853814ab842cb227035302e83bf1a050200cc48bd0
TLSH
T13DA011A00B383AAA0C202820B8008CA0AAC2CBA03220EB0A202E203E00808A88080830
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-CustomWheel\index.js
Size 98KB
SHA256 3b5c57d415c7f07dfac3ad33de4d74be74b141f5adbdd87f53b75df58a1c8a65
MD5 1ccb59ab2558e2ab5e53de85ebf98746
SHA1 57783f22453fc3b85a879bf3ab01a880177bb594
SHA512 14bae13473a3d6f57fd9622a638a53d0d5de83bbe3065db210eda931eac9cf87c9a4010b6cae0120c4830baade76993b3fa72465462c294c6ba464fef636ea8f
SSDEEP 3072:F51bg7ImlylhMxYWfLPY9/+5DJf9ABIZjUTUrUeUVURFiCkVndFSB/r5VOfGTsxK:F51bgRylhMxYWfLPY9/+5DJf9ABIZjU4
TLSH
T18CA3A4C92025127985BA63BAAFE76088FB647067A10182983DDCC61C1FF1994D1F6FDF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-FormsWheel\.git
Size 67B
SHA256 b619a006d8a1cee1c787fa1c5bc46da5fc671e26f612a5eadd792a0ace266413
MD5 c441659eff3fd45d83ba70858770d5e2
SHA1 ac92ede9542c0ae3fca6f95ecf3a0d6331183bb3
SHA512 8c9de03c96f3a007c6ee8fa84ccc3321cc65390ec4d7334f220983f4ab4fea00aa12cd71d9464fa8c1dbcd5f6c0c42cd41160fc054fe544dd1fc518ce168ab95
TLSH
T181A011A00B3A3A8A0CA02000B8008820AAC0CBA23B22CA02202C202C0A800A88200AB0
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-FormsWheel\index.js
Size 179KB
SHA256 e2bce5bf6ee408eb4600674a634f9cc4fd4a1e5ac874d238ab9c406df6db461d
MD5 733de097153a915c6bab1ab6dc2daff7
SHA1 3c143ece16efd1d95feff37e5a32e301772ede6b
SHA512 e356191e79b960e5ca515322ed308883b0d1d5ce336a5c18a26e021b092645c05be7f87bc5dca8ff1d4a6a9c297730618e44d2070418ed2651a799805a42592c
SSDEEP 3072:L1ZMyRlVK/ISa01yiwObFsEz/KbJMNV862m+oZH:L11RlVK/IuyiwObSELKbJ6V862m+oZH
TLSH
T13C04B6881242192E623357AC8F579144FBA9B13B624095273DFD83482FB1994E1FBFDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-HistoricMode\.git
Size 69B
SHA256 10fd118e80942ee138bb337d5f8b25c332520d7d4de919290b5066b0574aa4ce
MD5 21258b937f9b17e29eea71f93690ee3c
SHA1 b4b363d36ab3578d01431a7078919fb6de2996c3
SHA512 ad0a253bea566909307a7a43d7356d9ad79e7183bf031efdf112fab42177c78aac1714a29867e7f1c8d69e1dcfaecd769fcc682f741354b6fe42d2db6b2129b3
TLSH
T1B6A022B20B3C3B0E0C802000FA00CC20BFCCCBE03322CB03A22C203C808C020C2208B2
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-HistoricMode\index.js
Size 40KB
SHA256 4eb15ad0892aaff58579a49fabae9fb409e22d922c47df8dfbf1b0892eae0d41
MD5 91d1a2a3906633ee7c0494df2390d083
SHA1 0a579a3056e4f2d8ba81a97c8d5398f3873c2c48
SHA512 1d50ae2332eabc3147c568f3d543b73fc092c64c5482fa923955518fd8951bc481bd864cfd881bd4c5517e926e5a267e6f4365d7e2ffb2e648b42351fae2c394
SSDEEP 384:xJAI+Y7cswKAUil+hvl7RXomcLqJnAY9ntrRGE0SsMiXtSTdw+rLRDx:xJAzYpw3g9i3Mgt+rLRl
TLSH
T122139455200508739A76923D6F82A814F766614BA133C7197EAC83881FF1D98D1BBFEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\.git
Size 61B
SHA256 80d7b9fb4ad1312b912b3df0755f98db2b081f60f0be38e98043193f8e79ea87
MD5 b52793fd5425b8fae3600ffb90cabef4
SHA1 7572ab70d5051896560f317406d36520c1a2210a
SHA512 bab99b552c4ce6a746de02bdaae4ba4d4a43ede0c2a25d454634d06db25dfc18e9259cd6708ead97fedfe36d2113111ab64c7000b80e27be90c2b495f2e75413
TLSH
T193A002B50B3C3A0D5C54AD55F9008C606FC5DBE13325DB27612D207D45D5165C151D79
MD5 SHA1 SHA512 TLSH

Submit Download

border.json

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\API\border.json
Size 4KB
SHA256 c5e35fb73288f391ce6f39bed4507059de127498180f7b09caf7de99152cbe02
MD5 886d2b87146cc9e6a68f736db3ba9475
SHA1 48e3c1c6e38e66a49a3505bb3f4350c61360759d
SHA512 71a4a45c659bc1606d77ae16a74cbaeff503ff5408341f765b8d75504b1d04d95ac5e31f2d576ce6ed565e8587d269bb8d81e6ccd222bcae796e2838250b9ef0
SSDEEP 96:dExzqSfh4Ivd3emzIS8MCIJh8mz3WEdtfIS3zqhSxJhVasnddDJs3:dExzqSfh4Il3emz18MCIJh8mz3WEdtwF
TLSH
T11691B532B4E2686B40A0424670FA05BAA340127FC6239A4FB5F51C2BD76FD0A555B7FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.png

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\assets\logo.png
Size 356KB
SHA256 afe1d4072859fd75a66ef198529af52484ed774be682c5f368bf923c50ee469e
MD5 b6227aff8c13606545428d28be6c9ba8
SHA1 2e26d2aa961d31d671d6028491cfd5519157fbac
SHA512 3c490a72bc9479198e52148b454eef19c5dae60d5ac2ed478b44085ebf6ac3aa0d31461dd37f2cb8e7a1e66992693386671ba1d994ea7a2aaf821794ef78fe33
SSDEEP 3072:vumR3xpeFpGpmdswO1Rvi0U7xxVg3xHlSbS6rhKY6t4s7D:fR3neqEyrvs7xqlQtWVv
TLSH
T12574BA12BF44ED06D1492A358961D7E51321FC4D9B32C38739C9BE6BBFADAD36E41280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plug-th.css

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\css\plug-th.css
Size 7KB
SHA256 67b108d960a4525ba7a992bda6ab603434db074df7623eb61e31f70c27118c17
MD5 287e8f9726e1ce24fea9308cf57cdeee
SHA1 7f0a880ce593ea39563f955ab54cd41846bfe61a
SHA512 f9e0b675ace8f94cd84aaae03af4684af66cc48285dde4ee077daa37ad3fed5ae1f75081d628e4ebf803972e2eb7d7e2a938bfaa7b84fa4832fc164bde204363
SSDEEP 96:rIWtXq6EfWbb14/0gv3K3B14L8Y2PQutbvzAblbuVWg3yBq/BvOvzdvCnpP3nNNL:rIWtXL6a14/0Ma5PQu4Gk1ClXfss
TLSH
T103F1FE60EC490166B97AC73C77C599C7FB9A2022DD03475F3B8941602BE63B8D9AFD90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AA.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\addons\AA.js
Size 17KB
SHA256 ce6279658e62b13a64974efc6417cac142d232e768211768d0472921fbb6ac00
MD5 8baf6407f2d28516639d3c5c72c1add5
SHA1 c41295d193901565e32f4857c247ccf66163810e
SHA512 7839aa4ef0635a358860846568cdc227887345b3be8b03fb5df7af2e3915fc76479edf567f95025afb0974f72475d644e6cc9502478ec5094e2f3ecf083277a9
SSDEEP 384:l2qlUa3j3g32BYml36Nl4m/MzbaeTX1BwPJ:l283GzeTX1e
TLSH
T17882110A222E0119917263399F625709FA3A456F0702C9B93EFC81C19FF5CA456A3FFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinLose.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\addons\WinLose.js
Size 30KB
SHA256 b7781d51e2d0945d6c5dd2609c75321fdfb3c127f7dba6faf913554a762075d8
MD5 19e3daa4536550fb3cf63033670fa7b6
SHA1 c1f396c5762a2215741191589be8009d1ff031df
SHA512 e5d2923161b2184789f10198bd784b1fe2a3d749dd779e6c1a56055269775ff0a03b9a7d75fa2233b097eaad4d76aba5288e8e84f9ff8b329b365b5797c059b1
SSDEEP 384:yBqtLmTin5Kr0DrkerZsKrXkrcWf12cz2I5YUW3W3DrwW3Lypl:JmTiSRrcWf12KQUW3+DrwW3Lypl
TLSH
T101E2861991950523487362F95E56174AFF3602176103C66E3E7D82866FFBC26C2A3FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

observer.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\main\observer.js
Size 5KB
SHA256 37975ae8eac9e741ad6f79fbc09465a4fb7c245be8cdc0b2cc46898cc85667f7
MD5 3735503f24fe8d8d606f6a72a48ee007
SHA1 6dc8af999ad1fb7bb2cb2c11b894324e7586dee6
SHA512 ac8ca7b7fca18bbe2c95d46b9ff629de42fe8172af17701aa7a327740ac7c71591839558fd6898366d701b39fbcfab1209f221e2d96c5da5cdb2163e6b484d47
SSDEEP 96:+CGtlFhlccmAaonwioHYyVzVDa+wzxHxjp/w1owS5SshBO4hj39h2i2hKmZuW6YF:+C4zOBRHDVzVDa+wzxHxjp/w1owSYshG
TLSH
T165C1AC48651213A708FF773FA417171EFF2E4093693A41913E8C87926FB0E9417A6ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shadowDom.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\main\shadowDom.js
Size 2KB
SHA256 6fddd6590edc62834aee6e94b2c808d2db50ad1e345bed162987870ab47d67e7
MD5 6d887024f5c195ca14fc34676cf37500
SHA1 cef0357ec4cff4d95339cf5b64f0ba370f436c0d
SHA512 919e1903a0b8e0e7cf35dce95749b6eac4f62ee9774ca1e9dea7aa39434777bdd169f6ff22b1a751e270478eb540ae06b326c55a69ac385f978146654aef6541
TLSH
T11341CE123972B37D6590120A6A7785DEAFAC502DF1382BFDF7A5F22850739E48090A99
MD5 SHA1 SHA512 TLSH

Submit Download

RegaliaBackground.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\RegaliaBackground.js
Size 67KB
SHA256 411aef756c243f90483d222608219067de58c07c9b8886ecbd61d530462b22c5
MD5 aafe1762177acae4df4a0ff927a03323
SHA1 f1b405df16aa5247d7fc78e35aab7164a0f7f481
SHA512 576aacaa49c599149ca33ba8d4dc0eb0c9709011106a510e399ee7efc39faa4db6a44a0134b2fa7a307634fd5b3c89679bdb3731231dc1b315235dff75bcee96
SSDEEP 1536:j8Xc+W5xiIATkTyemYWA4bWqmnCCGsqO6zQuGGslSPA02vXB:IXc+W5xiIATkTyeesnCCGsqO60uGGsll
TLSH
T15D63A864527A0135827673796FB64A09FA7DC03B9200DA6D7DBD90A82FF1C5092B3FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegaliaBanner.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\RegaliaBanner.js
Size 18KB
SHA256 293490af0f2e46d6e00291f629e5d09b73e33a2b5ef868b4ea8eab5e6ace9d5b
MD5 4f807312b618e2b60adf0f7d66c8b4ab
SHA1 97bd1ed3dc7085620146495999e916ef5baf9efc
SHA512 e548d2a6f6216918e991802d6e2998e0614371326d2893e4491d68a6ee9766a9c782b3043f0b09abaa8862a0219339c48d0779de6eb6b6bfb13ee74253d40671
SSDEEP 384:0SCc+6lMasM8S9mMfRz0rWlmF4NHMjB4CH+ABwWCOgVj:DCpNS9mQqsO4RMvBw3F
TLSH
T11F9234559E3A0536C176233E5F724E59F622A03BD201CA483F7ED5A42FF9C1056A2FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegaliaBorder.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\RegaliaBorder.js
Size 32KB
SHA256 d723c89d3b21c8ff16d5502dcd18bff5f2d6ef30b4ef44e4a0bdd4e18cbe0b37
MD5 634af163d50060b4bb5fb141431a78d0
SHA1 506748aa2431e4f4896f91e11d01dc290bf95f75
SHA512 11eaa969ad76a3da4dfb8d9d32b5bc7f5d8446a7c726aea6cea6fea332081b292e487b329e3eda655aa4437efdba5fc285e4d38de796322fa5a4d31eb3b83f16
SSDEEP 768:YrIkC8UmCNAsJiEjhwGs1C3JFGEhK6ig6oqdEoeR+tC:mIkC8UdNAsJiwhwGs1CFGEhK6ig6oqd6
TLSH
T1ECE28429773913368176532E5FB38D9DFA2A803BA701C69DBA7DC1A41FF1D6090A0E74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegaliaIcon.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\RegaliaIcon.js
Size 30KB
SHA256 d0eed2cf9a1881dc8c74ac832f40f78b5fc5e3d0d6eaacf5700750324d33d1aa
MD5 1b20d12d3537e571e6a46d996d0c41b9
SHA1 c8db7cd398d5ac560b592844a863d8e4aafd4ac3
SHA512 e2aa045d465d803ddc527967d707e0b77e2afe575cd1244b84442be25a879333fffbcb8ed3320e1b641af559bc2d45afb69e969077985910a9c0c38328c8f0e0
SSDEEP 768:grYFVP4j4mgM9gmWAvBi4RRpX4fBKksIwP:OIs1g4gmWAvBi4RRF4uZ
TLSH
T1E0E28654F77A0236F37A232AA7720D09F935D1375A00CD693AAE94A42FF1D5053A2F78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegaliaTitle.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\config\js\plugins\RegaliaTitle.js
Size 19KB
SHA256 a83e7650ebbf963a9909be45a81c4b7ea7330c099a974844980dd0010aae8a47
MD5 d2d2d6a96b16cd7c187393f2625daff8
SHA1 3c2eebee771e1f3f50146ee2cd3c547f99b587c9
SHA512 e2957f457eced36a67000fd0dd94101af1e6680743d6a112002dbc78253cff208148d026364cdb773f1aca9634e8d9cf4bdd7adec45f4d54d44579bbf15a4cdc
SSDEEP 384:vhCaOtgQSvmv1yT0p6gMqWlmF4NHpp7PBfB4CV5DLV+mh5gEgvN:vhCGvmtyT69sO4Rpp7ZPbw
TLSH
T187925369963A0132917773365FB2AE15F622903B5681CA087EBDC4952FF5C20E1F2FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js_

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-Jade\index.js_
Size 32KB
SHA256 5e55551d3ff4e26a8ff983cdfafb6347f1d7a92a44611e236752fa22ff789e28
MD5 5b1995100b6cc2d47a3116ff04812695
SHA1 8c68b0889ad96ee66f621fb9b1cfc2ce558385c7
SHA512 75c8e4f781595d89f1d7d656bc5df9d82b86e036b260b6cf05c5cd48971af32ea5ba58890287a19e530d08d534de67a4b85c480767a55adfc368833894645b41
SSDEEP 384:lv+BnqYqM+uiro9lFeel1ZkIfB+Ny3vDB7mBwIRQI5RymOvT:YBnqY6hr+BvvDB7mBwLSM
TLSH
T1A0E2641A256121164533A379CF135F09FB3A066B1214C9363FBC429A5FFAC918663FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-PartyMode\index.js
Size 35KB
SHA256 ddc88ff365f1904b828725cf9109889a07d93683e6a7e6a0df5a9da27730e410
MD5 bc9079964a05a6cb232fad08dd0434e2
SHA1 ae22e570b886266eed23334fe297966aaea50c89
SHA512 fd40dfa0c07e3c69c24b95206b2c6b76d24272434e7d6322019ee86a5a59bcc1de5323d6a2d9cbccb5797978d7cd45d5010f1c38fb8628ea6f9a30acc5d45c01
SSDEEP 768:QQWVYZI0nRWFeBUI3mGt2UnjJPlsWyBw6L:QQolFYh2UnjJPiWy66L
TLSH
T18DF2D65660612971817B67B8AF634216FF21902B9F1142287BDCC3881FB0A68D5B7FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-RandomSkin\.git
Size 67B
SHA256 2dbfb1ea1536ee1da089951e5f64fc9067cbd2bdb9f8b491cdcb2a52ab77f3e1
MD5 5557435bc589b49866ab70289bfe32d5
SHA1 6180efc257df43502dd62e3c051ab51e1033648f
SHA512 12a0eb894648f3f6f33dcba92ae56ea4b7bbeacf1628d32ae5e41dd4d9524ad431f0c1ad038b5881d68a0690319d5c27c4d0309d5793904514f3038d5b04ef56
TLSH
T198A022F00B3C3A0C0C802820F800CCB0AFC0FBF23320CB03302C203C0080020C082838
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-RandomSkin\index.js
Size 24KB
SHA256 f07c3d00b6c0ce806fc4e949dbc3626520729e0a1f2ac62c5e0d569c17b3eef8
MD5 4fb5abe9da5520d00f840466990e6c32
SHA1 2c7b307e70860b622ff0db651f22e4462289d470
SHA512 095c2a0698663937aa9c8bf3df13965ea2750ac2b207a38ee77015e5c61ff1393a1a4871b4a3689c9ecc0ecbb28cf3fe8d1f97b200dbb614f150897bd4c9652c
SSDEEP 384:IARVRH0pZrGhGz22keVicE6soG3iVk+iaRzk6HQOIV+hwKhDs:IAR3UpZrGhkYvoGyKPaRzk6HQOzwKhg
TLSH
T1CAB2964031532133A679622EDF536168FB75613B5210EB2434EE83782FB591092BAFEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-SettingsPanel\.git
Size 70B
SHA256 8d19b9079cf5da07919b18c01666cf53746cb6191ba00316d0f94eb063e0ac6d
MD5 5f8954173fba17d917800632d337c9b7
SHA1 84d6ecec74c97406cd94da3f37bd9413512af311
SHA512 c35740071501cdc4e8d9cd8b02783daf7a6ff5203859ed3580ca177ca3fd114d944e08cd01dd8b5e2c80ed3f8a792e9aa1be4e33fe95213c4be7c63984afbe84
TLSH
T1CBA022B00B3C3B0C8C802000F8008C202FC0CBE03330CB23202C203C0A800A0C280A32
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-SettingsPanel\index.js
Size 126KB
SHA256 0955040928acf5ccad6540480374a344bdb79d819d51323213699a1f8467a7c3
MD5 2a93c645763217b63a96897828887934
SHA1 5aa91dd43c1a088cc17b752f19079ed3e4306d4d
SHA512 185ad703783f54f4c252ff4bf36a78f39756cf6fd1c7347b18269fcd2247325e99a9a4f2a6f321e3b33dd088d2529467ae277296d8c65b0612f95137b6f98eea
SSDEEP 3072:8faggz4DFiXAtURHff0j8H1LOdvbY/1DQAyyIU5kzgRWa8o8VsQorWLz0qODQ9x:8faggz4DFiXAtURHff0j8H1LOdvbY/1Y
TLSH
T19CC3B415A1651226C8B323395B735319FB72502763008AA879FDD36C2FB1DA091B7FEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-SkinMonitor\.git
Size 68B
SHA256 f0f80c813bef2766a726ef1a268f75eb45ba9069d2083514caa9ba8cfda671db
MD5 a769b8cf5a7badf6df62cc1efea2d12c
SHA1 ea871f90111bfb6dceed1cdfbb940a179c799108
SHA512 9ff2e7bd3d7e6fe97124af9375d80f2ca3f900538fd5baa882ca92ee8107fe4d55ce26e884c3fd6f79109ebd83447926ccc21b13057ff9237e7830891f1a6f95
TLSH
T11DA022B00B3C3A0E8C003028F800CC203FC0CBF23320CB03202C203C008A0A0C280E30
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-SkinMonitor\index.js
Size 18KB
SHA256 4392bf3cf1ec335a06e35a4a958552802134dda957cd6ef24914298533bba32d
MD5 dc23068fbda36717d58076aa02db9df2
SHA1 dece0be0119de82458339912a77df4cf97f28ff2
SHA512 3c22e5a952727609523df41d647d02246ce8e5e34780e0206d0fc47a03a0acc2b3678d6330f403955c9463f7e6582a3e618372390117f5236fdf885198824fcd
SSDEEP 192:FrX3C+uVFJnJEiQtzoipm1rl2Il5saH0nmIKlpVDir1jfdTSKbx/rxxx+xjxtxHr:9i+uVFJnCi2hQFle7nGlzswIO1H1Ae
TLSH
T13882829A246A152341B367B84F6B4513FB23B43BA7244269FBDD83042F718389576FEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.git

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-UI\.git
Size 59B
SHA256 e8e863a9400e03d410414df7f34a24f499d018a9e3cad6f15050a6a1ec86001c
MD5 569d486fed355909adea94ee16426f1f
SHA1 fb1eb18343f2957ba6e10a095ad991b0074aa967
SHA512 01e6456edf00f28133dbd748225d9feaef31689aebf1ce6b46b1626d07fdb56706f5135acb5e89727678b634adea7f8e72e591797374cd96e07e3f697b7d5174
TLSH
T169A002B10B3C3A0E5C946955F9008C606FC9DBE13331DB17712D207D4585065C151975
MD5 SHA1 SHA512 TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\plugins\ROSE-UI\index.js
Size 25KB
SHA256 9cb3c98a8de81b48a4c5ca819273a313154b9e52afe4b45a05b1136927a93dcc
MD5 fc6b3b37aea3b3756fb431008a977a42
SHA1 2f5903c2a213d4ded4a506b0edd7db27a6b8102a
SHA512 3ad97d4fb87b4c00fadf1cf5ae1c177c555eb870a2960acfa5895e792120340a5c1a66ba1583999b3cd42e426c89f8f1af2e94ba1e9fb89ae775b6457ba4e860
SSDEEP 384:fSR+kBe7H7CLcoKPgpUurXZuobikui96NT/3JF:ak78GkUuAfkui96NTPJF
TLSH
T1FEC2826570822236893FA33F9F936119FBB564639200A56579FEC30C1F7695042B3EEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rose.log

Path C:\Users\Admin\AppData\Local\Rose\Pengu Loader\rose.log
Size 757KB
SHA256 f5f391b5e3fa15ff27506e89c44e0421d8ba2641bb05c10d3e280fc275c57469
MD5 4c7ad776941a09d9950c14c11a9ce071
SHA1 f385c52a28e14931bcb728ee5328e9f9003237dd
SHA512 e42b674b8e0c428cf07a80b30618e18dac9d444dd538d4df4b15f39743c812b83b8db7eff6f84271a92aec4a51e13a82851863ed9a645c98a63acafdc8b85f42
SSDEEP 1536:+vByr4S6L6WjxjuVYCu2UBDGYd3wwMWP6AxnfYUoOqlN23bZMX+HF3f3Gu8ecVPK:tK3wmg9Q
TLSH
T173F4C00229FE71FB46345943D4A3AE8B0EE17B6705459D6E3338B47C349CE1A66BF620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Rose_Setup_1.2.4.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-8PM5AKRNXP.tmp\Rose_Setup_1.2.4.tmp
Size 4.2MB
SHA256 6312737ac8d76cbbba987e53c1fc12c83b96345cf02a706dbaa519349c9a5bae
MD5 a56f9dca7841bf8b9645f851174757c9
SHA1 f508f1e93f0c19e1884077513b79e94bfc055987
SHA512 19d2dc3b7e0cdddd8bd8033a07283efbb513a7a41cc0b8d9707886ea80a6a2cd9394e58903159855c4399232da4496ffc5d6cf073a31f1b2a38cd5dae8cecfb5
SSDEEP 98304:ZYU5hnuOajWwMPdCpepI3GrwrA+Js333EKc:bxuHjWfZIzdh
TLSH
T1C5268F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1168-590-0x0000000001530000-0x0000000001561000-memory.dmp

Download

memory/2068-588-0x0000000000CF0000-0x0000000000D21000-memory.dmp

Download

memory/2484-14-0x0000000000870000-0x0000000000CC1000-memory.dmp

Download

memory/2484-355-0x00000000033B0000-0x0000000003414000-memory.dmp

Download

memory/2484-11-0x0000000003450000-0x0000000003451000-memory.dmp

Download

memory/2484-9-0x0000000000870000-0x0000000000CC1000-memory.dmp

Download

memory/2484-395-0x00000000033B0000-0x0000000003414000-memory.dmp

Download

memory/2484-5-0x0000000003450000-0x0000000003451000-memory.dmp

Download

memory/2484-354-0x0000000000870000-0x0000000000CC1000-memory.dmp

Download

memory/2484-393-0x0000000000870000-0x0000000000CC1000-memory.dmp

Download

memory/2484-10-0x00000000033B0000-0x0000000003414000-memory.dmp

Download

memory/3316-589-0x00000217A45F0000-0x00000217A464D000-memory.dmp

Download

memory/4004-399-0x0000000000280000-0x0000000000377000-memory.dmp

Download

memory/4004-0-0x0000000000280000-0x0000000000377000-memory.dmp

Download

memory/4004-7-0x0000000000280000-0x0000000000377000-memory.dmp

Download

memory/4004-400-0x0000000003410000-0x0000000003474000-memory.dmp

Download

memory/4004-8-0x0000000003410000-0x0000000003474000-memory.dmp

Download