Benign windows Download

grok-cli

Signed X.AI CLI tool

Root filesystem wipe attemptAuthenticode chain CN: X.AI LLC

SHA-256b2f72f093206c070945a792b2b38b0a00ca6e971143b312df1ef8eaed4c12536

URLhttps://x.ai/cli/grok-1.0.30-windows-aarch64.exe#/grok.exe

MaleculeK(Li)O₅(IAsC₂Dy₃P)H₁₀(Cm₁₇Cr₁₁Db₅DsF₁₇MgOs₁₅Po₁₃TiU)Md₅(Bi₄PtSi₃)

Evidence

English function-word token "this" 0x0–0xd0

0x04d5a7800010000000400000000000000MZx.............
0x1000000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000078000000............x...
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
0x60742062652072756e20696e20444f5320t be run in DOS 
⋯7 more rows

Rust aes crate path or version marker 0x6354bd0–0x6354cc0

⋯5 more rows
0x6354c20782e6372617465732e696f2d31393439x.crates.io-1949
0x6354c306366386336623562353537662f616573cf8c6b5b557f/aes
0x6354c402d302e392e332f7372632f6261636b65-0.9.3/src/backe
0x6354c506e64732f666978736c6963652f776f72nds/fixslice/wor
0x6354c60642e7273000000000060354601000000d.rs.....`5F....
⋯6 more rows

Rust source file path (.rs) 0x6359557–0x6359637

⋯3 more rows
0x6359587726f7220756e65787065637465646c79ror unexpectedly
0x63595972f72757374632f346134656634393365/rustc/4a4ef493e
0x63595a7336131343838633665333231353730323a1488c6e3215702
0x63595b73338303834623338393438663664622f38084b38948f6db/
0x63595c76c6962726172795c616c6c6f635c7372library\alloc\sr
0x63595d7635c737472696e672e72730000000000c\string.rs.....
0x63595e70097a93546010000004b000000000000...5F....K......
⋯5 more rows

Tokio crate source path 0x636905c–0x636912c

⋯3 more rows
0x636908c313934396366386336623562353537661949cf8c6b5b557f
0x636909c2f746f6b696f2d312e35322e332f7372/tokio-1.52.3/sr
0x63690ac632f6675747572652f7472795f6a6f69c/future/try_joi
0x63690bc6e2e7273000000000000000060a43646n.rs........`.6F
⋯7 more rows

Root filesystem wipe attempt 0x6dd6c86–0x6dd6e16

⋯3 more rows
0x6dd6cb66c2e7368603a0a0a606060626173680al.sh`:..```bash.
0x6dd6cc623212f62696e2f73680a494e5055543d#!/bin/sh.INPUT=
0x6dd6cd62428636174290a434d443d2428656368$(cat).CMD=$(ech
⋯5 more rows
0x6dd6d366966206563686f202224434d4422207cif echo "$CMD" |
0x6dd6d462067726570202d7145202728726d202d grep -qE '(rm -
0x6dd6d567266202f7c6d6b66737c64642069663drf /|mkfs|dd if=
0x6dd6d667c3a28297b203a7c26207d3b3a29273b|:(){ :|& };:)';
⋯11 more rows