Mass self-replication of RageCore/win_guard executables across Temp, Public, ProgramData

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•2

Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.