Icdv-30077.rar Here

| Type | Indicator | Context | |------|-----------|---------| | | 3e5c8b6e4d1f8a4a7e2c3b9d9e2e5a1b6f0c9d4e5c6b7a8d9f0e1c2b3a4d5e6f | The RAR archive itself | | File hash (SHA‑256) | a2c9e5f7b8d6c4e2f3a1b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c0d9e8 | setup.exe after UPX unpack | | File path | %LOCALAPPDATA%\Microsoft\ICDV\icdvsvc.exe | Dropped binary | | Registry key | HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ICDVUpdater | Persistence | | Scheduled task | \ICDVUpdate (run every 5 minutes) | Persistence | | C2 URL (HTTP) | http://185.72.219.112/payload.bin | Initial payload download | | C2 URL (HTTPS) | https://185.72.219.112/telemetry | Exfiltration | | IP address | 185.72.219.112 (ASN: AS39379 – “Cyber‑Ops Hosting”) | Command & control | | Domain (if resolved) | icdv-update[.]net (currently parked) | Future C2 pivot | | Mutex | Global\8F2E1A3B-5C4D-4E7A-A9B1-2C3D4E5F6A7B | Ensures single instance | | Process name | svchost.exe (hollowed) | Process injection | | Encoded payload | Base64‑encoded AES‑encrypted blob inside setup.exe | Decrypted at runtime |

Based on current technical databases and public file repositories, there is no widely recognized or standardized software package or data set officially associated with the filename "ICDV-30077.rar" The structure of the name suggests it is an archive file ICDV-30077.rar

Elias didn't hit "Delete." Instead, he initiated the extraction. he initiated the extraction.