Overview

overview

8

Static

static

3

2026-08-16...ar.exe

windows10-2004-x64

8

2026-08-16...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/08/2026, 18:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_3626a5f2e59bac5caaf03bfea7f9d90d_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 9.8MB
  • Sample260816-wyncpsvalf
  • SHA256 1dbd8cc6fa2b3e16e49b591b8053df11ea8cee11e3c6cebf45638103392902ca
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_3626a5f2e59bac5caaf03bfea7f9d90d_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_3626a5f2e59bac5caaf03bfea7f9d90d_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4668
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_3626a5f2e59bac5caaf03bfea7f9d90d_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_3626a5f2e59bac5caaf03bfea7f9d90d_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1784

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.7MB
        • SHA256 9b5553b2afa940b8a9e8e806f2e0931432624db117470c214d29de71c40b84d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.0MB
        • SHA256 612c8fa2378d3d2448dd2fe71e5c118c4cd10545f80702a597d5d256918eafc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 9.8MB
        • SHA256 633560addb278024c91d8b15c8cab435f2fed1f2a202e058d6856f77302e6627
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 10.1MB
        • SHA256 d9697996f21caa8c28ba6eee7e4510bf1dee4a73a465204240369a241825c42f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 9.9MB
        • SHA256 ecb8eccb407b9baf2d9ba570c560a9ca0a9d4e8958fc1d1549a8cf99bc9d85ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.6MB
        • SHA256 baaea25be974f2619f7d68768c4db9c426009f6ca3dcf787e004ca680431f821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.3MB
        • SHA256 01fea06a17c73ed2927e9dd8872fbb5c4b3cf62469b3a12d20108c0787ac717a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.0MB
        • SHA256 0a9173598156b2d9790f95ac34d5acb25a861bacdf8f1074daee6e6cfe80311f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.8MB
        • SHA256 292c04c8b01e3f0825a0d5f106546601fdf41affe5ec996a96c8f3c42c869861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.2MB
        • SHA256 880f82b84272d5118fe5d02f598ab3e8b6e773ac91d86cd875bb21311439cd79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.4MB
        • SHA256 ac66816bb953768e949b01e16a36603876296a532e681f63888bb0e4a286be60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.6MB
        • SHA256 09c27c43d95cce2bd4f24328e6b69039aada255ba9e139a8f3c300124b483ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.0MB
        • SHA256 e3396bc59c050ce9a640b586b3c4df107971efe7106644ab9d3030433c2a41f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.6MB
        • SHA256 bab909eeacb01da428df4452bf3c9c42686dd3fef027aca6e025e86f4b189d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.6MB
        • SHA256 9fb5d02ef6b5a28056931126f4d56df2af49da650aefd545de872e8a15dc0974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.6MB
        • SHA256 ad3416c9285c37eece236677b27361950ae5a6decc41bafe8c5624cfdf4fa38a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 9.8MB
        • SHA256 1b4ad4130ae47d6e2c2243a1b0bbc6da93358938657b2b1e90c0d768dda5a72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.6MB
        • SHA256 7ca9accc3ae7665cf5cd40b5faefe6bdda5559cb77e6fbf844421064ff11c343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.6MB
        • SHA256 35b6013ba3973c130c32da59432f4e015e5d7892f0b1a6e09ed0e1007d569779
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.6MB
        • SHA256 9ea2b254cedf7d2085fc5b32ff449db273354e7373e02ebad24af9d67adeb161
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.6MB
        • SHA256 f385efbb71d2ea9dc1cc30a68081f0b20902af970db5f59c4c37fdfae3abf711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.6MB
        • SHA256 b0105aac2ea5d34ccfd640dd7a12021fc73fc4c13d32f3d43f17ce40cddb330a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.6MB
        • SHA256 0e021cc87120e699cf1fc8c62abd7d85ed24687fef76ed9841465b023d44292a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.7MB
        • SHA256 eb4bda1709135403905ed2e518f263c01cc47d6f2f8d2904a6205ba69c351491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.8MB
        • SHA256 f262ce78ebc6b68a48ce763fe1ada4c489c1191a8c15dcfba9a6f1ef7a3fe9f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.0MB
        • SHA256 604232a1e369f9c49b193774780e1a02fbf768a74c4632eb99ee271c00c3bc48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.6MB
        • SHA256 43b36e9de623893fb41ba6f76aa279e525b2ac34e20721b79a0ab45fb804a9e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.6MB
        • SHA256 5adfa53ae17f72deb57a0ca8c37bcd3d0815b600606f7bf333f7d1b4426b50ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.6MB
        • SHA256 d30e627f1dc4288f98bac2e9938f52a8553d41f92e6a178f9810b47b0db2c775
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.6MB
        • SHA256 32766011ff172cec7e610b1abd3bc24e1487cfade9840ab2c4137495555fea64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.6MB
        • SHA256 fe925d46e7fcda93d6c822b9c9bb3af151135eb38f3dfce266774dac82e2c109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.6MB
        • SHA256 89be2cad1795ef393ca9d07c35bffac13e76561904e236507b5095c50cbcd8db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.6MB
        • SHA256 096dc36dd3dc9463120d1a739183408051658639c77e6593102b99c29f776835
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.6MB
        • SHA256 ee93f660b543551de0d2fa6edcf17091f95834c5a558b86da1ec562df8bb6984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.6MB
        • SHA256 04fb0b4b94e673f189c76b822db2be910fceb019a778835db22f86dbf89ef57b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.6MB
        • SHA256 2f6ac153106c1aacf58dfec90a73f3a1fb8f97fbb9863809cb94e9cd6f1ba27b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.6MB
        • SHA256 fdf4519fe27612b449d220bf40755e25b4dd359195e7f733351049d269845da1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.6MB
        • SHA256 70d75b6a1a4d949fe5b62409cbf81bf5ef7c4b29e7f91cf808d4bd697c44bdd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.6MB
        • SHA256 a703fbcf72916ddfe882a7c1091ddcb7b5e7f85e5f6249c1834a901f81d767a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.6MB
        • SHA256 44694d82dbd89bb4f7145d15cd08c07d6b15d840feeaa471464069f24ffc7101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.6MB
        • SHA256 fe1446c0001a2cf204472e6636fcd8ba8eac50e53b94c52cbdaee6e84cae2364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.6MB
        • SHA256 5abc1d8ddce7a973ba8202e11ac5b6dc0a6f25641e1d533a730c66dafc129449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.6MB
        • SHA256 b0335e0187153e7a88ef2c76a83f632a4b784a2566dab33f707f0cc377b0d75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.6MB
        • SHA256 530bc1348a8508cadf01224cba10f3b2d09d1847ad7db27a87655f992d85c2a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.6MB
        • SHA256 e55fdb1bf8ae35aaaca4e37c1faae7454b4f21f4d45ca695d00c37d4e073262a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.6MB
        • SHA256 f48e962015bae7836fc7bd9492de96705219bed2f68a4d87e538e241e92de957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.6MB
        • SHA256 52b9eb9191885eb75a683ca39d653aa38fc9caf0d876d0cfcb3866ad9829c152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.6MB
        • SHA256 f9fdbb78e13659d92e2f0dfdc8569dde8cc2b56a15cf762f218c1bbf06ec0dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.6MB
        • SHA256 b576cdda1e6470cd374081bebc2078ff4d27d0e9491ff190d91083e011e1e03b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.6MB
        • SHA256 51122acead1f3520c6619b4f9866645274feb4db567dbd48f4d4160746bf3ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.6MB
        • SHA256 56cc1e6c5b15e6bc1a560ea7c89fdd1edeb0a01924d734a97d23facfb65e70f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.6MB
        • SHA256 6c1693b064476971404f614272cbf71ed9439af93e0929c86db4e00b090883a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 19.6MB
        • SHA256 6eaa7b04d7685523224f25b8df6a5b2325c9d6142150855a246d32cb01a3976d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 19.6MB
        • SHA256 48975df296a44d9a0e49093db5ad4692fda4cbb975d4bbfe3a32148f7e2c39c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 19.6MB
        • SHA256 2e5092708a2aa8106e24d2a4edf0a8c8a0ebd5e23cf595e4a0995f3248edc77c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 19.8MB
        • SHA256 5599fb90ff5d92ead1eef84b3f4c64af86d0498a5dd2fb11a997b95c4a43f5b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 19.6MB
        • SHA256 26108efc1f4f003a94e8040783a91f9384c89c5ef12912c63f466535d8ec486a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.9MB
        • SHA256 e65869ff948608696dfb9b201f0672a50cd3f6cbab4a5945821f9bdc27e3ecf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.8MB
        • SHA256 1dbd8cc6fa2b3e16e49b591b8053df11ea8cee11e3c6cebf45638103392902ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1784-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4668-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4668-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download