Overview

overview

8

Static

static

3

2026-07-30...r_.exe

windows10-2004-x64

8

2026-07-30...r_.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/07/2026, 03:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
  • Size 29.0MB
  • Sample260730-edpllayfrc
  • SHA256 4c7e240c7f562856701c78a4fa009f4f3e2e9e45e5008febabe5f6c9c1d15a14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:848
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_22dbae8d99c5451f4ab983eb349e49b8_amadey_cobalt-strike_elex_emotet_glassworm_hijackloader_.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2252

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 29.6MB
        • SHA256 ee8277c073e2d1f2711461bd6a9d6edcdd1966e135fe33779caa1e6a67989359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.0MB
        • SHA256 a507cc4be39f190ee84b86f045318d4b87e24c1046720807ded2ee2af890e557
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.7MB
        • SHA256 1483d06f435f8dac96926d43ba35aceda7cdb9ee3988cde14b4ad6de3d0b4880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.4MB
        • SHA256 5b47d86bdcca5257968d445675dbaa46179b27c53a0970263121943576bbae27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.2MB
        • SHA256 e213a19e4041dbcf292a2e425a60accd0e2835795ccd93e8ee70e21d4ade66e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.6MB
        • SHA256 cb477b04cb7510e58242c5f999d9f73bf190681ba063d20b4ff7b8992970040a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 59.8MB
        • SHA256 03f4a908a1fcd807b864e50ed2dd3448998e3e622a57ad7709351aae2853704a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 61.0MB
        • SHA256 5403556e894a1e6b892d4b484c39d01eab5f8208f7963707fa8dde576fa64185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 59.3MB
        • SHA256 c18000f63350f15848c2b7d964e8615c998b99d30307588f71500dff833748c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 57.9MB
        • SHA256 32e4215f5166ee116c3d66615c2998b51ba9569dbf053b104b83965fc8e6939f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 57.9MB
        • SHA256 02317b304e92c57e028064a4a5cb7c887fb35351d38689cef5798ffb7594a7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.2MB
        • SHA256 bdd3793b0a24dbd558eaf92bc509b75fbf5a8adef08e253290ae5ac63641b913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 39.9MB
        • SHA256 4cd8d737e598916a7c7483399958ec6e044aba091e909863c3def3bbde6b3eb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.7MB
        • SHA256 d5f2be019b2d7e29a04c48f70f39b786fb6a1d5c2fe2e9cd851d202a7c8f931e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.1MB
        • SHA256 f4c277c1c645881e384b16f056bbc1271b4c646b1c275f4f50facdd047ebd22c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.4MB
        • SHA256 77ba9651da65bc4776973d99c28ef2e4674d9007300c9690e50d8d91a8a49f42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.2MB
        • SHA256 9a15d999edee2af771316d66074f373f26c527d8935442e339932e54046b3f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.7MB
        • SHA256 59c7aa8957a7a5097446c13abcaf6f25aabd0d5bde7148a30e8995f97e888243
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.1MB
        • SHA256 f49a8c901df69a9c3ab03f43de200ec0dee56d5fb9106235f8a032e636a1a1a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.7MB
        • SHA256 4265882d2b25c793debb2f11fbe85f8b070a9e7a85276a09f969f420b18e3ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.2MB
        • SHA256 d0f4511efebecb8452987da04862714f6bc695a447562f5b73b05eb9d2623065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.5MB
        • SHA256 9e04d9300a261d6634c7ef7b2b2f1c1cafce3e70b21efb3fd7baa29b053a6533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.8MB
        • SHA256 fa9b0d1d297cde925c2f8edc922b329f1e0817d636e6821bbb2e594ecd17b774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.9MB
        • SHA256 157e5e9ee58639e0f2a313310e7b7dd2344dd18e9ad149baacf3cae650180fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.2MB
        • SHA256 39d52cc95e90ca2b0584b8893a50b88a183901e1b1d3bfd438e8cb22faef28ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.0MB
        • SHA256 ebb981d2ec3803f43451bf16c4d029e3f5a8d5afcb530decc045b85df26f3a13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.6MB
        • SHA256 c5db84e69bf6d05825b01eeb97c7a9d4b40a441f035a7fe84d248fe5309ecfc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.9MB
        • SHA256 642253d0fde26c3785858ddb3ad82297ef48f02a28fe0eeb97dbd30950543d27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.3MB
        • SHA256 314a0d7cb37f4ee101ab3f28a91996eb6d573477caee3c2bb81c69982e81034e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.2MB
        • SHA256 6321cc0392877821cd9f308858fc6e8b09565f43d81d300d2713b0f3e9b0c5d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.8MB
        • SHA256 66e63efb0c83120c99f9bdb951b4909d46d94e319bf46d39f79ead80c998a123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.4MB
        • SHA256 17b6749c68a88e789e5fcdd608dc569465fa7203fd488b98366efbe08cc19372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.1MB
        • SHA256 11d8838984e88c1d06ef6dc691c207c15ff7e5fbb8c2ff507ba1904050203e0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.4MB
        • SHA256 b0a1a56e2a3686b708f1d8f285c59b1c826eabacb1f688c45b86ea97fca55425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.6MB
        • SHA256 65dd603b98a87f82b88b6ed22325c07c0f74751a761b554e7e16754cfbe07b3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.0MB
        • SHA256 e183844a63f367a5071b989a2a2d68d78bb493ed52271b5fe7eec41fbd769f0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.6MB
        • SHA256 4d293af1ca68cb61991963b5ef3acf1ffc84ad3469032e3649607751324de133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.9MB
        • SHA256 1485a835b868c708aff90a1868cb442d54b6ff6959e036afa411244efd762a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.8MB
        • SHA256 622440a81f543d65cfef4f9a15c75dbb18c224cdcd22fded3c2abcd2a6e1fd39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.1MB
        • SHA256 05fef8c54d0aea75cdd655c2d637c0a92eb0e6ef145beec78c9c4527f9e18533
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.8MB
        • SHA256 83ccbf494e6a16ceb41b65606b47d16812e6ac4bc8ad071fed2a73ca4064fd89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.1MB
        • SHA256 f0661290d7360bda1216c26cccfbe8855209ccb4b73fcaa51b766c2e7d710e27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.3MB
        • SHA256 524687f1d94e4c283ecf9f4ee128b9b6619cd4f5b858a49c91a8876f9b654649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.1MB
        • SHA256 323eeb30117c39e79035e9445288c3c121a7275e96b7f1be691b95c31ab82452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.8MB
        • SHA256 84cb1e912baee92d659dbb0fc1573d8ab2f6bac53fc2e8e791959eef1b6eb8f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 11.1MB
        • SHA256 eb1faeb960cffca0696644ddeafb09c7363bd94c739d76ef44d38e0d9b86b391
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 11.1MB
        • SHA256 d160193fd90afce3ca7fa7cc58fa05d86e4822e383f0e6b816c3c2f9988d1bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 11.2MB
        • SHA256 b017ba7760c53d55e8bdaa86ac1aface8f98e146eb74e18da791ab705e890cac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.6MB
        • SHA256 8f32b6d12605fee2fff4924840250a4b5251d3d804a964d7deeed40cc8873fa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 11.4MB
        • SHA256 6e42dd459babca2a4395bb1f14f6bb60ddfa35e0e9252bacb0864d518f456265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 11.9MB
        • SHA256 615a24f60431d8dbdddfa3d9422ae4c9df29079ea5de763b4134bfdd093b228a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 9.9MB
        • SHA256 5f3b9b2f8b372e0a61ec3d697756f9be43a76f7ee78c613fd1e829637c68282a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 11.4MB
        • SHA256 dea464f1b1ff22f29c8e03be045b17a74296c57db60e0bf6de8f51ec72fc5215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 10.5MB
        • SHA256 dff02f1151ae154ea2568ba306c405240ad101099cdc7b8fe1c3650d5e70185c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 10.1MB
        • SHA256 fde0e97f6c0dc4fc71f37a0079deab8879bc0f8f1273c1fe0815e80979460019
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 10.9MB
        • SHA256 7b264321099c11ed0a5993c87c6a0b2f46b2ef38eaa8326305989f7f1af91424
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 11.3MB
        • SHA256 f84ba62bd5c9e53d100a812646f29679a51677fcd3da339f09707031b853978c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 11.5MB
        • SHA256 10e442f9a941cbaca596fba88e70be0896abf27e996be96ac82391060e0e6516
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 29.0MB
        • SHA256 4c7e240c7f562856701c78a4fa009f4f3e2e9e45e5008febabe5f6c9c1d15a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download