Analysis
- max time kernel
149s - max time network
118s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 22:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Resource
win11-20260513-en
windows11-21h2-x64
9 signatures
150 seconds
General
- Target 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
- Size 1.6MB
- Sample260605-1783zset9x
- SHA256 2dce43ebfc6bd22af81e7a27cb6044d2fc2ebd81eb8b5f95cdce14c56f70bfba
- MD5 5b60f28a63df74d4ac55065d59e5d4db
- SHA1 0f769133ef2cc7a4110c716449c062d0a73bd6a4
- SHA512 2621d04d27aa632b817e77724e050de27ed710723fc521e6a6d77cc981a66a5255bac3e899a0cec0e5701b71c197e78fe8766b0996fc25b6d84c0105212fc24b
- SSDEEP 24576:XRazrU3KQn0cMJlA38GYVsdaFd5FWsAfqeeTOyCkaXEf:BmrU3KBRJo8GYVCPaBGkaXEf
- TLSH T1A9756B0667A401FAC167D178C69A9633FBB078050B346BDB87A1C7572F376E0AA3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Database Administration = "C:\\Windows\\system32\\systemDA.exe" 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\lzsys.sys 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\lesys.sys 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\ReadMe.2.txt 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systemDA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nCalc.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\sv-se\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\ko-kr\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\de\Jenna Jameson screensaver HOT XXX.scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\pl\Anal Pleasure 3.dvd.mpg .pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\lt-lt\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\main\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Jenna Jameson screensaver HOT XXX.scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ja\Anal Pleasure 3.dvd.mpg .pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\tr\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\tr\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\Anal Pleasure 3.dvd.mpg .pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\th-th\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\tr\Jenna Jameson screensaver HOT XXX.scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\Internet Explorer 7.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-tw\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\ja-jp\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\id-id\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\Anal Pleasure 3.dvd.mpg .pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\gl-es\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\Jenna Jameson screensaver HOT XXX.scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\es\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hans\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\Jenna Jameson screensaver HOT XXX.scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\source engine\Anal Pleasure 3.dvd.mpg .pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\pl\Anal Pleasure 3.dvd.mpg .pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to make crystal meth.doc .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\en-us\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\tr\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Detroit.zip 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5532 4380 WerFault.exe 79 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\,ê¾Bc:\program files\common files\microsoft shared\ink\ar-sa\WinAmp 5.rar ̨Öv<·2“»2“èêdc:\program files\common files\microsoft shared\ink\ca-es\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ô±2“Àîdc:\program files\common files\microsoft shared\vgx\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\D´2“0ìdc:\program files\common files\microsoft shared\ink\ar-sa\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\languagemodel\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv3c:\program files\common files\microsoft shared\ink\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\vsto\10.0\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\~c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Weed growing for dummies.ebook.pdf .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\’c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ja\Weed growing for dummies.ebook.pdf .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\œçdc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôvc:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.rar ̨Öv<·2“»2“èêdc:\program files\common files\microsoft shared\ink\zh-tw\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨ÔvKc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hant\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Internet Explorer 7.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\œçdc:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv\c:\program files\common files\microsoft shared\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ja\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôvc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\es\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common (ädc:\program files\common files\microsoft shared\ink\bg-bg\Hot young babes have an orgy.rar .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\,êdc:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.rar ̨Öv<·2“»2“èêdc:\program files\common files\microsoft shared\ink\en-gb\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\es-mx\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\DVD Xcopy PRO crack.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\it-it\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\th-th\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\fr\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\Ôº2“ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hans\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\D´2“0ìdc:\program files\common files\microsoft shared\ink\nb-no\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\cs-cz\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\cs-cz\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\lt-lt\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Hot young babes have an orgy.rar .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\Ôº2“ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pt-br\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\et-ee\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\lv-lv\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\ro-ro\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôvc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\ar-sa\DVD Xcopy PRO crack.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\,êdc:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.rar ̨Öv<·2“»2“èêdc:\program files\common files\microsoft shared\ink\es-es\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôvc:\program files\common files\microsoft shared\ink\th-th\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\WinAmp 5.rar ̨Öv<·2“»2“èêdc:\program files\common files\microsoft shared\msinfo\en-us\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Visual Basic.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨ÔvHc:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\`ædc:\program files\common files\microsoft shared\ink\fsdefinitions\main\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôv9c:\program files\common files\microsoft shared\ink\nb-no\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\`ædc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôvc:\program files\common files\microsoft shared\ink\nb-no\WinAmp 5.rar ̨Öv<·2“»2“èêdc:\program files\common files\microsoft shared\ink\pt-pt\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\D´2“0ìdc:\program files\common files\microsoft shared\ink\zh-tw\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨ÔvFc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\zh-hans\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôvc:\program files\common files\microsoft shared\ink\sk-sk\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\tr\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\,êdc:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\D´2“0ìdc:\program files\common files\microsoft shared\ink\hu-hu\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\*¨Ôvc:\program files\common files\microsoft shared\ink\id-id\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\WinAmp 5.rar ̨Öv<·2“»2“èêdc:\program files\common files\microsoft shared\msinfo\it-it\WinAmp 5.rar .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\D´2“0ìdc:\program files\common files\microsoft shared\msinfo\ja-jp\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common (ädc:\program files\common files\microsoft shared\ink\ca-es\Hot young babes have an orgy.rar .scr 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\xc:\program files\common files\microsoft shared\ink\de-de\Weed growing for dummies.ebook.pdf .exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\`ædc:\program files\common files\microsoft shared\ink\fsdefinitions\insert\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\`ædc:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\zh-tw\Adobe Photoshop 7 Illegal Beta.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\les\dotnet\shared\microsoft.netcore.app\8.0.15\WinAmp 5.rar .exec:\program files\dotnet\shared\microsoft.netcore.app\Windows XP SP3 leaked.pif 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\Ôº2“ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ja\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\D´2“0ìdc:\program files\common files\microsoft shared\ink\fr-ca\WinRAR 4 BETA.exe 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4380 2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_5b60f28a63df74d4ac55065d59e5d4db_amadey_cobalt-strike_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4380 -s 86842⤵
- Program crash
PID:5532
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4380 -ip 43801⤵PID:2768
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 1.6MB
- SHA256 58f1de0683d5c35ee171d5f8185521a416404741508ac28fdb22dff8b4050cd1
- MD5 5d69ecea51d408ed82e9bbbef7a80bc6
- SHA1 e57a0d24117f9ed5edac93f0bdb18482c666b045
- SHA512 8e7da60a0072fce14853036fef82bfb0889f19e3b998165b135ba332c9699dc6751eba529aaf32a2d2ff773afcaab07fdc5685c44039260d98f30dc187c122ff
- SSDEEP 24576:XRazrU3KQn0cMJlA38GYVsdaFd5FWsAfqeeTOyCkaXELaO:BmrU3KBRJo8GYVCPaBGkaXEP
- TLSH T1F5756B0667A401FAC167D178C69A9633FBB078050B346BDB87A1C7572F376E0AA3E711
- MD5 SHA1 SHA512 SSDEEP TLSH