Analysis
- max time kernel
149s - max time network
119s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 18:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
- Size 1.5MB
- Sample260809-wsl8fsshrd
- SHA256 63fce6a8a480dd0aeae2153acc233b9d60ab79f973782e5f98d24f540dc487e1
- MD5 d2040eb35993dab9dd548ee99f0c7dfd
- SHA1 285afd72f61071fe45786c7c79c578f1afe8248f
- SHA512 07cc84f1e4b1ed48d89962c7e7462873c4b96e4ee89ca2a3309ca44292c06392113ed4155e0fb5efa3a9dc3d56a3440d168ce915102a47ce1ba47ca34f1a8bd5
- SSDEEP 24576:XRd9y5CWVfF3cydWXkPOQeyvGmG5VPPSdrmXJQW9OIgzhCTZGoD:Bdo53VYXzQeyvGAsN9XgzgTZGoD
- TLSH T11F65AE01B3C1C4B0D466457488A7CAA5963BBD114F215BDF3394BB9F9E723C1AE32A27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Database Administration = "C:\\Windows\\system32\\systemDA.exe" 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\ReadMe.2.txt 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\systemDA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\nCalc.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\lzsys.sys 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Windows\SysWOW64\lesys.sys 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\program files\common files\microsoft shared\ink\ms-my\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\it-it\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\af-za\HalfLife 2 crack.exec:\program files\common files\microsoft shared\ink\am-et\HalfLife 2 crack.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\aftrnoon\Playboy centerfold.jpeg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\concrete\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\bin\Playboy centerfold.jpeg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\source engine\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\filters\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\tr\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\radial\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\enfr\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\portal\1033\Internet Explorer 7.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pl\Jenna Jameson screensaver HOT XXX.scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ko\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\bluecalm\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\proof\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\bin\Hot young babes have an orgy.rar .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\ml-in\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\NisSrv.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th¼UwâPõ8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\pixel\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\Firm ass gets pumped.avi .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\mi-nz\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\source engine\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fr-fr\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\bin\Internet Explorer 7.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\da-dk\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\Kazaa Lite 2005 Edition.zip .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\1033\Jenna Jameson screensaver HOT XXX.scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilesx86\microsoft sql server\130\shared\Jenna Jameson screensaver HOT XXX.scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\ar-ae\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\root\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\blends\Jenna Jameson screensaver HOT XXX.scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilesx64\microsoft sql server\130\shared\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\SenseAP.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\canyon\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\cultures\Jenna Jameson screensaver HOT XXX.scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\HalfLife 2 crack.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th¼UwâPõ8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\edge\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\How to make crystal meth.doc .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\Visual Basic.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilesx64\microsoft sql server\130\shared\Jenna Jameson screensaver HOT XXX.scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\aftrnoon\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th¼UwâPõ8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\blueprnt\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Detroit.zip 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1472 4340 WerFault.exe 88 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\ édc:\program files\common files\microsoft shared\ink\fsdefinitions\insert\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th¼UwâPõ8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\refined\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ édc:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ .pifc:\program files\common files\microsoft shared\msinfo\Internet Explorer 7.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\pixel\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\1033\Internet Explorer 7.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\Hot young babes have an orgy.rar .scr 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\ar-sa\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€í›c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ÊPõ`ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\source engine\Windows XP SP3 leaked.pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\roc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\water\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\Øï›c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\equation\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\vsto\10.0\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ru\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\fc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\1033\Kazaa Lite 2005 Edition.zip .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\kk-kz\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\pc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Visual Basic.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\en-us\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ .pif\Windows Loc:\progrc:\program files\dotnet\shared\microsoft.window¼UwÂ[õXèdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\fr\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\c:\program files\common files\microc:\program files\common files\microsoft shared\¼UwRYõèêdc:\program files\common files\microsoft shared\ink\kn-in\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\zSõÐàdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\platformcapabilities\Windows XP SP3 leaked.pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\radial\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\1033\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\îc:\program files\microsoft office\root\vfs\programfilesx86\microsoft sql server\130\shared\Windows XP activation crack.zip .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\(çdc:\program files\common files\microsoft shared\clicktorun\Weed growing for dummies.ebook.pdf .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\ta-in\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\tt-ru\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\breeze\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\iris\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\á7jwc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Anal Pleasure 3.dvd.mpg .pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\mk-mk\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\es\Internet Explorer 7.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\e Photoshop 7 Illegal Beta.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\r_njrat_remcdc:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\ar-sa\Weed growing for dummies.ebook.pdf .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\boldstri\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program fc:\program files\windows sidebar\shared gadgets\Windows XP activation crack.zip .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\am-et\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\en-gb\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\office16\en-us\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\clicktorun\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\vgx\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\th¼UwâPõ8ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\axis\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\network\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\oc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\equation\Norton AntiVirus 2006 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\de-de\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\šhõ°Ûdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\1033\Windows XP SP3 leaked.pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\esen\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\cs-cz\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\nn-no\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\dvd.mpg .pifc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\Internet Explorer 7.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ª[õ€èdc:\program files\common files\microsoft shared\msinfo\es-es\Windows XP SP3 leaked.pif 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\concrete\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\zh-tw\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\1c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\çdc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\WinRAR 4 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\msinfo\es-es\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\en-us\Adobe Photoshop 7 Illegal Beta.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\af-za\Weed growing for dummies.ebook.pdf .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created C:\Adobe Photoshop 7 Illegal Beta.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\WinAmp 5.rar .exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe File created \??\c:\program files\common files\microsoft shared\ink\af-za\Norton AntiVirus 2006 BETA.exec:\program files\common files\microsoft shared\ink\am-et\Norton AntiVirus 2006 BETA.exe 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe 4340 2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_d2040eb35993dab9dd548ee99f0c7dfd_amadey_elex_hellokitty_luca-stealer_njrat_remcos_vidar.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4340 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 71002⤵
- Program crash
PID:1472
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4340 -ip 43401⤵PID:3724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 1.5MB
- SHA256 1e337dcb9e5ab987e99948b47c669c77de90ae88666b6007969dee7ad694533d
- MD5 150b9cd0d6cf47a4e671a06eb175d6de
- SHA1 2505facf16fc798e8525c96c7aafba4336bc2f42
- SHA512 dc6193a4f0c95cadae0295195727b5ba054a3b7f890eb5b1b1903b85ca0fdc6d5d3ed40e07aa32f59002576a3101d2cf6f79c0d037408076075847867abacc80
- SSDEEP 24576:XRd9y5CWVfF3cydWXkPOQeyvGmG5VPPSdrmXJQW9OIgzhCTZGoqh:Bdo53VYXzQeyvGAsN9XgzgTZGoqh
- TLSH T131759D01B3C1C4B1D46645748863CBA5963ABD114B219BDF3394BBAF9E733D19E32A23
- MD5 SHA1 SHA512 SSDEEP TLSH