a4e210c8c5e3c76bf1c92334de3e0fc933a8a92cb8599a95a46a90cc84850816

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/04/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe
Size 17.2MB
Sample260419-ny7gkshv2p
SHA256 a4e210c8c5e3c76bf1c92334de3e0fc933a8a92cb8599a95a46a90cc84850816
MD5 41487297db9e38aa53cb2ed103878591
SHA1 92c6b1bb14dee5f28afd21800345a7d0404269fb
SHA512 42d85e4d0f0bd477443bd17e33b6b33c37800d5857a95b72d5426a46ccff73a781b0d17196abd571e0d674457d8c1f78a5d07e7fde9d74f3abf2f0fad6f7fa03
SSDEEP 393216:SjzCrHaJVPKuhdPAeYH2XZqosBLGlNOEtIcG47:dHsSDOZpyMjIcG47
TLSH
T1EA07336371828D32C9530CF249A8E7B6453CBD264F6454C793C5FB2D59B82CE2E3266B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103E497CC28A174A9B7A2A96CAB452FA	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103E497CC28A174A9B7A2A96CAB452FA	RescueProcessChecker.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5	RescueProcessChecker.exe

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	RescueRemoteControl.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	RescueService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	RescueService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	RescueService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	RescueService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	RescueRemoteControl.exe

Executes dropped EXE 10 IoCs

pid	Process
1980	RescueService.exe
1848	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
1760	RescueCrashHandler.exe
3800	RescueService.exe
484	RescueCrashHandler.exe
5944	RescueLoggerProcess.exe
3376	RescueRemoteControl.exe
3396	RescueCrashHandler.exe
1696	RescueCrashHandler.exe

Loads dropped DLL 26 IoCs

pid	Process
1980	RescueService.exe
1980	RescueService.exe
1980	RescueService.exe
1980	RescueService.exe
1848	RescueProcessChecker.exe
1848	RescueProcessChecker.exe
1848	RescueProcessChecker.exe
1848	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
5944	RescueLoggerProcess.exe
5944	RescueLoggerProcess.exe
5944	RescueLoggerProcess.exe
5944	RescueLoggerProcess.exe
3800	RescueService.exe
3376	RescueRemoteControl.exe
3376	RescueRemoteControl.exe
3376	RescueRemoteControl.exe
3376	RescueRemoteControl.exe
5944	RescueLoggerProcess.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RescueProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RescueLoggerProcess.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RescueRemoteControl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RescueService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RescueService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RescueProcessChecker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 11 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1584	PING.EXE
2300	PING.EXE
2196	PING.EXE
6040	PING.EXE
3600	PING.EXE
6036	PING.EXE
5916	PING.EXE
896	PING.EXE
1680	PING.EXE
4696	PING.EXE
3204	PING.EXE

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RescueRemoteControl.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RescueService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RescueService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RescueService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RescueService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RescueService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RescueRemoteControl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RescueRemoteControl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RescueService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	RescueService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	RescueLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	RescueService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	RescueLoggerProcess.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	RescueService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	RescueProcessChecker.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	RescueProcessChecker.exe

Runs ping.exe 1 TTPs 11 IoCs

Remote System Discovery

T1018

pid	Process
2300	PING.EXE
2196	PING.EXE
1680	PING.EXE
4696	PING.EXE
3600	PING.EXE
3204	PING.EXE
6036	PING.EXE
6040	PING.EXE
5916	PING.EXE
896	PING.EXE
1584	PING.EXE

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
3800	RescueService.exe
4824	RescueProcessChecker.exe
4824	RescueProcessChecker.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1980	RescueService.exe
Token: SeCreatePagefilePrivilege	1980	RescueService.exe
Token: SeShutdownPrivilege	1848	RescueProcessChecker.exe
Token: SeCreatePagefilePrivilege	1848	RescueProcessChecker.exe
Token: SeShutdownPrivilege	4824	RescueProcessChecker.exe
Token: SeCreatePagefilePrivilege	4824	RescueProcessChecker.exe
Token: SeShutdownPrivilege	4824	RescueProcessChecker.exe
Token: SeCreatePagefilePrivilege	4824	RescueProcessChecker.exe
Token: SeShutdownPrivilege	3800	RescueService.exe
Token: SeCreatePagefilePrivilege	3800	RescueService.exe
Token: SeShutdownPrivilege	3376	RescueRemoteControl.exe
Token: SeCreatePagefilePrivilege	3376	RescueRemoteControl.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 1980	456	2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe	79
PID 456 wrote to memory of 3932	456	2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe	80
PID 1980 wrote to memory of 1848	1980	RescueService.exe	82
PID 4824 wrote to memory of 1760	4824	RescueProcessChecker.exe	85
PID 4824 wrote to memory of 3800	4824	RescueProcessChecker.exe	86
PID 3800 wrote to memory of 484	3800	RescueService.exe	88
PID 3800 wrote to memory of 5944	3800	RescueService.exe	87
PID 3800 wrote to memory of 3376	3800	RescueService.exe	89
PID 5944 wrote to memory of 3396	5944	RescueLoggerProcess.exe	90
PID 3376 wrote to memory of 1696	3376	RescueRemoteControl.exe	91
PID 3800 wrote to memory of 740	3800	RescueService.exe	92
PID 740 wrote to memory of 1680	740	cmd.exe	94
PID 740 wrote to memory of 4696	740	cmd.exe	95
PID 740 wrote to memory of 3600	740	cmd.exe	96
PID 740 wrote to memory of 3204	740	cmd.exe	97
PID 740 wrote to memory of 6036	740	cmd.exe	98
PID 740 wrote to memory of 1584	740	cmd.exe	99
PID 740 wrote to memory of 2300	740	cmd.exe	100
PID 740 wrote to memory of 2196	740	cmd.exe	101
PID 740 wrote to memory of 6040	740	cmd.exe	102
PID 740 wrote to memory of 5916	740	cmd.exe	103
PID 740 wrote to memory of 896	740	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueService.exe
  "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueService.exe"
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueProcessChecker.exe
    "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueProcessChecker.exe" -regsvc -expectadmin -starterpid 1980 -WorkFolder "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp" -ApplicationType 1 -ForceInstall 0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /S /C ""C:\Users\Admin\AppData\Local\Temp\2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe.cmd" "C:\Users\Admin\AppData\Local\Temp\2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3932

C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueProcessChecker.exe
"C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueProcessChecker.exe" -Service -WorkFolder "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp" -ApplicationType "1"
1⤵
- Drops file in System32 directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe
  "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe" "--database=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\ProcessCheckerCrashReportDB" "--metrics-dir=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\ProcessCheckerCrashReportDB" --url=https://dumpster.console.logmeinrescue.com/api/dump --annotation=format=minidump --annotation=hostname=Wwakkabn --annotation=installationid=FeDrhw1V0Q --annotation=sessionid=a9add4b8-c9ac-47a4-b263-6e7444bb6ff3 --annotation=version=8.11.1.4421 --initial-client-data=0x5d0,0x5d4,0x5d8,0x5b0,0x5dc,0x74c6f408,0x74c6f418,0x74c6f428
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueService.exe
  "C:/Users/Admin/AppData/Local/Rescue Applet/LMI0001.tmp/RescueService.exe" "-RegisteredProcess" "1" "-ParentProcessId" "4824" "-WtsStartingUsername" "WWAKKABN\Admin" "-WtsStartingSessionId" "1" "-ServiceName" "RescueRemoteSupport_attended" "-Service" "-LogLevel" "2"
  2⤵
  - Checks system information in the registry
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueLoggerProcess.exe
    RescueLoggerProcess.exe -ParentProcessId 3800 -InstallationId FeDrhw1V0Q -MonitoringUrl https://dumpster.console.logmeinrescue.com -WorkFolder "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp" -Environment Production -ApplicationType 1 -HostId e2b54dd0e7ae0d80dd187aaa018ac1fa -LogLevel 2 -SessionId a9add4b8-c9ac-47a4-b263-6e7444bb6ff3 -SessionType Attended
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious use of WriteProcessMemory
    PID:5944
  - - C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe
      "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe" "--attachment=attachment_RescueLoggerProcess.log=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RescueLoggerProcess.log" "--attachment=attachment_logger.json=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\logger.json" "--database=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\LoggerProcessCrashReportDB" "--metrics-dir=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\LoggerProcessCrashReportDB" --url=https://dumpster.console.logmeinrescue.com/api/dump --annotation=format=minidump --annotation=hostname=Wwakkabn --annotation=installationid=FeDrhw1V0Q --annotation=sessionid=a9add4b8-c9ac-47a4-b263-6e7444bb6ff3 --annotation=version=8.11.1.4421 --initial-client-data=0x4e8,0x4f0,0x4f4,0x4c0,0x4f8,0x74c6f408,0x74c6f418,0x74c6f428
      4⤵
      Executes dropped EXE
      PID:3396
- - C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe
    "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe" "--attachment=attachment_RescueService.log=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RescueService.log" "--attachment=attachment_params.json=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\params.json" "--database=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\ServiceCrashReportDB" "--metrics-dir=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\ServiceCrashReportDB" --url=https://dumpster.console.logmeinrescue.com/api/dump --annotation=format=minidump --annotation=hostname=Wwakkabn --annotation=installationid=FeDrhw1V0Q --annotation=sessionid=a9add4b8-c9ac-47a4-b263-6e7444bb6ff3 --annotation=version=8.11.1.4421 --initial-client-data=0x788,0x78c,0x790,0x6d8,0x794,0x74c6f408,0x74c6f418,0x74c6f428
    3⤵
    - Executes dropped EXE
    PID:484
- - C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueRemoteControl.exe
    RescueRemoteControl.exe -CompanyId oEv8JoaMUF -InstallationId FeDrhw1V0Q -MonitoringUrl https://dumpster.console.logmeinrescue.com -WorkFolder "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp" -Environment Production -ApplicationType 1 -DrawMouseCursor 0 -LogLevel 2 -Service 1 -SessionId a9add4b8-c9ac-47a4-b263-6e7444bb6ff3
    3⤵
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe
      "C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe" "--attachment=attachment_RescueRemoteControl.log=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RescueRemoteControl.log" "--attachment=attachment_rc.json=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\rc.json" "--database=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RemoteControlCrashReportDB" "--metrics-dir=C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RemoteControlCrashReportDB" --url=https://dumpster.console.logmeinrescue.com/api/dump --annotation=format=minidump --annotation=hostname=Wwakkabn --annotation=installationid=FeDrhw1V0Q --annotation=sessionid=a9add4b8-c9ac-47a4-b263-6e7444bb6ff3 --annotation=version=8.11.1.4421 --initial-client-data=0x558,0x55c,0x560,0x530,0x564,0x74c6f408,0x74c6f418,0x74c6f428
      4⤵
      Executes dropped EXE
      PID:1696
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Rescue Applet\cleanup8508.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:740
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1680
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4696
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3600
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3204
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6036
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1584
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2300
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2196
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:6040
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:5916
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 5
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LibRescueLiveControl.dll

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\LibRescueLiveControl.dll
Size 17.4MB
SHA256 5e66fb39d58eb3b2b8e7ea0f036dbae8393b048be2a69651e97a6f9708d0eaa2
MD5 f1c2efd1b20caeb1b219bdc4a66269d8
SHA1 84933bf34fe2422b321a3d850ba6a22b4c5583a9
SHA512 a10a0ca11f2bcc82a481f998d23c05729eff6aa79361e9b06ebb54238ea8affb74450730f016d5ef553e3191e8e5c0d69382b9f95c9ce2da514982b451b12527
SSDEEP 196608:6RHEUSfjF9P9k1mxZxJ2VkT1z7tJJsv6tWKFdu9C60etlFLns:6CUSbGmLxp1z7tJJsv6tWKFdu9CFetTs
TLSH
T1F107BFE2B68780B1EC8A11F4657AE73F8634A9144B2950D7A3DC3F5D9A311D23B3770A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MediaClientLib.dll

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\MediaClientLib.dll
Size 14.0MB
SHA256 407f40e5d66acc131253ec76e20721deac9cbd1166058745ebefa27e624db2df
MD5 64ccbc1031b8d535a2ad13f0000a0773
SHA1 c280bab4d008f0812a5f8794b354271719d43007
SHA512 2bcbb2b0814114476a530ed05e1d0412dcd8efb83bf264ff0d3a87e3307a0f9a33e6026cd01f9902212fa0e26a48c89de2590363a4c92a4a3fb989a24384c78c
SSDEEP 196608:UB9Vrr0/H0/iTzLwemjVogSyuMczbVlQVZBzwMqoCAyqIqAsOO4:UBjM/UKzLsoHzGBzHqfqeO4
TLSH
T160E6B081F1A26174C94618B0AD3DBA3A6E28025D877049F7FBD85CA07BF67D03379786
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PasswordPrivacyDll.dll

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\PasswordPrivacyDll.dll
Size 1.1MB
SHA256 7d92e6597c79adbafdbcf097e4ab3d8478ad29ca915ff9f5da31733840aca521
MD5 7700f4c0f4e73badd8bafa8a5f7b58f2
SHA1 71689c48543411874e86dd56b4b46817e6513b99
SHA512 08c811c5a048a80a79faaa858161d7eb7fb9c92fb9c1bb4ee5bbd3629eae49e39ce79b6665bd89cea03a79d60ef93ce5d4fe0d900bd98e26d10d96b4ad86b81d
SSDEEP 24576:mZQZYlonJ+0yqzGVY2YIiHwAnkR+y9TES5T471hr51:7YM801G81cOS5TI1hr51
TLSH
T104458C03BAC189B1F5AE06B448B6B33C897EBD704734C5C75BC8688969715C1BB3B396
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RescueCrashHandler.exe

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueCrashHandler.exe
Size 635KB
SHA256 de50a662e89a10b4bb8fac2767b5297e0b4ad54c1efa942db536ccee9fe4466c
MD5 ded61a8184d9b0b0316ba8c1fc309efd
SHA1 ce670b1ab4f1b825b5be77730ebf5781fb5f37a5
SHA512 3a50354a16374914cfe07ccf31b211212cdd1cbe81e98767911bd0b007dbdbec0f13612215f55d875365707d5e2070e784c9b3a88c1886698df4847b44309156
SSDEEP 12288:9/SVWh6PJLTf7Xg6FS3kkJSIvar1p8xvzgBoMt/EFvz898W9saLfozJIHrJQaCA8:9/SVWwJLfoCLXCA9eW/h+512TqwMOPwp
TLSH
T18AD4AF11B041C032E5B222B2A57DAF7455FDB52657B70AD737C48E3B9B202D23F34A9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RescueLoggerProcess.exe

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueLoggerProcess.exe
Size 237KB
SHA256 1da23c55b4c54067a6518618cc94fc0a26809a4a952009037bbc1ccef046286b
MD5 e1888e4311bab6b2158f38d82c11f654
SHA1 43950ae19b128bc7f75d022274c0c60bab2ea5ae
SHA512 e7d09eba8ef27272ebac805282c312d979e64f4f114545ece623dd1d244f35477abcae5ff84d574cb2eac5ed76797accb7bd83a5c0ca4b4fb70c6e62a107b800
SSDEEP 3072:xJoCsb+KFeqSaBrKDdFQFyyTWJdM1tCzSCwn/fhC/8JITH2oXXVCF:XozFRK3h/nwn/f0/X2oXXY
TLSH
T151348C53B1D0BC35D6220DF114E0A9604A2EFD525F6499E72348FAEE0B30BCC9A2657B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RescueProcessChecker.exe

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueProcessChecker.exe
Size 237KB
SHA256 9c0dc5203690c2aa030f45616c92ddc78d1e156bdd2ff324973e96dd7f102ee2
MD5 69c073c1be25edae6ccdaa7d60312f21
SHA1 7e8ead344e516d2015d97d7b872180304f539c46
SHA512 f5dd32f7054b0e24d4d1dbcafdb18002ee69c79efd9f004e26e0225718346c36eee43283e69e8c3688f77ce12f688d5fef5d58daeffe9ced16574ef1b826b202
SSDEEP 3072:vJoCsb+KFeqSaBrKDdF0FyyTWJdp1tanZjtdCwn/fhC/8JITH2oXXB7ZX:xozFRKLhwngwn/f0/X2oXXJ1
TLSH
T1E3348C53B5D1BC35D6220DF114E0E9604A2EFD525F2499E72348FAEE0B30BCC9A2657B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RescueRemoteControl.exe

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueRemoteControl.exe
Size 237KB
SHA256 bd966426984144ab1bed47545bdec8bc39d5b96c9b37fda3aa8960f5c59c26ac
MD5 2bd8fcc76f89903ea5d69bb43ca73227
SHA1 e23d52360ca5a018a2d45e35c01e69556fe7d31c
SHA512 4773ee19f38b0b0209339110846739ce71f940389bd174774624f99ab16a748b2b3a353bdd99a99d5e9ecd2a5f03d5352fa62d021558b40e42d75acb244515b1
SSDEEP 3072:fJoCsb+KFeqSaBrKDdFQFyyTWJdY1tC/WCwn/fhC/8JITH2oXXLoH:hozFRK3hTHwn/f0/X2oXXm
TLSH
T1FD348C53B5D0BC35D6220DF118E0A9704A2EFD525F6099E72348FAEE0B30BCC9A2557B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RescueService.exe

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\RescueService.exe
Size 237KB
SHA256 e926e8d01257c9cc57266b926508d3ce3ff23f3ba51288a43cc8b22cd6972764
MD5 ced5eb5fb77a343a8938de9c2a6d164a
SHA1 1e9b88147e4614d07ecd472295ec2efbb4d10d1a
SHA512 f3e94e51d08d8743cdfa4c72bae56cba317ac8c56aeb9499babcfabecee5a64e308c6cb9ec90ac0ac564badf3d8d69568d4117f49f9bef04be90697403f8ce1a
SSDEEP 3072:d5ACMreKFe6SyBrKDFFPFyyTWJdz1tyQoUCwn/fhC/8JITH2oXXdzQL:7AjFpK0hGQAwn/f0/X2oXX0
TLSH
T15C348D53B1D0BC75D6220DF114E0E9604A2EFD915F6499E72348FAEE0B30BCC9A2657B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\LOGGER~1\settings.dat
Size 40B
SHA256 61385bd96fec6174d22b992175d3e08b1467b54435bc46dbda5ec62a99352aa8
MD5 e5f7c67327ec3326abf82d110f71e20c
SHA1 bfa12dee70b269b487a06cfa24b25c53766d6aad
SHA512 98b78ffbd4dd983729710ee6913f2a3e68a3d0281867cedece43fc123e2217a1b2cabf93b7d31e8726c43f321290aed13456e31663b1be952aa4fa6071cdeae1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\PROCES~1\settings.dat
Size 40B
SHA256 091341011ea896c33947ea7e79d3e726ff04c1a7d0d12a54f782431500c2111d
MD5 46491aa88d8a3e4ca2fbe5a5dc8f7604
SHA1 e01970d3340fcaf636baa88883b1fc9f0c58ad6d
SHA512 f27959eb3bca8eaa983a313044deeda4b8c0834bf479a6ff96525899720da7894edd2bd93827928929eaca1d9afd101cf15a66475802b7cf1fd10aa1ee3468b3
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\REMOTE~1\settings.dat
Size 40B
SHA256 18b90729a342a4ae2687ce60deccd5f22d7fa7d438bd9c36304c338909554f5b
MD5 ffc4943a09c1cde23a22f979fe58fe76
SHA1 a399b261931f090cf61610e90238287b75557e34
SHA512 058d65a1be0f51936dd9b425620d60dfe93e8d57ad5f86fc309f5e176e621adc9e462f57caa05784a9c0f5e4f020d7c5be67d134ad20809d49af97472d1aafaf
MD5 SHA1 SHA512

Submit Download

RESCUE~1.LOG

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RESCUE~1.LOG
Size 15KB
SHA256 47c77e2604dad65ff2b47c6571b9c9cca4868c923f0aa9b7f7dc48473886f6d0
MD5 c9e6975a0c1044b44e6027a5b1dcb3cb
SHA1 98c17290864ca10c81aad4ca294687c3803e932f
SHA512 138e9741dcc375d76732582442f135f579bce32e32dffa1e6c38a7f630cd4eaf8f3f12b50396f228adc13df6b57815bb9430a936b23ef648f0e46ef188f0d81f
SSDEEP 384:47fDMj1m/ymnReyA3RmASr6DgdAgobNBL:RmqmkrR9UdFov
TLSH
T17662F0C68D2FBCF763B6C3BAF8761A46E70037775949494B23D8550C33A6E063A5B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESCUE~2.LOG

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RESCUE~2.LOG
Size 13KB
SHA256 efd80867e27680456417bad471fa4203260876438755aa34981d1f8623f17b01
MD5 2b9e163a3066e579a694892a0906c7fe
SHA1 b59cab1978db1141702e76bcdf60f4f79d8835e4
SHA512 cfa7968e547b8919d62adecada73cf0d2fbc081b709c755d9f2cb3a63c16f54c3dcd2e349a33c21395c9eeb59b6ac88e58e1300bd21bb71ae8f5adfaed9068d7
SSDEEP 384:EpdAmRRADRmAony5JAMRRADRmA8T7s89TmzYk:DlNKPrNi7+H
TLSH
T19D5202EF582DB4FB63F59362B76E4C499540326F9AF521229380C40A3BDFE1887E7214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESCUE~3.LOG

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RESCUE~3.LOG
Size 3KB
SHA256 7acdf5ab764a5ee7201c6dd4e7b65d2e08f5566635aa3b60a91002c840a0fbbc
MD5 98d75b085161f89d671af11c97587950
SHA1 51bbab7982c752003ae38d503a87535bc1a23c6a
SHA512 ef0ba00a022036bdadc706f5faa7f0def225d4b33dbd8e8dde92ed51a1b53ef6fdd8822ffde549a85dd21a1e76a61064f6503417082b0d426cc32c5bf27743c0
TLSH
T16171AFC3463BB8F732BE3796D4B52E42FA4073AE46F14C1B2BC8D04927665405786DD0
MD5 SHA1 SHA512 TLSH

Submit Download

RESCUE~4.LOG

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RESCUE~4.LOG
Size 2KB
SHA256 89074772e99d63616982b519f973714267493fd15330acc566fa4638356d5af6
MD5 ccdc717a53ead52f14dbc736baadc271
SHA1 b9b7c4a969c1fd8627d944dcfca75538d99ccb46
SHA512 628e6062d83c0ab6cee4914111198e6aa9a3765358e4fc2ecd78c27290207b14506b6e36bd72f758108b69e774bd136b0025d97f877a566b8df5bf249a09c88b
TLSH
T1DC5121D25E377CEB1321D2B7D9B69D24E26133EE4A984D0B23DC118C3B86B855297281
MD5 SHA1 SHA512 TLSH

Submit Download

RescueProcessChecker.log

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RescueProcessChecker.log
Size 6KB
SHA256 3709aaad4a11612dc030eb41a9ab144a68cd97ebc85817f555d325ae10c3278a
MD5 9ef0baf6754bdf7caa68ec1b490e6313
SHA1 2b0815fc57c13d25c3838eee4a0f17c847acca0e
SHA512 fc908c1d675b903653ca446c2707f87e991c0bacbab984023c15012299b8238f9b44f152a4b34c8a097d658ca5559d23df5be8579b43a822cbb29f0bd4c51950
SSDEEP 192:pQZmKpaRdGAmRMqADR7qAZCpNc+EB5ZyaLFm+pa+6UAMRMqADR7qAZuphcyInIG:EpdAmRRADRmAony5JAMRRADRmA8Tq
TLSH
T182D112E61C5DB4FA5371A362BA9B9C5DA0403A9F58F46551E3C4C40F36DFE1893A3314
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RescueService.log

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\RescueService.log
Size 2KB
SHA256 d320f711f5587d2ab2b7010d4d4f3aba76c89c6a6f898c3cbc0a29f87ae438c7
MD5 80814b5ec6aacf35fdaf6d4aee25320c
SHA1 c75476241980b5df4d7aeeb622be940d741cb9ed
SHA512 20c70883377a3dfb5d11bf6bfb07e634610b53c3763db93da3c57f869a95a52d3221d67eca9b67dfbaa0b3198e02957fd36144950aa25d30500c0566c718c12d
TLSH
T1F4419ECA4D89FCF7B371C17AE42FBA92AB11BB7F69094D0617C0498C3697E091BA7510
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\appdata\SERVIC~1\settings.dat
Size 40B
SHA256 9423f9f08ae8688cfcae382a56750c9b0b02fdf2e55d9313ce1b02038eacaad1
MD5 fd7ece06bc65ae0c1e8a1f1109662235
SHA1 d297e78d8552f56d0acf7617198a311f51cc7b9d
SHA512 ff1362970c9065e10132a577c830ccd5662630d604dc8eb73a3830cd5bf6de9e5a17d69550e4aa8a228a5e1fd872785d5350f14482c5de800e5d42fd9978ec76
MD5 SHA1 SHA512

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\libcrypto-3.dll
Size 4.2MB
SHA256 6ca0e4e34211287122215a082c3ab24d0ef8bb119086ff43af1e3fec852a7dc2
MD5 85f1c0bab0b8ad58aef57cebb31213c3
SHA1 72198be5f3c02f0c2aa445e243244c4afa049522
SHA512 b26780c366eed49c8f792bd04a4ab4cf89f96409ae90d18f74057f4c3a0764064ddb47d0cc39a7b6c66958c5a7a910b31b6108edeb1ce52cddda10126ed812df
SSDEEP 98304:ArEe6y3ncz7XoBv+nci1CPwDvt3uFlDC2IC:F7y367XoBvWci1CPwDvt3uFlDC2R
TLSH
T17316BF12FB926191E8DF917D03EEA73F0E3D5B14872489D38EA625E9C8356C1673E390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\libssl-3.dll
Size 1.1MB
SHA256 be0f9e13b443c1b8c7e8131b8944a6e9c69f69341b1b2c7e4760d75183062858
MD5 b80e70eb5038d0cae3bfc7306e107c55
SHA1 aa844e7e4d60f752d1d93018eb0d3e165f996faa
SHA512 08d577a004070411b038b6257118c12f4faf4be804ca5b06f3fc78ebbdf5b22c483534ce2003d4ecd0d6374dd3055a0819a2a698152aa9dd7225fa2cd0f95c08
SSDEEP 12288:L5SNXZNH78/r/qEipzLBSxvyEuSc2/8lJUwFrYhlfnR4Iu4AGd7kiFe9Xb169W:dSrXJUw+fGodYiFe9Xb169W
TLSH
T18F35AE11BA818961DCE631BD02ED773E467DA2200718C9D74F855AFADE20AC16B3B7CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mandatory.json

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\mandatory.json
Size 825B
SHA256 a62e091447af771eddcf944617596d2f36804c6e08141a0f1ef0e3f21b440315
MD5 ba1610de23a20f131b895327f463230d
SHA1 495b0721be65bb2a909e8f5fc0e044b5b852aa97
SHA512 d2229fced7af85450ab82c3ed19e700765565eb86ab22bb76e57ee928c7dcfb4cb5639f6167ed8d651b35cdd362febfac68aa874bb5c08bbfcdfc071888eebdd
TLSH
T1FA0189B2CC5A4DB75B2065D0A582A54E70685BD71DA07098B741401F1FAF82FA23B39D
MD5 SHA1 SHA512 TLSH

Submit Download

params.json

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\params.json
Size 588B
SHA256 88804963e03664b9d53b01195988d78f3946f26424d3239491e70caef647c9fe
MD5 37b946bdf287950b6ec742f19a12abf2
SHA1 417834d7f0be0d32beef24f6812429bfb73ec3a6
SHA512 4c8b24eb8bf72401120d29d48312c5b837e95afa5ebc194daab462f667eef12cdb99ac9be257d6b15e44747970ed2189778b66272e30133627d553cbae460cbd
TLSH
T1CFF04CFB4DEF24F94710B2C16A8AB90E701C4FC55591B558A444543F25AB483A01F79C
MD5 SHA1 SHA512 TLSH

Submit Download

params.json

Path C:\Users\Admin\AppData\Local\Rescue Applet\LMI0001.tmp\params.json
Size 917B
SHA256 2e7aef4c9e0d38d9ceaa9651e9b65aa3a938744b25fdf3c628b8e9859e253e0c
MD5 bfb76eeebaac105640c66f0aa2eb5c98
SHA1 7303d707eab9ead8ef02ce01bc10215221b26edd
SHA512 863f693898b4252c420249d72a194a2ef2bdc665c2e1b2b99947446ffe83dc2b30fa676aeb29ff95866a08f9af35aa176e7a0c9f285528722e8b182147482ae8
TLSH
T12311C8F2CC1B1DF70B1464D0A982B60A30284BD72DA07489B780012F1FAF86FA13B39C
MD5 SHA1 SHA512 TLSH

Submit Download

cleanup8508.bat

Path C:\Users\Admin\AppData\Local\Rescue Applet\cleanup8508.bat
Size 332B
SHA256 6185a56e148f13d500b6c1b8e6785242ba042fe53d89bb28f631d4f3e187a1ae
MD5 c89b0bfbc1916f5bf84b30c0aa5656ad
SHA1 ec05069f51eb15909bd81a31b441c54b9b780231
SHA512 7fb38b3da5394ada68b7e4dd159e30a6f5c7c798aa2f60a2b85fd7f79570b8604bb5b3aa1fcbabf21d21e609792840689318069c44c6260180de003d8470383b
TLSH
T128E026468BCC855E0B25C2FB4EAA3448E424C31967453A8136109CC4AEA641AE1B7581
MD5 SHA1 SHA512 TLSH

Submit Download

2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe.cmd

Path C:\Users\Admin\AppData\Local\Temp\2026-04-19_41487297db9e38aa53cb2ed103878591_akira_amadey_elex_luca-stealer_lynx_njrat.exe.cmd
Size 537B
SHA256 5653c22a6d0f410d2a1207c131206c1f990be9a3fcd2c8e5a5dfa77b01d73c1b
MD5 2d1ec5c3d0d2fd67e0aa148f4e523d93
SHA1 24a6528837fe7c825f44be9e0c2bd942203bb9b0
SHA512 7fdeeb8471cc5916131011186ea9da7c9ccea6b9755bbdec2ecce4f564079c05b566ff147b700b3535fe608e48a69c5d2922d74be5003995a77a19a03bf06f25
TLSH
T181F0688D210A08022DF088572A47D584F208D083DB1D5309B46F21C98FB6314C2CA386
MD5 SHA1 SHA512 TLSH

Submit Download

103E497CC28A174A9B7A2A96CAB452FA

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103E497CC28A174A9B7A2A96CAB452FA
Size 914B
SHA256 7d70c0fbbaf7f78fdfd9cff22985752affc557ec98cd6bb4b9de0b9a0b7d98fc
MD5 0f7fc291a041bfe01e6ce9e879f43f64
SHA1 6dea5b129c4730626c2224b62a2417947adf8900
SHA512 545880652b1f154479f0c99da90a42a293fc55b36a10e30d669f71417a8103952eec65253af68887e394b4af44f04dc5801689d8c71174c9b55ee0753efa555a
TLSH
T1431184C342EECEB0D5479E84248445136900F2684871EDDB2736C1624BD1E4ABFF60E5
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
Size 727B
SHA256 fca146d54bef6e986a834cd9b7d8a8feaeeab3a8205dba463400ad5e5972f21c
MD5 c42619981f01219b1dde75db86769bc5
SHA1 5c646120159986ed66cc5e0e450d07dbb80be80a
SHA512 4fc91209732d74bf15b988534c77486d08427ae60fdeb2fb29139d33c32906796c98a1c7d76bf4587f14a64b67131314aad621fd8ac8c143574f26b87537db15
TLSH
T1B901995ADFBD11905B45485F4B2CDB1378C456040461521A33765204F70A771AB0533D
MD5 SHA1 SHA512 TLSH

Submit Download

103E497CC28A174A9B7A2A96CAB452FA

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103E497CC28A174A9B7A2A96CAB452FA
Size 294B
SHA256 a81dd1f7cd58f57439458c89895c9982e09aabfdba27ee0b9e3075598bebb15f
MD5 4d6cfdf8a3acb422670335b3c3b81b6c
SHA1 37736723e65a0f16d880e4bde7aff5c142d2fdb5
SHA512 4b3f55ae8f352f9299706d085e4147d76e01e78a50e4bfde17b8b0620ed67112932e4bc52143aca7b8a89f0b91a2b4c48810bce8c9ffca1e4073859b0471c93e
TLSH
T10FE0A72A1FED013BF5E666BE1EB05641FA24BD36A006DF1803E0268E8439F001C31919
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5

Path C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_1B47B234E9558C0145847E653CBECED5
Size 408B
SHA256 3ae17212af5311893cfb95849303dac0c5c1e2f82255d017aaaa0e64f88408e9
MD5 84839bd3887ed53d316090c59b7d00c7
SHA1 986eedc9615dca59c423ec3f90b0d7e81a67576f
SHA512 7ee4edc0de338d85abeb0b2ca5c458a161ce84d5155ad738a15a0b1a71424e617ff208c8647dfd4cfad1f6e72002a3c380d1d67780d4ad415d029083cfa019f5
TLSH
T162E0C63423FE410EF2F1F23802F6A8221A6AF30B0A42CAE850D01624BA71B800CD2920
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1848-85-0x0000000000C40000-0x0000000000D3E000-memory.dmp

Download

memory/1980-87-0x0000000001710000-0x000000000180E000-memory.dmp

Download

memory/3376-185-0x0000000001050000-0x000000000114E000-memory.dmp

Download

memory/3800-189-0x0000000001160000-0x000000000125E000-memory.dmp

Download

memory/3800-190-0x0000000003A20000-0x0000000003AC0000-memory.dmp

Download

memory/4824-101-0x0000000001850000-0x000000000194E000-memory.dmp

Download

memory/4824-155-0x0000000001850000-0x000000000194E000-memory.dmp

Download

memory/4824-100-0x0000000001850000-0x000000000194E000-memory.dmp

Download

memory/4824-198-0x0000000001850000-0x000000000194E000-memory.dmp

Download

memory/5944-195-0x0000000001510000-0x000000000160E000-memory.dmp

Download