Analysis
- max time kernel
122s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
General
- Target 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe
- Size 14.8MB
- Sample260602-rwp2asfx5v
- SHA256 177abd8b75fadba73907386529e63324b97fbe1a0ab7a23d79f40faa5431b9e5
- MD5 c552cd9593d15b9d93c85487a9b66b3a
- SHA1 383b982c08dd8a2d16bc8deddb66fe3d4e341675
- SHA512 40dd6a29fbc40db2ab77877371e2d863038c249d02166d34eb271ae3b1daaae60bbf54e52cdef40e8f4b891ec6f6d092d58dd9b56ad467ea40aa0193c125b2d3
- SSDEEP 393216:yS46IDiYpH+d/mJA3fkJuoqzPYCruUlDTFj0:GDiY7A3fkJH6PBruEN0
- TLSH T12FF6333525A1D032E6D664F5AD78EB6E2DA469F00F094783F38C794E77B0BCA9421327
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 41 IoCs
resource yara_rule behavioral2/memory/2600-1-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-5-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-3-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-4-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-9-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-11-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-14-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-13-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-16-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-17-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-61-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-60-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-62-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-63-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-64-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-66-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-67-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-69-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-74-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-76-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-80-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-81-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-84-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-86-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-88-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-101-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-100-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-103-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-140-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-158-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-191-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-205-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-227-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-226-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-263-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-264-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/files/0x001a00000002b50c-269.dat INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-275-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-277-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-278-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2600-279-0x0000000002430000-0x00000000034BE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 41 IoCs
resource yara_rule behavioral2/memory/2600-1-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-5-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-3-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-4-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-9-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-11-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-14-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-13-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-16-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-17-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-61-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-60-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-62-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-63-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-64-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-66-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-67-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-69-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-74-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-76-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-80-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-81-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-84-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-86-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-88-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-101-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-100-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-103-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-140-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-158-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-191-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-205-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-227-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-226-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-263-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-264-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-275-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-277-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-278-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-279-0x0000000002430000-0x00000000034BE000-memory.dmp UPX behavioral2/memory/2600-282-0x0000000000400000-0x0000000000491000-memory.dmp UPX - Executes dropped EXE 2 IoCs
pid Process 2416 vcredist_x86.exe 3352 install.exe - Loads dropped DLL 1 IoCs
pid Process 3352 install.exe - Windows security modification 2 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 2 1540 msiexec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\K: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\N: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\O: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\J: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\P: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\Q: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\V: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\X: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\G: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\E: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\M: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\T: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\Y: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\H: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\I: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\L: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\U: 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification F:\autorun.inf 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe -
resource yara_rule behavioral2/memory/2600-1-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-5-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-3-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-4-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-9-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-11-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-14-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-13-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-16-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-17-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-61-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-60-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-62-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-63-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-64-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-66-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-67-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-69-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-74-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-76-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-80-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-81-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-84-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-86-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-88-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-101-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-100-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-103-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-140-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-158-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-191-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-205-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-227-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-226-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-263-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-264-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-275-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-277-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-278-0x0000000002430000-0x00000000034BE000-memory.dmp upx behavioral2/memory/2600-279-0x0000000002430000-0x00000000034BE000-memory.dmp upx - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File created C:\Program Files (x86)\PopCap Games\Heavy Weapon Deluxe\Install_props.xml 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File created C:\Program Files (x86)\PopCap Games\Heavy Weapon Deluxe\Install.log 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90kor.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.1\mfcm90.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326514.1 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326451.0 msiexec.exe File created C:\Windows\SystemTemp\~DFA8FB219B9EB70E77.TMP msiexec.exe File created \??\c:\Windows\Installer\e58a0df.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326435.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90chs.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90deu.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90rus.dll msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057\9.0.30729\FL_msdia71_dll_2_60035_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8 msiexec.exe File created \??\c:\Windows\Installer\e58a0e3.msi msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.1\9.0.30729.1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.1\mfc90.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326435.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326498.0 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326529.0 msiexec.exe File opened for modification \??\c:\Windows\Installer\e58a0df.msi msiexec.exe File created \??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057\9.0.30729\FL_msdia71_dll_2_60035_x86_ln.3643236F_FC70_11D3_A536_0090278A1BB8 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326482.1 msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA5B1.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326435.0\atl90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.1\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90fra.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.0\msvcp90.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.1\mfcm90u.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326451.1 msiexec.exe File opened for modification \??\c:\Windows\Installer\ msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326451.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1.manifest msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.0\msvcr90.dll msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057\9.0.30729 msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326498.1 msiexec.exe File opened for modification \??\c:\Windows\Installer\$PatchCache$\Managed\D20352A90C039D93DBF6126ECE614057 msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326514.1\9.0.30729.1.policy msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF003D5FDD86EA158E.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326451.1\9.0.21022.8.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326529.0\9.0.30729.1.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326451.0\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90ita.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.1\mfc90u.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326451.1\9.0.21022.8.policy msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326529.0\9.0.30729.1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90cht.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326482.0\msvcm90.dll msiexec.exe File opened for modification C:\Windows\WinSxS\InstallTemp\20260602153326482.0 msiexec.exe File created C:\Windows\SystemTemp\~DF5A4BA801A1E86ECE.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326435.0\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90enu.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326514.0\9.0.30729.1.policy msiexec.exe File created C:\Windows\SystemTemp\~DF3F139E4FAB715257.TMP msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90esp.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90jpn.dll msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326451.0\vcomp90.dll msiexec.exe File opened for modification C:\Windows\SYSTEM.INI 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe File created C:\Windows\Installer\SourceHash{9A25302D-30C0-39D9-BD6F-21E6EC160475} msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326514.0\9.0.30729.1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326514.1\9.0.30729.1.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20260602153326498.0\mfc90esn.dll msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vcredist_x86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language install.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe - Modifies registry class 52 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_MFCLOC_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Version = "151025673" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\PackageName = "vc_red.msi" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e00390032002c002b004b006e00240039002e0037006d0024006f0066007000790021004b007400620000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e0049004000790043006a0027006200720045003400710030004c0044006f0059004c007e006600580000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.MFCLOC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0040006500650034004900600034006b0069003500590047006500590051006300340025007700780000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\PackageCode = "6C7E9C94F9A4F6E4EA39E910D4A1AC39" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011\D20352A90C039D93DBF6126ECE614057 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.ATL,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e007900590067002500610066004a005700640037003800700038006d007200570035002b004d00660000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\VC_Redist_12222_x86_enu msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_CRT_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Clients = 3a0000000000 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.OpenMP,version="9.0.21022.8",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e004d0039002c004f005500350063004d0078003400660069003f00660040007b00300021004400480000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_MFC_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Net\1 = "c:\\0c5713f92ea161683666a03dde\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\Servicing_Key msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_ATL_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media\1 = ";1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.ATL,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f00410054004c005f007800380036003e006500720069002d002e003800540052004600340074006d00310053006a006d00350059005d00380000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\FT_VC_Redist_OpenMP_x86 = "VC_Redist_12222_x86_enu" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\AuthorizedLUAApp = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\LastUsedSource = "n;1;c:\\0c5713f92ea161683666a03dde\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.CRT,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004300520054005f007800380036003e006b0027005600490037006f00520050007e00370055003d006f0029006d00730026002c003300420000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFCLOC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043004c004f0043005f007800380036003e0063002e00410078003f007d0058003200710034003900530045006800470072004b0038007400360000000000 msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\Microsoft.VC90.OpenMP,version="9.0.21022.8",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004f00700065006e004d0050005f007800380036003e004d004f00700050006d00360078002b0044003400700061006d006600580031006f00390032007a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\ProductName = "Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\SourceList msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D20352A90C039D93DBF6126ECE614057\AdvertiseFlags = "388" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Win32Assemblies\Global\policy.9.0.Microsoft.VC90.MFC,version="9.0.30729.1",publicKeyToken="1fc8b3b9a1e18e3b",processorArchitecture="x86",type="win32-policy" = 4500600029005600590027002d0046005a0036005e00620076007a0072004f00520068005b004d00460054005f00560043005f005200650064006900730074005f004d00460043005f007800380036003e004d0072004e0075004700740065007d0054003400240066006f0062004f005000340040004d004d0000000000 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D20352A90C039D93DBF6126ECE614057\VC_RED_enu_x86_net_SETUP msiexec.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 1540 msiexec.exe 1540 msiexec.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe Token: SeDebugPrivilege 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2600 wrote to memory of 808 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 8 PID 2600 wrote to memory of 812 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 9 PID 2600 wrote to memory of 724 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 14 PID 2600 wrote to memory of 2200 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 51 PID 2600 wrote to memory of 1040 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 52 PID 2600 wrote to memory of 2664 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 53 PID 2600 wrote to memory of 3204 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 54 PID 2600 wrote to memory of 3328 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 55 PID 2600 wrote to memory of 3592 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 57 PID 2600 wrote to memory of 3612 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 58 PID 2600 wrote to memory of 3688 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 59 PID 2600 wrote to memory of 3760 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 60 PID 2600 wrote to memory of 3824 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 61 PID 2600 wrote to memory of 3876 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 62 PID 2600 wrote to memory of 4164 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 63 PID 2600 wrote to memory of 808 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 8 PID 2600 wrote to memory of 812 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 9 PID 2600 wrote to memory of 724 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 14 PID 2600 wrote to memory of 2200 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 51 PID 2600 wrote to memory of 1040 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 52 PID 2600 wrote to memory of 2664 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 53 PID 2600 wrote to memory of 3204 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 54 PID 2600 wrote to memory of 3328 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 55 PID 2600 wrote to memory of 3592 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 57 PID 2600 wrote to memory of 3612 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 58 PID 2600 wrote to memory of 3688 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 59 PID 2600 wrote to memory of 3760 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 60 PID 2600 wrote to memory of 3824 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 61 PID 2600 wrote to memory of 3876 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 62 PID 2600 wrote to memory of 4164 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 63 PID 2600 wrote to memory of 808 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 8 PID 2600 wrote to memory of 812 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 9 PID 2600 wrote to memory of 724 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 14 PID 2600 wrote to memory of 2200 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 51 PID 2600 wrote to memory of 1040 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 52 PID 2600 wrote to memory of 2664 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 53 PID 2600 wrote to memory of 3204 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 54 PID 2600 wrote to memory of 3328 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 55 PID 2600 wrote to memory of 3592 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 57 PID 2600 wrote to memory of 3612 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 58 PID 2600 wrote to memory of 3688 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 59 PID 2600 wrote to memory of 3760 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 60 PID 2600 wrote to memory of 3824 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 61 PID 2600 wrote to memory of 3876 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 62 PID 2600 wrote to memory of 4164 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 63 PID 2600 wrote to memory of 2416 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 81 PID 2416 wrote to memory of 3352 2416 vcredist_x86.exe 82 PID 2600 wrote to memory of 808 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 8 PID 2600 wrote to memory of 812 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 9 PID 2600 wrote to memory of 724 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 14 PID 2600 wrote to memory of 2200 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 51 PID 2600 wrote to memory of 1040 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 52 PID 2600 wrote to memory of 2664 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 53 PID 2600 wrote to memory of 3204 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 54 PID 2600 wrote to memory of 3328 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 55 PID 2600 wrote to memory of 3592 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 57 PID 2600 wrote to memory of 3612 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 58 PID 2600 wrote to memory of 3688 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 59 PID 2600 wrote to memory of 3760 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 60 PID 2600 wrote to memory of 3824 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 61 PID 2600 wrote to memory of 3876 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 62 PID 2600 wrote to memory of 4164 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 63 PID 2600 wrote to memory of 2416 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 81 PID 2600 wrote to memory of 2416 2600 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe 81 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:808
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:812
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:724
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2200
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1040
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2664
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe"C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe" /q3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\0c5713f92ea161683666a03dde\install.exec:\0c5713f92ea161683666a03dde\.\install.exe /q4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3352
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3328
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:3592
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3612
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3688
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3760
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3876
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4164
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1540
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\0c5713f92ea161683666a03dde\install.exe
- Size 549KB
- SHA256 3377e31d233ff41aea253e6221815820997763acdf40b005f8791400366cb8ff
- MD5 33c9213ff5849ef7346799cae4d8ac80
- SHA1 5421169811570171e9d2d0a1cdca9665273e7b59
- SHA512 da0fc3f57156e06c0c37c1fb5176e1b147ce4aa21f519112123722496b04ad4bc3d366e2b51fd78de1ba0304d35bfd5e5fc95cabc2b3eb174f77636a8fa162a1
- SSDEEP 12288:JhpnLfQKj2G8qMu3jNHS1fiU/wFXbNEnDQvxjza:JheVu3jdSp/wtODixj+
- TLSH T1C1C47D317EF48035D4F352B456AD626151B9FCB01B3980CBB38453AEAA70BC1AB35B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\0c5713f92ea161683666a03dde\install.res.1033.dll
- Size 89KB
- SHA256 2893b1b9751f833d4a3ded7c1fba1a96cada2927a2349c5d751365eed647c100
- MD5 8e97ea8a1ed69806232e8743f9a28706
- SHA1 e911d3802e64f9be0e1ac68865bbcc92624d6a1f
- SHA512 aa57fe0b822145aa1d8eb72f9735ef5d92036f24c4c80392799d701447d18ea510331f5653b39c43dc923cd0f1a61bf87be0f8a4927f6e3754d19ac76fd443c3
- SSDEEP 768:5E/1+JTdsC21GLQn77xqNTHSCnHWkokPMR1ioIEO/CaqpuK6tmpU8Cu1j0:gIp0YTHSpNR1inEO/Cajr8Cu1g
- TLSH T1A493614267F98125F5F73B74ADB956701E7ABC919E38C28E2280619E0DB2BC0DD70763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0E582FE5_Rar\2026-06-02_c552cd9593d15b9d93c85487a9b66b3a_elex_stealc_stop.exe
- Size 14.7MB
- SHA256 c477a5adab391a3b47502e5a640ae7c0602e39d8df752fb58393f7eb71b3e9ce
- MD5 f77242772e51fe2986cbf01bbf093819
- SHA1 f6fb7849c84d362cdb063225520361d14f80793c
- SHA512 bbfbd9b2faefe483d11449113bc4e19e5ac7bc5508fb189d007e40527c00578931b32dde733638698f53d8f80b99d5e1d8f224f8fd3e4f1f19a807f3e70befaf
- SSDEEP 393216:GSd6IDiYpH+d/mJA3fkJuoqzPYCruUlDTFj0:zDiY7A3fkJH6PBruEN0
- TLSH T1BFF6333525A2D032E6D664F5AD78EB6E2DA469F01F090783F38C794D77B0BCA9421327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\VWLB2E0.tmp
- Size 392B
- SHA256 75d14d0475f53623de1b2b2978aa6906fad152a7efb633a817b61eb95c51dc08
- MD5 4c1dd5c685a7b577b284086527247b9d
- SHA1 6c901d503a2b8d589db21922a11c6cf7419c887c
- SHA512 284b9a2c3896e0ddd0b305f28c5c2045b65e889187f13aad2310a9b0f8cdc041adf0bd43a405fcd7d0568964b7e6336b5f8b4f86ac65ff2806592f6e2b014e5f
- TLSH T158E01A6A62D96C2AF9A7DA8A85BA00636B36BD227878CD0C50E2238C50F4400B171B67
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI34F9.txt
- Size 2KB
- SHA256 ff61ed0574725ed206b94f99009fb2f8e72777dc3c761b0ebe24b2917232f039
- MD5 c7be7f4b2e9b667856d11b528a99cfe3
- SHA1 8cb81852eba0069e4da200e58588943182a3e8fd
- SHA512 960844428f15be6cbaca948b93aa454a9557eba8887464b3b06b56d282d5c25070df5ea93aee0f578c4fa3cc00eaae3e025996e3864af6621a2d989bd66aec1f
- TLSH T1CA51C6251AD50C09F6B39A07EDF3C4515A737DD3A9348F0C2389C2594AAFD06A87C7AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\popcfg2\defines.xml
- Size 1KB
- SHA256 117ca1381a96d2f3fb357be5a3d8faf580d6911f00cb8755cd4e9e158797fa5d
- MD5 cc69cf64fe8403212bfad9b8f8c8625c
- SHA1 a9edf066896300dd995b15e00ea88211dd8d26a7
- SHA512 78e3cf1a6c5779d69052ef681c9e74c02e0966a3eb2fac75f82f80556aaf8f17a3b7f9070dcc98e6183cd35f27b2604dc8bfd5cee1911316c1d4270632bd1e0f
- TLSH T18421ECCD59E4F970243966ED7A321C89DE51DDAF884148A4FEDA4C532F700AB20E7A73
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\popcfg2\eula.rtf
- Size 52KB
- SHA256 5fe1559110c4cf1a53256bdb3d93ad9387295198530405b7d7ea1280c217ec2f
- MD5 977e662aa64f82e18254938fc04e1cc4
- SHA1 d33c0842896d8089037efb5b4924b7b12b5ebe3d
- SHA512 90417e5ac7e7f4d1ce1d3d53972f5bdb58f0a57e6aeefb00ad85079991071e9f91a6a8468650e124583a4f5a59df181cde668e5d3aa3565ceb0235cd833ad45a
- SSDEEP 768:z113q1UFkArir8slLj9ZVvq33i5EWqvReswxr9bIJdfe4zR4AWRVq3ZrS14F:z1ErpEgIJd26WRVqDF
- TLSH T1CA3396B8404257C5D36323A4FB16F09DBB2BF118A4E998D831FFC2BE6077A9CD166521
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\popcfg2\install.xml
- Size 3KB
- SHA256 77c051a0e3718e45613efd990d7f82aba8f6d30fffe1dfc85c55a033123f4f82
- MD5 8c38e8cb520718b3e90d0fbe04d67875
- SHA1 b95c69b5a934972090181187382d4444e1fcd0f3
- SHA512 24d844679084997148c26a295639833cb819c9262985cd47e83dee334218bceb74a2a544bea957c24a88e2f8d2454bf43152e0b0491f8a08fff0b60111b294f1
- TLSH T13971BC49B0D9A3707C30978CB6738C4AEA23D5D71055089CF2DFEE576F7544A24A3693
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\popcfg2\logo.bmp
- Size 24KB
- SHA256 7f3e2f0ec8926e7911fe024271387657adf8bda95581c6235f995be57ff56ea1
- MD5 1843d66328cedc1ce60cb98f3d593f4a
- SHA1 d84a82214e498123609a13aa54164f972776d33a
- SHA512 f1fa3aa6a62c868d69d17b6ab5e5cb39e4099f971c84c16f6857c6202016ad9104a5f2e188e8721be5ac3ab43c4bc45122e84fff473e4913aed60b4fa3e8c8c7
- SSDEEP 384:B6o0ylnfRNngxSugmpWIH8p7POrzRAmPa5BIXfDl3+H:iCnfRNngxXWTRpmPa5KJOH
- TLSH T11BB2291CFC0C06786AAEA53A63B9E7177C02B095919316E6F1712E74CBEC6439E1178F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\popcfg2\product.bmp
- Size 19KB
- SHA256 b6cfb51681f09ba314b04444901c1adf97a1390390f0c8003898e04a70f16c07
- MD5 378ff057266510d0651ba279c9438684
- SHA1 5787d75e45c8fccea2cffeb08c9cad5d24158cee
- SHA512 bf9314a718795d0b2e816f0e93db9d44ead8c485d612f6cff1738b07357f2c3d866280d62a4ccc24e00abfdb6e6481d2954fe9553f4589fa2789d66aafb8d1de
- SSDEEP 384:TvXCSHqas3cTNJTzKAFZIH216ufe01UsGLCu6GAJVoFDANUiABIe/y/c:zXFHYSTzdFZIHO6slGLv3DAN9e/y/c
- TLSH T1F8925AD206B30861D9B2B73CECE60583BB07BE52A55862FE90A6B39745F21D13D93037
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\popcfg2\props.xml
- Size 6KB
- SHA256 b0d21cd683d0982eff52f5fe42d8841377110806a2fd1b1d09ea7ccc1893fd14
- MD5 ed1a4daf65608f02a8bd5a1bb2e19ac6
- SHA1 496643241d51f5347f53fc176c69858b65febe6a
- SHA512 8998362f9fc37dbd535d3cd248aaa43abcbcdfc4dbee308890f41f0ca62073d7658ee398497f15e44a8ea0116a820ea6bf2b57bd7f2baebdf05bd46f49f72606
- SSDEEP 192:PtMQYWr0aqezy3xr1EMlfu3SThPo/EABSDn5MyrN9ert/rhKn:PtMvWwrNWyJ9eB/c
- TLSH T14CD17994723A19A0F9500266FABF1A7E214580CD437826F5EDEF222B018D57673B6F93
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\popcfg2\vcredist_x86.exe
- Size 4.0MB
- SHA256 41f45a46ee56626ff2699d525bb56a3bb4718c5ca5f4fb5b3b38add64584026b
- MD5 5689d43c3b201dd3810fa3bba4a6476a
- SHA1 6939100e397cef26ec22e95e53fcd9fc979b7bc9
- SHA512 4875134c664503242ec60717232f2917edca20286fc4b675223edbbe5dc0239ebfaf8f67edd76fedcaa2be5419490dc6f47930ca260e6c9988ccf242416c204b
- SSDEEP 49152:DQC7p7i0AY9PE1UJEfcnKiJ/K7+RIaCSi3haenvUvwwZDfimxQ02BhoZGxaJq8QQ:DLp7ilY9CQEcKz+kSixJvzwZeK2ggYK4
- TLSH T1E31633B52AEF137AF6D1D2F024A999122D7477527C020B31D485921BC26AF5FB03B36B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ssgyk.exe
- Size 100KB
- SHA256 842fd8490dd47418fa623c73807c5e4cef3158a54ac63f6ab3d792c02cd15a45
- MD5 27d412ecc1cbf1a7ee4622c94c2c49fb
- SHA1 04cc585eb86dac75024f3650c8e4511b4781116c
- SHA512 7b0d42f520f96559a5fe3f8a3dd9417f7fe90e48632ba6561f52e7c9962030e84c0403353c91f11dbc14945b69e65b7ca5fa02ea5b728676de8daf8d7d4cba5a
- SSDEEP 1536:5WJp80SLQbB4AzstOu00LO5tfBlr7g2g5E95LkCb9ZEYBeigOKz8jcPWPHm:5WJp8bcGAqM1tfBJImIgdJgpfevm
- TLSH T1AFA312BBAE3BD838C04E7C761DD605E1674146DB3DBB902EA566B09B8FD41B04811F78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\VC_RED.cab
- Size 3.7MB
- SHA256 43b7648183347374236296f2176c7c7da920da9c1a08adda761e12614efb299e
- MD5 ecca3c1acb74cb73c600eabdd3f9c9d9
- SHA1 f015759f623c377494a5996670204f1fcd0895e3
- SHA512 2785b8e8cfc310ec114cee696c5b85900fc71186dcbf0c99a9c13f4f0fdcc9e9dd583c9d1fd82492a680efcd7071c3593b02b628bd947bc19b1302b931aca807
- SSDEEP 49152:EMz7ZTOo5P8csRm7OpgKiljN/HVD7yMCSMHosTTZm1iydmklUYUPjm5ZPkWGhQKF:Lz7ZCo51am4fqpQSMICZwAZrGByPbZ
- TLSH T1C60633F539EABD72F980F3F850ADC534392473D679660F2450CAC32F9245B69B22A05E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1028.txt
- Size 3KB
- SHA256 cfa4f2c6c2a8f86896c5a6f9a16e81932734136c3dfde6b4ed44735e9c8115c2
- MD5 f187c4924020065b61ec9ef8eb482415
- SHA1 280fc99fb90f10a41461a8ee33dbfba5f02d059d
- SHA512 1d5a8e80fb6805577258f87c4efd7c26a9ac1c69f7dea1553d6f26bcc462d2d9c01d4b94077f70110a33b39648c9aa3bb685e10534f19ba832d475e9ee6aa743
- TLSH T15E81A6AC1DF32742F493ABB39D834821C7F1A6912BBA0A77458C87495A7045EB049BD7
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1031.txt
- Size 15KB
- SHA256 3e4d78fcc11eecb23af12a4eaa316114bb36d39561f6062a3921c08a43261321
- MD5 3168ed3b48c1dc8d373c2abc036574cf
- SHA1 7ffbcfb6cd9b262a0e9a55853d76055693f60c60
- SHA512 9465640705c382bb736e468a2ffb303ecfb2637c55ddca759d1fb190279b98103def64a8c599deaa1439e58c41d7b2c2809332c2a5f18945e9ee3d6c046a5197
- SSDEEP 192:unSQcLPGw05JEwLW4bt9xepjQOw9cqOANn2fxd:u2LPRwJEwK4xypjUGlA12fxd
- TLSH T13862C02167E5961CF6F37F542EB9E3689F72BDE2A87AD51E2340105E48B1B14CA20733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1033.txt
- Size 9KB
- SHA256 c68a0fd93e8c64139a42af4fcd4670c6faea3a5d5d1e9dd35b197f7d5268d92b
- MD5 162fc8231b1bd62f1d24024bb70140d5
- SHA1 7fa4601390f1a69b4824ee1334bee772c2941a24
- SHA512 a707b5ef0e914ba61e815be5224831441922ed8d933f7a2ffe8aecf41f5a1790a1e45981f19d86aa5eab5ea73d03b0c8e2ab6b9f398ab0154d1c828da6f6beda
- SSDEEP 192:6cJ4sOGsTRyAiLfoIPtjlDxsk4apSfqn7yb/:6cJTYyAwdPtjnszasfzb/
- TLSH T1D1229E15A7FD1208F6FB7F906EB9A1685E3A7CA6AD3EC65D1110105E09B6E40CE70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1036.txt
- Size 11KB
- SHA256 3456ebc9c6decef8b27b10d97f7f6d30a73b5da0024e1b8a0657e3b9a1cc93d9
- MD5 c360851dfdf51b6ddc9cfcc62c584898
- SHA1 f8fbe6b98039d01700dc49eb454bb1c1d8cc4aa6
- SHA512 a340a7d98b4b6f925a803805224e733433e76230a36c4ab17e28f9d5951b81280d776153414701b29bb05b496b726932683e35fb603587d7ff5b716a88fece8d
- SSDEEP 192:lHcOi0SMq5Gl9EAbGu8xFk7XetMKgTqebK8T25C76j1o3M6ykT4Z9KhI/b:1cOiGF/BN3EWN09UAb
- TLSH T1C9425762A6FA5209F6F27F90BEBD91554F3BBD969D3AC11D1210118E48B1E44CEB0B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1040.txt
- Size 13KB
- SHA256 ebafaeb37464ed00e579dab5b573908e026cd0e3444079f398aada13fa9a6f66
- MD5 04b833156f39fcc4cee4ae7a0e7224a1
- SHA1 2ffa9577a21962532c26819f9f1e8cd71ab396bd
- SHA512 8d3f6a900ebd63a3af74ab41ac54d3041de5fe47331a5e0d442d1707f72a8f557d93d2f527bbb857fb1c67dd8332961fd69acc87de81ba4f2006c37b575f9608
- SSDEEP 192:KYCk+hFhpk2i7mJZKVJTlVec3xo3xWScwMnuEz3ZGE88agajQq+Cv:5co6XG9lmhyukqSajsI
- TLSH T1F1528F51B7FD2208F2F77F90BE7AA6684E7BBE56A83AD11E1150109E4871E608D60733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1041.txt
- Size 5KB
- SHA256 467773ddffdb3f31027595313b70d1ea934c828b124d1063a4aa4dbe90f15961
- MD5 031fab3fb14a85334e7e49d62a5179fe
- SHA1 12370185ef938a791609602245372e3e70db31be
- SHA512 7424a52bbb18a006816ee544d47f660e086557d13bb587d765631307da96aba56d8b9cd3d4e7d50c2a791815273910cef95ebe928bc03dd9c540b97ac7a86447
- SSDEEP 96:JV48yKn6zm4X4zyG61NDyroY1fnODSQJR4Jbcnnik49joxfhUWuNdTvp2U9:JZBn6lYSuxpO4MU7IS
- TLSH T15FC1116C1ABA09BE94F6809758C955F8F7B9F615A2DE0C89044CC88B05548ED730FFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1042.txt
- Size 5KB
- SHA256 3d45f022996cd6d9ebb659a202fbfd099795f9a39ed4e6bbd62ac6f6ed5f8c7b
- MD5 6fcd6b5ef928a75655d6be51555288c7
- SHA1 eafdcc178343780b83f1280dad9d517aaedab9e4
- SHA512 635ba44d8d8ecfbdb83a88688126f68c9c607e452e67d19247dfe7c307c341dad9b1d2dc3eae56311c4b3e9617ab1ee2bd2a908570df632af6de1e1fa08bf905
- SSDEEP 96:A48gbatW+eU2giS0wyGjlH+5YO9M60AoV7nokPJ:MTi+ZREU
- TLSH T16AC152BB3AEDAA813251668017C6A7F7635F7202721F9C81CB90413421E87B48639BDF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.1049.txt
- Size 13KB
- SHA256 f82bca639841fa7387ae9bbf9eca33295fab20fade57496e458152068c06f8a3
- MD5 bc3a8865b60ec692293679e3e400fd58
- SHA1 2b43b69e6158f307fb60c47a70a606cd7e295341
- SHA512 0d9820416802623e7cd5539d75871447f665481b81758c08f392f412bc0fd2ef12008be0960c108d1c1ce6f26422f1b16161705104d7a582df6a1006b0d1b610
- SSDEEP 384:dSqMupEO2FQgf7vmbw6ZZSSOTewMtsKaK4NnszO2W:bkFszk
- TLSH T17852586FF8BC9515A460E2111F628AF710AB7750A328A5CAF2CF7DA8906D53533217CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.2052.txt
- Size 3KB
- SHA256 744275c515354ece1a997dd510f0b3ea607147bbf2b7d73f8fca61839675ba27
- MD5 ec4b365a67e7d7db46f095f1b3dcb046
- SHA1 d4506530b132ef4aad51fcbc0315dadc110c9b81
- SHA512 5e5d1e196fc6ac194589bc6c6ab24e259aed8cbd856999390495fd5ec4211f212c6898e1b63538bfbb4401a5b4da08f3a2e09bca1cfb2e9c2cee38e63190b2a2
- TLSH T1D981096E5DFB1412F493795158A686D36BF315A3573B4DE3088C490C52374CE9830F9E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\eula.3082.txt
- Size 12KB
- SHA256 c79ff7b9e67aed57f939343a3d5fd4fb01aa7412530693464571148b893b7132
- MD5 c2d1221cd1c783b5d58b150f2d51aebf
- SHA1 3bc9b6419a5f9dcf9064ae9ef3a76c699e750a60
- SHA512 c4ec596814b408e3c0aaf98864e2769c6175dba020f3014dd79f0190d81812020c932afca449e6b8b35233f36f2ab2efad0dc8d0d68dccdb40f6715fb1d050b4
- SSDEEP 192:++hGO8i6aZyiqQm6W7TlR3LycUV2G+74G:+Vi3ZyDVF+mB
- TLSH T11C423650A6F96606F2F77F51AEB991688E3BBDA29C3EC51D0210119E0DB1E44DE34B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\globdata.ini
- Size 1KB
- SHA256 7912e3fcf2698cf4f8625e563cd8215c6668739cae18bd6f27af2d25bec5c951
- MD5 0a6b586fabd072bd7382b5e24194eac7
- SHA1 60e3c7215c1a40fbfb3016d52c2de44592f8ca95
- SHA512 b96b0448e9f0e94a7867b6bb103979e9ef2c0e074bcb85988d450d63de6edcf21dc83bb154aafb7de524af3c3734f0bb1ba649db0408612479322e1aa85be9f4
- TLSH T1AF11D64846A04125E2F2485298E21CEA9DAB74235E39E95A00D52BCF9AB4E41FD3634B
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.ini
- Size 844B
- SHA256 67a50ffbb8a1d500eaa4d9f0227d6a8595a2750154e6b31662fc4f51286e47fc
- MD5 5feaa6a36fea7dfdb88c18d69ba6d6a9
- SHA1 7afd91a7b046d68b6ee9fd367bcd7a4fec546216
- SHA512 6c8c0456f232a02a49d51b3f1a830a18b9078e621cd0dc3f4f76f79b83035e8affac67bce3af9a37fa9096a34a8499c59cf982b63a4b2400b9190d2db293e682
- TLSH T15B01EF63C629518928E6E8B740A00A8BBC559EC973412C54C0512CCC2FE789BD32EB7E
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.1028.dll
- Size 74KB
- SHA256 b8f0f576199e32fd906538537c8da052ee666a91ef971c577a53fd715e544604
- MD5 5e7e93fb7b9d36665b10be97703dafe5
- SHA1 17b42892768e9742920febf70e9214997e3f04ef
- SHA512 8f2828606ae34a691be77cdc5dc20f3aeb641bb24742fac04860a6f847c42cdc8453b8e5f9722f7b016438849c2b57fc8ea9b41111b69ffed30624e16824a1d6
- SSDEEP 768:QJ/1+JTdsC21GLQn77xqNTHSCnHWkokPMR1b6O/wa2Lc3aE1Nk+BU8U8Cy/jubP0:mIp0YTHSpNR1b6O/waBlxBM8Cy/F7
- TLSH T10E734B027651C132D8961AB885FAD3A1ABBDADC1173981C377DCB5AE0DB27C0AD38395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.1031.dll
- Size 94KB
- SHA256 94779d2272a18a0340156225485aab95d0473aef478442dfe392d11b7e6f41db
- MD5 a1157142485b86985c03e26add533201
- SHA1 05320791cdf33ff3a9989396f6b54172b2d7d0ee
- SHA512 3fa2b3c4c57e071f24cdd02fc53dca5206370c8161cd9ba7b95fa8a9bce9e5268f3f7824908f93df7a087afd38425219447339f40908ffc9b1d593d063ae21c1
- SSDEEP 1536:PIp0YTHSpNR1gRO/6NabBfDNh5T8fdXWohToh+ohvodoEuQGKQG56KjtrE4HErl7:P0+NRwO/6NabBfDNPT8fdXWohToh+ohj
- TLSH T1AA934E5267E58625F5F22B746DB993A06E7ABCC1AE35C54F238071AD0CB1B80DD34B32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.1036.dll
- Size 94KB
- SHA256 3ffe888bc0bbe9bb81369b49171d532839fbea931d8553371e857df6ef815c13
- MD5 cbf6e77d932688970a28328ca5263501
- SHA1 b1d469e921ba90df15760943f228ebb2cbc55792
- SHA512 eeb2773960f7ecf9e87b5225cc730651388fab7dadda766a38d345f051ce2cab7027ac6c7286092e86f71c67b8c8a8c01c3808f205082280ad051fcba96358c9
- SSDEEP 768:Yi/1+JTdsC21GLQn77xqNTHSCnHWkokPMR1jXIO/3aXLNRg41isJafbAgw8IIuUH:lIp0YTHSpNR1j4O/3aUsJHW8Cy/Ih
- TLSH T16C93401267E88521F6F33F74ACB992611E7A7C8A9E34C15E2384A59E0CB1F90DD74723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.1040.dll
- Size 93KB
- SHA256 c2a81077da2201d180bd5496129ea6bcfc5930d8a6d256babdb9a552b1a597d2
- MD5 dcca7196203d338b41ead5e1418c6a92
- SHA1 44267accc8577f093abc77dff8d5f7ff25c343b2
- SHA512 13e934786445067be1c9eca38587dc55e294b2df6e1a16d13c584dc3c031126314047c007ecbc4548aa9bbe1f1021f19cd6b639fc66f43ef9465f4c4c10df049
- SSDEEP 768:GE/1+JTdsC21GLQn77xqNTHSCnHWkokPMR1zDOO/2adt6bkWhqKYx3mU8Cy/j1a:BIp0YTHSpNR1POO/2aWbXhqKKf8Cy/Ba
- TLSH T1C8935E1267F99225F5F33B34AD7996A41E7ABD819E38D14F138160AD08B2AD0DD70B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.1041.dll
- Size 79KB
- SHA256 11c111b3f24ba7d197007fb572b9f77e7d6f58c290de239a08f287c2aeb3b89d
- MD5 0fcc2f2bf7c18392514413a3c2a5ec5a
- SHA1 bf7f494336589b8763b0936f0558749dbb407c4b
- SHA512 c704d1264fd2a106487baf87f6db054862bb31576b0716fe1570eca46ba90519c23c3246852c6b33ec1cf1fc6ff1529b163ff38ec9d32c5eb588585545fcb596
- SSDEEP 768:+m/1+JTdsC21GLQn77xqNTHSCnHWkokPMR1WCO/da42K4HMobKUzqBK7YhL9U8Ck:nIp0YTHSpNR1WCO/dasPBK7Yhy8Cy/7
- TLSH T17F83094176618926E8E242B944B9F3E12BBCFD9047A544C327CCF59F08727C46F397AA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.1042.dll
- Size 78KB
- SHA256 d6f45cb0308e3790b0d819cae9d87e61d79468414ce7f78bd41e7289fc832945
- MD5 d276d0c01bf44cb781ff5d293676674b
- SHA1 f96e3a9bbac867b4dd9b24312845a852a5b44ed4
- SHA512 46100a058157b8435633bf0fc6a2c92086d74c60e480e0faa016e7aaba848e16c2431e48b83e738c28e3a393592ff6cc27b7a2c2a55ff6d94494cf83686175c7
- SSDEEP 1536:cIp0YTHSpNR1dxO/iaE5IelPpQpwIcG8Cy/Uov:c0+NRJO/ia4G8Cy/r
- TLSH T198733A437565C132D85156789AFAD3B26B3EADC04B274083B784B5AE4DF23D0AE343DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.1049.dll
- Size 91KB
- SHA256 ac9ef02d54eb87a5bc2bc8c77a6497853072ff37e7e82495ef8d79f6a5af07e3
- MD5 2e57ae4186f17be4148077ffe8212a27
- SHA1 edad955ab3deef258c354d134b5a3443369f85f8
- SHA512 b2f239253866aab26cb1ab8a90f89ff90553cdb5897bba2ebf0e08eefb5a975c68bf7904f15b09e33777718478e3cc1a074dff8d8ddacc8a56b675adf125443b
- SSDEEP 768:7s/1+JTdsC21GLQn77xqNTHSCnHWkokPMR1eRO/caYiE7t0gd7tWda/9U8Cy/joq:OIp0YTHSpNR1eRO/ca4zW8Cy/p
- TLSH T19C93B50FF938C521E855D2B40A768AE225BDBB50172981C762CF7DA954B53B07B383C7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.2052.dll
- Size 74KB
- SHA256 8fec53f664217f624ec8229425abde74225eccf6b55e41d4c12c9d9789f4159c
- MD5 4b8d230ccfadf8a2d3ea4b1512238292
- SHA1 53793dde6106277c33367de5cf361f79a52692c2
- SHA512 10993d5ca2b40060ba5925e8d7c008d028c06d909cb3b3a8f8da6a289e2cd45b95227114115e7ab6bed7fc91601d94c5b3c1a9d44e08850dc3048e4e9d51423d
- SSDEEP 768:d//1+JTdsC21GLQn77xqNTHSCnHWkokPMR1PSFkd0p4B7QcmSkjnRzU8Cy/jqQ:nIp0YTHSpNR1Pqkd0psK68Cy/2Q
- TLSH T1B5734B027661C932C996057885FAD7A22BBEADC10B7585C377DCB6AE0DB23C0BD38355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\install.res.3082.dll
- Size 94KB
- SHA256 8f826dba565fc464395ed24219da946f55692705de9f61f501dcfebf338970a3
- MD5 55a9b25fa0d768fb902842439d041b1f
- SHA1 da103afd92af9b6f89b604191db2805a015a8c38
- SHA512 dc1b1dc345cb0e2e7e055abc07fc1374abbf773afae64fc27db292c5b97a166bfe4eaa69188d6831a91bfa2913c2238277a860a098ee9606b4112cba55067f7d
- SSDEEP 1536:3Ip0YTHSpNR1NRO//a3p1yN0mnpzE8Cy/r:30+NRJO//aqN0mnJE8Cy/r
- TLSH T151933D016BF89226F5F33F38A97956605E7ABC919E39C04E535465AE0CB1F80DE34B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\vc_red.msi
- Size 227KB
- SHA256 8811e5fe167223d906701bc8deb789de0a731e888e285834bcae164b03d43c96
- MD5 6e17361f8e53b47656bcf0ed90ade095
- SHA1 bce290a700e31579356f7122fb38ce3be452628a
- SHA512 a566fc8bbb4d354db32f13de2fde73a1210c61b1c30a1be22b16c7e98b8d51c673259c57a924b04035cb9f0bf4a087a3e8b32221e7ff87032cddc840ffe3ed2f
- SSDEEP 3072:LZhipq8Cy/bqq69vP1Y+VQ+5Pm8Cy/I81M5JwNmvK0+E4mN2EJJ8d8Cy/:rgx69P1Y8Q0mgIx5hJ8g
- TLSH T1A2344B12B522C133DC813372425EEB612EBDAFE64B55C99721DDB28C5DB27D0933A28D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\0c5713f92ea161683666a03dde\vcredist.bmp
- Size 5KB
- SHA256 594884a8006e24ad5b1578cd7c75aca21171bb079ebdc4f6518905bcf2237ba1
- MD5 06fba95313f26e300917c6cea4480890
- SHA1 31beee44776f114078fc403e405eaa5936c4bc3b
- SHA512 7dca0f1ab5d3fd1ac8755142a7ca4d085bb0c2f12a7272e56159dadfa22da79ec8261815be71b9f5e7c32f6e8121ecb2443060f7db76feaf01eb193200e67dfd
- SSDEEP 24:pS75l775l7aqV7j7Q55okTg2vrlgprDDcaWJQvS2PRSmob6SHSl4CiZ:pKV7j7AXgbjlLI
- TLSH T15EC1E74B200A6854D296603147AECDFB472BADC182E063F631F93E8A36FDC98351E719
- MD5 SHA1 SHA512 SSDEEP TLSH
