Analysis
- user interaction
yes - max time kernel
301s - max time network
303s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 12:57
Behavioral task
behavioral1
Sample
ejx.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
26 signatures
150 seconds
General
- Target ejx.exe
- Size 23.4MB
- Sample260730-p7ectsycmh
- SHA256 6c04a994524bc861714c4a325328df0c2ad9f2306e15cc45a9bf0c03d8d611c0
- MD5 e1a025c75721db232315bf9961adbb43
- SHA1 d92c94e3e7e3acb3822e87704957964d443c0ce0
- SHA512 00d05721ba9011e9a9cb7d4d435fb6e6938fb4976d660517b75170f670bec59961fe6f510e526578c753037dc77710c71af21a2a41b08f9cf2b8f5f3fc41241c
- SSDEEP 393216:0UF0D/V63MUjb40GdyQIBd7DUgWoY85Lnfzwi5iVt34UiWfkF7G71sy:BHHmd/Ijwv85IFV2TWfKa7x
- TLSH T10F37333FB28B613EE06E5A36B972A251413B6721A4134C57D7F4C84CCF590B11E3EB9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation EJX.exe - Creates new service(s) 2 TTPs
- Executes dropped EXE 4 IoCs
pid Process 2812 ejx.tmp 4716 EJX.exe 3156 EJXHelperService.exe 644 EJXCore.exe - Loads dropped DLL 19 IoCs
pid Process 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 3156 EJXHelperService.exe - Stops running service(s) 4 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 62 IoCs
description ioc Process File created C:\Program Files\EJX\unins000.dat ejx.tmp File created C:\Program Files\EJX\is-PMCCH8MUAB.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-GGCBU5NBHI.tmp ejx.tmp File created C:\Program Files\EJX\is-IVI2GV2ANG.tmp ejx.tmp File created C:\Program Files\EJX\is-BCTU4VQ92W.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-J543QHRD0R.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\shaders\is-QDZXX4RZXI.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-NX4WOSS1CJ.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-DKY1UVPBJY.tmp ejx.tmp File created C:\Program Files\EJX\is-L2LGCQA7LF.tmp ejx.tmp File created C:\Program Files\EJX\is-HPYYFNK1FB.tmp ejx.tmp File created C:\Program Files\EJX\is-8SIXPV9064.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-XVIOJYL0GS.tmp ejx.tmp File created C:\Program Files\EJX\is-431ZOE5S41.tmp ejx.tmp File created C:\Program Files\EJX\is-M6NJFSMFMP.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\is-RDOQ9HEELX.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-DELMUM62YI.tmp ejx.tmp File opened for modification C:\Program Files\EJX\unins000.dat ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\fonts\is-MFV9PGHAP6.tmp ejx.tmp File created C:\Program Files\EJX\is-OYWUQ0DPZG.tmp ejx.tmp File created C:\Program Files\EJX\is-YTZCKQ856K.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-R7VXWLJ4E2.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-0DLKXI8JQV.tmp ejx.tmp File created C:\Program Files\EJX\is-MAWC50NAKI.tmp ejx.tmp File created C:\Program Files\EJX\is-4R8QR5FL3L.tmp ejx.tmp File created C:\Program Files\EJX\is-U8QGQU84W3.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\ads\is-5MAY761AVW.tmp ejx.tmp File created C:\Program Files\EJX\is-HL1UUP1VZU.tmp ejx.tmp File created C:\Program Files\EJX\is-LH8CETZJY5.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\shaders\is-13W21BZG1L.tmp ejx.tmp File created C:\Program Files\EJX\is-X8ZP2GXC5X.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-VDWJZX52C1.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-SYY22H50YX.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-25RSM0Y78B.tmp ejx.tmp File created C:\Program Files\EJX\data\is-AR0IAM9JLI.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-3IC6EQJFMW.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-DPTYWN8OMQ.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\ads\is-CI59L26LCN.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-NA4V72SWQ8.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\is-FSGFFRFQCN.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-IM7JK1AEQM.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-5Y5AHY44PO.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-Z62Y8W36HD.tmp ejx.tmp File created C:\Program Files\EJX\is-9CDT99Z9X4.tmp ejx.tmp File created C:\Program Files\EJX\is-XI0F6SAODF.tmp ejx.tmp File created C:\Program Files\EJX\is-HZVI9KU2UV.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-UHELHUTA16.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-GVR5O6X8EB.tmp ejx.tmp File created C:\Program Files\EJX\is-UVDBBIEDT3.tmp ejx.tmp File created C:\Program Files\EJX\is-GXIEY38SY1.tmp ejx.tmp File created C:\Program Files\EJX\is-5C2RYJJML8.tmp ejx.tmp File created C:\Program Files\EJX\is-IQCOMNOVGA.tmp ejx.tmp File created C:\Program Files\EJX\data\is-KIBO9GAX4D.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\is-53ED1DJMAJ.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\is-KU1OZ4L9OY.tmp ejx.tmp File created C:\Program Files\EJX\is-CW3BTRIDPI.tmp ejx.tmp File created C:\Program Files\EJX\is-L1WD3DESEC.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-2N3CHHM7OD.tmp ejx.tmp File created C:\Program Files\EJX\is-W7FR82LBL2.tmp ejx.tmp File created C:\Program Files\EJX\is-I5301C1R0K.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-FEIDJP58WA.tmp ejx.tmp File created C:\Program Files\EJX\data\flutter_assets\packages\flutter_js\assets\js\is-OOG165RPM1.tmp ejx.tmp - Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 608 sc.exe 4412 sc.exe 3016 sc.exe 4424 sc.exe 2064 sc.exe 3720 sc.exe 3508 sc.exe 3376 sc.exe 4372 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2816 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ejx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ejx.tmp - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4692 chrome.exe - Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
resource yara_rule behavioral1/memory/4828-0-0x0000000000D10000-0x0000000000DEC000-memory.dmp innosetup behavioral1/memory/4828-7-0x0000000000D10000-0x0000000000DEC000-memory.dmp innosetup - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Kills process with taskkill 6 IoCs
pid Process 4496 taskkill.exe 848 taskkill.exe 2992 taskkill.exe 3940 taskkill.exe 4084 taskkill.exe 4652 taskkill.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298901818848129" chrome.exe - Modifies registry class 14 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\shell\open\command ejx.tmp Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\URL Protocol EJX.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\shell\open\command EJX.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\shell\open\command\ = "\"C:\\Program Files\\EJX\\EJX.exe\" \"%1\"" EJX.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\URL Protocol ejx.tmp Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\DefaultIcon ejx.tmp Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\DefaultIcon\ = "C:\\Program Files\\EJX\\EJX.exe,0" ejx.tmp Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\shell ejx.tmp Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\shell\open ejx.tmp Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\shell\open\command\ = "\"C:\\Program Files\\EJX\\EJX.exe\" \"%1\"" ejx.tmp Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx EJX.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx ejx.tmp Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ejx\ = "URL:ejx Protocol" ejx.tmp - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4496 taskkill.exe Token: SeDebugPrivilege 848 taskkill.exe Token: SeDebugPrivilege 2992 taskkill.exe Token: SeDebugPrivilege 3940 taskkill.exe Token: SeDebugPrivilege 4084 taskkill.exe Token: SeDebugPrivilege 4652 taskkill.exe Token: SeShutdownPrivilege 4716 EJX.exe Token: SeCreatePagefilePrivilege 4716 EJX.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe Token: SeShutdownPrivilege 2408 chrome.exe Token: SeCreatePagefilePrivilege 2408 chrome.exe - Suspicious use of FindShellTrayWindow 39 IoCs
pid Process 2812 ejx.tmp 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe 2408 chrome.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4716 EJX.exe 4716 EJX.exe 4716 EJX.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 4828 wrote to memory of 2812 4828 ejx.exe 87 PID 2812 wrote to memory of 4424 2812 ejx.tmp 89 PID 2812 wrote to memory of 4496 2812 ejx.tmp 91 PID 2812 wrote to memory of 848 2812 ejx.tmp 94 PID 2812 wrote to memory of 2992 2812 ejx.tmp 96 PID 2812 wrote to memory of 3940 2812 ejx.tmp 98 PID 2812 wrote to memory of 4084 2812 ejx.tmp 100 PID 2812 wrote to memory of 4652 2812 ejx.tmp 102 PID 2812 wrote to memory of 2064 2812 ejx.tmp 104 PID 2812 wrote to memory of 4716 2812 ejx.tmp 106 PID 4716 wrote to memory of 3376 4716 EJX.exe 108 PID 4716 wrote to memory of 4372 4716 EJX.exe 110 PID 4716 wrote to memory of 608 4716 EJX.exe 112 PID 4716 wrote to memory of 2816 4716 EJX.exe 114 PID 4716 wrote to memory of 4412 4716 EJX.exe 116 PID 2816 wrote to memory of 3720 2816 cmd.exe 118 PID 2816 wrote to memory of 3016 2816 cmd.exe 119 PID 4716 wrote to memory of 3508 4716 EJX.exe 122 PID 3156 wrote to memory of 644 3156 EJXHelperService.exe 124 PID 2408 wrote to memory of 1356 2408 chrome.exe 144 PID 2408 wrote to memory of 4692 2408 chrome.exe 145 PID 2408 wrote to memory of 1864 2408 chrome.exe 146 PID 2408 wrote to memory of 1864 2408 chrome.exe 146 PID 2408 wrote to memory of 2080 2408 chrome.exe 148 PID 2408 wrote to memory of 2080 2408 chrome.exe 148 PID 2408 wrote to memory of 4712 2408 chrome.exe 149 PID 2408 wrote to memory of 4712 2408 chrome.exe 149 PID 2408 wrote to memory of 712 2408 chrome.exe 150 PID 2408 wrote to memory of 712 2408 chrome.exe 150 PID 2408 wrote to memory of 3240 2408 chrome.exe 151 PID 2408 wrote to memory of 3240 2408 chrome.exe 151 PID 2408 wrote to memory of 4812 2408 chrome.exe 152 PID 2408 wrote to memory of 4812 2408 chrome.exe 152 PID 2408 wrote to memory of 4308 2408 chrome.exe 154
Processes
-
C:\Users\Admin\AppData\Local\Temp\ejx.exe"C:\Users\Admin\AppData\Local\Temp\ejx.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\is-M6EO74L4LZ.tmp\ejx.tmp"C:\Users\Admin\AppData\Local\Temp\is-M6EO74L4LZ.tmp\ejx.tmp" /SL5="$90144,23327863,842240,C:\Users\Admin\AppData\Local\Temp\ejx.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SYSTEM32\sc.exe"sc.exe" stop "EJXHelperService"3⤵
- Launches sc.exe
PID:4424
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /im EJX.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /im EJXCore.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:848
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /im EJXHelperService.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2992
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /f /im EJX.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3940
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /f /im EJXCore.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4084
-
-
C:\Windows\SYSTEM32\taskkill.exe"taskkill" /f /im EJXHelperService.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4652
-
-
C:\Windows\system32\sc.exe"sc.exe" start "EJXHelperService"3⤵
- Launches sc.exe
PID:2064
-
-
C:\Program Files\EJX\EJX.exe"C:\Program Files\EJX\\EJX.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SYSTEM32\sc.exesc query EJXHelperService4⤵
- Launches sc.exe
PID:3376
-
-
C:\Windows\SYSTEM32\sc.exesc query EJXHelperService4⤵
- Launches sc.exe
PID:4372
-
-
C:\Windows\SYSTEM32\sc.exesc query EJXHelperService4⤵
- Launches sc.exe
PID:608
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc create EJXHelperService binPath= "C:\Program Files\EJX\EJXHelperService.exe" start= auto && sc start EJXHelperService4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\sc.exesc create EJXHelperService binPath= "C:\Program Files\EJX\EJXHelperService.exe" start= auto5⤵
- Launches sc.exe
PID:3720
-
-
C:\Windows\system32\sc.exesc start EJXHelperService5⤵
- Launches sc.exe
PID:3016
-
-
-
C:\Windows\SYSTEM32\sc.exesc query EJXHelperService4⤵
- Launches sc.exe
PID:4412
-
-
C:\Windows\SYSTEM32\sc.exesc query EJXHelperService4⤵
- Launches sc.exe
PID:3508
-
-
-
-
C:\Program Files\EJX\EJXHelperService.exe"C:\Program Files\EJX\EJXHelperService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Program Files\EJX\EJXCore.exe"C:\Program Files\EJX\EJXCore.exe" 50137 C:\Users\Admin\AppData\Roaming\com.ejx\home2⤵
- Executes dropped EXE
PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdba1ac728,0x7ffdba1ac734,0x7ffdba1ac7402⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,15836108572686395533,6777466308896643872,524288 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2200 /prefetch:32⤵
- System Time Discovery
PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,14431793509069616449,1940736035763100993,262144 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2072 /prefetch:22⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,1388754033755717508,6770000058589662191,524288 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:82⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,16682801791726604835,9307259022387640276,2097152 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:12⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,17042594555894470803,16851715889438841186,2097152 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:12⤵PID:712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4464,i,14914789109464766827,7461803756776030817,2097152 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4484 /prefetch:22⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4752,i,14102508565905215350,7101745356871025922,2097152 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4492 /prefetch:12⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,2373349872283495545,17051506448969909581,524288 --field-trial-handle=2076,i,12396119561595533891,9724519559295999122,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5536 /prefetch:82⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1520
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1092
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1144
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
2Service Execution
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\EJX\EJX.exe
- Size 96KB
- SHA256 31d69703c8964f8f176f549193ba7bf15bd3e5c443c83df25f4dde7d74858ac9
- MD5 75df107fd511d94a42d393e3b73aa439
- SHA1 42bbe398577a07017d2740be3e94654b5fdcb0e8
- SHA512 7bb5b5e1d45a61e0d34cd43a0199d8d90336dae6bea0ba4495beaa444874fe6e39a7791dcab269bbae43f8424cb04f231a5bbdbd7c7db64ae093183b705a2bcb
- SSDEEP 1536:TcqxYA/VDLZ4HhQKxxvIEiP6wC5eaWhlzbu8ovX2iJkrW3dZEx7QCiQV81:Qqxd/BmHhpgEO6HzWrzbu+iJkrOZEiAc
- TLSH T1C5A34C27EA1810EAD229C47DCA578946DB73BC9A47A097CF4B900ED70E67AD45F3E201
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\EJXCore.exe
- Size 39.4MB
- SHA256 8685be06352ead2d75b1b2dd830a44a390b00e4b5d258fd4d155051100ca12da
- MD5 6ef4322c47a4fe2d25865d8e4f8ab954
- SHA1 6eb4baf11816163851fbf0ef13aaf91c8dcfcbd7
- SHA512 286347ee1cfdb189abd5571379f2a27eade395908e99e9372487995b124ce1e3227132d2eaf929044a422033c908fdeed47075901ab088060172f2222fa1ee7c
- SSDEEP 393216:MGEwdIHgGD3JxHCLlZddEqfsCJ6iX7aCY:MGEuIHgGDTH6lZdqC84XY
- TLSH T19997494BFD2508E5E4AEC839C5A656237B713C65572423D72B10FA142F3EFE06ABA710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\EJXHelperService.exe
- Size 704KB
- SHA256 79db865230aa5f2be77b487e08bdedd5b9ff24aee3e19f0a26923cfaacfdad98
- MD5 1e5a4f036eeabff3f83940ebedb5a393
- SHA1 654ea209034fb5f969eac382d81437522aa0c2d9
- SHA512 eff5dba9e9f4463fe967e3b9b4b5fc9dad10a11b5ce06a2fe4fede9b56e4ae3b7bf2f8995f2a7e526a1331dddcfadba6cebc16a6abf4b2c0441eb83dd7619365
- SSDEEP 12288:KXCObKsj4KjkBLX3iGrIj1we2ug7fgXdybyZS:WCObKsj4KjEX3iwGALgJS
- TLSH T10DE45B13FA9581FCD05AC074831A9633FA72B88A0B3575FF06D456313E69EA1AF2D718
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\app_links_plugin.dll
- Size 136KB
- SHA256 b9063f2b68c426b710bbcaca309bdd96aff3323a100a02ee5dc4b33a09dbf928
- MD5 c5c6d20ba9eeb2003ff253cf7a68dad1
- SHA1 396b9114e70de460fb39d74441744871de7a6064
- SHA512 28fb6d8224cd3de32abbd4ac0dbb82272a99a1d937d6a1ed1d3feacff731326dc8bb2629057f26483a4b83bd1f17ecf8fdf97926b8c7332754b1d1274812bb32
- SSDEEP 3072:UTZB3vnv6YEQa6XhiCKk02nhMpZdTdcCc9GTamSEC:UTZB3Pv6YEQa6E2nhMpZdTdcC7TamSE
- TLSH T1BED36D2BF71940A7E25AC07CCA534945EBB2B8910BA197CF17500B9B1F27BE85E7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\connectivity_plus_plugin.dll
- Size 97KB
- SHA256 e01644346c127300ae22ac2da1991b0a3e657a9175521444501674055c550768
- MD5 777dd233ff875d1ae51e6a1b35b2e071
- SHA1 060a7424d948804b948fb13a713424e00b869360
- SHA512 09ded2c3373fe7f81b6ccb8fb7b86c429bcf8f2455b27741f9254e497a551f4b79a5da53a9ad34702f1fbe2faf8ac82568a48166c8c1026d62f2c49a2d897dc5
- SSDEEP 1536:S4k9FrGV4x6TqhGx7WH2G/BiVQgPRCm2XPMAfC/y4iCL:R+rGV4x6HqH2G5isXPMAfC/yPq
- TLSH T145A32A3BBA5D50ABE219C4BCCA574945DB72B8854791A7CF17900A9B0F2BFE40F3E601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\data\app.so
- Size 10.8MB
- SHA256 c4355ee27e1d6fa4f49e8bbdd89cb14d801374145d9291ab50032f10b3560dc2
- MD5 bac493f5f9df008bbf6f83673a713096
- SHA1 1e6ab222d17b77093e5df472d150cc969066bb9d
- SHA512 e22049090b179333b1a4b4200e46a0962541a103b69a2b6a4b24d1ed77552b3983adb5349dea753fe5289f82e2d5c8e20e338f8a50f60146d998cf0de1673039
- SSDEEP 196608:pviasyiLmjVwWYG7TgiwHz7NrB1gu8mgW99QX5vhNpHFt:pKasyiLmjVwWYG7TgiwHgNp
- TLSH T13AB60947D4E48760E473E772BB5F26A59E2078DC4A34778706D45A663E8BCE04ACE332
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\data\flutter_assets\AssetManifest.bin
- Size 1KB
- SHA256 eafaf4f627f62750fb6ed398223fa8b3502e92edd21d787f2c11184121ef1b28
- MD5 a7ef18a07c71502a5e6b3d0b5ca41bdd
- SHA1 d1a7c14f8a00a2d0880f917c5f663a9622ad842a
- SHA512 8ca840bdb7115009f1a970222e8a21ad5948bdf5856648360546d7e005dc7915d6e457bf1977f04981396c2a78fc380b2bb96a575f0aab0abdda122e9f4e59f7
- TLSH T1FE31D51897A5B5A939107326E89805C25C4F6B896464F1FF7339C498B985CFA08FBCF2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\EJX\data\flutter_assets\FontManifest.json
- Size 392B
- SHA256 3b25f92ac19a244e66650f5c974350eee79ff2e7dd6998510ef8a25137e4ef97
- MD5 d1b0e7e12ab95ecc3783a1c7530fb470
- SHA1 4b0c9f50e249c4982dc097bc3da04b4409e8160b
- SHA512 1f471350cc442afdb66254da43327727aabbc3b4d8126d1d9979860afe01b7bd53667ec277648c2236ba257d8334201831130ce2d5b93298221d4f96c5394a40
- TLSH T16DE0650F492606B550CCD89AF067559274952F1B324DFC0FD6711EE4A6F031013747BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\EJX\data\flutter_assets\NativeAssetsManifest.json
- Size 45B
- SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
- MD5 f3a664e105b4f792c6c7fe4e4d22c398
- SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
- SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
- MD5 SHA1 SHA512
- Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\ads\reklama.webp
- Size 15KB
- SHA256 6f24c1fcc94fb558158f00b6b041e57bbd5730e54cd817ef6d0314acdc20cf6e
- MD5 f699274ab5fef27d9b6d21f02b6eec59
- SHA1 501b73119ca364f62611df33ca2bbfca2156dd01
- SHA512 e061afa69f40440e95d0186b8a4402d3c9c9cb3fc2c7c8af2a1708d1b1b6578aae1d521ec9daca8db3198d2309aeccbeb8727ad764c7104054df6178eb94ab97
- SSDEEP 384:HI4z1AjoZ/MATkE6yPL4k8l3ysuYu2aIghKN:HIsBil3yx1gtN
- TLSH T11C62D187F5CB1617FB032AE21287BDFA58A7E959E714A8EE934042F7809D711D803C4B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\logo.svg
- Size 9KB
- SHA256 fea66473a90f2fe12374990de4de3238cbe83c93e6ea9aeb4933fd5c60c5141c
- MD5 24030a1011ab502c6381ae49d71f5100
- SHA1 9345fefacad091f58f40f0e5fd075b76a9083267
- SHA512 7b171b293931102c2c09b2e330a5f11be8b8d8cbd4c609e0c37f7b94eed7a4c268dd4275e1c974c6cc66288ecc73674c6db5589e6931a4463e5bf65885fe0f8f
- SSDEEP 192:LG7+K8RmUZcgjLWdMXjqo1Gu0Mv44JcuaGAEvqRz/PDo6:LGD8kUZcgjLWEjqo1Gu0MQ4uuaV9RDz
- TLSH T1511274EE9BEBA3F5E003F3F4CB5058697A5F14F66A23CE14C7A91D0AD96206D9014C82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\settings.svg
- Size 1KB
- SHA256 91f7aa95dda55d2f73a358c56f665bf353ee68bee3bbe9058422c1e49f9a3fd3
- MD5 13ec5970cb74adc866dd82a6ffa701d5
- SHA1 c88415edff50145d87f88362ec3cff72bdc89398
- SHA512 7c1cf398301caf6bbf6450c338341be596ed0eeb88ff84bb4f1dadfa18bdd3a9b4a889b79f45deac95cbe74202d7e18c4d3333d7de005dba620097366181562e
- TLSH T1924186F6828C3AD4D146ABF0CC3B68F4754F74FB2A03DDD64394A9C8DA1208C500A554
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\support.svg
- Size 1KB
- SHA256 e3d6fdc8a71ab37fc5e819bf328d90095ef9e153d152cff139172957a2662464
- MD5 37ae15cb12880faa2f459d332cded743
- SHA1 83b97afd989b6338d3396e806398152e6bb5331f
- SHA512 917a344add81c5537c66de27ff728650fe9e67a749824db52ec794c38cc0f9cab034b6ac86c0af27b3597dacd84e7162c3f234c829dedc942b3bce3ac9580a81
- TLSH T191219A61A1D1B551D2C583FE4A37F28673AF38A93F554746C2B8CEB8B9A291ECC0CC45
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\inactive.ico
- Size 4KB
- SHA256 27b077d51e59977c9614123e20d4e12dc9d1abb9dcbe91faf198ae6849963c72
- MD5 3013f686e4028268fd63121f1d34ee7f
- SHA1 a5d2b56947df2279f0503d2078b75f5537430adc
- SHA512 870cdf5b3b297c4a6af87c0582335904f6c24e28b4ec2aed296269bb6f3022debcfd6cf82307671b21baa4b60b51e6048e00be996366eb14fbecea5e84bbab40
- SSDEEP 96:EFAvJIBBB3KoLcac9CM67K2lqzgIEs5TPCPx6KeSY:n7oLcacwe2lqz6s5T6PxjY
- TLSH T13D919517883C509DEC3E04B1486B78FA0E7F453DCE583A1605E473BA6106A9A6BB9E81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\data\flutter_assets\assets\fonts\Jost-Medium.ttf
- Size 60KB
- SHA256 07aebfbb345c3e5faca53cdc2cdb09bfae3cd696358a79d153060625129ef580
- MD5 090175d88161f36142c3b541783ca73b
- SHA1 4a4abef46a165bc7468d240f70fdb948f12e97f7
- SHA512 58ffbb67b60d60565582f7430e315ee3a709018d50a0e286953f46cd0ff8cbdc56fd5f25a0419bb0f5007a4d3a3e444308ec850f17b15316ffb30667d2663139
- SSDEEP 768:7oj5X/xwClUQQsyaDWl0B4BTjuJVM74nP5IPscHttQ7MH6/a8FEjQ4P43nGsyXLV:LsETjuJVM74nP5YsQttI/IQuUnGZXLPN
- TLSH T15D531906D373935EE3172E7C46B3D22695C9EC36D6A6437DC10DE617F8EA8A09E89304
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\data\flutter_assets\fonts\MaterialIcons-Regular.otf
- Size 1.6MB
- SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
- MD5 e7069dfd19b331be16bed984668fe080
- SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
- SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
- SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
- TLSH T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\data\icudtl.dat
- Size 842KB
- SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
- MD5 018361032ba13dfeab636138ab6b9831
- SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
- SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
- SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
- TLSH T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\dynamic_color_plugin.dll
- Size 81KB
- SHA256 6a69ea3bb857e1f3285e5eeb13d974220c57e0bd249ed750cef756f98d9cf520
- MD5 68937944a37dc788cdc784c0f45b01a1
- SHA1 a331f68ea4e48a0b7e4273f9e4e87edde9dc7301
- SHA512 1c66f4469a4fb4e479c2d2ea4fe5a37979d52a57b450cf9d1d98992be436804875c1b11ab52e7fd4da2439626fb208c07dd0574ed315d4e809aeacc6e0a0470c
- SSDEEP 1536:pmaGg/U6h8xDn1bcx0sbM8z1WM1lalNlD:A7T6qr1W0sbM8z1WM1cln
- TLSH T108832A2BEA1D50ABD259C878CA534905DF72B8964BD1A7CF57500ADA0F27FE80F3E211
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\file_selector_windows_plugin.dll
- Size 109KB
- SHA256 ddb4c31c305a53e27d2f935384f226658485f6f56d8c47f3c8f575f24c555658
- MD5 4ad4f1384e9d0919c9e39d925141521b
- SHA1 50426891e6bf93474a6747b60f5bcdfdbb9bc01e
- SHA512 521eb8317722f39f53f58950b67d6cdee9875db8ed9a92bf72468cdd774a619ce3140fd0eb0e97565597a97a85289ece8b7966ae3946b6a0d7d37548e1ba5a65
- SSDEEP 1536:UBXrl+wCXtRGN1jl/nHu9kxFnKxpm61abZho1uCpVMfZGTx9+5:QblHCKHueFKq64bZho1J7MfZGTx9+5
- TLSH T108B31B2BF61D40BAE26AC47CCE539901DB72B8954790A7CF57500ADB0E57BE45F3E201
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\flutter_js_plugin.dll
- Size 86KB
- SHA256 e46d36f034fb7ddae37e45edfd73476ed0d085d3de254e1840982c455c1769bc
- MD5 de72bc82f7ea04a8ba624943ee1897be
- SHA1 64c3c0349923aaf4b46ed3a5dd9bb6002cf1d9b9
- SHA512 a406b060d6829b8b946c1f97a9b792a695cfb6424b96831b5fed3bdc7bcf88f72bfc28e9a96cbf3bea278bdba222150e76053ccca2e30ed319530ac8ba692a35
- SSDEEP 1536:k8td+56bSKxR6ON+YDmuZuecRFxBEMAJCEsEBWv:lI56b5jDOBRTBEMAJCEsEBWv
- TLSH T176833B2BE61950ABD319C5B8CA834A05CB7278815B91A7CF57904EDB0F27BE81F3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\flutter_windows.dll
- Size 19.8MB
- SHA256 e225762642535e2f31b9ebb3d7def4dae93162d357e09bee241e19d461b9ff46
- MD5 4f110b4f83285c211d56a503bc300c7a
- SHA1 5dbe13d3231cfef7e09447948bb7d8c5324f788f
- SHA512 66526e7017f4b0f380ba1787afb38646a90c5fc8328d1e41c0b80d3c3524f570b578a229116956d320a5a2b8382b118765a856e080e725c08729c91cc05038e9
- SSDEEP 98304:r8wG47fQ6x7Foser61UwcaRdKckSYIrZXYh624nV4lkmHKVGsvvNSQE1bSsKZU/7:rbZvtdKcy0pdeSslYe5qfNODaq
- TLSH T1EE276B03F29680EDC459E178971BAA27F671B8490720B6DF27584B223F66FE05B3E750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\hotkey_manager_windows_plugin.dll
- Size 104KB
- SHA256 b9e091e23130c498ee07a8ffaf08dda69097b5c6bac3bcaf61fdffba333401f0
- MD5 53e7dad228ef1f44bb8e3969159c20fc
- SHA1 40817b4d111e4974c391289fafe52681241eb13c
- SHA512 f40c9e99e7a3f1d1d4f605a17e23d5cf64a01222f601911e7aa924307dd67b307c054f381e1fa3db044825fac42313f52618c42f694e8a3ba8fbf3ead005adef
- SSDEEP 1536:tiKblVJQryWHrgI16uBxFc+YgOHn2aMuOOYqi0uT:dbpEgO6SO+YJH7MuOOYqi0
- TLSH T1CDA32A3BAB6D40ABD26AC57DCA474945DB71B88507A1A7CF57900B9B0F17BE80E3E600
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\msvcp140.dll
- Size 544KB
- SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
- MD5 bc88b387cafa556068b5c5d6ff3ccc8f
- SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
- SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
- SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
- TLSH T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\screen_retriever_windows_plugin.dll
- Size 116KB
- SHA256 446e9b8ac8900e406903c8c4d8c9210ae0aa31be8744fe5e9e6d759730a8a7b9
- MD5 9472effe84cd6403ae0ab305f8be5223
- SHA1 8ba279e53b196ab19d889fad1ad2abae41429ee9
- SHA512 9808f642d8d5356da09534d53206258a9c07fc7fef77115700ba03f4500cac172ca35c94eca8e7c97d9da28a5428edb43c2baeee6406954725f25399d4f61046
- SSDEEP 1536:QsILOR6ScJJsKeRcz06Z7xS+kZ3hhrSoqz1wKnqMp+eCRAySHvD:QDOcOw063KdGoqvqMp+eCRAys
- TLSH T122C33C2BF75940A7D26AC4B9C9438D46DB72B8914791A7CF57900A9B0F27BE84F3E301
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\share_plus_plugin.dll
- Size 131KB
- SHA256 e20bec5a8d8b05a5d2995060c46ec266b9cc2a77ae178bf3c20b810530bf9dcd
- MD5 c6e5851da56de6a6e3d74227a125c901
- SHA1 397448c2e329b8fd9a00524fb96358916a82b210
- SHA512 9a5d38637e88344364777c33d659ad930923caad2c87eddd0a5145662b1bdb7e583404a4f81d3b2f83c657174069129e66b53d4524d2f61bd925def45c3bc43e
- SSDEEP 1536:gpNAti4ITRKMG6JtkxhIVoPv50ajBOGZhMfT4xAxYMUvRn5k6f/U/0e/5Qe+WP/M:gpNRqR6wuVoPvCajBOGZhMfT4xAxKz
- TLSH T1F4D32A2BBA2C40D7D12AA079C9438E45D772F8A74F9187CB27510B9F4E63BD84E3A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\tray_manager_plugin.dll
- Size 105KB
- SHA256 b9beb12012d0c9d0841550347e4ea46eb1f5d49b52199afca3c98464780d641d
- MD5 117dd90405e9406360a60d84daa260eb
- SHA1 e74bca2ee4426d2bdf6403d4fe89a3c539e477ba
- SHA512 230b7f50f5343980c72c979d0815aa240d3e896679b9fc2813634b6efbc5951e344c5f2f65f0959a2643c5ed140954905d7cb56aa5028b5d61e33043bbf71855
- SSDEEP 1536:X+aiLhJu6wZlP1fD3Uk6Relxh8CzockvuovpZJHCKPI0TPR:FiFwfD316UhPockvuovpZJHCKPIu
- TLSH T131B33C2BAA5D506BD26AC4BCCD534D45DBB2BC8547A1A7CF57800ADB0F27BE40E3E601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\url_launcher_windows_plugin.dll
- Size 96KB
- SHA256 0f7d384c3800ec97ef00e128ad8fa6b70c596d8302026a784f78ba437bd32a65
- MD5 001d4dbc69de217a2cfbb50562fa340f
- SHA1 e0f7f8449c2f26c8ebf0b40358d4bebf335e43f0
- SHA512 56f44dc166f6a339525b0026fee217c63011a30e528676af7d853cb7c2466d67db34a6e8f4bc385188d7f1a5a3d3356002b946953f4d969c5bdf1faaac496ea8
- SSDEEP 1536:9GpZR9r942MfYxKj2866rzCoFB22it9LBwdIBBaM8xVxiSjigb:9kfr942MQ86nxvhBsM8xVxiSj
- TLSH T19DA33A3BAB1D10ABD259D4BCCA534941DB72BC854791A7CF57A00ADB0F27BE44E3E602
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\vcruntime140.dll
- Size 121KB
- SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
- MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
- SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
- SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
- SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
- TLSH T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\vcruntime140_1.dll
- Size 48KB
- SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
- MD5 cd1b08f4930b276ad78853580b76b5c6
- SHA1 a0330279d3d0d47f19ed984726e25260b547a228
- SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
- SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
- TLSH T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\window_ext_plugin.dll
- Size 93KB
- SHA256 4004f846e488ee9395b89402bde32bb3d97d6790dde4d6334531d214f252cf17
- MD5 9332dabffcdb23f286fb874c3b21197a
- SHA1 a7bb28b2ac70bf6ba1d0123e985acffdafe46328
- SHA512 f0efb589289c123674eb0c4a236cbd0dff0206854a2bccb64d7507b99fad953f3ca8089bc687c4c85de490cc5656190bacab7a67ee30de3925e057ca7b308ac1
- SSDEEP 1536:M3zsqXrQ66oTxLc9/wHqMJRIMpZdsCnJL5vhv:MxrF6Ge/YqMJRIMpZdsCnJL5J
- TLSH T1E6931A3BEA2940ABD21AC57DCA478945DB71BC954791A7CF57900ECB0F23BE80E3E611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\EJX\window_manager_plugin.dll
- Size 127KB
- SHA256 85b3364e5ffa00b5495e655e4cf1d0961c1fc73c524f8e55284f3ff62656d3aa
- MD5 3d076be713fd6fecd0628eaad010ff7b
- SHA1 e1d5dcffee99271e43bf7eaa0d3d83addac53fa1
- SHA512 cac0569778c56d49e5dc8e015ec603a3148dfb6a22c08fea83959a776532e9134ba0652b75d4c1ffcb231d98299c44f324cd4a94bbb54af1b2db1086f61afb78
- SSDEEP 3072:98CLcqRAAePnX6CQ9H0T9tP0QoPvpZJHJTeKtIS:6CgqRAAeP6CQUavpZJHJTeKtI
- TLSH T137D34D2BF75900ABD16AD4B8CD438946DF72B8854B91A7CF07904A9B1F27BE41F3E601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 c09a928e7ccc5dbd17a1a899875a73135d0e7f9ac202ab47493cda4fecd865ae
- MD5 8f277c99f2e803e4365c5b1b15075f78
- SHA1 f061d9f536193493c7fc98f2fc0022157f4ba50a
- SHA512 993d503f431944dae6bad4bc2b8a4edff3a1a8068ae7daa0da306ab718ade0599dfc4eac730a9d039925fe9939fc9af47e60dff534265d8a49f32ff5d3c071f2
- TLSH T12EE02B9AC821EC371DFD4B2D50504A49EE5013572B61C96B7A3C910DCFB06670386C5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 f6eecfc114c764faadc3585bb94a5da7c644c944f996dece890ae2592ee18d5c
- MD5 7b89dcf6fd4f4e745883df78cacb814d
- SHA1 33e9d7af19e17a2399674e679199f04a9ad2c914
- SHA512 51c75c112d713b431d16cfcf0b93f15060bab9eca83742fceddd110b71326797add0b2b559829fa0fdf97b825914319ebbca43cb5923e1cefa66bc5a30761603
- SSDEEP 192:tR4SPVD8BISr+v7AhAPRp2l9qHsb+WNnqc08L5XkwmVyIsnAUgtaJ:tR4S9ar6k8XmkwX0mde8
- TLSH T10242D72EFE10693FACDAD229FA153B53E7F5203565842E84EAFC9A1C15D75CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 a94d428d0beb8ce65140a1f2ce5c20f4825b13681c8e4eef730dd10ff6c3d13b
- MD5 0872f72f5173cc3edf178ca1e922fbcc
- SHA1 5573ddd547c2270cadf0fb5bb7d5a52b7d24a57e
- SHA512 88b2335e6611a0dac736076535f6854dc642bdc33e625f664860972a97c7f51661d526f2abf42df716247ee64db42d46f360d52f707d1dd7b496d5f7bed36cf4
- SSDEEP 192:tR4SPVD8BISKiv7AIAPRp2l9qHsb+WNnqc08L5XkwmVyIsnAUgtaJ:tR4S9aKukJXmkwX0mde8
- TLSH T13642C52EFE10693FACDAD229FA157B53E7F5203565802E84EAFC8A1C15D75CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 13805701603dbbca9403b94e006c712edafb4f98a8e0ae4ce0ad1b025b835f93
- MD5 28aca1b912d001e337a9e715a111a353
- SHA1 177a8b35a6fa74a15deedffd79dc9066169fc496
- SHA512 0e554b40f873ea651a22f9b91cf52ad45cc99b35e2db0e34845d695aa13aaf61497b6646f39f5b0ba26fc4a43100e92a0aff8ad949d0289fb397cfe00b0cede5
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcSjvKXODx4+ErU31PHG0pdpS8gfp:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7pf
- TLSH T1A4720967AC0C9E374F94D6CCDC277B4FADB5015B61E9886483FA981903D5BCA110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 3a0dccf567bbf01c45bd5240e6db591b4f1eb5ec417f7887ed0d2e26a9d937df
- MD5 800d130fa5c27958a039159d0143eed1
- SHA1 f7818aab34f04ca85a8c1ce5b10935a41f5a1db6
- SHA512 83f9292fb3c634768e9a53de1440b763193c7dcf6d45a365df4a53d39defa9514cdf9cc9994c7b1ea36533d678e781a4fa24c48a849431d3b78007225395afca
- TLSH T1B5B0120280015112C04206F0114614DC71245F10960B1B0153F06D33DC25161C1150D1
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5d0d70.TMP
- Size 96B
- SHA256 318a3a7e5e91012a5e505e035b96f0ab1977fbb05158d9d7ae9d8be0c7751725
- MD5 dc947f71116f67e1307851865199583e
- SHA1 e2b9fcef8ce8ea76efccaba743055e417370c3fd
- SHA512 70d5fffd15cabb31be07d4433110aac94871a284e8c31e8349f96415555949b2216dcb3d1c463bc3a255501ac91ac5c6057c3b7515a6954be91498f324be2cbf
- TLSH T174B02282C0023222C00203F0208AA8E8B020EF22C2032F02E3E00ABBFC202F08020020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 237KB
- SHA256 609ebf217a54396d0ce15ffaef4660e629fe740471703f8ef5cabbb1a188bc48
- MD5 43486bf69a08d3c5d93662b8af15869c
- SHA1 3c7b02d807054633af7ccec098e07ef3cf991e9d
- SHA512 65ef910117452ac23866345d627721d948f9b60229e3363fd33b2e7754391eb023dda73d77599c4c68afe7473826bdec91aeca10e2c9cd5a710b8453a69e0932
- SSDEEP 6144:2bhck6sr0vF191xGSD/itJVXYD5U1cm7Rkm1tYpBeh2BAoOe:imtF19rrD/KJNY61v9oBGcAoD
- TLSH T1583413176D30AD3659B44348318F2A1E3AF18D73DB9498D2D0D9AF0829FE79D0E09E39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 2ddcffdecbff2f8020ffd44322666d4f2e694028b8452fb31bf6221bfb0ccce2
- MD5 135cb134ab8a0f4737063123d5463190
- SHA1 54af2be3dc510ed5968fe57ede13376ff20a8a63
- SHA512 a052fe481b1c360d66e6862531105a09b46ae2e211d83046f14daa85b4859ea9e994bb2d7c6cccdfb9734fdac8b19a1ca021f8e0feeb36a23ca588f1d5e04cc3
- SSDEEP 3072:A/Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:5m7Rkm1tYpBeh2BAog
- TLSH T13AC3023B5E75E93B5CB5A74EB08E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\is-M6EO74L4LZ.tmp\ejx.tmp
- Size 4.1MB
- SHA256 609c91716742ea5c214243e3749926e9dc1a5243394d567c9b827f02b721271f
- MD5 15693b98f8b622cfcecc67f79522c59c
- SHA1 67e44f8f9eed8c48df82b0b90c1f6d3530e0e09b
- SHA512 3b07e2536a6d6260166ce5ecbafb84d8938c06afe149dba24c07f171ccd2a18a1fd49f49f8a84eb04d4ef5abdbb3602c3cf8de80067cc11ac2b35327c236de80
- SSDEEP 98304:LYU5hnuOajWwMPdCpepI3GrwrA+Jr333w:FxuHjWfZIzw
- TLSH T168168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_13-58-48.log
- Size 620B
- SHA256 90cc582b3f5ba1f85158c30aa2ccda8ed100d6b5eeb9526f21cf062e672922e4
- MD5 9b61e7b965cca7294ee32a652963b2d2
- SHA1 5ad6053986b197ab14066b7dd2d97c50eec7935c
- SHA512 8e0f0674f2c6e05fccf6f8d213790cf3ecdecf5dec754f9cf0606f6d946777fdb3fa9e32b00fe1a6af55def6fcc7d60b85a2ad678f3a3738ddb9fdcd84dc4594
- TLSH T1DBF04C5833B648AB090F60E38E27D66CCCB4F41A3A48B1287318089C234300B5F3F4AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_13-58-48.log
- Size 1KB
- SHA256 5f8990a19f73eb5ffa289e017adc18062b9a66bbfd4381e9910510ce7fefc55e
- MD5 2fa45c4e6e2de42c91aad7dd83424d32
- SHA1 ac3314601bb40d2135625131580afbb4619e8f54
- SHA512 934a81af5e9fcbfea04d4c47f8ac7b520f2a566058aa839e22bf196e3b4cca256d26366ae86f4dc540841874052057890a10281a3a1b0f84bb50805993e50edc
- TLSH T18021D74625B128EA053A21D3DE2BDBACC5B0F548350C701C3798449DB7E9C1F5EAFA98
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_13-58-48.log
- Size 1KB
- SHA256 a5ea2af0725b2d4498ea4772cbc3bb09ab8bac58540838d43fa1e5108738acb6
- MD5 1914caef8d59dd3ecf6efc18d2136b92
- SHA1 1f7c04a072fdb8bde9c0dc9d4cd9a2fd73564816
- SHA512 91bbe55097bd0fa5be7105e2ebc6cb26720f5c4babe2246d8f008a0f958771e94c7aae6a905ea2b35925413d61e9583be5341c0c34edf9e66dac333ef0a1970d
- TLSH T17331E74625B125EA457A21D3DE2BDBACC4F1F648250C30183398449DB7D9C1F5EAF698
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_13-58-48.log
- Size 1KB
- SHA256 6ace07eb1477b5fb23c3e9bb5edd270be5749c721c17c413bc80a308835e4822
- MD5 af5cca7ce3b093054b781561d2e69d87
- SHA1 f3b5dd3e0bf864677354062c7f82af674d98ba4f
- SHA512 806786bc428ba40549d3122bddf346b50865ceacf51cc06aa57e5fb104d0e68e8c0f4425958bc2540b448a747772babc5fb180e95d0ca34eebe3ac51dd9c6aa6
- TLSH T15A41D34624B124EA447A21E3DD2BDBACC4F1FA48251C301833D9449DBBE9C1F5EAF798
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_13-58-48.log
- Size 2KB
- SHA256 47fab8be9c3599fa0e7c95daec8e5015bcd8861194bad6d1e8983c408a31d1b1
- MD5 716937ceffc2d2bac6458981ab2ee22f
- SHA1 680070152cbbab471c0495ecdbac41c4c4b0b7d1
- SHA512 2399c06801a531fe9b9fd4a02ca9c45e09c6c31b5fc3bca31ba062464f0bb7cbb5381952e6f5a101f1e5951e9e98ee7ba18cf789121bda855de87783bbd74035
- TLSH T1A251384724B024EA503A21D2ED2BDBACC4F1F944261C305837998499A7D9C1F6EAFA9C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_13-58-48.log
- Size 4KB
- SHA256 ae292ce7b1b0e9ed8df452b5364d91c3997ec5ea7a0013bf17c64b2a5db89984
- MD5 9d5fc506300a90e47acfd75a69794682
- SHA1 7ef0a9131564ac288908e65f38667d05d55f1b6c
- SHA512 d67210d2bba631e160c952b5bd8bf3a74b82e84ff97e306d1136c1d55c6932d7740adec20aa230f1d698be8776db5b999a6cbd8892de0140cea6ee160fd76a45
- SSDEEP 96:AP4Y1va0jMkCU+pHGWmCf7CLU1qY47OUp:+va0jMnvB1B47OG
- TLSH T19A91DF5A20B121AA517E20D6EE27DBACC9F0F944220C341C3BDD449C67D9C5F6E6FA9C
- MD5 SHA1 SHA512 SSDEEP TLSH