6c04a994524bc861714c4a325328df0c2ad9f2306e15cc45a9bf0c03d8d611c0

Analysis

user interaction
yes
max time kernel
1800s
max time network
1770s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ejx.exe
Size 23.4MB
Sample260730-srtpcsvtas
SHA256 6c04a994524bc861714c4a325328df0c2ad9f2306e15cc45a9bf0c03d8d611c0
MD5 e1a025c75721db232315bf9961adbb43
SHA1 d92c94e3e7e3acb3822e87704957964d443c0ce0
SHA512 00d05721ba9011e9a9cb7d4d435fb6e6938fb4976d660517b75170f670bec59961fe6f510e526578c753037dc77710c71af21a2a41b08f9cf2b8f5f3fc41241c
SSDEEP 393216:0UF0D/V63MUjb40GdyQIBd7DUgWoY85Lnfzwi5iVt34UiWfkF7G71sy:BHHmd/Ijwv85IFV2TWfKa7x
TLSH
T10F37333FB28B613EE06E5A36B972A251413B6721A4134C57D7F4C84CCF590B11E3EB9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution installer persistence spyware trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\wintun.sys	DrvInst.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	EJX.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
3824	ejx.tmp
3664	EJX.exe
5340	EJXHelperService.exe
5636	EJXCore.exe

Loads dropped DLL 20 IoCs

pid	Process
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
5340	EJXHelperService.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	165	77.88.8.8	5636	EJXCore.exe
Destination IP	170	77.88.8.8	5636	EJXCore.exe
Destination IP	173	77.88.8.8	5636	EJXCore.exe
Destination IP	176	77.88.8.8	5636	EJXCore.exe
Destination IP	421	77.88.8.8	5636	EJXCore.exe
Destination IP	638	77.88.8.8	5636	EJXCore.exe
Destination IP	655	77.88.8.8	5636	EJXCore.exe
Destination IP	658	77.88.8.8	5636	EJXCore.exe
Destination IP	112	77.88.8.8	5636	EJXCore.exe
Destination IP	159	77.88.8.8	5636	EJXCore.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
64	pastebin.com
60	pastebin.com

Drops file in System32 directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\wintun.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\SET1CA8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\SET1C96.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\SET1CA7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\wintun.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\SET1C96.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\SET1CA8.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wintun.inf_amd64_8ed20477a29aa8f7\wintun.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\wintun.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\SET1CA7.tmp	DrvInst.exe

Drops file in Program Files directory 62 IoCs

description	ioc	Process
File created	C:\Program Files\EJX\data\flutter_assets\is-07J6PDQDSG.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-RYD8HW4N6O.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-F9BOZK3VDB.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-MWPC2CWMFO.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-KMT6E81LUV.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-U0AQMM82T2.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-LDUFWXX9JB.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-SMEE2V0RKG.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-YT48BHVWIE.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-EXG4S8H291.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-PCFLKU3LMF.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-BDXPV03YO8.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-ESMJOL8TJ6.tmp	ejx.tmp
File created	C:\Program Files\EJX\unins000.dat	ejx.tmp
File created	C:\Program Files\EJX\is-929XMEEWLV.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-TZTIGJLEF8.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-CRBAKIO02A.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\packages\flutter_js\assets\js\is-8JOXXGCU9Y.tmp	ejx.tmp
File opened for modification	C:\Program Files\EJX\unins000.dat	ejx.tmp
File created	C:\Program Files\EJX\is-YPTSVNTORF.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-W1G0RMEHFU.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\is-T0MVQ7OXHC.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-VN2YOICXV4.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-84KQJ2GOS2.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-LE6FBWN3VB.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-DT8EO1QNS9.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-L62MTPG3VV.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\shaders\is-X0ROZD3UB3.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-P6JU13N5UE.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-U8032JGFZK.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-P5Z0VIRG66.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-OSM896AIY4.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\fonts\is-WHDJJ83UC2.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-7IJVJW2T03.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-4XBA4XTB3E.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-Z6NEEBDXNM.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-0IRH70R1XN.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-K2GBBQVI48.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\ads\is-6DQOFTNUB7.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\fonts\is-8WPEPOJ8BB.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-V1PKICCL79.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-G6FSXRXY0J.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\is-PB8YQGJ7FK.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-Q63D5E8ERT.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-JX596V5WLA.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-WC3PD6FYYR.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-0PVEFELMJ8.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-XRNMSKLEV2.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\is-5LXPY27WUE.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\is-WQ5I4ZYCXZ.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-TL0MGY6ZKJ.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-YKTOQV7ZRS.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\is-3S8MYYEQMP.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-F18C3F0X35.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\shaders\is-BFK3DFREJ6.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-L8080S27J8.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\is-WWPKN0PWE6.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-FNCKT2G0QJ.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-92UWGM7G2A.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\is-RKQFWWOUS2.tmp	ejx.tmp
File created	C:\Program Files\EJX\data\flutter_assets\assets\ejx\ads\is-EVY4U5M8C5.tmp	ejx.tmp
File created	C:\Program Files\EJX\is-UJ87NSGDRS.tmp	ejx.tmp

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	EJXCore.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Launches sc.exe 9 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
468	sc.exe
4900	sc.exe
892	sc.exe
2532	sc.exe
2296	sc.exe
4636	sc.exe
1876	sc.exe
5180	sc.exe
2520	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1752	cmd.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	EJXCore.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	EJXCore.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ejx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ejx.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4956	chrome.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3312-0-0x0000000000AF0000-0x0000000000BCC000-memory.dmp	innosetup
behavioral1/memory/3312-41-0x0000000000AF0000-0x0000000000BCC000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 58 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	EJXCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	EJXCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	EJXCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	EJXCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	EJXCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	EJXCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	EJXCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	EJXCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	EJXCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	EJXCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	EJXCore.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\	EJXCore.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

GoLang User-Agent 3 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	196	Go-http-client/1.1
HTTP User-Agent header	197	Go-http-client/1.1
HTTP User-Agent header	634	Go-http-client/1.1

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
5100	taskkill.exe
2272	taskkill.exe
804	taskkill.exe
3000	taskkill.exe
4136	taskkill.exe
6024	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	EJXCore.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	EJXCore.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298985338830885"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	EJXCore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\DefaultIcon	ejx.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\shell\open\command\ = "\"C:\\Program Files\\EJX\\EJX.exe\" \"%1\""	ejx.tmp
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\shell\open\command	ejx.tmp
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx	EJX.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx	ejx.tmp
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\shell	ejx.tmp
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\shell\open\command	EJX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\shell\open\command\ = "\"C:\\Program Files\\EJX\\EJX.exe\" \"%1\""	EJX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\ = "URL:ejx Protocol"	ejx.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\URL Protocol	ejx.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\DefaultIcon\ = "C:\\Program Files\\EJX\\EJX.exe,0"	ejx.tmp
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\shell\open	ejx.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\ejx\URL Protocol	EJX.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	EJXCore.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5580	chrome.exe
5580	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	taskkill.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	5100	taskkill.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeDebugPrivilege	804	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	3664	EJX.exe
Token: SeCreatePagefilePrivilege	3664	EJX.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe
Token: SeShutdownPrivilege	5568	chrome.exe
Token: SeCreatePagefilePrivilege	5568	chrome.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
3824	ejx.tmp
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe

Suspicious use of SendNotifyMessage 37 IoCs

pid	Process
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
5568	chrome.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3664	EJX.exe
3664	EJX.exe
3664	EJX.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 3824	3312	ejx.exe	87
PID 3824 wrote to memory of 468	3824	ejx.tmp	88
PID 5568 wrote to memory of 6008	5568	chrome.exe	94
PID 3824 wrote to memory of 4136	3824	ejx.tmp	95
PID 5568 wrote to memory of 4956	5568	chrome.exe	99
PID 5568 wrote to memory of 4172	5568	chrome.exe	100
PID 5568 wrote to memory of 4172	5568	chrome.exe	100
PID 5568 wrote to memory of 2060	5568	chrome.exe	101
PID 3824 wrote to memory of 6024	3824	ejx.tmp	102
PID 5568 wrote to memory of 2060	5568	chrome.exe	101
PID 5568 wrote to memory of 1640	5568	chrome.exe	103
PID 5568 wrote to memory of 3820	5568	chrome.exe	104
PID 5568 wrote to memory of 1640	5568	chrome.exe	103
PID 5568 wrote to memory of 3820	5568	chrome.exe	104
PID 5568 wrote to memory of 4124	5568	chrome.exe	106
PID 5568 wrote to memory of 4124	5568	chrome.exe	106
PID 5568 wrote to memory of 1028	5568	chrome.exe	107
PID 5568 wrote to memory of 1028	5568	chrome.exe	107
PID 3824 wrote to memory of 5100	3824	ejx.tmp	108
PID 3824 wrote to memory of 2272	3824	ejx.tmp	110
PID 3824 wrote to memory of 804	3824	ejx.tmp	112
PID 3824 wrote to memory of 3000	3824	ejx.tmp	114
PID 5568 wrote to memory of 100	5568	chrome.exe	116
PID 3824 wrote to memory of 4900	3824	ejx.tmp	118
PID 3824 wrote to memory of 3664	3824	ejx.tmp	120
PID 5568 wrote to memory of 2524	5568	chrome.exe	127
PID 5568 wrote to memory of 5808	5568	chrome.exe	128
PID 5568 wrote to memory of 1756	5568	chrome.exe	129
PID 3664 wrote to memory of 892	3664	EJX.exe	130
PID 3664 wrote to memory of 2532	3664	EJX.exe	133
PID 3664 wrote to memory of 2296	3664	EJX.exe	135
PID 3664 wrote to memory of 1752	3664	EJX.exe	137
PID 3664 wrote to memory of 4636	3664	EJX.exe	139
PID 1752 wrote to memory of 1876	1752	cmd.exe	141
PID 1752 wrote to memory of 5180	1752	cmd.exe	142
PID 3664 wrote to memory of 2520	3664	EJX.exe	144
PID 5340 wrote to memory of 5636	5340	EJXHelperService.exe	146
PID 5568 wrote to memory of 892	5568	chrome.exe	151
PID 5568 wrote to memory of 892	5568	chrome.exe	151
PID 5568 wrote to memory of 4996	5568	chrome.exe	152
PID 5568 wrote to memory of 4996	5568	chrome.exe	152
PID 1204 wrote to memory of 3772	1204	svchost.exe	156
PID 1204 wrote to memory of 3148	1204	svchost.exe	157
PID 5568 wrote to memory of 5932	5568	chrome.exe	167
PID 5568 wrote to memory of 5932	5568	chrome.exe	167
PID 5568 wrote to memory of 4528	5568	chrome.exe	168
PID 5568 wrote to memory of 4528	5568	chrome.exe	168
PID 5568 wrote to memory of 3996	5568	chrome.exe	169
PID 5568 wrote to memory of 3996	5568	chrome.exe	169
PID 5568 wrote to memory of 5580	5568	chrome.exe	170
PID 5568 wrote to memory of 3460	5568	chrome.exe	173
PID 5568 wrote to memory of 3460	5568	chrome.exe	173

C:\Users\Admin\AppData\Local\Temp\ejx.exe
"C:\Users\Admin\AppData\Local\Temp\ejx.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Users\Admin\AppData\Local\Temp\is-KQXB8DLBMQ.tmp\ejx.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KQXB8DLBMQ.tmp\ejx.tmp" /SL5="$80290,23327863,842240,C:\Users\Admin\AppData\Local\Temp\ejx.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" stop "EJXHelperService"
    3⤵
    - Launches sc.exe
    PID:468
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /im EJX.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4136
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /im EJXCore.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /im EJXHelperService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5100
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /f /im EJX.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2272
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /f /im EJXCore.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:804
- - C:\Windows\SYSTEM32\taskkill.exe
    "taskkill" /f /im EJXHelperService.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\system32\sc.exe
    "sc.exe" start "EJXHelperService"
    3⤵
    - Launches sc.exe
    PID:4900
- - C:\Program Files\EJX\EJX.exe
    "C:\Program Files\EJX\\EJX.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SYSTEM32\sc.exe
      sc query EJXHelperService
      4⤵
      Launches sc.exe
      PID:892
  - - C:\Windows\SYSTEM32\sc.exe
      sc query EJXHelperService
      4⤵
      Launches sc.exe
      PID:2532
  - - C:\Windows\SYSTEM32\sc.exe
      sc query EJXHelperService
      4⤵
      Launches sc.exe
      PID:2296
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c sc create EJXHelperService binPath= "C:\Program Files\EJX\EJXHelperService.exe" start= auto && sc start EJXHelperService
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1752
    - - C:\Windows\system32\sc.exe
        
        sc create EJXHelperService binPath= "C:\Program Files\EJX\EJXHelperService.exe" start= auto
        5⤵
        Launches sc.exe
        
        PID:1876
    - - C:\Windows\system32\sc.exe
        
        sc start EJXHelperService
        5⤵
        Launches sc.exe
        
        PID:5180
  - - C:\Windows\SYSTEM32\sc.exe
      sc query EJXHelperService
      4⤵
      Launches sc.exe
      PID:4636
  - - C:\Windows\SYSTEM32\sc.exe
      sc query EJXHelperService
      4⤵
      Launches sc.exe
      PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb2c07c728,0x7ffb2c07c734,0x7ffb2c07c740
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2016,i,14551952347907043073,8264615355244140347,524288 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,3145641455769835618,1416911387209871111,262144 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,15053662810314862141,5490251802460733725,524288 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3104,i,3911380802510517246,13375039196381824802,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3108,i,7994691277425125233,1156161817075278224,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4332,i,16019478527137046,5516186916255788736,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4656,i,1292585139303956056,18110692431122246890,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4612 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5544,i,18022695540787393392,2400283952891551858,524288 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=1224,i,5137876848481629010,11648875977334707291,524288 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,12616583741595212758,12245198621715115097,524288 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,1266480285941827977,6596875048170693962,524288 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5560,i,10143057138013274802,5607893476800368915,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4804,i,10335561073580481534,14990646537441185181,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3296,i,9750234473808207951,3313246104288183693,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:5932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5592,i,13124777027638856910,6876603792833359891,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=4688,i,871407780856340803,11117890670541831752,2097152 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5604,i,10895056367772473476,15391004225540448785,262144 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,17805750142948048872,12008396665531220902,524288 --field-trial-handle=2104,i,1185638499335171263,3309771849299269685,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:3460

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2064

C:\Program Files\EJX\EJXHelperService.exe
"C:\Program Files\EJX\EJXHelperService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5340
- C:\Program Files\EJX\EJXCore.exe
  "C:\Program Files\EJX\EJXCore.exe" 50241 C:\Users\Admin\AppData\Roaming\com.ejx\home
  2⤵
  - Executes dropped EXE
  - Unexpected DNS network traffic destination
  - Drops file in Windows directory
  - Modifies trusted root certificate store through registry
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  PID:5636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "9" "C:\Windows\Temp\971e1573115815450a607c60290a0337afb0886d8b3fb7f8a8063a1cad46e6cc\wintun.inf" "9" "4ab06b3eb" "0000000000000148" "Service-0x0-3e7$\Default" "0000000000000138" "208" "C:\Windows\Temp\971e1573115815450a607c60290a0337afb0886d8b3fb7f8a8063a1cad46e6cc"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3772
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "1" "0" "SWD\Wintun\{D53088EC-9C8F-8938-E921-4513190847F3}" "" "" "4d0a67b77" "0000000000000000"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:3148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

EJX.exe

Path C:\Program Files\EJX\EJX.exe
Size 96KB
SHA256 31d69703c8964f8f176f549193ba7bf15bd3e5c443c83df25f4dde7d74858ac9
MD5 75df107fd511d94a42d393e3b73aa439
SHA1 42bbe398577a07017d2740be3e94654b5fdcb0e8
SHA512 7bb5b5e1d45a61e0d34cd43a0199d8d90336dae6bea0ba4495beaa444874fe6e39a7791dcab269bbae43f8424cb04f231a5bbdbd7c7db64ae093183b705a2bcb
SSDEEP 1536:TcqxYA/VDLZ4HhQKxxvIEiP6wC5eaWhlzbu8ovX2iJkrW3dZEx7QCiQV81:Qqxd/BmHhpgEO6HzWrzbu+iJkrOZEiAc
TLSH
T1C5A34C27EA1810EAD229C47DCA578946DB73BC9A47A097CF4B900ED70E67AD45F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EJXHelperService.exe

Path C:\Program Files\EJX\EJXHelperService.exe
Size 704KB
SHA256 79db865230aa5f2be77b487e08bdedd5b9ff24aee3e19f0a26923cfaacfdad98
MD5 1e5a4f036eeabff3f83940ebedb5a393
SHA1 654ea209034fb5f969eac382d81437522aa0c2d9
SHA512 eff5dba9e9f4463fe967e3b9b4b5fc9dad10a11b5ce06a2fe4fede9b56e4ae3b7bf2f8995f2a7e526a1331dddcfadba6cebc16a6abf4b2c0441eb83dd7619365
SSDEEP 12288:KXCObKsj4KjkBLX3iGrIj1we2ug7fgXdybyZS:WCObKsj4KjEX3iwGALgJS
TLSH
T10DE45B13FA9581FCD05AC074831A9633FA72B88A0B3575FF06D456313E69EA1AF2D718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_links_plugin.dll

Path C:\Program Files\EJX\app_links_plugin.dll
Size 136KB
SHA256 b9063f2b68c426b710bbcaca309bdd96aff3323a100a02ee5dc4b33a09dbf928
MD5 c5c6d20ba9eeb2003ff253cf7a68dad1
SHA1 396b9114e70de460fb39d74441744871de7a6064
SHA512 28fb6d8224cd3de32abbd4ac0dbb82272a99a1d937d6a1ed1d3feacff731326dc8bb2629057f26483a4b83bd1f17ecf8fdf97926b8c7332754b1d1274812bb32
SSDEEP 3072:UTZB3vnv6YEQa6XhiCKk02nhMpZdTdcCc9GTamSEC:UTZB3Pv6YEQa6E2nhMpZdTdcC7TamSE
TLSH
T1BED36D2BF71940A7E25AC07CCA534945EBB2B8910BA197CF17500B9B1F27BE85E7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

connectivity_plus_plugin.dll

Path C:\Program Files\EJX\connectivity_plus_plugin.dll
Size 97KB
SHA256 e01644346c127300ae22ac2da1991b0a3e657a9175521444501674055c550768
MD5 777dd233ff875d1ae51e6a1b35b2e071
SHA1 060a7424d948804b948fb13a713424e00b869360
SHA512 09ded2c3373fe7f81b6ccb8fb7b86c429bcf8f2455b27741f9254e497a551f4b79a5da53a9ad34702f1fbe2faf8ac82568a48166c8c1026d62f2c49a2d897dc5
SSDEEP 1536:S4k9FrGV4x6TqhGx7WH2G/BiVQgPRCm2XPMAfC/y4iCL:R+rGV4x6HqH2G5isXPMAfC/yPq
TLSH
T145A32A3BBA5D50ABE219C4BCCA574945DB72B8854791A7CF17900A9B0F2BFE40F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\EJX\data\app.so
Size 10.8MB
SHA256 c4355ee27e1d6fa4f49e8bbdd89cb14d801374145d9291ab50032f10b3560dc2
MD5 bac493f5f9df008bbf6f83673a713096
SHA1 1e6ab222d17b77093e5df472d150cc969066bb9d
SHA512 e22049090b179333b1a4b4200e46a0962541a103b69a2b6a4b24d1ed77552b3983adb5349dea753fe5289f82e2d5c8e20e338f8a50f60146d998cf0de1673039
SSDEEP 196608:pviasyiLmjVwWYG7TgiwHz7NrB1gu8mgW99QX5vhNpHFt:pKasyiLmjVwWYG7TgiwHgNp
TLSH
T13AB60947D4E48760E473E772BB5F26A59E2078DC4A34778706D45A663E8BCE04ACE332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Program Files\EJX\data\flutter_assets\AssetManifest.bin
Size 1KB
SHA256 eafaf4f627f62750fb6ed398223fa8b3502e92edd21d787f2c11184121ef1b28
MD5 a7ef18a07c71502a5e6b3d0b5ca41bdd
SHA1 d1a7c14f8a00a2d0880f917c5f663a9622ad842a
SHA512 8ca840bdb7115009f1a970222e8a21ad5948bdf5856648360546d7e005dc7915d6e457bf1977f04981396c2a78fc380b2bb96a575f0aab0abdda122e9f4e59f7
TLSH
T1FE31D51897A5B5A939107326E89805C25C4F6B896464F1FF7339C498B985CFA08FBCF2
MD5 SHA1 SHA512 TLSH

Submit Download

FontManifest.json

Path C:\Program Files\EJX\data\flutter_assets\FontManifest.json
Size 392B
SHA256 3b25f92ac19a244e66650f5c974350eee79ff2e7dd6998510ef8a25137e4ef97
MD5 d1b0e7e12ab95ecc3783a1c7530fb470
SHA1 4b0c9f50e249c4982dc097bc3da04b4409e8160b
SHA512 1f471350cc442afdb66254da43327727aabbc3b4d8126d1d9979860afe01b7bd53667ec277648c2236ba257d8334201831130ce2d5b93298221d4f96c5394a40
TLSH
T16DE0650F492606B550CCD89AF067559274952F1B324DFC0FD6711EE4A6F031013747BB
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\EJX\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

reklama.webp

Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\ads\reklama.webp
Size 15KB
SHA256 6f24c1fcc94fb558158f00b6b041e57bbd5730e54cd817ef6d0314acdc20cf6e
MD5 f699274ab5fef27d9b6d21f02b6eec59
SHA1 501b73119ca364f62611df33ca2bbfca2156dd01
SHA512 e061afa69f40440e95d0186b8a4402d3c9c9cb3fc2c7c8af2a1708d1b1b6578aae1d521ec9daca8db3198d2309aeccbeb8727ad764c7104054df6178eb94ab97
SSDEEP 384:HI4z1AjoZ/MATkE6yPL4k8l3ysuYu2aIghKN:HIsBil3yx1gtN
TLSH
T11C62D187F5CB1617FB032AE21287BDFA58A7E959E714A8EE934042F7809D711D803C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo.svg

Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\logo.svg
Size 9KB
SHA256 fea66473a90f2fe12374990de4de3238cbe83c93e6ea9aeb4933fd5c60c5141c
MD5 24030a1011ab502c6381ae49d71f5100
SHA1 9345fefacad091f58f40f0e5fd075b76a9083267
SHA512 7b171b293931102c2c09b2e330a5f11be8b8d8cbd4c609e0c37f7b94eed7a4c268dd4275e1c974c6cc66288ecc73674c6db5589e6931a4463e5bf65885fe0f8f
SSDEEP 192:LG7+K8RmUZcgjLWdMXjqo1Gu0Mv44JcuaGAEvqRz/PDo6:LGD8kUZcgjLWEjqo1Gu0MQ4uuaV9RDz
TLSH
T1511274EE9BEBA3F5E003F3F4CB5058697A5F14F66A23CE14C7A91D0AD96206D9014C82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.svg

Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\settings.svg
Size 1KB
SHA256 91f7aa95dda55d2f73a358c56f665bf353ee68bee3bbe9058422c1e49f9a3fd3
MD5 13ec5970cb74adc866dd82a6ffa701d5
SHA1 c88415edff50145d87f88362ec3cff72bdc89398
SHA512 7c1cf398301caf6bbf6450c338341be596ed0eeb88ff84bb4f1dadfa18bdd3a9b4a889b79f45deac95cbe74202d7e18c4d3333d7de005dba620097366181562e
TLSH
T1924186F6828C3AD4D146ABF0CC3B68F4754F74FB2A03DDD64394A9C8DA1208C500A554
MD5 SHA1 SHA512 TLSH

Submit Download

support.svg

Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\support.svg
Size 1KB
SHA256 e3d6fdc8a71ab37fc5e819bf328d90095ef9e153d152cff139172957a2662464
MD5 37ae15cb12880faa2f459d332cded743
SHA1 83b97afd989b6338d3396e806398152e6bb5331f
SHA512 917a344add81c5537c66de27ff728650fe9e67a749824db52ec794c38cc0f9cab034b6ac86c0af27b3597dacd84e7162c3f234c829dedc942b3bce3ac9580a81
TLSH
T191219A61A1D1B551D2C583FE4A37F28673AF38A93F554746C2B8CEB8B9A291ECC0CC45
MD5 SHA1 SHA512 TLSH

Submit Download

inactive.ico

Path C:\Program Files\EJX\data\flutter_assets\assets\ejx\tray\inactive.ico
Size 4KB
SHA256 27b077d51e59977c9614123e20d4e12dc9d1abb9dcbe91faf198ae6849963c72
MD5 3013f686e4028268fd63121f1d34ee7f
SHA1 a5d2b56947df2279f0503d2078b75f5537430adc
SHA512 870cdf5b3b297c4a6af87c0582335904f6c24e28b4ec2aed296269bb6f3022debcfd6cf82307671b21baa4b60b51e6048e00be996366eb14fbecea5e84bbab40
SSDEEP 96:EFAvJIBBB3KoLcac9CM67K2lqzgIEs5TPCPx6KeSY:n7oLcacwe2lqz6s5T6PxjY
TLSH
T13D919517883C509DEC3E04B1486B78FA0E7F453DCE583A1605E473BA6106A9A6BB9E81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jost-Medium.ttf

Path C:\Program Files\EJX\data\flutter_assets\assets\fonts\Jost-Medium.ttf
Size 60KB
SHA256 07aebfbb345c3e5faca53cdc2cdb09bfae3cd696358a79d153060625129ef580
MD5 090175d88161f36142c3b541783ca73b
SHA1 4a4abef46a165bc7468d240f70fdb948f12e97f7
SHA512 58ffbb67b60d60565582f7430e315ee3a709018d50a0e286953f46cd0ff8cbdc56fd5f25a0419bb0f5007a4d3a3e444308ec850f17b15316ffb30667d2663139
SSDEEP 768:7oj5X/xwClUQQsyaDWl0B4BTjuJVM74nP5IPscHttQ7MH6/a8FEjQ4P43nGsyXLV:LsETjuJVM74nP5YsQttI/IQuUnGZXLPN
TLSH
T15D531906D373935EE3172E7C46B3D22695C9EC36D6A6437DC10DE617F8EA8A09E89304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaterialIcons-Regular.otf

Path C:\Program Files\EJX\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\EJX\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dynamic_color_plugin.dll

Path C:\Program Files\EJX\dynamic_color_plugin.dll
Size 81KB
SHA256 6a69ea3bb857e1f3285e5eeb13d974220c57e0bd249ed750cef756f98d9cf520
MD5 68937944a37dc788cdc784c0f45b01a1
SHA1 a331f68ea4e48a0b7e4273f9e4e87edde9dc7301
SHA512 1c66f4469a4fb4e479c2d2ea4fe5a37979d52a57b450cf9d1d98992be436804875c1b11ab52e7fd4da2439626fb208c07dd0574ed315d4e809aeacc6e0a0470c
SSDEEP 1536:pmaGg/U6h8xDn1bcx0sbM8z1WM1lalNlD:A7T6qr1W0sbM8z1WM1cln
TLSH
T108832A2BEA1D50ABD259C878CA534905DF72B8964BD1A7CF57500ADA0F27FE80F3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Program Files\EJX\file_selector_windows_plugin.dll
Size 109KB
SHA256 ddb4c31c305a53e27d2f935384f226658485f6f56d8c47f3c8f575f24c555658
MD5 4ad4f1384e9d0919c9e39d925141521b
SHA1 50426891e6bf93474a6747b60f5bcdfdbb9bc01e
SHA512 521eb8317722f39f53f58950b67d6cdee9875db8ed9a92bf72468cdd774a619ce3140fd0eb0e97565597a97a85289ece8b7966ae3946b6a0d7d37548e1ba5a65
SSDEEP 1536:UBXrl+wCXtRGN1jl/nHu9kxFnKxpm61abZho1uCpVMfZGTx9+5:QblHCKHueFKq64bZho1J7MfZGTx9+5
TLSH
T108B31B2BF61D40BAE26AC47CCE539901DB72B8954790A7CF57500ADB0E57BE45F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_js_plugin.dll

Path C:\Program Files\EJX\flutter_js_plugin.dll
Size 86KB
SHA256 e46d36f034fb7ddae37e45edfd73476ed0d085d3de254e1840982c455c1769bc
MD5 de72bc82f7ea04a8ba624943ee1897be
SHA1 64c3c0349923aaf4b46ed3a5dd9bb6002cf1d9b9
SHA512 a406b060d6829b8b946c1f97a9b792a695cfb6424b96831b5fed3bdc7bcf88f72bfc28e9a96cbf3bea278bdba222150e76053ccca2e30ed319530ac8ba692a35
SSDEEP 1536:k8td+56bSKxR6ON+YDmuZuecRFxBEMAJCEsEBWv:lI56b5jDOBRTBEMAJCEsEBWv
TLSH
T176833B2BE61950ABD319C5B8CA834A05CB7278815B91A7CF57904EDB0F27BE81F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\EJX\flutter_windows.dll
Size 19.8MB
SHA256 e225762642535e2f31b9ebb3d7def4dae93162d357e09bee241e19d461b9ff46
MD5 4f110b4f83285c211d56a503bc300c7a
SHA1 5dbe13d3231cfef7e09447948bb7d8c5324f788f
SHA512 66526e7017f4b0f380ba1787afb38646a90c5fc8328d1e41c0b80d3c3524f570b578a229116956d320a5a2b8382b118765a856e080e725c08729c91cc05038e9
SSDEEP 98304:r8wG47fQ6x7Foser61UwcaRdKckSYIrZXYh624nV4lkmHKVGsvvNSQE1bSsKZU/7:rbZvtdKcy0pdeSslYe5qfNODaq
TLSH
T1EE276B03F29680EDC459E178971BAA27F671B8490720B6DF27584B223F66FE05B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hotkey_manager_windows_plugin.dll

Path C:\Program Files\EJX\hotkey_manager_windows_plugin.dll
Size 104KB
SHA256 b9e091e23130c498ee07a8ffaf08dda69097b5c6bac3bcaf61fdffba333401f0
MD5 53e7dad228ef1f44bb8e3969159c20fc
SHA1 40817b4d111e4974c391289fafe52681241eb13c
SHA512 f40c9e99e7a3f1d1d4f605a17e23d5cf64a01222f601911e7aa924307dd67b307c054f381e1fa3db044825fac42313f52618c42f694e8a3ba8fbf3ead005adef
SSDEEP 1536:tiKblVJQryWHrgI16uBxFc+YgOHn2aMuOOYqi0uT:dbpEgO6SO+YJH7MuOOYqi0
TLSH
T1CDA32A3BAB6D40ABD26AC57DCA474945DB71B88507A1A7CF57900B9B0F17BE80E3E600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\EJX\msvcp140.dll
Size 544KB
SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
MD5 bc88b387cafa556068b5c5d6ff3ccc8f
SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
TLSH
T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\EJX\screen_retriever_windows_plugin.dll
Size 116KB
SHA256 446e9b8ac8900e406903c8c4d8c9210ae0aa31be8744fe5e9e6d759730a8a7b9
MD5 9472effe84cd6403ae0ab305f8be5223
SHA1 8ba279e53b196ab19d889fad1ad2abae41429ee9
SHA512 9808f642d8d5356da09534d53206258a9c07fc7fef77115700ba03f4500cac172ca35c94eca8e7c97d9da28a5428edb43c2baeee6406954725f25399d4f61046
SSDEEP 1536:QsILOR6ScJJsKeRcz06Z7xS+kZ3hhrSoqz1wKnqMp+eCRAySHvD:QDOcOw063KdGoqvqMp+eCRAys
TLSH
T122C33C2BF75940A7D26AC4B9C9438D46DB72B8914791A7CF57900A9B0F27BE84F3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\EJX\share_plus_plugin.dll
Size 131KB
SHA256 e20bec5a8d8b05a5d2995060c46ec266b9cc2a77ae178bf3c20b810530bf9dcd
MD5 c6e5851da56de6a6e3d74227a125c901
SHA1 397448c2e329b8fd9a00524fb96358916a82b210
SHA512 9a5d38637e88344364777c33d659ad930923caad2c87eddd0a5145662b1bdb7e583404a4f81d3b2f83c657174069129e66b53d4524d2f61bd925def45c3bc43e
SSDEEP 1536:gpNAti4ITRKMG6JtkxhIVoPv50ajBOGZhMfT4xAxYMUvRn5k6f/U/0e/5Qe+WP/M:gpNRqR6wuVoPvCajBOGZhMfT4xAxKz
TLSH
T1F4D32A2BBA2C40D7D12AA079C9438E45D772F8A74F9187CB27510B9F4E63BD84E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\EJX\tray_manager_plugin.dll
Size 105KB
SHA256 b9beb12012d0c9d0841550347e4ea46eb1f5d49b52199afca3c98464780d641d
MD5 117dd90405e9406360a60d84daa260eb
SHA1 e74bca2ee4426d2bdf6403d4fe89a3c539e477ba
SHA512 230b7f50f5343980c72c979d0815aa240d3e896679b9fc2813634b6efbc5951e344c5f2f65f0959a2643c5ed140954905d7cb56aa5028b5d61e33043bbf71855
SSDEEP 1536:X+aiLhJu6wZlP1fD3Uk6Relxh8CzockvuovpZJHCKPI0TPR:FiFwfD316UhPockvuovpZJHCKPIu
TLSH
T131B33C2BAA5D506BD26AC4BCCD534D45DBB2BC8547A1A7CF57800ADB0F27BE40E3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\EJX\url_launcher_windows_plugin.dll
Size 96KB
SHA256 0f7d384c3800ec97ef00e128ad8fa6b70c596d8302026a784f78ba437bd32a65
MD5 001d4dbc69de217a2cfbb50562fa340f
SHA1 e0f7f8449c2f26c8ebf0b40358d4bebf335e43f0
SHA512 56f44dc166f6a339525b0026fee217c63011a30e528676af7d853cb7c2466d67db34a6e8f4bc385188d7f1a5a3d3356002b946953f4d969c5bdf1faaac496ea8
SSDEEP 1536:9GpZR9r942MfYxKj2866rzCoFB22it9LBwdIBBaM8xVxiSjigb:9kfr942MQ86nxvhBsM8xVxiSj
TLSH
T19DA33A3BAB1D10ABD259D4BCCA534941DB72BC854791A7CF57A00ADB0F27BE44E3E602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\EJX\vcruntime140.dll
Size 121KB
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\EJX\vcruntime140_1.dll
Size 48KB
SHA256 1f2d41c4aa5db0bc33ebf7b66d72943a817d7ce6cbe880502a9403823633093f
MD5 cd1b08f4930b276ad78853580b76b5c6
SHA1 a0330279d3d0d47f19ed984726e25260b547a228
SHA512 6bcdd6b16d815d72dc7efd6a2352319ece102f3b7d85c648286e4b3b594b7670d61b7e05c580fc416421e1a1622b38737b1e90080171384e7e2cd5e37ac71225
SSDEEP 768:g3oZYctpzcx0pdESASv83Tw4DYEOMg9z7NONRds9zb:kc6wk3TgEqz7N6Rdkzb
TLSH
T140236BE4977C4082D8ABA870C1E6EE17BD38F7A61B10968B07A5D14C1E537D1AB3D31A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_ext_plugin.dll

Path C:\Program Files\EJX\window_ext_plugin.dll
Size 93KB
SHA256 4004f846e488ee9395b89402bde32bb3d97d6790dde4d6334531d214f252cf17
MD5 9332dabffcdb23f286fb874c3b21197a
SHA1 a7bb28b2ac70bf6ba1d0123e985acffdafe46328
SHA512 f0efb589289c123674eb0c4a236cbd0dff0206854a2bccb64d7507b99fad953f3ca8089bc687c4c85de490cc5656190bacab7a67ee30de3925e057ca7b308ac1
SSDEEP 1536:M3zsqXrQ66oTxLc9/wHqMJRIMpZdsCnJL5vhv:MxrF6Ge/YqMJRIMpZdsCnJL5J
TLSH
T1E6931A3BEA2940ABD21AC57DCA478945DB71BC954791A7CF57900ECB0F23BE80E3E611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\EJX\window_manager_plugin.dll
Size 127KB
SHA256 85b3364e5ffa00b5495e655e4cf1d0961c1fc73c524f8e55284f3ff62656d3aa
MD5 3d076be713fd6fecd0628eaad010ff7b
SHA1 e1d5dcffee99271e43bf7eaa0d3d83addac53fa1
SHA512 cac0569778c56d49e5dc8e015ec603a3148dfb6a22c08fea83959a776532e9134ba0652b75d4c1ffcb231d98299c44f324cd4a94bbb54af1b2db1086f61afb78
SSDEEP 3072:98CLcqRAAePnX6CQ9H0T9tP0QoPvpZJHJTeKtIS:6CgqRAAeP6CQUavpZJHJTeKtI
TLSH
T137D34D2BF75900ABD16AD4B8CD438946DF72B8854B91A7CF07904A9B1F27BE41F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ef5d25d-6f3b-45f0-842d-4af7e60df709.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0ef5d25d-6f3b-45f0-842d-4af7e60df709.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

60ae295f-c00f-429a-9eee-981406fbc78f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\60ae295f-c00f-429a-9eee-981406fbc78f.tmp
Size 414B
SHA256 bf812d4f3cfbb11fca97f5e39a03ca174ae187402ce5b55f98cec81055ae5760
MD5 84caa836736b579db4165e94aba13d61
SHA1 bd38cda300d9c14006747d71fb43e865055e0f2e
SHA512 4301f8e61cb934078dc5a0d3cce88cd1e8114c24116f1216f3f73af75aec9539a51789b8967330c8dab997f36ad3a223dfd28a0ce2a52814a3573b963bf18ba1
TLSH
T114E02BAECA61DC3718FD0B1CA0500749E65513473740888B7A3C85198FB423A478A85C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 40b9c718bc55b4838604e79c066f0af1634697bc130c61d8ae04f5c769ab3431
MD5 4a17c6a9f3d7bbb9db8e4ae8c2fff41c
SHA1 198e07ae5f1662425774c20f3c61c72cef0a5e05
SHA512 a213823ff5a7f30bde2e51de7e4aca258e640fc0784ff1c69b8d85501e7853f565c59355fba576b0d4b33037a680b12b8400ea8805cebd0a60f43cc419ce0dd1
TLSH
T164F06D65A24D1402EB9262B604D0D91533370B6499E7FECBB0B26AB491723DF80319C6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 563d60144892420264bca1c94e01a984d85494a97e6f6f9b04ce9df849a86222
MD5 21c8c9f734c5d8229b6e7492dd5b3401
SHA1 5177eff35be6b35c9c72f0a909adbd138ef343f0
SHA512 ffef84ee5598d28794442bbf10ab7298d22653c97ca87098fed79bd6d06bb38ec9837fab01f8acc882a56f8692d5181f539656fc39ae44a0872d6f4a62194162
TLSH
T1F1F09275A34C1442EB8272B645D0892537370F6489A7FEC7B0B26974A1323DF80228C7
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e19aa535efaf7efc90e4c033827fd7859c883b0eee0cab555cefbbcf15d1104c
MD5 843b5da91a4edf7c0cb685afe3e289bb
SHA1 071cb79f8818e08d269c3dd4311bde8f289794f6
SHA512 e0508667b05590b3800480a2e9ec6db49dec360e57f1b2ac57360123719ab8e8448957498a98bd32c3f589d732904be85eca76cd7512feccae281f6ee3ac6f4d
SSDEEP 96:DCy8N+paa7KskxdEbAaOBpD2ekJBTsDjhE4JEEMW:DCy88paa7KsadEbAvBpCeCBTsDjhE4Jd
TLSH
T1E1C190F7C3E4993DCD1192F4EA152E1FCE690A24536C3D66C8D4AF5B53E2872E20168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 94a5fcbc17dde8c3f8e4aa7f4a96cf588b00144d4d24719d8c04ea13a31858f2
MD5 684ce7678720110d31d82ab088467a95
SHA1 f852461820fd6a70611dbfec31373926f60ea7b6
SHA512 3a15c52ff07b4ce2d23dec8be293b8819cfbbc6027cfe6ff4395a839605a213e531bcbf5fdacfe49a967eed2d13b4ae21070c1cf466b7d190f5bb6427ef9aa98
SSDEEP 192:DCy88paa7KsadEbAvBpCenTsDjhE4JEMhP:DCy88paa7KsadEbAvBp5nTsDy4JEMhP
TLSH
T1A8D1A1F3C3E4993DCD1192F4EA152E1FCE690924536C3D66C8D4AF5B53E6872E20168E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 b3d012a3a77d3737d86540aebdbad9737189f314218dc0f3036e2c709e171fde
MD5 9197f2662ea399e0d440b38fcb9c1cff
SHA1 c9c6f61c2a50e1877b082b2bec7cce7d1599b121
SHA512 9f079f9bedef4dd54d5ee0460af4c6b0c770b83203bdc97a0ff9572f36fdd02b88f500918f547e2b1818993fb6f690bb1ad06939e45e0e42d7ca5542321415a2
SSDEEP 192:D0uUBsaa7KsVdEbAvBprmTsDjhntEK7TZArl:D0uUBsaa7KsVdEbAvBprmTsD5tEK7TZo
TLSH
T13FD18DF7C3E49D3D8D1191F4EB156E1FCE690924536C3D6AC8D4AE1B93E6872E20068E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 250af0d7ef3a2fdf2fc1ba9127e85cad6162ff9bd6d5a3f797d65cf5eb177884
MD5 54102d0076708ce269a304e5d340da65
SHA1 9477b1d5cc0e673cbfbb45614045da23d4c226cc
SHA512 2c2606baffbf68047cc971804df8256dacf7610bbf75bf23daca42898026c3f555a526744e4a0178f8950af9471bd7e7303d9a1c6270dd6ecc0691856e78d4cf
SSDEEP 96:D0uF+Zaa7KskadEbAaOBpD/kxTsDjhntEEZ78c7hW0EiEMW:D0uUZaa7KsVdEbAvBprmTsDjhntEK7TU
TLSH
T1FCC18FF7C3E49D3D8D1191F4EA152E1FCE690924536C3D6AC8D4AE1B97E6872E20068F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c1071fe0032af3ef1e163e74e68f03b9ef27cefdb7b9dd5a8f3b0aefdafc557b
MD5 81e328a3686176084d6c0938af9c80d2
SHA1 54dd88b5d31318d94d63e6617c6b7d1475faaab9
SHA512 5f9277da5985c74cf45c49247fec9b4918528578e356161d0ff3ae69d3916437dfe4636ab6e76a9e53500961c9e4380bd1a89114b842014bb2d78138f222a511
SSDEEP 48:YALlqxfqx5hxQbVE0WPbVrBJafo7XLsIW4sfWgmzsMWfslWostWKscyW+smWbAbn:DCy8N+paamOgt8S/skxdEbAaOBpD2ek9
TLSH
T12FB180F3C3E4993DC92192F4EA152E1FCE690924532C3D66C8D4AF5B57E6872E20078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 ab477ae80e7aea5df04005a8ee20ac0ae8a533f878caafaec40636694f387e18
MD5 b01ad89ca2816270b20a691dbfa73543
SHA1 7626f0067b5c9fca5342a2aa3dd6f9fd65189846
SHA512 3c7e18f0c0db07122e3fad38709ee341ebedcdc32d9e7ff9a7ac1c42457f5d36053028b7ed04cc312a043d09660e5067263077c308b4ba848f0296b9645a8d1d
TLSH
T1C911AFB7A23EB45715AD08FF1F40BC055CBAA43102826CF4CA5BC1ACB0C08B31702817
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f194529ff75b7612a2e0abf2f711c8ae46b6109477c0df3fc0ad9c462f044b97
MD5 81d7dc40c92d7b588871df809fab1173
SHA1 510469ff99bae04d11cf161dadff606964f4af1c
SHA512 ce00df3c7f38d44648b6edfcb5dc12d8fb2a119711e9758307bd419034e80dd54bfb1f1b85f7b9b73b5513f70db778e77d7a50d2f8e4c30cb081d6f6db5d8078
SSDEEP 192:WRr5P+LwcFv71hhAPRp2g92Hsb+WNnO10QT2CraWAKqVyIsnAUgtaJ:WRr5Wt1Bh8XDQwE022maSq8
TLSH
T16542D56EB910697B6DD7C31AFD267713D7F5202521E52E84E6FC8A2C08E75CD222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1ac0037b082408fb2417e0cd100e42939fc86a8fe5bc329b903b38356069ee9b
MD5 9b8f2ea1de28476dbb789872e31c8cfd
SHA1 9357ea546534daf98cb4667c2f7eb8961aeb83d4
SHA512 a515cf760ac5287c72b2d86eb62a79d6b9fc5fbccc37f70101b212ba67fd7ec7a050fd21f4c1c183a1eac0491e202a4047eaf803b1f05f614a4224f8f4149bc8
SSDEEP 192:mRr5X+LwIRv71hVuPRpsF3lJ92Hsb+WNNYEDy9iecj2iT2CraWAKxVyIsnAUgraJ:mRr5urBBhKXmQwF592c2maSXe
TLSH
T1F262D66FA9206A7B6DD7C32AF815B717D7F4202561E02D84E6FCCA1C05E76CD222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 60789449412107fa15fae06c8bb5c02192a7542e8bf1659058f88b7a2a4479e4
MD5 71a784035d9edfb24342000a89ff137c
SHA1 2c8281633611f0d7304dff1ce62d3db8a5066d98
SHA512 76a36ce29c297dcfbc56bcccb872c2ead489f5939f3f34e185ec90c2bf9191ae6a2cb0153375719a06fb3ed578ec4c8d883a8bd7cd01b5cb7dce18824694f3f5
SSDEEP 192:WRr5P+LwcKv71hpAPRp2g92Hsb+WNnO10QT2CraWAKqVyIsnAUgtaJ:WRr5WtGBhUXDQwE022maSq8
TLSH
T17F42C56EB910697B6CD7C31AFD267713C7F5202521E52E84E6FC8A2C18E75CD222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 8748787f475e5dddabace5a17db92e47734ac1f738a47198ec9b426e64b131a2
MD5 e953fe53a58ba4989530ede39e5d285e
SHA1 bb2a224850d10f1668e2cc813265323d4033ce99
SHA512 8b4d65b2f5fddc6a6d9102e0056779d9b4b5526af54da6b57b23e8df6031adf9da7d65691cb94b8ffb4f642e1f624debf5ef7484aeea88655b119f3b6b553ede
SSDEEP 192:WRr5P+LwnRv71hIAPRp2lJ92Hsb+WNnCpT9iWeT2CraWAKlVyIsnAUgraJ:WRr5WYBBhJXeQwEMWQ2maSTe
TLSH
T1FC52D52EB9106A7B6DD7D31AF9127B17D7F4202521E52E84E6FCCA1C18E75CD222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 52fb679c2dc2c91646f45d07f67aacc96a03b02a2013970526b0c63990a6033e
MD5 161f160966e24cbb7baf80db433ab7a1
SHA1 63692dabfecd64668d582318555172c2b2d971b5
SHA512 bbb93570e45e8e47f9a37bf3ba99d1e78f26397ba0911cf701584da190b7c3fe069da5d27ea3bf1cf876e7aad48dcacb6a6597d148f0a0b9c6b24f3b3a9954e3
SSDEEP 192:mRr5X+LwIwv71hVuPRpsF3lJ92HlDHsb+WNNYEDy9iecj2iT2CraWAKxVyIsnAUp:mRr5ursBhKXm+rwF592c2maSXe
TLSH
T10762D56FA9206A7B6DD7C32AF815BB17D7F4202561E02D84E6FCCA1C15E75CD222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3cd9a55ec4d3ccab82e4c0a1d41b0f7deb3cd64278568fa5a5a9999245c03e0a
MD5 362c99147d250d97a4448330aeadcc5b
SHA1 7528c42f2ba736255f3cd2fc0c447dcc0d269f90
SHA512 c657b2e0e4e68983c54798ea08323dacf49e4d8064753faa17acde006fe17e7c219584b2e2747b0c461c5d7dc3d6fce42d1186f3d6276d02e579565936c9250b
SSDEEP 192:WRr5P+LwFRv71hIAPRp2g92Hsb+WNnCptNT2CraWAKlVyIsnAUgraJ:WRr5WGBBhJXDQwEtV2maSTe
TLSH
T1D442E62EB9106A7BADD7D31AF9127B13D7F5202521E52E84E6FCCA1C05E75CD222B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 c54836683d23f9fee57c69a9d42002f448a01bbb5b6b38437c5fcac9744adcc4
MD5 97aacfb3977979cfbf9d8a6c4d36d689
SHA1 28c462804fa985bea43aac67e658ae60025ec226
SHA512 ac229055b177234c91f43061b9900ff41ba000713f4120fbf08cb18c16d47d484d5415a198c6f1896335d53e2a7e2f4dc407a06b90151f49d9994124c8990d05
SSDEEP 384:+wjKJ7KxkXqKf/pUZNCgVLH2HfgslU697pLuLcSjwxXODKh+ErU3wZJHG/A1YTPB:+0KJ7KxkXqKf/pUZNCgVLH2HfgsG697U
TLSH
T192720A676C488E770F94C68CEC177F4FADB5024B65E9886483FA982903D5BCF11462EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d389071732519524fd88ea263f4b366e2049e07ce097955d2df831fe4c19ac7d
MD5 988aa0a7a1a6f6b33f46cb6f2f3ea48c
SHA1 bf192db229b62f382c3481cfe0607e035d4544d2
SHA512 8980bbfca3fd7b0057c3ccc0df0be3e384c1b5cbb3444a5f981f2be05fdb1fa1fb67e35c7f21bba8c524f051ce5ca87aa02564d5db47bbfdac939827616ad6b6
TLSH
T19EB01261C401A201C40206F415C614C8B118AF209A0F1B0263E06D3788255518018060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5882b8.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5882b8.TMP
Size 96B
SHA256 502649f7684a5e28e55dc4a61648cd9e54b2f6aad5ebf88b9e597bb12d7b4798
MD5 ae9a7763284b07787e918b1e186f1cb1
SHA1 4362d4a2c39e54289e48664ccc58d99bfa2e4924
SHA512 e177370892a20a249624d6b22542597ad3aff8b47fbf2d451df990fa71d2454908aa2dd47c8efaf7bf107c5cda9b0a816fde81ab3a7da250e5231d7967745d90
TLSH
T1BFB0220BC0832203C00203B028C882E83020CF20CA030302B3E02BA2EC202208222030
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 294KB
SHA256 e71a1a22a85c4d5b07461ee93332b2418adb589814bfdeb1545a0a81dd73a46a
MD5 2aea767e4e34d2b6dfb377a1b427a570
SHA1 a61976d554563f847dc39ed1b467309821c09f2b
SHA512 ffc7bf97bf168060315171c72484b52a55830c67cc2775d44e923747a29a9c7893306e8f06c0d79fad2db2e6b03910aac75ec82b0275e5cc6290a5da0631977b
SSDEEP 6144:a6CLay2IFbhck6sr0vF191xGSD/itJVXYD5U13m7Rkm1tYpBeh2BAo+:anay2QmtF19rrD/KJNY61W9oBGcAo+
TLSH
T1A45412376D306D7B8AA4479870CB3A2A3DF18E73DA544CD591D86F08369F69C0E09E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 294KB
SHA256 b4729340b0493685205e04923ba8267a0f4fbea26b90a2d6a2e31ee4d34b6408
MD5 4582519afe42341559e3383c6a3755e2
SHA1 1ca25ea5d43c83274ea285d829416316f37e2a6d
SHA512 b8db7647ebe067e12b198040b9b10381040f8f849673afc26b044524d942179431e8436c4fef0c05804704c601322f2280c7066cdd3242ee6b99ab60f46d060a
SSDEEP 6144:26CLay2IFbhck6sr0vF191xGSD/itJVXYD5U13m7Rkm1tYpBeh2BAo+:2nay2QmtF19rrD/KJNY61W9oBGcAo+
TLSH
T1525412376D306D7B8AA4479870CB3A2A3DF18E73DA544C9691D87F08369F69C0E09E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f28cb29de87c52a928889aa72ea7333cb8a5681719cfa328b1c5b25511d42893
MD5 67b2cf512f459e9fc367c9b759701970
SHA1 07a1a9e20dd72b2526de1157073e628324d989bf
SHA512 00983298c21c3f6455e562f5bef95ffa64dd0635469072b4a8f6edef380742bc43b41d425a3e085a4f7daeff5805b36fc5cd4b840e45eddce2ee4c6eabb1f055
SSDEEP 3072:VGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM3:8m7Rkm1tYpBeh2BAo3
TLSH
T167C3122B5E71E9375D79AB4EB08E0B1F1EF14AA6C930DE92C8D85B0437E97CC0A45934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 ebcc52e6d29d87927b5ae1e28b171531ef62529c87731d001a7e889e8d3918e2
MD5 3851c26c45689593e62076d76e608b8b
SHA1 43c8cfb4ebde21774e20bf8892e8336deff92b35
SHA512 dc40a1f9c4cfc58f5df6b2de1c865ab55abeb5d2b9136561cd8d1a1d407d7146b0d387585e2e967cd5b8e8536c2a652b3b880a0bd0ab5078b0be3fe09f289c89
SSDEEP 6144:qbhck6sr0vF191xGSD/itJVXYD5U13m7Rkm1tYpBeh2BAo+:2mtF19rrD/KJNY61W9oBGcAo+
TLSH
T1733412177D30AD365AB44348318F2A1E3AF08973DB9459E2D1D9AF0C29EE78C4E09E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 294KB
SHA256 01bd53e117d762930a3d27ad917e76a5dd723f51ad0dfdf98884ee9926cf73e1
MD5 fe0a7119433bed2c5125e931fc16e1d8
SHA1 44e95a9034710d507bdc1467420d4e2ea9120861
SHA512 33653677a1fe9a8c4a32b265f111e4ec5fbf66e603888b180e857fb3ffe0fef2cade0b49583138f2275fd1e0cf5d344b774d291188d6bdc0f20e6b5e374884d4
SSDEEP 6144:e6CLay2IFbhck6sr0vF191xGSD/itJVXYD5U13m7Rkm1tYpBeh2BAo+:enay2QmtF19rrD/KJNY61W9oBGcAo+
TLSH
T1885412376D306D7B8AA4479870CB3A2A3DF18E73DA544C9591D86F08369F69C0E09E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 237KB
SHA256 303d0b9bbb87752c6a390d3591d09c483e7d9619d14302c61e4fb3e7b3609763
MD5 9fe107cfa3df0a9d3ae216e55ba4b4f0
SHA1 cf5467e256ff915f5b102563b5b5fa2be7ccaf00
SHA512 ef7f6c5170a5d2f787976d343d6418d56eb43872884db98c5d6d1b2d22d80836961a7a464d2a26ed9018783336a5bee91679a26214434e73d2a14d7698536ae7
SSDEEP 6144:Pbhck6sr0vF191xGSD/itJVXYD5U13m7Rkm1tYpBeh2BAo+:jmtF19rrD/KJNY61W9oBGcAo+
TLSH
T1783412177D30AD365AB44348318F2A1E3AF08973DB9459E2D1D9AF0C29EE78C4E09E35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ejx.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KQXB8DLBMQ.tmp\ejx.tmp
Size 4.1MB
SHA256 609c91716742ea5c214243e3749926e9dc1a5243394d567c9b827f02b721271f
MD5 15693b98f8b622cfcecc67f79522c59c
SHA1 67e44f8f9eed8c48df82b0b90c1f6d3530e0e09b
SHA512 3b07e2536a6d6260166ce5ecbafb84d8938c06afe149dba24c07f171ccd2a18a1fd49f49f8a84eb04d4ef5abdbb3602c3cf8de80067cc11ac2b35327c236de80
SSDEEP 98304:LYU5hnuOajWwMPdCpepI3GrwrA+Jr333w:FxuHjWfZIzw
TLSH
T168168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imagecache.dat

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\imagecache.dat
Size 32B
SHA256 177be5878d1e5fde974cbeb79a0e2ed640af3e9bf3e267468d69d89e98547b1c
MD5 4779c15c39aef933042c5a5b4bcea5b5
SHA1 aaa5de471964f37489184913d968844b167f8978
SHA512 8082e90a28a5414c8e4107173edc3bf1e040360b374ed58629dd9bfa5b486268db0a9c366b006a3cf40becbe0c872b29aa6e6ace8a4f860238305fca26cdc42d
MD5 SHA1 SHA512

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 620B
SHA256 d0fd91bb6dca8ec408ea24c39cc7f9e52f2ba52fe618017b59acde96c3d77683
MD5 87f918e10ed25c8de2f68d7a5ae76b29
SHA1 df036cdb603e47c270b99c5331bf472467aa778b
SHA512 2c6735573ef2883454b2cc6a0c43238469cfa1fce4b46b61ddd11979d967072be7e25d09e733e67e61a4bb5a631f9f9fd4f464d97ecac76b453eb3fbc330b911
TLSH
T111F0D19897B712E3800E98E29915DA2C88B4F59A3A4C89A0F31508AC134380B1FAF5BC
MD5 SHA1 SHA512 TLSH

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 1KB
SHA256 9ca9a1c3b1802c6c56a68bc33196202ede5d7b3d4242304aaa93ca1a981b4dda
MD5 ea94ec87e2ff2932992dc3e4ead0e071
SHA1 ec72954cbc6efa39ef2a38ebfb1b20cf3c8283e9
SHA512 f84f59ea7dea244b3c5d6a758ead0f60e845c471dc24c7299b6dafb3b1a9a6be3930f271918617f73dec3c0ab35442c3b98593d2eadcfe1daa1d8870ddcd6d85
TLSH
T15721E28545B322E6402E25D2DC36CBA884F1F5883A0C78E4B3944499E7D5C1F2EDFAA8
MD5 SHA1 SHA512 TLSH

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 1KB
SHA256 9f8c05e611b277ed51fbd170ab7b5dc019d03cac498400f079f2b813bdde2a71
MD5 aaacc79ecea8c8c5ec98ad4a66ab44ac
SHA1 6cbc789e10846d836acac26b92862a82a39e1a3f
SHA512 d9f019ce1709e8ba70fd5d815802a05b5fbac4c399d01bf1b52874903e2b2751fdf57789d04e2c5fa24b050a79512691bda0350ed12b6557ad8c38bba95f02ef
TLSH
T1E631E78545B322E6403E24D6DD36DBA8C4E1F688360C38F4B3944499E7D9C1F5EDFAA8
MD5 SHA1 SHA512 TLSH

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 1KB
SHA256 bca2ab102a89233af48aec6f71c6ee3b611026ac1493ffbd4af8e3f28c91016a
MD5 a34d0ecd192bc6ec102a200db39fbafe
SHA1 b675268d34d4b0cfa5d5fca081767b297f52e032
SHA512 ea420cf0098c837affa18523d4c4812ba40a29e73320521bd4ac7b863c45c85376397095353f691fe25242c6ae209e4deecf483142a8193ae7ae6a0c2749f979
TLSH
T12D41D88644B322E6407E24D6DD36DBA8C4E1F684250C38F4B3D44499A7D9C1F6EDFAA8
MD5 SHA1 SHA512 TLSH

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 2KB
SHA256 0d26fd50396053f9013618ef37efc188513de0381e8c6b8d3734fa842f57abaf
MD5 b24d0fc559cca5b38efd94e7dd6ae3e9
SHA1 2658015d09d148d4ded76b21d84810a634bfc8a2
SHA512 db06f80615c11cbaa94657996ab9b6256f0e6d4250bb3185092b4079a09fbcbf5a54acd90f3c271eb5900d51198309a207233d1d30406fe70453872654abbdd7
TLSH
T1CD5139C644B322E6503A24D2DC26DBA8C4F1F544260C38F0B3944959B7D9C1F6EEFAA8
MD5 SHA1 SHA512 TLSH

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 3KB
SHA256 d95e0c02fe7de554a36dd3159fddeee79781d2ab268171e3d59ea6a0f8ace474
MD5 33ed31f90e227ac665bfaf140ad08574
SHA1 8a4899bd246075d328b9419d1b759444880227db
SHA512 d5c08dfbf1d2ce08b23c5dbb5b3b02d6c4e4780483f2bb65f7cfcf72aa145fd83d6f22a97c7fb396022439649bc716a4e3880c0daf73699cbe3ecb2f1fffafdf
TLSH
T1F7717A8944B322F6513E14D6DD269B68C5F1F944260C38F0B7984998B7C5C0F6EEF9AC
MD5 SHA1 SHA512 TLSH

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 4KB
SHA256 0cc68c7ec05730f3d03961c2728490e4d9e94edaf8a8a675822ea8c8e7e6affd
MD5 387c9eede960581d926b62d26f74b82a
SHA1 ddde13fcaabec9363c61ed44497cb57c120e4d2b
SHA512 5018aab8cc1957a9212eefd40c420fc54a334547179969be47def119aa67e6c7256afdcfd25445afff909a1df8159e22e15b9e29c3957422f5878ea6419959d5
SSDEEP 48:AlugbySt5R5FFG/lt2s4jXN51Ni8t0jS/oGohFmLzboXCL4kbuwpB:AlFGYX5FFG6sa3PbPsFmLzOCL4kbuwpB
TLSH
T1E5819CD944A322F6512E18D5ED269B68C5F0F944220C38E0B7984D98B7C5C4F7EEF9AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ejx_2026-07-30_16-22-38.log

Path C:\Users\Admin\AppData\Roaming\com.ejx\home\logs\ejx_2026-07-30_16-22-38.log
Size 4KB
SHA256 bcf77c55185870fbab1c883b2c2e73dfe4d934ff0981daba9149754d82a6ecb0
MD5 b8bd99b51a267817082e8f41da76a444
SHA1 1626d51c6b6298d6cbdbb804971b59c618d05979
SHA512 abd21399254656c0c4983b398e6dea38980939486d4952e40155405830c20c261a9f0a45525c3572f264c792b9a4f21f24fc5f495676621db9702d46d521c59c
SSDEEP 96:AlFGYX5FFG6sa3PbPsFmLzOCL4kbuwpBXU4R3A8mQ:9YX5FFG9+8/kb9pBXbR3Aw
TLSH
T1E2A1AD99446323E6516E28D9DD22AA68C9F1B940220C3CE0B7994D5863C5C4F7FEF9AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.cat

Path C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\wintun.cat
Size 9KB
SHA256 8341392ff3ee5895c56ec900d56b1e7ebdfef4a1fafdd9265870b1e6e37c7946
MD5 c2e6e0c40e3af1a9cddd25ba17c9bb36
SHA1 d71050a78d0888dd670ad8fcafc8cc43d3ce344f
SHA512 bc13b18407eadbe093979aed924b2c07e90625db12bb32c13db035d429dfa831d65e1e27c2d603cf5c03d74a2a5f4dae25ce20a0ecc787d7d37a72b6f0cb9fd0
SSDEEP 192:/tWqfX2YCJCnXooyKfPFWQFqmsxWj21EhqnajKsLEg:FPCyrPFRMoqslGsYg
TLSH
T1D32208E289BC5483ED636DA043E8E5A7BC3D67C7281055B910DBF7A10D937C6E70942D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.sys

Path C:\Windows\System32\DriverStore\Temp\{3dcc9ae8-2b11-8d4e-add5-bb3b80d3a52a}\wintun.sys
Size 28KB
SHA256 1a7bb3555c5419befb1a5f54267dcae9a7af16749ddf4eef9b431fcf0b863110
MD5 43d91124fe8112d0027842824dad7326
SHA1 1e0dd7b0d0c0b880bf6864134d1e792e80e875fc
SHA512 6a51ad090239567052186e450425a026d15cb6870e3824d1d651f001107d8c20b8e4e4324026c155ada9b8e23e18a89dca794f8e17334a673b43af2b6619f8e0
SSDEEP 384:P1Bx5rLKocjGgMnwOpvoM4uEO8x02L4lfutekUJAP5mUFK+N+qL3orPFRXXlKqf:HDnwOloM4uF9fuUan+g3cbXn
TLSH
T1F2D26DD3E66C14C2E236C57682F1D9837D78B0721B12A2FF9550DA660EA7BC0D234936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wintun.inf

Path C:\Windows\Temp\971e1573115815450a607c60290a0337afb0886d8b3fb7f8a8063a1cad46e6cc\wintun.inf
Size 1KB
SHA256 0181e3af3e45efd36fa74de8245103c2c93ffc01e896dd4235f55d89e26d64b3
MD5 001c9ccc674d9d16dc371d075beeb05f
SHA1 ebe7fed368867bb40a3cca92a87457d765ed15ea
SHA512 8ad00678eb1428d4d0689500d675764a992b76332c1254a163d06614af268b75581b62db560a768f9a23562ba92a226eb01157c03af97875fa2994e8df115ae3
TLSH
T1413166D994E10D293CD3322D73277F82E55C223041D6201EB5BD8559D60BCDFA744CAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3312-0-0x0000000000AF0000-0x0000000000BCC000-memory.dmp

Download

memory/3312-41-0x0000000000AF0000-0x0000000000BCC000-memory.dmp

Download

memory/3664-254-0x0000019E0F010000-0x0000019E0F011000-memory.dmp

Download

memory/3664-924-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-504-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-436-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-415-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-794-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-1017-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-1014-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-261-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-250-0x0000019E0F000000-0x0000019E0F001000-memory.dmp

Download

memory/3664-828-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-839-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-1011-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-852-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-855-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-861-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-253-0x0000019E0F0E0000-0x0000019E0FBB9000-memory.dmp

Download

memory/3664-872-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-875-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-878-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-881-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-884-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-887-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-252-0x0000019E0F0E0000-0x0000019E0FBB9000-memory.dmp

Download

memory/3664-898-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-251-0x0000019E0F0E0000-0x0000019E0FBB9000-memory.dmp

Download

memory/3664-909-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-912-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-915-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-918-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-921-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-759-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-927-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-938-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-941-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-944-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-947-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-950-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-953-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-956-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-959-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-962-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-965-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-968-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-979-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-982-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-985-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-988-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-991-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-1008-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-1002-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3664-1005-0x0000019E0A0E0000-0x0000019E0B4F2000-memory.dmp

Download

memory/3824-238-0x0000000000C80000-0x00000000010B6000-memory.dmp

Download

memory/3824-248-0x0000000000C80000-0x00000000010B6000-memory.dmp

Download

memory/3824-53-0x0000000000C80000-0x00000000010B6000-memory.dmp

Download

memory/3824-54-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

Download

memory/3824-5-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

Download

memory/5636-589-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/5636-590-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/5636-588-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/5636-587-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/5636-592-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/5636-593-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/5636-591-0x0000000180000000-0x000000018006B000-memory.dmp

Download