Overview
overview
10Static
static
10Era Setup 1.0.106.exe
windows10-2004-x64
7Era Setup 1.0.106.exe
windows11-21h2-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3Era.exe
windows10-2004-x64
7LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4binaries/F...er.exe
windows10-2004-x64
1binaries/F...er.exe
windows11-21h2-x64
1binaries/vulcan.exe
windows10-2004-x64
1binaries/vulcan.exe
windows11-21h2-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...li.exe
windows10-2004-x64
1resources/...li.exe
windows11-21h2-x64
1resources/...me.dll
windows10-2004-x64
1resources/...me.dll
windows11-21h2-x64
1resources/...er.dll
windows10-2004-x64
1resources/...er.dll
windows11-21h2-x64
1resources/...dex.js
windows10-2004-x64
3resources/...dex.js
windows11-21h2-x64
3resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1Analysis
- max time kernel
79s - max time network
85s - platform
windows10-2004_x64 - resource
win10v2004-20250619-en - resource tags
arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system - submitted
18/07/2025, 22:27
Behavioral task
behavioral1
Sample
Era Setup 1.0.106.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Era Setup 1.0.106.exe
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20250502-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20250502-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
Era.exe
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
LICENSES.chromium.html
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
LICENSES.chromium.html
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
binaries/FortniteLauncher.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
binaries/FortniteLauncher.exe
Resource
win11-20250502-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
binaries/vulcan.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
binaries/vulcan.exe
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
d3dcompiler_47.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win10v2004-20250502-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/register-scheme/bin/win32-x64-130/register-scheme.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/register-scheme/bin/win32-x64-130/register-scheme.dll
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/app.asar.unpacked/node_modules/register-scheme/build/Release/register-protocol-handler.dll
Resource
win11-20250610-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
resources/app.asar.unpacked/node_modules/register-scheme/index.js
Resource
win10v2004-20250619-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/app.asar.unpacked/node_modules/register-scheme/index.js
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
resources/elevate.exe
Resource
win10v2004-20250610-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
resources/elevate.exe
Resource
win11-20250619-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
vk_swiftshader.dll
Resource
win10v2004-20250610-en
windows10-2004-x64
General
- Target Era.exe
- Size 180.2MB
- Sample250718-2dd67awqz6
- SHA256 0e6c9a16f7375ded598e0ff0fe4856c55f9082a6e124ffd7219a9ea8305f303f
- MD5 67b00b735e1ad2eb2726aaf39f3b4e56
- SHA1 92edda39a0707636be07296c73c0c447fbb37cbd
- SHA512 38642e771f6e4b2b2d9679742e7d87fa379835115a646306923ae116e42201f136ea66742cc81b0f58f98cb7625588ca3c8d3d948d56e904bd563ac5d9d2faff
- SSDEEP 1572864:+4SuXYuY8+xLxZu3Jidykta0iObusUd557Y8mn/XJjU0X+6s/na9ujx1JE+t8tT7:FWo3Cc1j9X
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation Era.exe Key value queried \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation Era.exe - Loads dropped DLL 2 IoCs
pid Process 4588 Era.exe 4588 Era.exe - Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Era.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Era.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Era.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Era.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Era.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Era.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Era.exe - Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\fluxapp\shell Era.exe Key created \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\fluxapp\shell\open Era.exe Set value (str) \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\fluxapp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Era.exe\" \"%1\"" Era.exe Key created \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\fluxapp Era.exe Set value (str) \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\fluxapp\URL Protocol Era.exe Set value (str) \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\fluxapp\ = "URL:fluxapp" Era.exe Key created \REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000_Classes\fluxapp\shell\open\command Era.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe Token: SeShutdownPrivilege 4588 Era.exe Token: SeCreatePagefilePrivilege 4588 Era.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4588 wrote to memory of 4036 4588 Era.exe 91 PID 4588 wrote to memory of 4036 4588 Era.exe 91 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4932 4588 Era.exe 93 PID 4588 wrote to memory of 4776 4588 Era.exe 94 PID 4588 wrote to memory of 4776 4588 Era.exe 94 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95 PID 4588 wrote to memory of 1096 4588 Era.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Era.exe"C:\Users\Admin\AppData\Local\Temp\Era.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exeC:\Users\Admin\AppData\Local\Temp\binaries\FortniteLauncher.exe2⤵PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\Era.exe"C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1944,i,7745335117496572742,9936262820981436560,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:22⤵PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\Era.exe"C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --field-trial-handle=2276,i,7745335117496572742,9936262820981436560,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:32⤵PID:4776
-
-
C:\Users\Admin\AppData\Local\Temp\Era.exe"C:\Users\Admin\AppData\Local\Temp\Era.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Era" --app-user-model-id=Era --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2652,i,7745335117496572742,9936262820981436560,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:12⤵
- Checks computer location settings
PID:1096
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""2⤵PID:1452
-
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"3⤵PID:3708
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\53da895f-ca0f-417e-9dae-ba1c68a36e8d.tmp.node
- Size 4.6MB
- SHA256 3d9f7f668c8d8226d1a6eddab4ece0eb43c58c7e29094ed0c61d9acf6605b719
- MD5 c319438eeed81f8f12bcc325252348a4
- SHA1 7a8dd7f4433b227dfd67180ae78308f3fe0064c8
- SHA512 974cf5a030682a2b51c1d66cc81372654abc5cadb826c74b4a30151adba9981c1b39187bfeff55111347fe2d8a6e999bc57bcb71722e423707bf334b440ce914
- SSDEEP 49152:cGtlq03IU6i1VwASOQlzK/zvA4S4yWue6qnE15+LmuLFj0PW12X7jUZc3zCkNRwH:++itKU77SE1M2PW11ZyCUR7OsICy
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\f95ffedc-854c-4c53-acf9-aaf95f17ca0e.tmp.node
- Size 100KB
- SHA256 c5929bdd422d0277427b99b20b6f5f6adeed09a72d58c8399511785a647b005c
- MD5 235a20d88e14e066518b5ff6644b258b
- SHA1 5cc4870a4432e0c2bfa66bbc4f9cdab9cf329b1d
- SHA512 856016b8530ae1b5d651d5e4c3123e5b4f023af436c929512a876a2bc58c15e3cfed7f40b6b907a72a2a7c80bf0d386a8fce9090b73d36fc873420aed63c5376
- SSDEEP 3072:Gf0c2iqOi/j0P8AmXW+tD1t9NK7i33Y7aM2WH/C:F/iqPrW8AmGVzf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State
- Size 676B
- SHA256 f9d1e17d2ad25837059e22f2f1fed438f4ea6b2578fba114555da658cc57b4e4
- MD5 4a24a040a9e73a830d06680dd566a899
- SHA1 da1b5c9e2a351c98b16640e65a8c1c54ba8e81cd
- SHA512 3b9c2d6c46054478c0dbe9f36cf08e020238e00089d9c2f69ef895034260d1fd70d2996f0b04376d05f6f41dbbceac72fd5254024f30029d3830e1f52ffedbcf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Era\Network\Network Persistent State~RFe58ad14.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512