Overview
overview
8Static
static
3Era Setup 3.0.9.exe
windows10-2004-x64
8Era Setup 3.0.9.exe
windows11-21h2-x64
8$PLUGINSDI...ry.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows11-21h2-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-21h2-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows11-21h2-x64
3Era V3.exe
windows10-2004-x64
7LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4d3dcompiler_47.dll
windows10-2004-x64
1dxcompiler.dll
windows10-2004-x64
1dxil.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1locales/th.ps1
windows10-2004-x64
3locales/th.ps1
windows11-21h2-x64
3resources/...li.exe
windows10-2004-x64
1resources/...li.exe
windows11-21h2-x64
1resources/...er.exe
windows10-2004-x64
1resources/...er.exe
windows11-21h2-x64
1resources/...or.dll
windows10-2004-x64
1resources/...or.dll
windows11-21h2-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3resources/...ker.js
windows10-2004-x64
3Analysis
- max time kernel
149s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/04/2026, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
Era Setup 3.0.9.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Era Setup 3.0.9.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Registry.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Registry.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SpiderBanner.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/WinShell.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
Era V3.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
LICENSES.chromium.html
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
LICENSES.chromium.html
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
dxcompiler.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
dxil.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ffmpeg.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
libEGL.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
libGLESv2.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
locales/th.ps1
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
locales/th.ps1
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral24
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
resources/app.asar.unpacked/node_modules/@sentry/cli/node_modules/@sentry/cli-win32-x64/bin/sentry-cli.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral26
Sample
resources/binaries/FortniteLauncher.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
resources/binaries/FortniteLauncher.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral28
Sample
resources/build/Release/dll_injector.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
resources/build/Release/dll_injector.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral30
Sample
resources/elevate.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
resources/elevate.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral32
Sample
resources/workers/diskWriterWorker.js
Resource
win10v2004-20260130-en
windows10-2004-x64
General
- Target Era V3.exe
- Size 201.1MB
- Sample260419-pmxzfaav2n
- SHA256 c9eeaa76c621ef3ddfbb67629f003f2525cca716284019bf846b0e62a069ff6b
- MD5 36164c7bf465ac9e8e699fc7d5b59a07
- SHA1 0b0689ea3d78f189e93b71cd7f5104eab41a799c
- SHA512 37b28c3da011bdaa3a0cadf06def3c7ab659481ce631bd7c89198df73da32c69b20c1378f3f3ec84017d96515bacf82d6e2a9cf9e5fce00e8eea1db46e83bd0e
- SSDEEP 1572864:NPfm31RV7UxMlZE9keIhkYLc7N49dEK+5Gof9IP554PxLom+gsT6BwLFFagWLmIR:xoba28xLL9516bAM
- TLSH T1E2A87B03E29A41D9E06DD175974A9633FE71B8094B24B2DF2B9407522F77EE42B3DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation Era V3.exe Key value queried \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation Era V3.exe - Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 Era V3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 Era V3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString Era V3.exe - Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\fluxapp\URL Protocol Era V3.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\fluxapp\ = "URL:fluxapp" Era V3.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\fluxapp\shell\open\command Era V3.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\fluxapp\shell Era V3.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\fluxapp\shell\open Era V3.exe Set value (str) \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\fluxapp\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Era V3.exe\" \"%1\"" Era V3.exe Key created \REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\fluxapp Era V3.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1180 Era V3.exe 1180 Era V3.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe Token: SeShutdownPrivilege 2984 Era V3.exe Token: SeCreatePagefilePrivilege 2984 Era V3.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2984 wrote to memory of 3032 2984 Era V3.exe 83 PID 2984 wrote to memory of 1444 2984 Era V3.exe 84 PID 2984 wrote to memory of 1444 2984 Era V3.exe 84 PID 2984 wrote to memory of 932 2984 Era V3.exe 85 PID 2984 wrote to memory of 4108 2984 Era V3.exe 86 PID 2984 wrote to memory of 4264 2984 Era V3.exe 88 PID 2984 wrote to memory of 416 2984 Era V3.exe 89 PID 416 wrote to memory of 4764 416 cmd.exe 91 PID 2984 wrote to memory of 1180 2984 Era V3.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe"1⤵
- Checks computer location settings
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\era /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\era\Crashpad --url=https://f.a.k/e --annotation=_productName=era --annotation=_version=3.0.9 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.1.1 --initial-client-data=0x508,0x52c,0x534,0x45c,0x538,0x7ff79cd92a4c,0x7ff79cd92a58,0x7ff79cd92a682⤵PID:3032
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,2837839063298014807,6991353812951047493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:22⤵PID:1444
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --field-trial-handle=1888,i,2837839063298014807,6991353812951047493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2224 /prefetch:32⤵PID:932
-
-
C:\Users\Admin\AppData\Local\Temp\resources\binaries\FortniteLauncher.exeC:\Users\Admin\AppData\Local\Temp\resources\binaries\FortniteLauncher.exe2⤵PID:4108
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --standard-schemes=app --secure-schemes=app,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=app,sentry-ipc --fetch-schemes=app,sentry-ipc --service-worker-schemes=app --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1888,i,2837839063298014807,6991353812951047493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2744 /prefetch:12⤵
- Checks computer location settings
PID:4264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed""2⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Windows\system32\reg.exereg query "HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64" /v "Installed"3⤵PID:4764
-
-
-
C:\Users\Admin\AppData\Local\Temp\Era V3.exe"C:\Users\Admin\AppData\Local\Temp\Era V3.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\era" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,2837839063298014807,6991353812951047493,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,WinDelaySpellcheckServiceInit --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=1064 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1180
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_1
- Size 264KB
- SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
- MD5 f50f89a0a91564d0b8a211f8921aa7de
- SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
- SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
- SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\era\GPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State
- Size 1KB
- SHA256 6435951fd0126e1421475801c38c1268a0016cda905c6aed98ce919c46f221f3
- MD5 7030cb5f019ed9adf8274ff637c37de9
- SHA1 c47fb58dee865c2aa0fe25ee13387e08ed64ef0a
- SHA512 f40ced918e45b0ae62cb69870bd0f257edb1ee7c7ae3336160152c0a69998158ab6aa25b1db66af8edb1cf63de14d120b864bb87299acc5f5e1088c7541be255
- TLSH T17E2184DAC7E8467D85B2A3F02B21B923C5AE051C032C3D0699D8DF8E67F1832824124E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\era\Network\Network Persistent State~RFe59867c.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\era\Session Storage\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512