1c0cfd2df682cd04b36c2f800d26885cddb2584e2f9ccfa524b5361d7da5e1f0

Analysis

max time kernel
152s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup_AccountManager.exe
Size

356.5MB
MD5

ee89d9c23cbd9e3d95186b63036590ba
SHA1

0c6e60760615292071992df7e1798857ea543de3
SHA256

1c0cfd2df682cd04b36c2f800d26885cddb2584e2f9ccfa524b5361d7da5e1f0
SHA512

2c7fee89a07e45610d4130741325890adb21d55d521670af88e4adb7cfd3ca0b4fa4de5ae61de348b3538815146c673abecaf88e8d20f0128fbd5df672280823
SSDEEP

6291456:kNMAmoa+1xzdLEv/440fyFnyEZ6tZF/sGuNJzO1eNaLtA22s1V1WbauWsrxc1:sNmopxzdLEYrKn+PF/AJzO1JLUgV1gWX

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	AccountsManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	AccountsManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	AccountsManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	AccountsManager.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\International\Geo\Nation	Update.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smartproxy.exe	AccountsManager.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\smartproxy.exe	AccountsManager.exe

Executes dropped EXE 12 IoCs

pid	Process
4828	Update.exe
760	Squirrel.exe
2080	AccountsManager.exe
1640	Update.exe
1864	AccountsManager.exe
1880	AccountsManager.exe
3844	AccountsManager.exe
1644	AccountsManager.exe
5076	AccountsManager.exe
960	AccountsManager.exe
1232	AccountsManager.exe
2588	AccountsManager.exe

Loads dropped DLL 15 IoCs

pid	Process
2080	AccountsManager.exe
1864	AccountsManager.exe
1880	AccountsManager.exe
1864	AccountsManager.exe
1864	AccountsManager.exe
1864	AccountsManager.exe
3844	AccountsManager.exe
1644	AccountsManager.exe
5076	AccountsManager.exe
1232	AccountsManager.exe
960	AccountsManager.exe
5076	AccountsManager.exe
5076	AccountsManager.exe
5076	AccountsManager.exe
2588	AccountsManager.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
34	raw.githubusercontent.com
35	raw.githubusercontent.com

Password Policy Discovery 1 TTPs
Attempt to access detailed information about the password policy used within an enterprise network.
discovery

Password Policy Discovery
T1201
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup_AccountManager.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	AccountsManager.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	AccountsManager.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	AccountsManager.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1880	AccountsManager.exe
1880	AccountsManager.exe
3844	AccountsManager.exe
3844	AccountsManager.exe
4828	Update.exe
4828	Update.exe
1232	AccountsManager.exe
1232	AccountsManager.exe
960	AccountsManager.exe
960	AccountsManager.exe
2588	AccountsManager.exe
2588	AccountsManager.exe
2588	AccountsManager.exe
2588	AccountsManager.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2080	AccountsManager.exe
Token: SeCreatePagefilePrivilege	2080	AccountsManager.exe
Token: SeShutdownPrivilege	2080	AccountsManager.exe
Token: SeCreatePagefilePrivilege	2080	AccountsManager.exe
Token: SeDebugPrivilege	4828	Update.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe
Token: SeCreatePagefilePrivilege	1644	AccountsManager.exe
Token: SeShutdownPrivilege	1644	AccountsManager.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4828	Update.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4828	4888	Setup_AccountManager.exe	92
PID 4888 wrote to memory of 4828	4888	Setup_AccountManager.exe	92
PID 4828 wrote to memory of 760	4828	Update.exe	96
PID 4828 wrote to memory of 760	4828	Update.exe	96
PID 4828 wrote to memory of 2080	4828	Update.exe	97
PID 4828 wrote to memory of 2080	4828	Update.exe	97
PID 2080 wrote to memory of 1640	2080	AccountsManager.exe	98
PID 2080 wrote to memory of 1640	2080	AccountsManager.exe	98
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1864	2080	AccountsManager.exe	99
PID 2080 wrote to memory of 1880	2080	AccountsManager.exe	100
PID 2080 wrote to memory of 1880	2080	AccountsManager.exe	100
PID 2080 wrote to memory of 3844	2080	AccountsManager.exe	101
PID 2080 wrote to memory of 3844	2080	AccountsManager.exe	101
PID 4828 wrote to memory of 1644	4828	Update.exe	103
PID 4828 wrote to memory of 1644	4828	Update.exe	103
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105
PID 1644 wrote to memory of 5076	1644	AccountsManager.exe	105

C:\Users\Admin\AppData\Local\Temp\Setup_AccountManager.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_AccountManager.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\Squirrel.exe
    "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:760
- - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
    "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --squirrel-install 1.0.0
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\AccountsManager\Update.exe
      C:\Users\Admin\AppData\Local\AccountsManager\Update.exe --createShortcut AccountsManager.exe
      4⤵
      Executes dropped EXE
      PID:1640
  - - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
      "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountsManager" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1964,7137675837975754421,4940812348039137288,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1864
  - - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
      "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountsManager" --mojo-platform-channel-handle=2228 --field-trial-handle=1964,7137675837975754421,4940812348039137288,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1880
  - - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
      "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountsManager" --app-user-model-id=com.squirrel.AccountsManager.AccountsManager --app-path="C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2456 --field-trial-handle=1964,7137675837975754421,4940812348039137288,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3844
- - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
    "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --squirrel-firstrun
    3⤵
    - Checks computer location settings
    - Drops startup file
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1644
  - - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
      "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountsManager" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1884,11928056854881466573,15632348319753028173,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5076
  - - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
      "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountsManager" --mojo-platform-channel-handle=2148 --field-trial-handle=1884,11928056854881466573,15632348319753028173,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1232
  - - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
      "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountsManager" --app-user-model-id=com.squirrel.AccountsManager.AccountsManager --app-path="C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2360 --field-trial-handle=1884,11928056854881466573,15632348319753028173,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:960
  - - C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe
      "C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\AccountsManager.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\AccountsManager" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2588 --field-trial-handle=1884,11928056854881466573,15632348319753028173,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Password Policy Discovery

T1201

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\ffmpeg.dll

Filesize
2.6MB

MD5
12cb29b61007fd6cd166882635241038

SHA1
31bacefd2d7238fb5ac77f728bb39a27b400dbb0

SHA256
2e60bc5a05d3e98d12d2bd577d63b6dc77bd1b3734633259fcaf50fa3688ca9c

SHA512
cbfab7708a01fe47904facfdf9604025d6f1c680e40ada0b4c1b1ef35a4eab7de5de96c22d0491c6d202175d2c66693216efab6cfab73e316d466811d834b126

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\icudtl.dat

Filesize
9.8MB

MD5
599c39d9adb88686c4585b15fb745c0e

SHA1
2215eb6299aa18e87db21f686b08695a5199f4e2

SHA256
c5f82843420fa9d144e006b48d59ba7ef95f7e6cb1ea95b27fcdd2c97f850859

SHA512
16194186a8407b29f799d4b02f5674e4fbd5d91163fad9f8dce6ceedd865b754a681aa960d0f3f1b62cb21d5443879f1b8e9b691c19c5802d5bdfe4ed645b8bc

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\index.js

Filesize
259KB

MD5
1b82ec6e0d006366a98285505b3e512d

SHA1
863282e319d2016a1bbd9a208ace0928735bd199

SHA256
21de0638c0a2c24c78ed515112d45ccf814c49c7fba4471aefdbb0cf1ff444c7

SHA512
0dd724d94506ec6c8ba6972fb28c68306ff88525292e06ce7228d376b6adc168b0ebf6633504d97f6f707571e1fe88e51c60433f8295165d22e7bd71377cdb53

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\@remusao\smaz-compress\dist\cjs\tsconfig.tsbuildinfo

Filesize
52KB

MD5
41a45079f559af456e23afa3ef8a1ea9

SHA1
b8c2705605aefac42e772ccc5fd31ab585642a80

SHA256
ca7d47ebb704eb21bc24a06d8fb8321bf8f4cd4c15a339300816b31f64cb5765

SHA512
1098a4039cb0658e4d182d0d4a86180c7790361eeef7761b1e30bff421dbc1a6ef20edf4908232d15db2089e79129cf71711d6c6568449b6e80e232d9a2aa3d0

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\@remusao\smaz\LICENSE

Filesize
16KB

MD5
9741c346eef56131163e13b9db1241b3

SHA1
d22157abc0fc0b4ae96380c09528e23cf77290a9

SHA256
1f256ecad192880510e84ad60474eab7589218784b9a50bc7ceee34c2b91f1d5

SHA512
c1e3a0c8f5267fb5c0b65733bda037c62d914ed989bee0f510d8196b1029eec00d40f415ce1514a4996d420ba02d856d04db0915b64573ef4a36033cc5efb94e

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\@remusao\smaz\dist\types\index.test.d.ts

Filesize
56B

MD5
f8469276f1264d196b57131905d8bf80

SHA1
3abdb41a8878115e1d1d68931b619022354b5f68

SHA256
ce1a1fae9216be8fc02e7e53b209f0d929e37d96ba944b961fc3febbd3fd31bc

SHA512
ff485b7274e033ba3befa7b01101631e9e98f4931c49cb32ae9ee8b9c2bfb02da56df7d461919c3da9953f8994ded11cc34f14bdfcc33cee6cbc985d529f5b98

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\@remusao\trie\dist\types\index.test.d.ts.map

Filesize
132B

MD5
64e15e31fc4311ba4a78164e63f16cf1

SHA1
fd1dbcdf31fd2ca6d3009b025a6a889c5a722a16

SHA256
d03f4254ac4181f760474e07d7688a0ae8229b6fd79dd62c5306f3f231ad86fd

SHA512
7895d0a342699f17909f25b0aa67f4ba1907598e46ac2408013367b26adc98bab33b2fb20842fa04be5469894115f95f594794d2d53d11421ece5335596d0498

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\@types\firefox-webext-browser\LICENSE

Filesize
1KB

MD5
d4a904ca135bb7bc912156fee12726f0

SHA1
689ec0681815ecc32bee639c68e7740add7bd301

SHA256
c2cfccb812fe482101a8f04597dfc5a9991a6b2748266c47ac91b6a5aae15383

SHA512
1d0688424f69c0e7322aeb720e4e28d9af3b5a7a2dc18b8b198156e377a61a6e05bc824528fca0f8e61ac39b137a028029ff82e5229ad400a3cc22e2bdb687ad

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\centra\createRequest.js

Filesize
135B

MD5
c6c57e7e14ff867875999036b23fcec8

SHA1
81b7193bea5cefbab1c10c37c239f1d608f7b75c

SHA256
f87c280c07e44813d58dd1631d978f21e9f4ef826f9da8dcfbabd53eaf9bb760

SHA512
cee39de3b7b799df01efc985eae9d5c757552053101df0c59cbfbc08b5434a03e602ded5d22dc58b81765ddf380ab76fdcf36901958028d7e8b59ff20197ee6b

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\centra\model\CentraRequest.js

Filesize
4KB

MD5
4aff968a9acd5b42f7e5cb39d679dde6

SHA1
ae2089454d21dc462a4bf19c2c62d7487dccc568

SHA256
954a20d6bc3b449cd9ee53c820d468de543ae5885c5f184b3f852a48c9bd4b81

SHA512
cb2e58b762a5c51d10a39a558dc4d77867930dbdf93b93897e09a5fe0787a70e7cd2db9c2c296114dcfdd25c2e1fcf513fb0660222cb02f122dfa4bcc5339431

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\centra\model\CentraResponse.js

Filesize
434B

MD5
d6fc31ecc270927ee7ed2e038bd6df77

SHA1
bb58c6b64aa875e6fde2ecab7071aa74982303bf

SHA256
fc7abf7b23b9ad08af0c8da405468582cfe5260d14cf57ec03f706579ce31943

SHA512
c8ff80edb2a550436198ff2ce086ce846e19be005902223ff21c6db11385d27f3e59c12017be7d567b17e648aed429cf0a89a4239f167f5b7b866c4247d47ea1

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\centra\package.json

Filesize
684B

MD5
ccd391710fadadc8783282d6c7551443

SHA1
08abb1baf50e480324f60cc8511712b72df66d47

SHA256
daf8c84da668893e4359a9b92ca3f0cedd80c7ef053adb4abb380a15e177a1da

SHA512
3202a80c8691d6f58fb7650bd096eb430c054a5ca58d1a2115bfe0629d95d95f711e021239ac358db010bf88292c3d7fead378142bf97dff5791a10b28987131

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\chromium-bidi\lib\cjs\utils\processingQueue.spec.d.ts

Filesize
647B

MD5
5fc9c648a57bff2ad3b3ed383260152f

SHA1
f68c5aca338c12309074dba721266cc9f71dfa8f

SHA256
66988394218ee2fdd24aaa8320767168ebe9a6563ade0d0445c52c64e8f7e76a

SHA512
7f40cd99124726587e8400459dd5421da137f23b57f4de564b254b4eb6c919d03eb174061483bf0e3de805da887ba8df772f203738ea0d8b9db0b7fdd87d7f84

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\debug\package.json

Filesize
1KB

MD5
2630a1ac039c8970c8fb0daf0f2f03c4

SHA1
ed6fe3dcf77a4c2ddadde904c5b1fc47cf9893c7

SHA256
754ba4f352a9b983fbbf93cfffe015d29bc789a08eb05815270abf50902697fb

SHA512
a017d21a1ecb159065bc32b94b38de03b38c10448b85f88bfe1498b144320884d612a868b9db192d6acf041f88da415f953d9dd8541ee29e4053e2463dd54791

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\debug\src\common.js

Filesize
6KB

MD5
28e94a3cc7d081498bea5ced383038f6

SHA1
c9707394c09387b56864a8865158d29fd307774a

SHA256
c65bff44c189188e0c45afdbd9b02c427ff5c6e54b94da53c102fbb7a53f0e37

SHA512
5775d4c9b823dc9514488a28f2bfcba990a13defdfc5992e1ffec915ca5e6ec2ba87bddb1cb7f4b772345a14b4041f98a74f7bcc9d9be2a3371e3002c33bbebc

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\debug\src\index.js

Filesize
314B

MD5
d6c53f5a0dd8f256d91210ad530a2f3e

SHA1
0f4ce3b10eff761f099ac75593f7e05b149ae695

SHA256
aa127ff1752b7d9c7415c5c7bb6994d9aa722b81bcbcab4bd48316b013d23bf3

SHA512
4faa874d9d862ffc921528742c4f1fe8a9b22a358760f6e93fcef138523575329a801ce9659ed8e96b02b73e581b3e99d91973e22981b358ffb5e43103a536c2

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\debug\src\node.js

Filesize
4KB

MD5
6e63fda079262f01e14f03bdf77146c0

SHA1
481608e3c95722f3a474336e5b777a6a521e76f9

SHA256
f237adcb52849de7c128f57e0468b52353c529a6c8341810477c0e7144359559

SHA512
3017b4717118f56fac106dcaa046aecf3cc63c37e64f49838e5379a13583c293f39ec5ace48fb2dabeac6af4a967f96219812733ead6f36c3f5c8d132d795900

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\deepmerge\dist\cjs.js

Filesize
3KB

MD5
1b80adba78b303ce0dacadeafb93d537

SHA1
30a374f658500f10d214d0c1b0aab81773cb6582

SHA256
2e5160f84a1141bd927264afe4d15766f1e6cf07daef182b37ff53fea121de7d

SHA512
e306217e89f871818a83f40857758890b736346395bce88d1c1d00445d6d937b639933ef51dee487f97bd3e46ac2e93694e565761968195b109e96ada1184461

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\deepmerge\package.json

Filesize
1KB

MD5
c205b1bc82eca22861a935e879251c74

SHA1
430df8e247f32c97946d9ff93511ef0af565602d

SHA256
f56978e7a6da1a3c6edee41abb54f98584a2fa2680458c48db820ae772fef0c9

SHA512
b2db5781e9cc0818255e2c869d02d1998b8273979befd52ac32ab60a91da0f9e056fdd775cec8433b9951b5831333259c0be35fa8bd353668e31178f3acbe497

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\has-flag\index.js

Filesize
320B

MD5
a5a0a76afed750bf24321951974305f9

SHA1
73ee55646b931a37ef3b38fd6d22cd56332d6724

SHA256
dc0f89bdb136779f9ec062e0a2963a3ec89f45731eec9e8028907ae9f9e9034d

SHA512
d42fda4cca34a77bb02a183f9cd79452c033763d1af0f011adf19499595dd57a4a60d0544f56920198ef6b89c129801e4d4b4f70f61c91039305fa90e9155e08

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\has-flag\package.json

Filesize
710B

MD5
73cc8d1e96c19ce85a7abb8f9468a86c

SHA1
0a61b7395724eb79396b1cef110a74565de5ea88

SHA256
5f786f6d16a53e7171fda89adc83bbd9c07fc17fb9de7ea78431283972593984

SHA512
ff8736dbb05083174d32a44600ab396566a32e55b37564db6f6f477c0c364091e00cebcd309248112dbe0d64e1c59ab917c2bcd675886db2593e90d839edd3f2

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\ms\index.js

Filesize
2KB

MD5
fddcc2097091479666d0865c176d6615

SHA1
55f9b3a7d4cfbf68b19ccd0d698aa86483dd4694

SHA256
55986972f5f3c9446f876c576e1cd30fd4f04cd26527efbb5ad834637c740e4c

SHA512
252644169a9398527927b69a2f19c6578bd62dcd180b94984d991939f53bf4e77ca687e840db42f7dba3b37124a5e3f3eda83535e75491bbe6ca440a7149913f

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\ms\package.json

Filesize
705B

MD5
b3ea7267a23f72028e774742792b114a

SHA1
fe112804e727b4f3489e9a52900349d0a4ed302c

SHA256
3708fd273bf5b1e91c72d88143f48ad962adcc10b99250a4a203d13804f37757

SHA512
01975d65bc491d0b39435d793a62bcdba6b5edf4fb886de0e48a8a393e26fdf31bdfb4f91dd7e10ba69a1e62ed091d5ea04f9f8bf57d784c3491a5c5c8472988

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\parent-module\license

Filesize
1KB

MD5
915042b5df33c31a6db2b37eadaa00e3

SHA1
5aaf48196ddd4d007a3067aa7f30303ca8e4b29c

SHA256
48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0

SHA512
9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\phin\lib\phin.js

Filesize
3KB

MD5
de19c169e624ad0baf42a3649773b1ea

SHA1
b3ae87e9d7546ea3f360d11d54b3897bbff54ae1

SHA256
15ba4dc495648710c5717c1b0d33df2d8900617e0f6966bc0c1405a87af15600

SHA512
927e4368f6d2294335c593cddab0880caaaf9977c26ba4d9b6598326393fa92d59d4b67b13ed70f314ca603967fec7fa49e97c64417c3e2aeac96583951cd2f1

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\phin\package.json

Filesize
908B

MD5
023a4677579f5d225b07af1bec46305d

SHA1
cf7aa9eb7ac9c9dc0b7dd2ebc50a1887ead4522a

SHA256
7034dcc60b150c6d10e442c9f8f74f6c843dc59fec92b7d50da76a6a600b8a09

SHA512
5855980d4036647b39b829a53e20b1d251baf78fa893d0c4c4df1517b2babaa58bfc896eca1db89ed3f0c572e90a38bbddc01d3d3bbc0cdc1a43760dc480ff03

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\Browser.js

Filesize
7KB

MD5
8875c7143d7b9e6d0242ffbf5b294b12

SHA1
efccfe3414b671a36257fed6b64b159420ac3e81

SHA256
a9d0ee870b3bc0c1e1fe8dcc4993d07975372d9fdbd05b197e6cebef8f14acc5

SHA512
a042d0fb8e525926fb192d2d192f451871aa8730be0b5224e7b3f07cd5ddfaf41dcff3d887f56220ff9996fe939f1c713f73417a4430d13fc9ecb1adf2c0caaa

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\BrowserContext.js

Filesize
4KB

MD5
a7b300650f0cac58cdb30c3996b8dab5

SHA1
1e57c59d2238886770a1fc158a8825de05f78dc5

SHA256
e68462b04e40f5d52a7999d5e37a384b3a5ab4976f58e9070dd2da506614648b

SHA512
07c3948f6ca49d1e0bf64acf1b651663acdf68a58790446ffaaa3de4d5b480cc65c00a97a1701bfa993c59e4959e773a46a8b5ecf969d950b0a8b88541c2ed3c

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\ElementHandle.js

Filesize
6KB

MD5
a953e5bbc9fc1cdfe1aadcb0920f202f

SHA1
56ae6e266869060eb66fd14e20aa67e699f99672

SHA256
ef63bc452522d49bd762948d0120372eb6e286f86a1dee9db369f0a5e9d99c05

SHA512
a194af5576b7a8451dcda525d261c360f37dae493847db59f0f6f4225ea53c915d8c91978d7458cb19007219c49d7835a92b798a2288c199843272be74450bae

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\HTTPRequest.js

Filesize
10KB

MD5
a7086b3f9c28850ddcfba2f63b9e2bed

SHA1
0e88a6b5a65f2aa131b2965465e5d924f7e0b581

SHA256
0ae98c5fb2c4c39cd4b9be5efa25f8c4d321d21b76004ee91e711b1ffee098c6

SHA512
5af5a687e85c8a2789eea47d68e7a54dcc481041c72d7463ca688d8f4d1bacec3246dd873819365967a67fe51d8cbf89a9eb9cbcc7850671bdfef158bd67d7b1

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\HTTPResponse.js

Filesize
3KB

MD5
b811292aad5df24f447fe7bc84f1d4de

SHA1
b36dbd59323cb8af8c985c127bb0b907b265577e

SHA256
fc7b8ca44fa22fd1bbc8f3711cc27f2de7ee980caeec7cb12b09cb7a3983ac00

SHA512
12245e5bff1c559fdfc2d6b488b7be23dc64dda11929d5db0644f780937a7dbb2dee4ad98b472628b80e0aee1fe09cff2a0716a7014d1b8ee0e8b0e4b364d05d

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\JSHandle.js

Filesize
3KB

MD5
543edc73b8c2b6f1b0014a5eaaa69613

SHA1
f28184b7ba73dc846f5775c2078f0bd3af4b4c43

SHA256
bb8177483fa444f98d699f2c83615d89556faba92cba6330d47c7bc2fb93dbe3

SHA512
4d140b86d8833ec528477ca50560629581cf76e07c2dbdb71470f199527d4a955e34b726ea52854b82d80f0c0e5faf597bcb8be53d81bb4724b1d08a8e762f76

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\Page.js

Filesize
14KB

MD5
ab06cd017e3d80c43aad611597487801

SHA1
7062f4a66cec372d9a407be957934cf38ebcd77b

SHA256
ef67cdf482c3e6cddce9fd40d99ac2c44a2f583dc5a352e87d7e902125e0b7c0

SHA512
0c565d5aae35d30606cc8606bfb003b06295c2f7aa60ea6048933ff48c844930ae862b1077dd42eef0f5739ce18406d9316e175da3508027b91fc65e43bf15a7

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\api\api.js

Filesize
1KB

MD5
decaf0d0eac9efa53c2aecd35328c1d8

SHA1
22f20b14618f371d56f8d032e8752f21edc0768c

SHA256
2bc062326375005b589b70d8baec1009a1a98da06271929fe8f07719b2805a83

SHA512
061607263501cc5a3cfc8f2d928ac7736dd1c2719fee393ebcedfc0c3ef1e52fb347733cfc11a4270e48560e63b348555117e975a4132a165b226a8a68574643

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\Accessibility.js

Filesize
17KB

MD5
1bcfc1147e3572fbff41437c11a3f7ef

SHA1
ff96ab6b2bb3b3df789eecfe1393dab86075aa38

SHA256
e9fdf3fec580d6d8bfc6c85d668afc933509df8baa82dd6782ba1032139d199a

SHA512
1d15ab64e42a7c1843a917ee263c972e9d73d4c087f85bd9a5df4eb9a25fb25eaf6b2447d158c46c7ddff1ab82be642f8ba1e9c3f7be76fd2e6f28d381ff3bf8

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\AriaQueryHandler.js

Filesize
3KB

MD5
67f2edc45dbda8adaad1188b0b6ce7f0

SHA1
868b6cb3b1ee07938dcaac4dd56ee8fd4b28af35

SHA256
29ddcb97e7385ac88c7dbbb69f70ff89bacf0d858ece7b7af029ef1eb40e5552

SHA512
480951f7bbf848d51422f623f43ef93852dd56d50cee6adebe40b7e5384e01e20a62d5a050b0621e4f46d260a04defbbb4bf8c1694a154b15f2a3bbe16c68042

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\Browser.js

Filesize
27KB

MD5
3b639c92cd43ea1be165d0bdab2e97d8

SHA1
e3ddbcdfe61d1088c326e16ae89b5a4eecea3d22

SHA256
d87b52dff37390db6aaf4b9a11f9daa356b0b35a7601a52ea27577ca925b6eed

SHA512
1790ab6cdefca0c6e0eedf19ef5308548171481eb091ee10f99fd8b410baf05e6dd284c33052cca55cc5044bd8ba9bd3c5df645e3d7c1ea8019d72d2cc3278f7

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\ChromeTargetManager.js

Filesize
23KB

MD5
67e00962344ef52895295936ca1bab29

SHA1
91dd5fb1ae9ebdf92482d102c90fb3735a8da341

SHA256
8bd611eedb361a68b959faa061f9ae4c39c4ba3539c91efae58601d7cec3f9ae

SHA512
30b07bb8f8243667f595f17cfc1a952201a6b5c5e6d1dd610cd0a16e2be5734a4f5b9a0094b182c6e2297cd3230950ffe8ba579f33371ecb1553c7a44292e7a9

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\Connection.js

Filesize
20KB

MD5
b2d4dcd014149044cfcf181385eb1ffe

SHA1
f5bccd6747fd23f707cc0bd5d9fb5c915374ba0c

SHA256
5a2b815bb1d162721cee89c850d9d65459fc0f433522350f0f518a6a7825b6dd

SHA512
9f390d2799aaa1b35a02eccd8f604679a4479df649ea7eabec1fad830d2d276b5becae95baf2bd0b8549f36fd55342f7d31e9226457bac76418fd31894ea4414

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\EventEmitter.js

Filesize
4KB

MD5
c42247c9c880e3152452ee4d7e2ce625

SHA1
1fb499df0749ba75f2de97e3bc5c6a953e2dea6e

SHA256
0f63d4c4a9dae91096c3c1c980f54be588bea6d740dc19fbd279eb42444fb88e

SHA512
df4b23963999ba6decfa280b4530c2578f0cc6dc77bf61de6a69cd00cb45bc7acbd82a76085b50de91369e6ba724f7ef703048a15d1fbc345833a8e11287f455

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\HandleIterator.js

Filesize
2KB

MD5
d06d1e7230d1571d1d41d0da32768e20

SHA1
32ec51658c76ca63ce27053363ea44397dc695f4

SHA256
474b94d6750aa46c25551c1be6b07a6ac9ada69396720bc10591c19fb54f6b14

SHA512
4bf304c19f8140abc0e9ff000c770c7a7665842aba39c1d11cc7fb5ab1ce215db334aabc161f5649a8c081850a9939cea6145e020ac113eff79e13d13885e359

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\IsolatedWorlds.js

Filesize
1KB

MD5
03ce2c3627316beb425e6426f5746c72

SHA1
e569051524b2b9479b69c7b6498fb8eaecbc7cb8

SHA256
8f1f6d9ef17b2b38f3d2ec0ecccba3ba64e5873cbf114e5da431aa935d2d979c

SHA512
3e879d0cf043d9ddb07324caccf9254864f14419e3f973dd8f1cde37f01d2640de64759a275229dd602e539c34e6a93e8563d2f17dd66483220cf56bc2d271ec

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\LazyArg.js

Filesize
2KB

MD5
7d2b18d5b9f2e06a67269e629cde2f62

SHA1
d9141ff9c0dd24ab8a3b6065180d27982af9e28d

SHA256
4dfc9ad6f14b0bd6f54cc03061741441320ba6e6f18c70445a55f4d9b98b21da

SHA512
edfd5d270c2c00b7d218b581b5e270b49a660dc22da838fc893941e7dd25e41d1d92e9c47131fa96b43d150eb69e915d7a3a19bf36eb4b084877621fb88d608f

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\QueryHandler.js

Filesize
6KB

MD5
f78120f0ee483e4a225e75a2107d9514

SHA1
5d1a4322e2510d3f41dfcb5da7d216ff2bfb4f31

SHA256
216a13ccc5b09ae890ebdc09a24e1fab401628c99ea8f317d2b03f54c74321ff

SHA512
1f3f6116746954abf76505f078ab08dee35b0a4c158c01f31bb7100f709ad5c6362c0d9c89e661c0c05b37274aab23dbed9f8753b16879055a9d563a1e64a430

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\common\common.js

Filesize
4KB

MD5
eaab8559dbcd6f5e5edbe00e6dcbb7ed

SHA1
17319381274ad3514a7e24e85156ab1a1381bd00

SHA256
8d5fd6634c16f07b9414002f98de1caabfb85340308810a8a70cfc2e42c87905

SHA512
84e71f2c1edf061eb8def719875c057639151d1b2daa7146b5e948e97e084f3e944ea70836f56cad10d058ac0fc9a68b83df74ef22f549c0e76966e39ad75540

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\puppeteer-core.js

Filesize
2KB

MD5
ca02f1ee67c8c7afacb826708203f5bd

SHA1
1be575eae8f25a698d15d4d597d01eef04bf1684

SHA256
d802e1d30bd8eacea813dcd8a4a5ad82229717d19696ade684953e628edb663f

SHA512
c5f5179cf3a19d68a6a4081ce4163483210598df21a4239c4dcb32785b03a4c5250be9c7c8a75749601b2e3e047abe94760a0ef0b84fb388b3b36447cd3b1416

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\util\AsyncIterableUtil.js

Filesize
847B

MD5
535e1f87d6dcda38c077ee5709b3c7b4

SHA1
8fac0e2213f50fb87d5a737d2f675f45c1d82981

SHA256
56aa99537ae30760af15113f24adbcc37c86e251696382326da947070e90f643

SHA512
7d1538c00b8efc7efc7138cd0b8943fc2bd4a1afc1eeaed5e4798c1d310aac09c09172ce54fccf17cdb55280447e91170a9d02c7b22e3fee6cf45281f221db99

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\util\ErrorLike.js

Filesize
583B

MD5
d2ac287f1b624a6502344bf94f9a4e94

SHA1
da3007c58c0a9a587600eac00d2c73f8582396d6

SHA256
7fc52043d6c55cad9d1af8e0d990bef669d4785cb8d6c7778b26d57f2adf240b

SHA512
6d519d8e3d83dd3e9a6aaea2a87dc894b48af0f712edec492c684c8dd7c512126f9edba29f83c5cad79de0d239f30a1f2186175370cb674f78678f57ee81ab28

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\util\Function.js

Filesize
2KB

MD5
c2b744a273b708dc0ea6bf0f750faf6b

SHA1
e367846c93cbf64f1d7fdaa11a9e6b1f7ef9a5d0

SHA256
12a87cecfe6b35cee5288675127eed539ea32f1e4f9b8a9e6bcaef5cb33a08ef

SHA512
ece0afa0674cf3c2469e1afaff9c1d115e32fe47dc9239d8fa074ee9ff804b29f61669f8c934dd53deaee5952c262fdd1a81e4702e37d58f0c2af4e6937893fe

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\util\assert.js

Filesize
1KB

MD5
c9c7db436dc28b113e9570b80cdfebf3

SHA1
0f5ebc7dc10cdfcf2e99506dbf71f90e91588855

SHA256
da541dea442687032c52880cf84b9ea11ded63ff2c1b54855e1a8d6a1e03b6cc

SHA512
83300bea6e8d07a21d2571eab8e11ea20cf59f5331a04396d58674a96fc1a435b9b24aa35e0a2bf08cf281434929ec3906c4ffc65563789684991c50d13114fd

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\puppeteer\util\util.js

Filesize
1KB

MD5
d701eada8e39251bf28a821821b7f521

SHA1
a8c0ccf5e7deea2ee2de0469bd307084202216e9

SHA256
dc102dc8aed9098c3a70a52192b1aebfdc01042031386636ddc8009404a0b7ea

SHA512
48655a0c33763298bdc024f463f2f1def024fef94161973fd964a37a3f0177c845b187428e011dc82fcb7c5d78751897c6d974274b621a7b26240046827689fe

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\lib\cjs\third_party\mitt\index.js

Filesize
350B

MD5
3eadd40717a2cbea14217b64a0a46f6f

SHA1
cfe6cea46a143db230e33c0853af1bac1a0b8e87

SHA256
89b666ae1436b58b64ba6ed31b8bce5902a915bbc282bfba1e987ecbfbf439a9

SHA512
13cfed874c8477b4a8d2c203c9b49528abb18f00490cc6dc7597b21442f394c7d49bcd1f9580a7007aa210fe8dc138b7aa48c06f9068662dfac9fd0dc467b3df

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-core\package.json

Filesize
3KB

MD5
bcb14143ac8bd1689cc2361343b2be08

SHA1
93274663feabb82d3526d516b1d0d5743e35c091

SHA256
8f7c38130656353d3ee4e566f5cb96d5877ff6486fd11bee1b8884f6e98c44b4

SHA512
d7eddb7d3b66103cd42200f1e7c1ad7d9b5f88585a3192d9287b4d6da1654cfd6a5e993110defb2b8e4c64f8f72a945baa672c68804c781ae1eb388f16f0010f

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-extra-plugin-stealth\evasions\defaultArgs\package.json

Filesize
44B

MD5
cee5d0585f69e11d285e2245c61a7944

SHA1
879afdd9ad3ea33ef8abbf983468f2ca730614f5

SHA256
1a1c7c4f8015bf0a3cb9dd2bf9d327715860134d51bf34fc2e4eadb8fd892ded

SHA512
44cd51c0733728d1d452c583e24331298efa8ed0a0a320ab76c635ec251d550a76961eefa06c3f5b15f393c0ae105783e70d07674f10a38440129e3d6aeb72b0

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-extra-plugin\LICENSE

Filesize
1KB

MD5
6623565a13afe50dfca3314de5982dff

SHA1
f166864228971de3a98e6528c365aedfb51e0f39

SHA256
f43f8e731aa2548019ed6714511d9e412bf48dd809d1b0d7e83d7dbf8a5683d1

SHA512
dd18f2eff7070d45998645f6ad1baf481b5a908b388d38d935c091a41d190701c37f4065a7f0bcbfa1146292354052007ba9ae59619ed848e6fe02adcec430ca

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-extra\dist\index.cjs.js

Filesize
17KB

MD5
3ae02225f5dc62eee98631fcf918de05

SHA1
51adfb18258e920bba915f20e0fdebdec42d77c3

SHA256
80926f65a001ce2f1c790f396e3e5ddab1b27d5ca865d831ba097cb2d5ac64aa

SHA512
362705bb94d56cd8c7dcc81c280d147019c7fa7a8ea1811ebc8be4a048045c0c6ed8333ba2ee4f49a7d808868fbb3d20ff52020aa108f80516156802bc3a1c08

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer-extra\package.json

Filesize
2KB

MD5
77e1d756818eac0f6ad1948cfd308b55

SHA1
767579dd4f3fbea8309957ff1e0ea8b7bd293e55

SHA256
f42382b3bafa0faed781205c1c13bb460b7588dfa854c2252589b0ac1cdfbb5a

SHA512
e6c3dbaed7fdd33be8baf963a537a7339a7669a5d8e96e9fcaabc1f8cbab12d494bec5d1c57fc6836abd9f8d037a2453d6a0abd35a28d362ad2750125d373b6a

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer\lib\cjs\puppeteer\puppeteer.js

Filesize
2KB

MD5
96689d6b3ad5ecf49701f7771c0d8228

SHA1
50af30d35749b30c14ba02a00fb04f977d1bbd75

SHA256
f4a4f067a59f4141fbd4e8759d244dc7ba5ebd5b69a7991b5928cd56bc22e5c9

SHA512
22c94ca69df784573c44204cee28de5a829d80af274404d97c64681cb168efc484b88a39653f681a0279d37818a77ff5fe728355258f920beecf2ee4bdfe229e

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\puppeteer\package.json

Filesize
2KB

MD5
518c8f18e8f0552a2d3217bb73eb0634

SHA1
0e723a66c0a02bf3bf422257e9ff25b29ba0be0f

SHA256
24bf28c6bfb697a08435e7e4c2b9dcd81b51a5403cc2bbde6ccdfee412a5b269

SHA512
54cc8b9f0b1fb664c1fc8affdffdad8eb3d21431f3a661371fed17bb6396b5b2a0748ea5d84dee4794de6771c5a82a3bac13117a25836693b32daf30290bd887

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\supports-color\index.js

Filesize
2KB

MD5
9a855ec52971bd5501058217723a4ebc

SHA1
ee9a711c9a006df8905afb8f0b7ebf4faa6a2c7e

SHA256
2626aab9a13dc645b1746d6ff1c919b7d27adee60729825404f24e70d982acb3

SHA512
4a8a0d3a52aae259c5de4496cded318c68e6486a8e2d998c5e4819957e7d943b2d798da5ab19719aa32d6dd60859ee74f1298390b9af7c1f3cdfb79edbd19d65

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\supports-color\package.json

Filesize
818B

MD5
79d88f702d689c72ebe1798d2853a96e

SHA1
12db9c2598721e751dffd0b42a20b7ae419b20e2

SHA256
34c434b27dc21bd0de7b5edca42fa0d9ebf72d2ac823c72865a334cb8fcfb9b5

SHA512
cebbcd376891243ad479e0f4f52c27a593b998c72edc057bc144f783464766e7645a47e5497d61a8310416d2c114f90f307e3f75ca4f1fbbe95b055b049f5eff

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\node_modules\wrappy\LICENSE

Filesize
765B

MD5
82703a69f6d7411dde679954c2fd9dca

SHA1
bb408e929caeb1731945b2ba54bc337edb87cc66

SHA256
4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b

SHA512
3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\resources\app\package.json

Filesize
757B

MD5
6c3fb090c129c186ffaedaa1e567a51f

SHA1
7157a7ad6e3c046fd46f27bb04baefe3f9608b94

SHA256
8341f33a2e523a105db712191445cfcde183e22bb522090bcc12b7464b8857be

SHA512
3d4fbed72900e31839baf6b22e44ae05a1d2faa76e15460ebbf819ebda12c9be40ebbc9bd28d26be6900ce5ff60c135a1bdf8824341bb87e9f2b0b29cd021f5b

Download Submit
C:\Users\Admin\AppData\Local\AccountsManager\app-1.0.0\v8_context_snapshot.bin

Filesize
656KB

MD5
c384ae622a7a6c7ec328678af12922c2

SHA1
25165dcaf78d3d29a16e4f979370e0b009ede240

SHA256
977a027c50bd79e93ec015fbebaccfaaa8885b88c76f7e5a2c33337d6d5173c3

SHA512
d0571f5e18dcf14a591a76243d52094bb843b0779630f31cbb66fd738c1c35d10bb7ef751eb01a953305ee19f2777f4d3ca6f9b132199b2af357c0b03185d9a7

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

Filesize
86B

MD5
a2d00dd6cce2872f7d8f27a54f803c77

SHA1
b4cb146f328fab2cb806f12787b8a259e76fd8bc

SHA256
55ab0783ee916ea470155929944fc3cd2a03aac6df6a89a64e8d72fa984c72cc

SHA512
c7592df8dfe7b8e12bf999eaf64f8e34b41a23fb31304892210a4fe847bb191ae3ce858d9b7f8c4640cf99924393cec7801cbf83575da03a6c7a03952d911abb

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
1.8MB

MD5
a560bad9e373ea5223792d60bede2b13

SHA1
82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa

SHA256
76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc

SHA512
58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
200KB

MD5
b4740e2b8de2a5950389ac3f4de835b8

SHA1
5a5fce12fdacfefbbfbc1cc89e57dcbd19257c5d

SHA256
a37c54548ad147d6b2bf0d7a34e8e9184876132e556b33c0986f1e048214ace7

SHA512
6f700caef471e787784e8ac97fa08b3a24a1b3997111e72cd92cfd849cd314bf99988b269537c6576fbdf4bdacee5911f977c92385eebca5f7141818337d7886

Download Submit
C:\Users\Admin\AppData\Roaming\AccountsManager\7c073607-32ea-4d2d-93dd-3c5ac5e79c84.tmp

Filesize
86B

MD5
d11dedf80b85d8d9be3fec6bb292f64b

SHA1
aab8783454819cd66ddf7871e887abdba138aef3

SHA256
8029940de92ae596278912bbbd6387d65f4e849d3c136287a1233f525d189c67

SHA512
6b7ec1ca5189124e0d136f561ca7f12a4653633e2d9452d290e658dfe545acf6600cc9496794757a43f95c91705e9549ef681d4cc9e035738b03a18bdc2e25f0

Download Submit
C:\Users\Admin\AppData\Roaming\AccountsManager\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Roaming\AccountsManager\GPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Roaming\AccountsManager\GPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Roaming\AccountsManager\Network\Network Persistent State

Filesize
1KB

MD5
a80150e5ed8a9b6bcea42038a2798a2b

SHA1
3cb3fb46f1652fce5640912897ad8dad6fdb259c

SHA256
919bf359c59886319cb069e7fe790e4870fae2001d7c774039b4632af187054f

SHA512
b04ff43d1b8de03fa2ab83757a3241b272575acba0fb3a4931a5dfa0300778bf24d0873e3cd143669faa89cbf3c61c8424cd086635e4789b549349dea0909638

Download Submit
C:\Users\Admin\AppData\Roaming\AccountsManager\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Roaming\AccountsManager\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
memory/1640-3038-0x0000000001700000-0x0000000001720000-memory.dmp

Filesize
128KB

Download
memory/1864-3018-0x00007FFE98280000-0x00007FFE98281000-memory.dmp

Filesize
4KB

Download
memory/2588-3186-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3176-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3178-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3177-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3188-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3187-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3185-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3184-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3183-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/2588-3182-0x0000020160180000-0x0000020160181000-memory.dmp

Filesize
4KB

Download
memory/4828-84-0x0000000020740000-0x0000000020778000-memory.dmp

Filesize
224KB

Download
memory/4828-7-0x0000000000530000-0x0000000000706000-memory.dmp

Filesize
1.8MB

Download
memory/4828-85-0x000000001B920000-0x000000001B92E000-memory.dmp

Filesize
56KB

Download