c441a8d7193fcfa0816b7a52c230da68fbc58ae2c696637deb2eb0b4921f36ac

Analysis

user interaction
yes
max time kernel
90s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ob.exe
Size 131.6MB
Sample260905-jnammsgp9x
SHA256 c441a8d7193fcfa0816b7a52c230da68fbc58ae2c696637deb2eb0b4921f36ac
MD5 7f42121315465be84f22d984244758fc
SHA1 6f4f145460f3111921ea2924e17755f128b3f804
SHA512 5d2d9848006bdc837919e8eb6c5d0d85e34b34ad7fad61dd1473706fdc1fb90d0e5902aba97da90c901fd6be30f14b61d82d8ad25e887d813ea0fd15ce600874
SSDEEP 3145728:Ym3608stHj5ubBv57QCe9jt0JMC0cRJXlg0ZuB9/+r4LEE:YwEb7de9mJM8FMvq4L
TLSH
T19268337404E89DCCF12B103DB5C79A058AE2F47AD539ACBE6324739C2A591CBB19CF09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 24 IoCs

pid	Process
1088	Update.exe
252	Squirrel.exe
5712	ob.exe
5604	Update.exe
5740	ob.exe
3416	ob.exe
4256	ob.exe
4780	ob.exe
864	ob.exe
2752	ob.exe
3408	ob.exe
4944	ob.exe
5764	ob.exe
4964	ob.exe
3848	ob.exe
1456	ob.exe
4376	ob.exe
4184	ob.exe
2108	ob.exe
2220	ob.exe
4960	ob.exe
1372	ob.exe
4764	ob.exe
5592	ob.exe

Loads dropped DLL 26 IoCs

pid	Process
3416	ob.exe
4256	ob.exe
3416	ob.exe
3416	ob.exe
3416	ob.exe
3416	ob.exe
864	ob.exe
864	ob.exe
864	ob.exe
864	ob.exe
864	ob.exe
864	ob.exe
3408	ob.exe
4964	ob.exe
4964	ob.exe
4964	ob.exe
4964	ob.exe
4964	ob.exe
4964	ob.exe
1456	ob.exe
4376	ob.exe
4184	ob.exe
2108	ob.exe
2220	ob.exe
4960	ob.exe
1372	ob.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
27	discord.com
28	discord.com
30	discord.com
1	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ob.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ob.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ob.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ob.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ob.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ob.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ob.exe

Modifies registry class 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher	ob.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell\open\command	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ob_launcher\\app-1.2.1\\ob.exe\" \"%1\""	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\ = "URL:fivem-launcher"	ob.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell	ob.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\ = "URL:fivem-launcher"	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\URL Protocol	ob.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell\open\command	ob.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{BA31B7F9-0FD6-4374-A965-3A27A41B17BE}	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\URL Protocol	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ob_launcher\\app-1.2.1\\ob.exe\" \"%1\""	ob.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell\open\command	ob.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell\open	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\URL Protocol	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ob_launcher\\app-1.2.1\\ob.exe\" \"%1\""	ob.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher	ob.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\fivem-launcher\ = "URL:fivem-launcher"	ob.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1088	Update.exe
1088	Update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5712	ob.exe
Token: SeCreatePagefilePrivilege	5712	ob.exe
Token: SeDebugPrivilege	1088	Update.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe
Token: SeCreatePagefilePrivilege	4780	ob.exe
Token: SeShutdownPrivilege	4780	ob.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	Update.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 1088	4384	ob.exe	89
PID 1088 wrote to memory of 252	1088	Update.exe	90
PID 1088 wrote to memory of 5712	1088	Update.exe	91
PID 5712 wrote to memory of 5604	5712	ob.exe	92
PID 5712 wrote to memory of 5740	5712	ob.exe	93
PID 5712 wrote to memory of 3416	5712	ob.exe	94
PID 5712 wrote to memory of 3416	5712	ob.exe	94
PID 5712 wrote to memory of 4256	5712	ob.exe	95
PID 5712 wrote to memory of 4256	5712	ob.exe	95
PID 1088 wrote to memory of 4780	1088	Update.exe	96
PID 4780 wrote to memory of 864	4780	ob.exe	98
PID 4780 wrote to memory of 864	4780	ob.exe	98
PID 4780 wrote to memory of 2752	4780	ob.exe	99
PID 4780 wrote to memory of 3408	4780	ob.exe	100
PID 4780 wrote to memory of 3408	4780	ob.exe	100
PID 4944 wrote to memory of 5764	4944	ob.exe	103
PID 5764 wrote to memory of 4964	5764	ob.exe	104
PID 5764 wrote to memory of 4964	5764	ob.exe	104
PID 5764 wrote to memory of 3848	5764	ob.exe	105
PID 5764 wrote to memory of 1456	5764	ob.exe	106
PID 5764 wrote to memory of 1456	5764	ob.exe	106
PID 5764 wrote to memory of 4376	5764	ob.exe	107
PID 5764 wrote to memory of 4376	5764	ob.exe	107
PID 5764 wrote to memory of 4184	5764	ob.exe	108
PID 5764 wrote to memory of 4184	5764	ob.exe	108
PID 5764 wrote to memory of 2108	5764	ob.exe	109
PID 5764 wrote to memory of 2108	5764	ob.exe	109
PID 5764 wrote to memory of 2220	5764	ob.exe	110
PID 5764 wrote to memory of 2220	5764	ob.exe	110
PID 5764 wrote to memory of 4960	5764	ob.exe	111
PID 5764 wrote to memory of 4960	5764	ob.exe	111
PID 5764 wrote to memory of 1372	5764	ob.exe	112
PID 5764 wrote to memory of 1372	5764	ob.exe	112
PID 5764 wrote to memory of 4764	5764	ob.exe	113
PID 5764 wrote to memory of 5592	5764	ob.exe	114
PID 5764 wrote to memory of 5592	5764	ob.exe	114

C:\Users\Admin\AppData\Local\Temp\ob.exe
"C:\Users\Admin\AppData\Local\Temp\ob.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\Squirrel.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:252
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --squirrel-install 1.2.1
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Users\Admin\AppData\Local\ob_launcher\Update.exe
      C:\Users\Admin\AppData\Local\ob_launcher\Update.exe --createShortcut=ob.exe
      4⤵
      Executes dropped EXE
      PID:5604
  - - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
      "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --field-trial-handle=1704,i,14126810062241405018,1139188653775834290,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,16313910318002592978,16340881250330334603,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2120 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:5740
  - - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
      "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1704,i,14126810062241405018,1139188653775834290,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,16313910318002592978,16340881250330334603,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1700 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3416
  - - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
      "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1788593974226553 --launch-time-ticks=588716623 --field-trial-handle=1704,i,14126810062241405018,1139188653775834290,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1708,i,16313910318002592978,16340881250330334603,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2444 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4256
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --squirrel-firstrun
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
      "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,11630815125391049733,15716695136839397638,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,2709572864717564920,4987557984119281186,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1780 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:864
  - - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
      "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --field-trial-handle=1784,i,11630815125391049733,15716695136839397638,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,2709572864717564920,4987557984119281186,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2076 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:2752
  - - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
      "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1788593974226539 --launch-time-ticks=595550437 --field-trial-handle=1784,i,11630815125391049733,15716695136839397638,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1788,i,2709572864717564920,4987557984119281186,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2348 /prefetch:1
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3408

C:\Users\Admin\AppData\Local\ob_launcher\ob.exe
"C:\Users\Admin\AppData\Local\ob_launcher\ob.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
  "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4964
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2292 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:3848
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=633013774 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2452 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1456
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=641716908 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3588 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4376
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=642724064 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=3708 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4184
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=648962005 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=3648 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2108
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=653610946 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=3880 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2220
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=656375117 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4000 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4960
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=656700219 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=4128 /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1372
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=4420 /prefetch:14
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:4764
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=4368 /prefetch:12
    3⤵
    - Executes dropped EXE
    PID:5592
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=676106937 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=3916 /prefetch:1
    3⤵
    PID:1412
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=677515078 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709007863834021 --mojo-platform-channel-handle=4788 /prefetch:1
    3⤵
    PID:5888
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=678557017 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709008800875870 --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    PID:3800
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=680971175 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709011612001417 --mojo-platform-channel-handle=4876 /prefetch:1
    3⤵
    PID:6292
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=683026849 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709012549043266 --mojo-platform-channel-handle=4616 /prefetch:1
    3⤵
    PID:6504
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=683701265 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709013486085115 --mojo-platform-channel-handle=4500 /prefetch:1
    3⤵
    PID:6652
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=683748967 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709014423126964 --mojo-platform-channel-handle=4540 /prefetch:1
    3⤵
    PID:6672
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=683771695 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709015360168813 --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:6696
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=683865131 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709016297210662 --mojo-platform-channel-handle=5052 /prefetch:1
    3⤵
    PID:6712
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=684587246 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709017234252511 --mojo-platform-channel-handle=5472 /prefetch:1
    3⤵
    PID:6828
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=684594352 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709018171294360 --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:6836
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=684601527 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709019108336209 --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:6844
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=684601941 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709020045378058 --mojo-platform-channel-handle=5568 /prefetch:1
    3⤵
    PID:6876
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=684664649 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709020982419907 --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:6888
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=684690958 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709021919461756 --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:6900
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=684972429 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709022856503605 --mojo-platform-channel-handle=6204 /prefetch:1
    3⤵
    PID:6944
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=685027986 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709023793545454 --mojo-platform-channel-handle=6272 /prefetch:1
    3⤵
    PID:6968
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=685029155 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709024730587303 --mojo-platform-channel-handle=6280 /prefetch:1
    3⤵
    PID:6976
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=685670257 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709025667629152 --mojo-platform-channel-handle=6600 /prefetch:1
    3⤵
    PID:7156
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=686143307 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709026604671001 --mojo-platform-channel-handle=6708 /prefetch:1
    3⤵
    PID:5164
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=686278358 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709027541712850 --mojo-platform-channel-handle=6812 /prefetch:1
    3⤵
    PID:5380
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=686451567 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709028478754699 --mojo-platform-channel-handle=6948 /prefetch:1
    3⤵
    PID:6244
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=686513572 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709029415796548 --mojo-platform-channel-handle=7068 /prefetch:1
    3⤵
    PID:6304
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=686700292 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709030352838397 --mojo-platform-channel-handle=7188 /prefetch:1
    3⤵
    PID:6568
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=686788060 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709031289880246 --mojo-platform-channel-handle=7344 /prefetch:1
    3⤵
    PID:6636
- - C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe
    "C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ob.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\ob" --app-user-model-id=com.squirrel.ob_launcher.ob --app-path="C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar" --enable-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --time-ticks-at-unix-epoch=-1788593974226721 --launch-time-ticks=689743199 --field-trial-handle=1692,i,1094223183797533206,15157055994119463927,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1696,i,14250309590193540964,15058440702194009747,4 --trace-process-track-uuid=3190709032226922095 --mojo-platform-channel-handle=7524 /prefetch:1
    3⤵
    PID:7392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000050C 0x00000000000004F4
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RELEASES

Path C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES
Size 82B
SHA256 a2f8438adb438ad3cba1d4c1d65f258bb260a796b8b2df16ac58cb67808c563f
MD5 44d76eda681705826e8c3bab6c94628a
SHA1 aeb36de56c5893ab9c3a7b222b26b688e8171a9f
SHA512 769316983c29fc807f2578bfec5b6716b6612b807f3cb51dfeec2346a0437ae711ff56747854cba8c8e8faf94a2c91350e9860361753d6602382df6d576dcafc
TLSH
T101A011AC00A3A8AA88820320880C0022CC0A2220A83B2A0A23288303003C388BAA020B
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 1.8MB
SHA256 76359cd4b0349a83337b941332ad042c90351c2bb0a4628307740324c97984cc
MD5 a560bad9e373ea5223792d60bede2b13
SHA1 82a0da9b52741d8994f28ad9ed6cbd3e6d3538fa
SHA512 58a1b4e1580273e1e5021dd2309b1841767d2a4be76ab4a7d4ff11b53fa9de068f6da67bf0dccfb19b4c91351387c0e6e200a2a864ec3fa737a1cb0970c8242c
SSDEEP 24576:pWltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9m2:0t3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T15A956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif
Size 43KB
SHA256 ce636d201ef86ffbf4ee8c8762b4d9dc255be9d5f490d0a22e36fe0c938f7244
MD5 b5a42ecde0b058b3c4e661e0ec84400b
SHA1 7e2bfc653c5bc6997553c150a0823daae372cd99
SHA512 b7f4a7bddb226066f7edf23dfb9bee658c30ae03dfe727ec739f51fd98c63831f732343c14a6ca080f31baed38bf9064cdd57c9d1daaf4c42c029fe83d846dc0
SSDEEP 768:5XxIn344C+JtOb7Q+8Phv9YaZuJ+Hz7X9Dbzjy2CXdSksvlxkZPbM/zEffvTeq6e:5XxIn344C+Jty7Q+8Phv9YaZuJ+Hz7Xk
TLSH
T106136B3EC2949279B43716F72A1B4EE26B5667B4221152421BFC70D332BCAEE334641F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setupIcon.ico

Path C:\Users\Admin\AppData\Local\SquirrelTemp\setupIcon.ico
Size 4KB
SHA256 9bab134942ae25268f6b893f69ed727aeb23ab3d2b28e781bdeeeeab9f376e3a
MD5 ec3a6a1a8c994d504c1b15ec040bad52
SHA1 32214452009dbdfc85da9c8fb78ecc98d2d35dab
SHA512 59c740c8f59161e7f88e4c85711a61cfbb15af60726ec933c65d53a6cde10030ad8658ae854649815b82d5624026a0021b81db4e078acf318adbe3ce84a24276
SSDEEP 96:E7aMAOdTYxMRFgkD6IZUzm1ZTFAiwTnewh8SwIPVT:E7XAOeCFj6BqDTFAiwTnew9BPx
TLSH
T17791B22C5F340ADCF34A0EB90FF67A9D625C1C232848860AF0A66B915F36FE82D02421
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\chrome_100_percent.pak
Size 113KB
SHA256 34433fa04ddf5eb78b3b4e9c64a3af626e28641907ad7a6086614eb6a8f00a07
MD5 a8d9be85b9a9c2a1be1815b29cfde9ce
SHA1 9b8df5aebf541d063311ad4c2be1d23398f13a33
SHA512 37ad60e74c7e439f83b87ce61018619568914ee491289e3fb34234a0c4e3258c4986cd56e6e58652134058ab1f824a90499d4aed46e611937ec946d9a3b680ec
SSDEEP 3072:fnk4PisCv+/P9NebGz8LI1TwILjQBHe7YAP18RVC2I:fnZYWFUbGz8LI1TdjQBQCrC
TLSH
T1F8B3E0D773B0AD7DD6870BB783660070FCB31B2D06C2160A4A99E479652AF88D8D93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\chrome_200_percent.pak
Size 183KB
SHA256 581c8d53199c10512d31a340699f9ad269f8eea5fe6bc49e05c1bde98ee612aa
MD5 e0d4001307e8e8554810b27796ad636f
SHA1 be92e88b55ae85cc5118009af0fe32c9470c0dca
SHA512 762324239832fa1a531cc3da546df8627610a164c13d83f12b64c28e207273989fa7da0c4e96787ab0a5d09f5202ebc31895f09ad2fdbea4e6e70c0d2b4f51d1
SSDEEP 3072:jgJ8LahaY7d6iN6uSwxohPQDQYaEjrvy/IwXJPpLjQBHe7YAP10uxR/TbIM0:jxGQ+N6uSZQDQYakvyAk9jQBQNd4
TLSH
T1C704F2D723B8AE3DD9570B73926610E0FE7A20291EB3110E469F98397925F8CD9C9343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\d3dcompiler_47.dll
Size 4.5MB
SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
MD5 6ac6cc720fb6bbe5c0ed4e84ad2b3337
SHA1 8556531bd06691ce0f8b7d83814c867a420526a4
SHA512 216084dc2a84ca818d68d603968acc978c0b60bdbe0a3152cbfc400ec11a2b96e81d1698a15dbb7738974f4365a8feb109f2bca5b641b42acedeaeff1e2a342c
SSDEEP 49152:JSHvWaWTktEzfRriMsCL98dhdVhpHGC6GNCxJYrv9y5Eze+V7ZpdKMZzaWoUyxqJ:suktcrfNlTyj5byqSC
TLSH
T1FE268D5767E840E9C5BBD138D687831BEBB1B80413345BDF01508669AF73BE26A3E724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\dxcompiler.dll
Size 24.5MB
SHA256 a753c92959f2fd96a49a8e58cd13b07f06474df34a26c42fed3313170dbc76fb
MD5 bc24d1c00760fa707a506faf9e1ddd0e
SHA1 84414890627b2a07c26aed935d60392be6a533c0
SHA512 b4c87db2b70786bd639af4f9e3076af3498e960436f4c487480e09bb0b86afd28c48a30653d70583145c711799796b57339ff4e0d19a579d317e095000f0e629
SSDEEP 196608:b4bshh6tCvu2Jujv2BwPcSGIUVr6ZRdcv905QP9CDtZqGm5q:b4bshh6tCMj+BwPcjIUVr6ZRDsCDrq
TLSH
T15B472A122646D49CC059C879C7678B26CA6C30E73FA7B9EBC0F451252B79EBC5B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\dxil.dll
Size 1.4MB
SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
MD5 f8f3501026df30556c34a9af9cb7af9c
SHA1 961d9012b6d79e2e3c28b310a80ba3ab36e2c559
SHA512 3631f8a3d48e8eea25091b93147d88f0e8a7539f2f242fe287d37f82fc4344528901e4cc48c93ebcf8691d2e11227a9b50f2b5ad45f2475c0119ad8b2d3661fd
SSDEEP 24576:zY+wATtbKYxy0y3ny6eBjNSGlVZyi27+V0IJNSD11J7R+j+v1acLUkJvS5Kao:8iTMYxy0Sy66Zh7Sh/cyvS5W
TLSH
T154657E1B229801B6D4BBD17CDA47CE0BE6B2B41503B09BCF12B406692F5BBF55A3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\ffmpeg.dll
Size 3.0MB
SHA256 b64f08946914d8ce2bdaaef5796adcf8398ee5ba55223afbb9f14072f4302b45
MD5 8accc3d599d648a51f5786726da45af8
SHA1 fb291b376cb52f6dd560c71d9ee3472286ef451f
SHA512 418c1d6efd01e8264f246e0c3c241885e293a8dcff2412a72d26bfb404e5e68cab546eb1d74455782f2fedf8ef9a3d31cac8be4229fccb3d1db1572997a45f49
SSDEEP 49152:l/D5N99s9KPgWUCx2zdwX31199a2LKIba7k6gSPNoJMUvTfsfUYG1w:l/fU9KYWFCdwnD4NoJF0
TLSH
T138E59E03F2D651EDD019C034979B9313B631384A4F205AEB16909A263F6BFD87E7E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\icudtl.dat
Size 10.3MB
SHA256 1cf67874b5a87a8363a86fb3f81e3cbbed54d389062dab8fb52308d5cf8c8612
MD5 5bfd3eefca4b5ef2d1a869396390a7de
SHA1 c58567f7fe308ccd43f406b70aa8bf6fdbea4f3a
SHA512 4489a55fa0b47c8d1e9679032e036c7998f82efb4191b98900ae40cfc30a26b65290867527161c594c42fe7999b2314f8928a5d717d65d4eeedd4fdb0ed0f427
SSDEEP 196608:A6akBhOR8LE/dUHiXUxa/iJ53IWhls2E91Z0G:AqwKLBHiXUxa/iJ53IWhls2E6G
TLSH
T118B63903A2EB4EC6F9FB5F7498F562779527BD49AE32804A51043F3B1C333908664B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\libegl.dll
Size 510KB
SHA256 d96e3731a45bd60af2410e482dda3bcadec20879b080328b755e2fb21f22455d
MD5 53e314c1a900b0bd52d01271e2a42c13
SHA1 1a3b5224928c6fbc5e3579bf7c1bb341e5f4845b
SHA512 b6cf2b5c1faa414af8605b974ad36b5efc7de1acfc5959824b76095dd143be2f343cdbeb13ce3ff1ed69a2ad495d2897ca5dd2c9c79819615fadb8ccedbfd61d
SSDEEP 12288:tu+HNFZuz/9KRT2Y2vpcZfqggfgtug/j/4:hwzlYBqggCj
TLSH
T115B47D15F3E84BA9D07AD1748A438642DB7174920B65F9EF02E052392F3BBF45A3E325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\libglesv2.dll
Size 7.6MB
SHA256 2b8c2d0da9e5b2e7af3a0518ae309765c5569316aef25c6593598db82679bb40
MD5 b81b55046164605b354a987531be14f6
SHA1 0bca407eca3781983c11be1b63ded81274193f70
SHA512 17b6498e744f77b8ee368ee7b442de6f1834dd99281e3bf1db112b0ebced72d7d3b8cffc0ee86f752480c181fbe47e59c06c042c1ab27147f37f5d3029ec5e46
SSDEEP 49152:35k4/IupMczTMoa/wQOnIy2FHyq+6hszXbJYDMY5FjSJuYVZogGKMz9o/SxkAdAX:eXuKdoyYCQdVKglAgYDL+UineuuWoC
TLSH
T1DC867C03F68641D9C05DE2749B6BA223FB34B8450724B7CF2A9457152F6AFE0AB3E714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\locales\en-US.pak
Size 548KB
SHA256 a02518efe75c630a1b5419af5ffdb1b16636b939139bccd7710e37f36ad9d55c
MD5 514fbace34b812d20cf9b2bcd2d7fe54
SHA1 2c0d961496efe4b8f8f2614a64aaf3e35d23f848
SHA512 eb915b16e3ee4382d2bb14393900d3f80f198fd029cd2c3faf066795ac29fb3dbd592fc0ff1a7203259eda205aae1ef7399a5aa9daea69971d41b1a9a8ef0e4a
SSDEEP 6144:roemduy82EC+HNHfYOMg/jScMP9sQqblfaYQhp1B1OjRng98//Swf:snuy6rHfdZM6Qqbg0jSwf
TLSH
T1FDC44C1FF744122A05A352A27F0995A2FF32D06CA35112563CBD812C33B6B6693B77F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources.pak
Size 6.4MB
SHA256 c4ad517120de2acbba6b4ca4e7fd02917245bafc95af7694a0e8a310c4c7f11b
MD5 6dd56a378382536447650a34785fb251
SHA1 c1a79a50f3382d1a5d7e9db8fd421c52103ffd83
SHA512 f7ece9a7dae373c7d22ba9938a395b131798090e1f9edb2c39e91c6d1df605da45079ee13262b69d692a480c2f20dac0023326fd5c33c503147954c0c558cbc9
SSDEEP 196608:LIiBRCfhs5QoCmkrB0QM/uFBgt3m06Rw+Ki:LIiTCp9mkr4GFWBm0iw+h
TLSH
T15F6633DB71312C4FC54883FE4528417E7C6CABA13D8951A2559C7228CC6E24B7EC9ABF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\resources\app.asar
Size 587KB
SHA256 da4bc788f9e34cffd038a0c4571d91b31840fdbb6f2a8f76fe5e596574e7e93c
MD5 2f94ae03efda42b3172d0e782c1c1e10
SHA1 132186b5bcc25ba85e9c983635f5e61471a59639
SHA512 e760dbdb363e28909a36584bd8686f1cb2551f8a099630912687de6d4930a810c65db1a87db8c6fda1e364876499d9c594864c7e619b809d0f9ce5c5a09d602f
SSDEEP 6144:ua/jSqR7FD0OUx/IxkP96cTpHftOo/1gjkV5C896tZDKPDi2L0g5kcwfKX6tn7x4:VjSqY1yOn+xontXaG/6M
TLSH
T14DD4D606DDB46CB307A6B6B4EC5A6006F625400B1C48BD1877AC439C8F5E67E71FAB9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

squirrel.exe

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\squirrel.exe
Size 1.8MB
SHA256 7fa9634fd43af28ca3810805129c5f1bb31b3f1e525de0165f76311d4e216981
MD5 ad2f1fde0a54bed1db73f24a3cdf9cad
SHA1 747ad9e66a4c1b7f4cd593d22dbbdf9121a3e020
SHA512 03301abf4652bd85b89c25f8ce5f2cb29772b4587bce74a1d3225251ff03eeda405f92e7fd34722f36ef8bd8d5cb23967c94d456311284d99d7b09a1f29049bd
SSDEEP 24576:2WltPuAnUCiag6CKM2zCy9sQuOjj1VgZej6GeS4lNrCze5qhYp4t9mQH:Xt3UCiag6CKM2zCyZuOjJaxSS5qh
TLSH
T15C956C01E7E89F2BE56F6B76E030055813F3E9867376F78B2A4871792A937504E053A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\v8_context_snapshot.bin
Size 698KB
SHA256 7fc0c9d00df326f25eeb231b40f8505ff12b61aa1c77a2788abc82c418354399
MD5 9a7cd9d528befb3c4e384e9e4f397e6d
SHA1 a2d8b05c209f37550ac3953714cee1fc9f499740
SHA512 5f0cff79ad8b24cbec32e4efb878e51f4ca160eb5d2ef9accdcf80a5965a594e5cb1272f836fa8e73c58694ca96229c23b6f58f49303f2f8a19c5fd4f8951430
SSDEEP 6144:n/V4XptgO5XKt+HlzA/8n7zx2NyuClVlxykismIdukcLKYNcPK:n8D5XsEn/x2NySkQIId/H
TLSH
T178E4A761FB0A8F3AC5453BBD8DE657463A30B18E9E87E24B7405633D78B96B04C3652C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\ob_launcher\app-1.2.1\vk_swiftshader.dll
Size 5.4MB
SHA256 25bd0ce50c918cdf0888ec239dd8e47a89ddcdf1c1f7c974c64d81bacc025aa1
MD5 8cafec391ef8e0cd103eeafbb4e4d76d
SHA1 b725938a3be78fed9f5d18c303d4e06e83e0c679
SHA512 2066f8c149f869b8550d6c1332ac45e7564e09a7fbfff33f887e21af864612260674151263e20698b12de1c45c6d05fb483356c392dc013842f2810ddc5563d6
SSDEEP 49152:eJBNQqwFMu+Bxzny/Iu/d5rjXLlcsuS1cTqhzQNxyE/3uLgPjM5LV1wtNwLd6Mk5:enNQEhnCUMXn7uA603OeU
TLSH
T142463803F28681E9C06DE5798B5FA623F631F8840B2276DF56A00F192E66FE0673D715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ob.exe

Path C:\Users\Admin\AppData\Local\ob_launcher\ob.exe
Size 254KB
SHA256 edfdf2c27b79ce2b2681d008b24ccb64a4fed5557e43ea95aa8f1e20b8bc9abd
MD5 c01505f8a29a0624f9517a8f4a728de7
SHA1 c71f44dfe51667b9356e3124bd1a734c7b3047ff
SHA512 df1d5f673ccc9dd01949fa97edba0fc78411d2f0be760028f691d89fc24142f651c5a0c157637459585f1c7216519e76920e1bfaba8481648f77f20cfdeb6d5e
SSDEEP 3072:eZzaqLh5m21b4n86fZHi8c62bdq32BsWtEGwF4JOAg0FuDTT6EGR7rLIYMU:eZzvhs2Z4n1E7g34XtVYAOfTdGR7oXU
TLSH
T1FB445B21B9D3C4B2D5B2063409F8E7B5563DFD600E629A7B73D4372E1F341C29632AA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

f_000009

Path C:\Users\Admin\AppData\Roaming\ob\Cache\Cache_Data\f_000009
Size 32KB
SHA256 31e8ab913d9485259dfc2745a1c08cdec725b7cb87daabc841fd9c18b993c8b7
MD5 ba1d471af6075b86b8d8b2d2621c000b
SHA1 17310109c915251fc26a08d2b0e97a25041d2c28
SHA512 752d9347599e3c086f3b12969914e7024f71113af7d08c662dc03ba0788449ad9af1624b102b4aa2db265a50fc4f1415d35111b4d95cd8f02efab2592355cedd
SSDEEP 768:4X/GxTkPRDs00I3RolADpECRcYDhPb4sVp/6gS0xLcnpBJD/BcS1n:4X/Gxis00IQAyCDhb48/6gS0x455d1n
TLSH
T10AE2E18D0F4D4290C24BB5B1534DE6628C2D53C9625E2C8A3D319B677FEA07785E6C78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Roaming\ob\Cache\Cache_Data\f_00000a
Size 67KB
SHA256 288b1fbef8dc969e47b6cbb27dbd9e58c669f1db506c3635cfd4df6b9e5591d1
MD5 4c92df87187d2ad73ed1e7bf6ea444a1
SHA1 7fbfcd3062ea86931611dfb98f87624c875b7022
SHA512 789a28be2f72204e58cabae3091e61045a2494e0cab146e0dbd089354582f375ae46650f97334ab04ea00ece9307b57978813c3de83d485e3a8ebca611024fa4
SSDEEP 1536:/IxL39oeaSo9aQsk57/wewfugefXsjgZ1720MsvooJiqvyp5L:/Ixfvo9ik5FwRe0jgZjtJ1vypl
TLSH
T12063127354879B872DC61F6DBB0846FCC0593063C6A2935B361B1F85334A42C9BF5AD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Roaming\ob\Cache\Cache_Data\f_00000b
Size 29KB
SHA256 f654a5aca319d9b73e1b7110d9691f92a424d7f0e385263cbfcc7d56c6677c11
MD5 5d02c18753791c99e7abd7e568911d96
SHA1 e898cf7d9d2a409fa4ad61ba611364687154a95b
SHA512 5205762e57ba07d15ed0c398329ce72245132dd16371a69467e8b3f1dbaa999c60a46deadda56e8d9a8d316d44a2e9f5f65c5285514bfc59133719e9300c413c
SSDEEP 768:ZR9LWW6EHKtQq62kcYeraxAHUs8Md+oVVBsLn02lZAdVWuZlDUv:9P4kX8UVs+2C02fAdVjUv
TLSH
T137D2F1AD9FE1F5E4201CE2BD789D7496758B227B7F03E409DC90A283B600D951DC7189
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Roaming\ob\Cache\Cache_Data\f_00000d
Size 72KB
SHA256 81380a89b496670abeb8255a95fe424ef374ec9d311a54ea8f3d2773faff12f9
MD5 f84270ddd32be91eab619a19e16701cc
SHA1 c362fd60d568925d5f77d2ac47c2ab278eb96086
SHA512 4145fcdf0d6c36aaf9b953f547b7ecbb42f7394318edd440dcc0140f638198f43c4c9e5b67fdf6cbea927e99cbe5960e154e4708aa736911ddb708704ee85e63
SSDEEP 1536:qbq6bwZ1j70I/Gs4WgW6VwDMnYlsnrIttbJoAAvvuHaxwv:yqowZRV+44PIFJAvvHxwv
TLSH
T1A87312CAD80CBEDEF1A3490730FD0253C869B5925B14481762BBB1CFE6E54656E068F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000f

Path C:\Users\Admin\AppData\Roaming\ob\Cache\Cache_Data\f_00000f
Size 198KB
SHA256 cb6b96f5da62c6f40a95e56480ad070172f73b135d8db8f385b5f4168d1ecc05
MD5 f34b9a76d12fec436281a588b19cebc0
SHA1 f1ee80d3cc37276a09f0df535349aa19e12894a2
SHA512 4ffe725488634ef9c06c7908c722054ba512e793378f193336dda60ec0a1cbb31ba90ac34a9744d08923003f6f60ef2fdc5fe85380611219a8763648c037a396
SSDEEP 6144:lwM6HxIcrUyWaPYkMevwtTv8OThc9I2iQeZZjYlZeaiC:gHqcrUyAevxEM2Q4jyZeaiC
TLSH
T1421423433A97EBF547CECED19E8E57DD8993B61A885C1529AF824F931F0C01C26D70A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\ob\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 adb440d22e9da168bb02bc32a97a8423afcec651040863757834a6e6c3625058
MD5 25a670ba77be29d04aac0c1278cd6690
SHA1 891e63f8a5c0bf1d87bb9b0f5738b777a0a82fef
SHA512 1bfd237bca4c16e8c217e593cd6036a531fa5187211c7cb30d298fa92c1bcf97310543e2574caf26a22ca7e140ffbf56c27a46d84c04e22b7764bd05d721fd95
TLSH
T16AE05EF19809F14EDFA487F67561D7692AFC2412F71C4A0A59F0E57AAD45214B00AC3D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\ob\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 74aab5197d749bb503473983cfd272b6087a52e2e00dfdfafec9417ee118feeb
MD5 b4c932594e1ac6d4940ed307953c5747
SHA1 8f4f33dda9ded771f00af87062be8b4677bd30ba
SHA512 cc98b38187f03b674580127bd826f2300c9fc547945c90e6caa9fe99f3f979e8e7ab9ea1c7337eb6f576e225f999f51c7465a91e7bd29daf2b236d4316364205
TLSH
T146D012715C41F159CF54467525C2E76B35FC5111E31F5D0455F0D5756995700B501C3A
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\ob\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\ob\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 378fcf9f2d5604d6cc351c4a9bd8a041d276f292534b258d668f183eb0069051
MD5 46c9dcdf13a97beb0c294906dd9ee54b
SHA1 29dd0a181f72ef8a306c5e4ce7060b0ccb8c761f
SHA512 686a95f9d9237b66d0fef433559b4211396b3d7bdd06ab089cc65d8f1cc6a4010c7ebfb49dc0b9b6a65d7f87aace42cb44e2b1b95d14c6eb8a63b003e2fb5606
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\ob\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\ob\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\ob\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\ob\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\ob\DawnGraphiteCache\index
Size 256KB
SHA256 9152fa0f3a069c80b6c43c634e2199d562d29c21043d9fe63d475200c534f87a
MD5 13b1cc4c027d261fc5547c8b74d52f89
SHA1 0019ae8228d9c2bcdb89658d4a452fa8295e2f42
SHA512 55104dd95c61f52bf095a21733f4415777f392604cf9e3c66d662790b6be6d8b0c64bae646150b943e848a2a57b735fe363c1845982ab235fdfa394bc8bc171e
SSDEEP 3:LsOllllklkXlHN0ll:LsUlPt0l
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\ob\DawnWebGPUCache\index
Size 256KB
SHA256 a59f6ea4517328b54495ce11ac802b9ba057d162eb635b8b39a6e67a557b4b59
MD5 c1e294d1cd3d505c51430a865994bd54
SHA1 439856e9829362ec4948b3e1d8a077a7d19aa247
SHA512 0c6b7769a3b3836a0cda73b163a72ae1fa61c3167dbf26f5e421136c974bbfe1e32ad897b4c9d7ab291f6b1f1fd87646c5e8e1b73ebabdb9c4dff40317741e76
SSDEEP 3:LsOllllklkXlD+ll:LsUlPD+l
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\ob\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\ob\GPUCache\index
Size 256KB
SHA256 77ca437073a3ff72a10aae0c4bbe2ccaf12af2b92214c22dce97b1a56fd7d950
MD5 71b6b7251bbe6afaad35d641f42d0e02
SHA1 a6cff477906f704c82f88f0ff1d1e11b8133ca7a
SHA512 b840d330b8d10b9885f4e17ff3034af7e9815ac34adfcd798a0f0c6d5d1815495c901a5d1484ef18fa43e3438423e0807e74194bfaabd9ae28c48c93d1e34ae6
SSDEEP 3:LsOllllklkXlIcl:LsUlPIc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ob\Local State
Size 434B
SHA256 102489801a18edf394452a8a41a2d27dc71f02070f6714fbacc0aaabd6c99c33
MD5 23f87b7c4213beb7a5e9d15a76ef14da
SHA1 d94b0307381efa36482fa7efccce1e1dbccc8af5
SHA512 14eed5c374f0e2c14428b1390835aa8bcaacdacfbd97704633be07579b2d970163e37ca48931138fb99d1d9aeb875923b9ade1ed51fa9c1f9320d9732cff4f48
TLSH
T1CFE081F0A1E1AEACBF601C3D131283148F9C8237868236B009490307ABF39C48E21F3C
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Roaming\ob\Local Storage\leveldb\000003.log
Size 30B
SHA256 8bd2ea70a0b70c91de138a5b87c7936c6a6fa7c4275c54b97f4ef0ccc5b79bb4
MD5 7e957d693bbab6ad7dec1d3aa28bd69b
SHA1 50369f74c280d83046d6b779ecbde129b8ac3b98
SHA512 0228357b6c4b73f3ef20a333b7afe71fb589efe438bc28a3e04df3fb64f367b7b463dc9c9792921c531124b7bde600524827b40f2cc5aeddbc1df8b3ed822cbf
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Roaming\ob\Local Storage\leveldb\LOG
Size 235B
SHA256 f2e6161f33464e9f471a599e857db59abdec0f95b200810f592eea97677feabd
MD5 0788892be3c06f64f50ec0c25dca327e
SHA1 aab5590504efeeeb22a6e633269ea561f2ca56bd
SHA512 a0193ce4b463eb14077e22d6bde8ca4e98aa5be43cf2ff4f98cb92377eae1779d1d3ef081df8d99029f8ba66e6397670ed248912d7295f895e021eac40399ad4
TLSH
T150D05E32C6E9C65EA30980EB9636B71ACB70B6457EAC3389AF46E089B4D444C95524C3
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\ob\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\ob\Preferences
Size 168B
SHA256 de6a1097fd6c975bd63dd3d1325a71ae3328a63b1edf8649f35746481d3b3344
MD5 5490374504318e2621b8ed8e118e2478
SHA1 b9216128edb9343b1dc60eebca65a179263eda92
SHA512 edbceb75a597a1eb001bc11c0d28d9ac4674078cab2897a46043028c61528b67f8dddcebe64e6b1db841785c5b62fccbf5fea8ee39b865f49841b952d2588b4a
TLSH
T1E9C08012F4209133CA3F88654046DC495DFD41744D07490890D471694D1BD1D058702F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\ob\Preferences
Size 93B
SHA256 529b6595a4727a6b2d6cc154ae51f426216c01fc7fda02de2460abfb3de118a4
MD5 322f01bb491180333c338526d93f115a
SHA1 554d5e43d5e46774b8f2a6b3682243a289927754
SHA512 69f8e980f44b1465cee8c0485598fa00be163db0fe88598e45ab2f817f9bea36a2b70dbb9d25d5214174ea9c198b9641bb3d5a86c18b1a4ea4493c00e2e95eb2
TLSH
T103B01253B810A0324B1B09E5000BC94F2CBE00340E475A0510D4F39D492DD4D088702B
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\ob\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 d466dd0d260890e9c76a9f909e3e168e8a8f842007444df00fc75bdd008d195f
MD5 203853a210f375c51fb0ae5928e9fbc4
SHA1 128307d1c5f38eb931d89bbda0943b24fbf942e0
SHA512 c34cb5c5ba4111eeacbb1ae968603fcb616fe4b9b0f508d26ca9f6deacfc06e3e99efcd9c2d580d94b6028248430d853d30d74ea11a72da5068ae4e8a85a8978
TLSH
T1C5D0A76BE1A54C90EFBF8B81AA32605A8760BC8895C6A448D912252C14B9B57D221EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\ob\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 406798d1ad6574229a2257bead0139c3b45554df46742934892b928923176d0d
MD5 f1695e19a468c65eb00a9eaa449867be
SHA1 21fcd7c28079dfd4f8d589c9519ca6a7c48b56b1
SHA512 2a766124ca1af9d5b40da1565164f98754be1eb3d71ef387921a747e908a6540508eb1e9e6ce534c823b4d0efd4e4b54b54ec0874e797acfd055e61bee0a5270
TLSH
T17DD0A76BE1A88C90AEFFCF816A22502A8721BC8894D69448D912052C1899B57D222E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a6fb3.TMP

Path C:\Users\Admin\AppData\Roaming\ob\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a6fb3.TMP
Size 138B
SHA256 2bcf8617ab8814d2b1a603c6986ef2f8313d951b433be18165f00f7347fa2533
MD5 f87df5097518b8bcad0eaaa1dbb6dafb
SHA1 f8bdd04bacbcff96468b22d52ab452f7dbda42f2
SHA512 4a0a9cffec2fe0eb0a65f1f9c4774c2961d49c495a3d34a1565f667824b38c6742cf4f97bc8f4c9eee099a6ea2c2f9bf6a862926e9ca34217078dfb1c3d9fa28
TLSH
T1BAC02B6BE3880C548B3D07819333610EC300BCCC88C7D04CE617365420F5F236601EE1
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\ob\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\ob\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

memory/252-97-0x00000000007E0000-0x00000000009B6000-memory.dmp

Download

memory/1088-10-0x00000000005B0000-0x0000000000786000-memory.dmp

Download

memory/1088-104-0x000000001C990000-0x000000001C99E000-memory.dmp

Download

memory/1088-103-0x0000000021640000-0x000000002167E000-memory.dmp

Download

memory/1372-747-0x0000028C78A30000-0x0000028C78B03000-memory.dmp

Download

memory/1412-1076-0x0000022BF7560000-0x0000022BF7633000-memory.dmp

Download

memory/1456-406-0x000001F0BA490000-0x000001F0BA563000-memory.dmp

Download

memory/2108-637-0x0000015360B50000-0x0000015360C23000-memory.dmp

Download

memory/2220-738-0x000001398FFA0000-0x0000013990073000-memory.dmp

Download

memory/3408-309-0x00000174A3630000-0x00000174A3703000-memory.dmp

Download

memory/3800-1221-0x00000194D7DD0000-0x00000194D7EA3000-memory.dmp

Download

memory/4184-424-0x000002B260AE0000-0x000002B260BB3000-memory.dmp

Download

memory/4256-172-0x00007FFD17830000-0x00007FFD17831000-memory.dmp

Download

memory/4256-173-0x00007FFD16AD0000-0x00007FFD16AD1000-memory.dmp

Download

memory/4256-197-0x0000027FAD760000-0x0000027FAD833000-memory.dmp

Download

memory/4376-409-0x000001B9D8780000-0x000001B9D8853000-memory.dmp

Download

memory/4960-745-0x000001EE92400000-0x000001EE924D3000-memory.dmp

Download

memory/5164-1267-0x0000023002850000-0x0000023002923000-memory.dmp

Download

memory/5380-1268-0x0000019564290000-0x0000019564363000-memory.dmp

Download

memory/5604-179-0x0000000000C90000-0x0000000000CB0000-memory.dmp

Download

memory/5888-1198-0x00000260666A0000-0x0000026066773000-memory.dmp

Download

memory/6244-1269-0x000001871A190000-0x000001871A263000-memory.dmp

Download

memory/6292-1242-0x0000013835B50000-0x0000013835C23000-memory.dmp

Download

memory/6304-1270-0x000001D5D49F0000-0x000001D5D4AC3000-memory.dmp

Download

memory/6504-1252-0x000001CB998A0000-0x000001CB99973000-memory.dmp

Download

memory/6652-1253-0x000001732B370000-0x000001732B443000-memory.dmp

Download

memory/6672-1254-0x000002B251CA0000-0x000002B251D73000-memory.dmp

Download

memory/6696-1255-0x00000204FF490000-0x00000204FF563000-memory.dmp

Download

memory/6712-1256-0x0000023B274E0000-0x0000023B275B3000-memory.dmp

Download

memory/6828-1257-0x000001FE22A40000-0x000001FE22B13000-memory.dmp

Download

memory/6836-1258-0x0000021B90130000-0x0000021B90203000-memory.dmp

Download

memory/6844-1259-0x000002E4DA2E0000-0x000002E4DA3B3000-memory.dmp

Download

memory/6876-1260-0x0000022ED1490000-0x0000022ED1563000-memory.dmp

Download

memory/6888-1261-0x000001F1E9230000-0x000001F1E9303000-memory.dmp

Download

memory/6900-1262-0x0000019EED910000-0x0000019EED9E3000-memory.dmp

Download

memory/6944-1263-0x0000026DD6860000-0x0000026DD6933000-memory.dmp

Download

memory/6968-1264-0x00000246475D0000-0x00000246476A3000-memory.dmp

Download

memory/6976-1265-0x000002F99B160000-0x000002F99B233000-memory.dmp

Download

memory/7156-1266-0x00000195E4BF0000-0x00000195E4CC3000-memory.dmp

Download

memory/7392-1285-0x00000177F4B10000-0x00000177F4BE3000-memory.dmp

Download