Analysis
- max time kernel
150s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/07/2026, 04:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cb-launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb-launcher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target cb-launcher.exe
- Size 2.4MB
- Sample260711-e96vradz8s
- SHA256 949c185c70d78e08c86fad5c449aa4e5002e4baee545a3ff7ec549110a660398
- MD5 d18e630e71303857bde79f95fff68e92
- SHA1 c1f0b979bcebcc7fbb94d58fd232d30afb192146
- SHA512 719415abeb6dba48565741cdf65119bfa5957d596211c1c4920bc0facb9ba8b391ddd3a30c2c2637fd5fb934f7655863a74bfa354f3dfe79a89d5885c4b2b725
- SSDEEP 49152:D+rQpOwXWUVZ7Dc4cvep1F8uUoNJ0FE4n:W+WUVbcEhv8EC
- TLSH T12CB58E27A3A800E9D1BAC278CE579606E7737405137267EF16A087961F67BE41F3EB01
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Detects Remus stealer 1 IoCs
resource yara_rule behavioral2/files/0x000d00000001c4de-126.dat family_remus_stealer - Loads dropped DLL 15 IoCs
pid Process 4104 cb-launcher.exe 4104 cb-launcher.exe 4104 cb-launcher.exe 4104 cb-launcher.exe 4400 cb-launcher.exe 4400 cb-launcher.exe 2008 cb-launcher.exe 2008 cb-launcher.exe 4104 cb-launcher.exe 4104 cb-launcher.exe 4104 cb-launcher.exe 5648 cb-launcher.exe 5648 cb-launcher.exe 3416 cb-launcher.exe 3416 cb-launcher.exe - Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 229 raw.githubusercontent.com 74 raw.githubusercontent.com 185 raw.githubusercontent.com 306 raw.githubusercontent.com 313 raw.githubusercontent.com 370 raw.githubusercontent.com 417 raw.githubusercontent.com 233 raw.githubusercontent.com 396 raw.githubusercontent.com 300 raw.githubusercontent.com 414 raw.githubusercontent.com 261 raw.githubusercontent.com 338 raw.githubusercontent.com 517 raw.githubusercontent.com 20 raw.githubusercontent.com 199 raw.githubusercontent.com 399 raw.githubusercontent.com 250 raw.githubusercontent.com 474 raw.githubusercontent.com 500 raw.githubusercontent.com 81 raw.githubusercontent.com 190 raw.githubusercontent.com 228 raw.githubusercontent.com 254 raw.githubusercontent.com 366 raw.githubusercontent.com 107 raw.githubusercontent.com 402 raw.githubusercontent.com 458 raw.githubusercontent.com 506 raw.githubusercontent.com 382 raw.githubusercontent.com 372 raw.githubusercontent.com 513 raw.githubusercontent.com 380 raw.githubusercontent.com 440 raw.githubusercontent.com 448 raw.githubusercontent.com 248 raw.githubusercontent.com 46 raw.githubusercontent.com 347 raw.githubusercontent.com 354 raw.githubusercontent.com 510 raw.githubusercontent.com 1 raw.githubusercontent.com 255 raw.githubusercontent.com 265 raw.githubusercontent.com 281 raw.githubusercontent.com 283 raw.githubusercontent.com 413 raw.githubusercontent.com 495 raw.githubusercontent.com 410 raw.githubusercontent.com 466 raw.githubusercontent.com 127 raw.githubusercontent.com 334 raw.githubusercontent.com 351 raw.githubusercontent.com 76 raw.githubusercontent.com 223 raw.githubusercontent.com 325 raw.githubusercontent.com 342 raw.githubusercontent.com 482 raw.githubusercontent.com 42 raw.githubusercontent.com 65 raw.githubusercontent.com 509 raw.githubusercontent.com 79 raw.githubusercontent.com 117 raw.githubusercontent.com 178 raw.githubusercontent.com 404 raw.githubusercontent.com - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\URL Protocol cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\shell\open cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cb-launcher.exe\" \"%1\"" cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\ = "URL:CB Servers Protocol" cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\DefaultIcon cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cb-launcher.exe\",0" cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\shell\open\command cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\cbservers\shell cb-launcher.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4400 cb-launcher.exe 4400 cb-launcher.exe 4400 cb-launcher.exe 4400 cb-launcher.exe 2008 cb-launcher.exe 2008 cb-launcher.exe 2008 cb-launcher.exe 2008 cb-launcher.exe 5648 cb-launcher.exe 5648 cb-launcher.exe 5648 cb-launcher.exe 5648 cb-launcher.exe 3416 cb-launcher.exe 3416 cb-launcher.exe 3416 cb-launcher.exe 3416 cb-launcher.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe Token: SeShutdownPrivilege 4104 cb-launcher.exe Token: SeCreatePagefilePrivilege 4104 cb-launcher.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4104 cb-launcher.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4104 wrote to memory of 4400 4104 cb-launcher.exe 90 PID 4104 wrote to memory of 2008 4104 cb-launcher.exe 91 PID 4104 wrote to memory of 3416 4104 cb-launcher.exe 92 PID 4104 wrote to memory of 5648 4104 cb-launcher.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --enable-experimental-web-platform-features --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --mojo-platform-channel-handle=2656 --field-trial-handle=2652,i,564041108370969563,1266821603469474923,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:82⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4400
-
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --enable-experimental-web-platform-features --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --mojo-platform-channel-handle=2736 --field-trial-handle=2652,i,564041108370969563,1266821603469474923,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:82⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --first-renderer-process --no-sandbox --enable-experimental-web-platform-features --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=2652,i,564041108370969563,1266821603469474923,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --no-sandbox --enable-experimental-web-platform-features --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=2652,i,564041108370969563,1266821603469474923,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:12⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5648
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_100_percent.pak
- Size 607KB
- SHA256 80139849d4cf4a9dc8ad429be071229bd7538c41f5af5aed498fd981873bd4cf
- MD5 eae66715d9a0d3a3574223e130dd3c83
- SHA1 8c6d664f736414c9fa75a5eaff2b452a94875a4c
- SHA512 f7e9a41030452879612a2916c06d514290757d2ba44149973deb45021622520bbe05a338d7d1554e095a48812ded0ee47f40c73ae7b1b988edadda7ef717f3fc
- SSDEEP 12288:dN8I3HbGgsz5B0GDJQrnKs8SNP+QSsSilHjzaR+6IdRuEDoO0Tehf7:r370zEEmPLScjz16oRZoO0TOj
- TLSH T1EDD412D373B4ED3DEA67567BA22904B4EC7345190AA2020A178FE8796E53748D8DD3C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_200_percent.pak
- Size 915KB
- SHA256 f2a2c9dd0ec8baf6820b445a1485787c6651d3f0c8d0ec8f58a808b836fa04d0
- MD5 7f25dc4230fbfb1b2ee7a2133f929fe4
- SHA1 54b9c0240f18f7f1507ade53cf332b63926a9077
- SHA512 c8a4cb67ebccf4e5e721e9542a5b4f94db1bd30ddd090f784db5d02b84a22c07aec013c51a5a8e045ca1cb8065d0917313eb39dac39032216091e675f65eb39e
- SSDEEP 24576:d3K0zkmmibkFR8+mZ8svQtPUw9WNbaK6edhOLoJ9:d3K0YmNbkFRJm2wQtJ9WTjrO6
- TLSH T1D71512D3A374CD7DCD630A77A25A01F1FCB510360AB6550B07ABAD393A567889CCA783
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_elf.dll
- Size 1.4MB
- SHA256 08ab23efb637be966b98a446e7bade2c321c40d276d1bc9b7bf2c2e372773fc1
- MD5 64fe193a87f6038c2680cfd3daff3baf
- SHA1 21a16e168c490b557f51409673a0865024586ddd
- SHA512 6ce3f469303351ac03374db1dfaf854b6dba24684303bffb913b4611e47e74e9884e43cbf17913b881e272a0d1a2c20f3e6658a37526ae05a461ffa713315e38
- SSDEEP 24576:FiG0brZ7IaEWKaRFvximf8K8Fm9MMPVdBdIpvb/A:FiGIrZ7QRaXAm+cXPVndIpvU
- TLSH T153658D17B29941F8D06EC17487474636EA727C520B30BAEF0698BA592E7BFE0673D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\d3dcompiler_47.dll
- Size 4.7MB
- SHA256 e4bc3420a28069bd13dc3be725d46676a7c0e99de221026e8c43cd6f7ed45c0b
- MD5 abe034c17e745bb9067ba38c18568880
- SHA1 7fea3a5664ddb084d42eaaa85fbee2dda18c5c80
- SHA512 ac08eeeee059c25af5397e2b417a2d92dbd07f0bf86187eff4ee233befe5c8e6386963401e06c981de734eb4e848714892bea0222f3bd0dec4453f79216697c6
- SSDEEP 49152:NuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccF:By904wYbZCoOI85oyIG
- TLSH T144367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\icudtl.dat
- Size 10.1MB
- SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
- MD5 2134e5dbc46fb1c46eac0fe1af710ec3
- SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
- SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb
- SSDEEP 98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
- TLSH T1C4B63803A2FB4EC2F9FB6F31D8F452679567BD496E32805A01042F3B5C336908665BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\libEGL.dll
- Size 464KB
- SHA256 f7d7ac7f1728e2b9005c018dd3b02e7abbb6e72cc5e6487170f4789370d0d73d
- MD5 f5dd1930751a60a81daf7fef2c5b64f9
- SHA1 566d84445d3bf86b7998cdda4940d150a1e23b7b
- SHA512 139d3633c8592fce287cd7b4b92b31ef9397832c7783d713e6981231e7ed244598ada8369726ec08c5d8d9a9e21150d2e2af8fd8511897812dc99c7c13860f33
- SSDEEP 6144:8nPnI88wUrg5221YJyTscPsEb+fqhWfWgF5Dk:YI8PUrg5oBcPTvWfWS
- TLSH T17BA48C15B7A544A9D02BC434CA578643EA76B8960F71F6DF0294E23D2F3BBE51B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\libGLESv2.dll
- Size 7.0MB
- SHA256 25c093a77b4a1ea7ed6281b0fea3ff78b65b92943dd428b7b03ca30ba3d18b9f
- MD5 a77815f73ecfcbe65b2a7bf4989efd2c
- SHA1 4fea955dcbdf265c855b406e9e88ad24845aecfe
- SHA512 469e7e60bc30d1f05a2b9e66a13b909b7b9484069199b94e223b6629779e702916688e72f959413b512094349aff7182e73960e1e29e066277d583743dbb4e9c
- SSDEEP 98304:JrCUUS2s0+RaBhTTrUNTGpHDxA3rfRMGr:3+sNTPr
- TLSH T14C766C13F6A541DED05EC279CB5B9633F630B8950730B2DF2A9817252FA6BE05B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales\en-US.pak
- Size 384KB
- SHA256 18b68d00be426a4f7acd4efc1e45ae296720ade13ca66d3cf768e48d814b6a25
- MD5 6252747a75950f7b35dfab8a68b5a2e2
- SHA1 9e326b2e19369da8dd964179b5cb6e281200c459
- SHA512 d5ce8114e5d25ae0dd6fcaafc760e5e07f16679b9d34783bbeb7cc43f7e1b91c61d9322991893f39de799c332d497c0d787ee64c064cab4b4eab907e9953d140
- SSDEEP 6144:Gsa9U2QMh961PILMP9ecNmMJfaY2zt9j5urSgne2aVwG:Gsa9U1DV2MlmMKzn58S3VwG
- TLSH T116846D1FF744222A069352627F099562BF36D06CA35112663CBD813C33B7B66C27B7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\resources.pak
- Size 7.4MB
- SHA256 6f9dafb5d3f16b89d13c01bcd52695d0671a66f6719a6bc54a878106903516c0
- MD5 ae257b89b5c4d150463136bfd453d8f1
- SHA1 122cd56eef4b50f50a4be1520b765e6142a2cbc1
- SHA512 11ad48df3d41a5d2f156108503538494db7a4c86058ae6b9c9cc54ad7eaf565bf371e812f76a0857ce2f0985c13738927f1e75a91fedc0304726d36d568c6bb4
- SSDEEP 196608:vt2wbBtt0Xlxh2co6ItFKWBiGhaKNhkrVPF6eelh:vt2aBz0xPWoT2krD6eelh
- TLSH T1B7763320F365AC3FC0C8E3B5986D41335F29584229A6B85EB0CD620D9F6D25A4BF167F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\v8_context_snapshot.bin
- Size 661KB
- SHA256 eb3bb6497db6ed980a1702ef2db9df891ea6327a6498e670d038b41f69c3ff10
- MD5 e5805239e163f6b63de51fd8bc815c03
- SHA1 138c7de6ea565012e2911e284bdcb89a396bbe42
- SHA512 0a15a807405a89db2a7370f65bd351bea981266dd668b5ce85708aa342b09557b932371cfa34baea893b1e1116a0c7a098ef313c0bb94d8a77a00416cd30ebb7
- SSDEEP 6144:OMi8t1sxjZ5O8Qsg8zp5zYiqluzARVO2/Vbra7xQJ:uHptYiVUVO37q
- TLSH T167E46084F701DAA7FD1129B1CED684C433B4FA45DF034CA7B2949B2E6A66B722D243D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\vulkan-1.dll
- Size 902KB
- SHA256 ae91c4e7548eaf48b1a65c43f518e2c1989b4740efe82726b56b6be31cbfd1c3
- MD5 0e12ae397d99a654d2d4563e125f4410
- SHA1 d31bf003a20c9acb6776ffef91bac6ff28e253a3
- SHA512 7f9e3eff523c1975f0ad642be65e49a561052c0a1c7cacb0fb8dd0875207f8339b093e5437437aaae68fccc3bf19dc9474d9187715e77b3b797ed4fac4207f4a
- SSDEEP 24576:TN4xVfNwgednIlMdKKg0x6Z5WqDYsHA6g3P0zAk7:yxVfNwgaIlMdL6Z5WqDYsHA6g3P0zAk7
- TLSH T1D6156D27A694492AD476C034D9828607C9B1B8921B25B5DF03684B0DBF6FBF8373DB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\discord\discord_partner_sdk.dll
- Size 9.4MB
- SHA256 46170463bf263045972fde1ccaa51b380eb1443541036a809d24f4e6a9f9c388
- MD5 75c2d48b9b95522f8a7f1706a8fc2e85
- SHA1 fa1d29a68cca5074fa25d441b21ea0e64b57cb35
- SHA512 205e2d7f8ee478e3e4c995c8d121f84fa76e6372474d684839d15dbcd2e3ad004cfc825593225961c0c1f671e5dbdf0807774d4321d14925d54f89d6be7662bf
- SSDEEP 196608:Oser7o2bIRaNUkysOYZdx4tqIMS4jxIBiFGcmJ:Oser7o2bIRaNUkBOYZdx4tKS4jxIoFGb
- TLSH T119A65B03F78A50FDC49AD178934BA537EA31788A072579DB07909B252EB7BE05B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 8b5bbe1807e2c4dfc8cb127925b73f6c7ec7a32b52abdf600087870c05ecb9d5
- MD5 cddd21694e1f171fd317fe1c3f8d97cc
- SHA1 8054983730411707ab4f5c05aa3971f17ab80c1c
- SHA512 ec68da49802afbc0423799aecc520c13e3386e1699deb90d7975fda651358e10cc0b09e6bc13abd19825099ce4b11185ca0e5dbc1d37541aa7d00727c15f955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Code Cache\js\index-dir\the-real-index
- Size 432B
- SHA256 36944e28ebf9471f2a3e4b043f3003d2456e47bfea24497515571fb9488679a4
- MD5 b02183ebe7605bbb933eaf478bae2ab9
- SHA1 a2fbcd634f6b3ca134f15a861fe23586f879a43d
- SHA512 6396a3a11ce35527e777d344fb1df0a8d514a37dda731062ea957034600d218162a66d288bdcaa5a07e8efff8a28a922924e326177b670e86d2dfd382359daa9
- TLSH T163E0C212330405D3C75CC73CA4CD00F031B056D04F4B7CD88DA879B9C4343615326B21
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Network\TransportSecurity
- Size 188B
- SHA256 3176d97ae11f94e0c03e12940322754d3a3e3e3bee312cfa3cd2ee9fe692b1a1
- MD5 9ff11bb1b11f9dc4dba37fc6529e4293
- SHA1 49b26ae0d5591059c3c58e93562156b321f2a088
- SHA512 100058b104f2f1d7f1d94ca3a1a186912eb9104703c36ce6dc551431a34b40bfc63564deca25434acbcce6f4e98352bd27d5651933e0679660995a99a8122dbe
- TLSH T1CDC022630069E0B220A80A3D08C06D0EAE3BB03800405CE88E42422890003BF6203022
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Network\TransportSecurity~RFe5b07bd.TMP
- Size 188B
- SHA256 a8a745bf7cfd034b5c7826a429e3a6a49da67c932662273ac764423cccc53bb9
- MD5 02102ed72e9597edaea7bd74ea9eb21e
- SHA1 b39bb0d81f2dedbdfd5db9d94fdaba0d4f99e799
- SHA512 4feaa679a2faf2ac930140e7f6c9ce10d440a0728a9d65401897d05e959ef5d1f3fdba17e4d66fa9fa13a9b753be9cb307c3b1325025e2e602080f6c502ab7d7
- TLSH T1A9C0227204ADA0322038053948C06D08BE3ABA3800C25CE886438228A0002BF920302A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Session Storage\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\cbservers\user\properties.json
- Size 43B
- SHA256 8e6b98f7f97d17ee84e73dbc4798ee82ad2c008ece6c1ed683940b5a70811897
- MD5 20f826e74d2e19dc425486219c046db5
- SHA1 196e57b51f4d33e300b07fea555909096cce73fd
- SHA512 93d585669097615749ec0f8436677f85f540ac044a96c808d869e0364a00d94e2608757d69c05b660a771143597f003e6ffb3f438f19fa6a8cbf12f7a3dd0ca0
- MD5 SHA1 SHA512