Analysis
- user interaction
yes - max time kernel
450s - max time network
440s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
cb-launcher.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
cb-launcher.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target cb-launcher.exe
- Size 2.6MB
- Sample260808-c75tkagk8x
- SHA256 c316e67a2136dcd29f49ddfbf3558286e7b0361813b99da063e73c8127a298b1
- MD5 b1285afd8abaaed71b988436196da574
- SHA1 610acefe855385d7c99aadcf7d2888adca2dd68a
- SHA512 2b6755c4b6e9f8f7c96cbfb797ce29c7eafbafd5861e33406b570349fd9713aca2077707b31cc551515029b57c110ebf1cd13c38dd5d529eb14149a16c95fea5
- SSDEEP 49152:0GxyvJAUMrNAv830y+nR4U4GrddpSVSFKdo/HnFW9v4G:YJMrNb7+v/v4Ro/oz
- TLSH T1F9C58D2763EC00E9E0B6C178CE979A06E7737446037167DF16A086AA5FA77E40E7E701
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Remus
Remus is a stealer written in C++.
- Detects Remus stealer 1 IoCs
resource yara_rule behavioral1/files/0x000400000001da74-146.dat family_remus_stealer - Contacts third-party web service commonly abused for C2 1 TTPs 64 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 596 raw.githubusercontent.com 105 raw.githubusercontent.com 547 raw.githubusercontent.com 563 raw.githubusercontent.com 613 raw.githubusercontent.com 182 raw.githubusercontent.com 258 raw.githubusercontent.com 374 raw.githubusercontent.com 453 raw.githubusercontent.com 472 raw.githubusercontent.com 639 raw.githubusercontent.com 61 raw.githubusercontent.com 423 raw.githubusercontent.com 456 raw.githubusercontent.com 558 raw.githubusercontent.com 598 raw.githubusercontent.com 85 raw.githubusercontent.com 201 raw.githubusercontent.com 310 raw.githubusercontent.com 475 raw.githubusercontent.com 517 raw.githubusercontent.com 611 raw.githubusercontent.com 272 raw.githubusercontent.com 381 raw.githubusercontent.com 429 raw.githubusercontent.com 467 raw.githubusercontent.com 207 raw.githubusercontent.com 157 raw.githubusercontent.com 372 raw.githubusercontent.com 399 raw.githubusercontent.com 425 raw.githubusercontent.com 529 raw.githubusercontent.com 609 raw.githubusercontent.com 266 raw.githubusercontent.com 444 raw.githubusercontent.com 316 raw.githubusercontent.com 363 raw.githubusercontent.com 441 raw.githubusercontent.com 260 raw.githubusercontent.com 353 raw.githubusercontent.com 620 raw.githubusercontent.com 221 raw.githubusercontent.com 28 raw.githubusercontent.com 177 raw.githubusercontent.com 191 raw.githubusercontent.com 278 raw.githubusercontent.com 334 raw.githubusercontent.com 623 raw.githubusercontent.com 301 raw.githubusercontent.com 483 raw.githubusercontent.com 439 raw.githubusercontent.com 487 raw.githubusercontent.com 551 raw.githubusercontent.com 566 raw.githubusercontent.com 217 raw.githubusercontent.com 270 raw.githubusercontent.com 541 raw.githubusercontent.com 583 raw.githubusercontent.com 393 raw.githubusercontent.com 530 raw.githubusercontent.com 288 raw.githubusercontent.com 344 raw.githubusercontent.com 595 raw.githubusercontent.com 631 raw.githubusercontent.com - Downloads MZ/PE file 8 IoCs
flow pid Process 198 3252 cb-launcher.exe 101 3252 cb-launcher.exe 105 3252 cb-launcher.exe 125 3252 cb-launcher.exe 126 3252 cb-launcher.exe 127 3252 cb-launcher.exe 145 3252 cb-launcher.exe 151 3252 cb-launcher.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation cb-launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation cb-launcher.exe Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation cb-launcher.exe - Loads dropped DLL 16 IoCs
pid Process 3252 cb-launcher.exe 3252 cb-launcher.exe 3252 cb-launcher.exe 3252 cb-launcher.exe 3252 cb-launcher.exe 3252 cb-launcher.exe 3252 cb-launcher.exe 3252 cb-launcher.exe 5008 cb-launcher.exe 5008 cb-launcher.exe 3176 cb-launcher.exe 1284 cb-launcher.exe 3176 cb-launcher.exe 1284 cb-launcher.exe 1196 cb-launcher.exe 1196 cb-launcher.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cb-launcher.exe\" \"%1\"" cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\ = "URL:CB Servers Protocol" cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\URL Protocol cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\DefaultIcon cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\shell cb-launcher.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cb-launcher.exe\",0" cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\shell\open\command cb-launcher.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\cbservers\shell\open cb-launcher.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3536 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3536 taskmgr.exe Token: SeSystemProfilePrivilege 3536 taskmgr.exe Token: SeCreateGlobalPrivilege 3536 taskmgr.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe Token: SeCreatePagefilePrivilege 3252 cb-launcher.exe Token: SeShutdownPrivilege 3252 cb-launcher.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe 3536 taskmgr.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3252 wrote to memory of 1284 3252 cb-launcher.exe 100 PID 3252 wrote to memory of 5008 3252 cb-launcher.exe 101 PID 3252 wrote to memory of 3176 3252 cb-launcher.exe 102 PID 3252 wrote to memory of 1196 3252 cb-launcher.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"1⤵PID:4548
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3536
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"1⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --enable-experimental-web-platform-features --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --mojo-platform-channel-handle=2620 --field-trial-handle=2748,i,13746777374486984257,16036261257878286506,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:82⤵
- Loads dropped DLL
PID:1284
-
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --use-angle=swiftshader-webgl --use-gl=angle --enable-experimental-web-platform-features --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --mojo-platform-channel-handle=2756 --field-trial-handle=2748,i,13746777374486984257,16036261257878286506,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:82⤵
- Loads dropped DLL
PID:5008
-
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --first-renderer-process --no-sandbox --enable-experimental-web-platform-features --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=2748,i,13746777374486984257,16036261257878286506,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:3176
-
-
C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe"C:\Users\Admin\AppData\Local\Temp\cb-launcher.exe" --type=renderer --locales-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\cbservers\data\cef\release" --user-data-dir="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\user" --cb-subprocess --no-sandbox --enable-experimental-web-platform-features --log-file="C:\Users\Admin\AppData\Local\cbservers\user\cef-data\debug.log" --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=2748,i,13746777374486984257,16036261257878286506,262144 --enable-features=BlockInsecurePrivateNetworkRequests,BlockInsecurePrivateNetworkRequestsForNavigations,BlockInsecurePrivateNetworkRequestsFromPrivate,BlockInsecurePrivateNetworkRequestsFromUnknown,ClientHintThirdPartyDelegation,ClientHintsMetaEquivDelegateCH,ClientHintsMetaHTTPEquivAcceptCH,ClipboardCustomFormats,CookieSameSiteConsidersRedirectChain,CreateImageBitmapOrientationNone,CriticalClientHint,DocumentPictureInPictureAPI,DocumentPolicyNegotiation,DocumentReporting,EditContext,EnableCanvas2DLayers,ExperimentalContentSecurityPolicyFeatures,OriginIsolationHeader,PendingBeaconAPI,PrivateNetworkAccessRespectPreflightResults,SchemefulSameSite,StorageAccessAPI,StorageAccessAPIForOriginExtension,ThirdPartyStoragePartitioning,UserAgentClientHint --disable-features=BackForwardCache,CalculateNativeWinOcclusion /prefetch:12⤵
- Checks computer location settings
- Loads dropped DLL
PID:1196
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_100_percent.pak
- Size 607KB
- SHA256 80139849d4cf4a9dc8ad429be071229bd7538c41f5af5aed498fd981873bd4cf
- MD5 eae66715d9a0d3a3574223e130dd3c83
- SHA1 8c6d664f736414c9fa75a5eaff2b452a94875a4c
- SHA512 f7e9a41030452879612a2916c06d514290757d2ba44149973deb45021622520bbe05a338d7d1554e095a48812ded0ee47f40c73ae7b1b988edadda7ef717f3fc
- SSDEEP 12288:dN8I3HbGgsz5B0GDJQrnKs8SNP+QSsSilHjzaR+6IdRuEDoO0Tehf7:r370zEEmPLScjz16oRZoO0TOj
- TLSH T1EDD412D373B4ED3DEA67567BA22904B4EC7345190AA2020A178FE8796E53748D8DD3C3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_200_percent.pak
- Size 915KB
- SHA256 f2a2c9dd0ec8baf6820b445a1485787c6651d3f0c8d0ec8f58a808b836fa04d0
- MD5 7f25dc4230fbfb1b2ee7a2133f929fe4
- SHA1 54b9c0240f18f7f1507ade53cf332b63926a9077
- SHA512 c8a4cb67ebccf4e5e721e9542a5b4f94db1bd30ddd090f784db5d02b84a22c07aec013c51a5a8e045ca1cb8065d0917313eb39dac39032216091e675f65eb39e
- SSDEEP 24576:d3K0zkmmibkFR8+mZ8svQtPUw9WNbaK6edhOLoJ9:d3K0YmNbkFRJm2wQtJ9WTjrO6
- TLSH T1D71512D3A374CD7DCD630A77A25A01F1FCB510360AB6550B07ABAD393A567889CCA783
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\chrome_elf.dll
- Size 1.4MB
- SHA256 08ab23efb637be966b98a446e7bade2c321c40d276d1bc9b7bf2c2e372773fc1
- MD5 64fe193a87f6038c2680cfd3daff3baf
- SHA1 21a16e168c490b557f51409673a0865024586ddd
- SHA512 6ce3f469303351ac03374db1dfaf854b6dba24684303bffb913b4611e47e74e9884e43cbf17913b881e272a0d1a2c20f3e6658a37526ae05a461ffa713315e38
- SSDEEP 24576:FiG0brZ7IaEWKaRFvximf8K8Fm9MMPVdBdIpvb/A:FiGIrZ7QRaXAm+cXPVndIpvU
- TLSH T153658D17B29941F8D06EC17487474636EA727C520B30BAEF0698BA592E7BFE0673D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\d3dcompiler_47.dll
- Size 4.7MB
- SHA256 e4bc3420a28069bd13dc3be725d46676a7c0e99de221026e8c43cd6f7ed45c0b
- MD5 abe034c17e745bb9067ba38c18568880
- SHA1 7fea3a5664ddb084d42eaaa85fbee2dda18c5c80
- SHA512 ac08eeeee059c25af5397e2b417a2d92dbd07f0bf86187eff4ee233befe5c8e6386963401e06c981de734eb4e848714892bea0222f3bd0dec4453f79216697c6
- SSDEEP 49152:NuhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccF:By904wYbZCoOI85oyIG
- TLSH T144367D5673E940A9C1BBD138CE478213EBB1781403345BEB5191C669EF73BE26A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\icudtl.dat
- Size 10.1MB
- SHA256 ee3c8883effd90edfb0ff5b758c560cbca25d1598fcb55b80ef67e990dd19d41
- MD5 2134e5dbc46fb1c46eac0fe1af710ec3
- SHA1 dbecf2d193ae575aba4217194d4136bd9291d4db
- SHA512 b9b50614d9baebf6378e5164d70be7fe7ef3051cfff38733fe3c7448c5de292754bbbb8da833e26115a185945be419be8dd1030fc230ed69f388479853bc0fcb
- SSDEEP 98304:GKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8j:GKPBhORjOhCliXUxiG9Ha93Whla6ZGr4
- TLSH T1C4B63803A2FB4EC2F9FB6F31D8F452679567BD496E32805A01042F3B5C336908665BB6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\libEGL.dll
- Size 464KB
- SHA256 f7d7ac7f1728e2b9005c018dd3b02e7abbb6e72cc5e6487170f4789370d0d73d
- MD5 f5dd1930751a60a81daf7fef2c5b64f9
- SHA1 566d84445d3bf86b7998cdda4940d150a1e23b7b
- SHA512 139d3633c8592fce287cd7b4b92b31ef9397832c7783d713e6981231e7ed244598ada8369726ec08c5d8d9a9e21150d2e2af8fd8511897812dc99c7c13860f33
- SSDEEP 6144:8nPnI88wUrg5221YJyTscPsEb+fqhWfWgF5Dk:YI8PUrg5oBcPTvWfWS
- TLSH T17BA48C15B7A544A9D02BC434CA578643EA76B8960F71F6DF0294E23D2F3BBE51B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\libGLESv2.dll
- Size 7.0MB
- SHA256 25c093a77b4a1ea7ed6281b0fea3ff78b65b92943dd428b7b03ca30ba3d18b9f
- MD5 a77815f73ecfcbe65b2a7bf4989efd2c
- SHA1 4fea955dcbdf265c855b406e9e88ad24845aecfe
- SHA512 469e7e60bc30d1f05a2b9e66a13b909b7b9484069199b94e223b6629779e702916688e72f959413b512094349aff7182e73960e1e29e066277d583743dbb4e9c
- SSDEEP 98304:JrCUUS2s0+RaBhTTrUNTGpHDxA3rfRMGr:3+sNTPr
- TLSH T14C766C13F6A541DED05EC279CB5B9633F630B8950730B2DF2A9817252FA6BE05B39720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\locales\en-US.pak
- Size 384KB
- SHA256 18b68d00be426a4f7acd4efc1e45ae296720ade13ca66d3cf768e48d814b6a25
- MD5 6252747a75950f7b35dfab8a68b5a2e2
- SHA1 9e326b2e19369da8dd964179b5cb6e281200c459
- SHA512 d5ce8114e5d25ae0dd6fcaafc760e5e07f16679b9d34783bbeb7cc43f7e1b91c61d9322991893f39de799c332d497c0d787ee64c064cab4b4eab907e9953d140
- SSDEEP 6144:Gsa9U2QMh961PILMP9ecNmMJfaY2zt9j5urSgne2aVwG:Gsa9U1DV2MlmMKzn58S3VwG
- TLSH T116846D1FF744222A069352627F099562BF36D06CA35112663CBD813C33B7B66C27B7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\resources.pak
- Size 7.4MB
- SHA256 6f9dafb5d3f16b89d13c01bcd52695d0671a66f6719a6bc54a878106903516c0
- MD5 ae257b89b5c4d150463136bfd453d8f1
- SHA1 122cd56eef4b50f50a4be1520b765e6142a2cbc1
- SHA512 11ad48df3d41a5d2f156108503538494db7a4c86058ae6b9c9cc54ad7eaf565bf371e812f76a0857ce2f0985c13738927f1e75a91fedc0304726d36d568c6bb4
- SSDEEP 196608:vt2wbBtt0Xlxh2co6ItFKWBiGhaKNhkrVPF6eelh:vt2aBz0xPWoT2krD6eelh
- TLSH T1B7763320F365AC3FC0C8E3B5986D41335F29584229A6B85EB0CD620D9F6D25A4BF167F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\v8_context_snapshot.bin
- Size 661KB
- SHA256 eb3bb6497db6ed980a1702ef2db9df891ea6327a6498e670d038b41f69c3ff10
- MD5 e5805239e163f6b63de51fd8bc815c03
- SHA1 138c7de6ea565012e2911e284bdcb89a396bbe42
- SHA512 0a15a807405a89db2a7370f65bd351bea981266dd668b5ce85708aa342b09557b932371cfa34baea893b1e1116a0c7a098ef313c0bb94d8a77a00416cd30ebb7
- SSDEEP 6144:OMi8t1sxjZ5O8Qsg8zp5zYiqluzARVO2/Vbra7xQJ:uHptYiVUVO37q
- TLSH T167E46084F701DAA7FD1129B1CED684C433B4FA45DF034CA7B2949B2E6A66B722D243D4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\cef\release\vulkan-1.dll
- Size 902KB
- SHA256 ae91c4e7548eaf48b1a65c43f518e2c1989b4740efe82726b56b6be31cbfd1c3
- MD5 0e12ae397d99a654d2d4563e125f4410
- SHA1 d31bf003a20c9acb6776ffef91bac6ff28e253a3
- SHA512 7f9e3eff523c1975f0ad642be65e49a561052c0a1c7cacb0fb8dd0875207f8339b093e5437437aaae68fccc3bf19dc9474d9187715e77b3b797ed4fac4207f4a
- SSDEEP 24576:TN4xVfNwgednIlMdKKg0x6Z5WqDYsHA6g3P0zAk7:yxVfNwgaIlMdL6Z5WqDYsHA6g3P0zAk7
- TLSH T1D6156D27A694492AD476C034D9828607C9B1B8921B25B5DF03684B0DBF6FBF8373DB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\data\discord\discord_partner_sdk.dll
- Size 9.4MB
- SHA256 46170463bf263045972fde1ccaa51b380eb1443541036a809d24f4e6a9f9c388
- MD5 75c2d48b9b95522f8a7f1706a8fc2e85
- SHA1 fa1d29a68cca5074fa25d441b21ea0e64b57cb35
- SHA512 205e2d7f8ee478e3e4c995c8d121f84fa76e6372474d684839d15dbcd2e3ad004cfc825593225961c0c1f671e5dbdf0807774d4321d14925d54f89d6be7662bf
- SSDEEP 196608:Oser7o2bIRaNUkysOYZdx4tqIMS4jxIBiFGcmJ:Oser7o2bIRaNUkBOYZdx4tKS4jxIoFGb
- TLSH T119A65B03F78A50FDC49AD178934BA537EA31788A072579DB07909B252EB7BE05B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 e258676e55cb38329f51b820fd60a8ce5d3161c1759663af9bcc868242a43dcb
- MD5 2bc6f47fe8fa18f677c7ad6079c4cdd9
- SHA1 bfe2dc32e6f4606f0810eb8be1334605cfdea200
- SHA512 392722d5610ca69d5eb77c5641ca230f9a03e4fdff1a961c208cef091b5aa798dcc4f6201fe8489b2f10bbce02ffa573daa99484e3e123b0be8a39b960857b8e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Code Cache\js\index-dir\the-real-index
- Size 432B
- SHA256 2c6ec9b3b7c15544b157c0676caa4b40944b31c78d40807abadda32d36a94efd
- MD5 8e78af8956f73788b3c1db3dffed7da2
- SHA1 19207993770a45afc58a4b3e6d8b1594a950a587
- SHA512 3320a2a487c0191387f096d4ce479626dc756fa9d1e0308cf46a50c86896ed9b0d0233549761f3395191bec74a543f52cb7dc7fc8be1324ab86d50b762f9ede8
- TLSH T164E0A712C1692593CB2CD27C14DD50D33B316B4503A77CD8C3BC4DBA042D3A1AE7AA26
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\LocalPrefs.json
- Size 681B
- SHA256 adc4e0136c8187fc45ff259af2ae396823de1b5fd07160ce5fe3e327c7c937ba
- MD5 a4c75037a66736b14cee0a022ca86e18
- SHA1 151d503c28c4f1e57826911527703cab1f66aa76
- SHA512 ba61cc767b9803acaaa399d8a716cb8d8f247f96318222d4ebb5d1ef403aa21ff2275c48033dbf4ef0efe1744271d69990e6a2be0fdef25cc8c11b802cc3450f
- TLSH T1C40123B55266C6139E290DA813F7F00A8E145837D36213941D5D0E1442EFEDC770D83D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\LocalPrefs.json~RFe5d6014.TMP
- Size 508B
- SHA256 09a7e39f84d30c153c73e9388b8f56ce43b754081ad913a26b7275467a7938a9
- MD5 49884201072970d9ec3fbd85b8ec7b9d
- SHA1 a593f97355d4e08c26ea68bb9d473307c88e2449
- SHA512 ba222000c5f2088062284aac14e4649b99b070f1fa21c167995c88789a6d5a08828de54b6e1fd1ffa761743daaf4233bbe07f09eca3fc6281f17b8091dde9c11
- TLSH T132F00EF213A1CA17D6200C9833F3A105CE144827D23527552E6D0E2162EBD98A31E53D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Network\Network Persistent State
- Size 461B
- SHA256 f970971ee1dec108b14eed3f2e9a59937a9edc96b57dd87489eafadaa504675f
- MD5 58367b4a4f38a6a850c5f9f1e0274378
- SHA1 1df469e75069a8226cc0d42b27f383b390691b32
- SHA512 e514893d235de7ffe1c4fa25d36a3da8a9a5dc9407e7bf468888e9431126b80acf4f459b527d52fde7bb1030289ab87e74570ced35f37724b9fa088192a02b4a
- TLSH T198F05592C6D89ABE8A5613F01A343A27C1AE080D421C2E06D9E8EB5E8BE247A651050E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Network\Network Persistent State~RFe5d6dff.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\cbservers\user\cef-data\cache\Session Storage\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\cbservers\user\properties.json
- Size 95B
- SHA256 1bd1483aefdb80b0ffaffce351bf77027c02ffbb7e79009735406f8514b83771
- MD5 e0d9f65ab196e49bc1414554a976bd65
- SHA1 d2a89ccb6ad272d8a05866f5081a2a103a5501e1
- SHA512 8f5f52df91f1ce797decb41afb77728e04cd8f9d0c67132d683d472267eb7d97e4d8b97b9f8ddd5b6251d6f31d78c31f4be6ee64e7cd0da27b43e3da5a5da90a
- TLSH T15AB002BDC4434C63140E42457178451FD5411D720E1778525565D64CFF0DC1D3D9C406
- MD5 SHA1 SHA512 TLSH