Malware Analysis Report

2025-01-03 09:58

Sample ID 241023-svcj9axckc
Target TeraBox_sl_b_1.32.0.1.exe
SHA256 c773d700a0ed4099d6158277331671526696056e388b19b06aacf6e69c6025ca
Tags
discovery qr link pdf
score
5/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
5/10

SHA256

c773d700a0ed4099d6158277331671526696056e388b19b06aacf6e69c6025ca

Threat Level: Likely benign

The file TeraBox_sl_b_1.32.0.1.exe was found to be: Likely benign.

Malicious Activity Summary

discovery qr link pdf

Checks computer location settings

HTTP links in PDF interactive object

Loads dropped DLL

System Location Discovery: System Language Discovery

Unsigned PE

Enumerates physical storage devices

One or more HTTP URLs in qr code identified

Program crash

One or more HTTP URLs in PDF identified

Suspicious use of AdjustPrivilegeToken

Modifies system certificate store

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-23 15:27

Signatures

HTTP links in PDF interactive object

pdf link
Description Indicator Process Target
N/A N/A N/A N/A

One or more HTTP URLs in PDF identified

pdf link

One or more HTTP URLs in qr code identified

qr link

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

160s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2784 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2784 wrote to memory of 1524 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1524 -ip 1524

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

138s

Max time network

157s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcessW.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 244 wrote to memory of 1056 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 244 wrote to memory of 1056 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 244 wrote to memory of 1056 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcessW.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcessW.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1056 -ip 1056

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1056 -s 600

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 136.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BugReport.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\BugReport.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BugReport.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BugReport.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\BugReport.exe

"C:\Users\Admin\AppData\Local\Temp\BugReport.exe"

C:\Users\Admin\AppData\Local\Temp\BugReport.exe

"C:\Users\Admin\AppData\Local\Temp\BugReport.exe" /repair "rp:" ""

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 98.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

145s

Max time network

164s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ChromeNativeMessagingHost.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\ChromeNativeMessagingHost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ChromeNativeMessagingHost.exe

"C:\Users\Admin\AppData\Local\Temp\ChromeNativeMessagingHost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 53.210.109.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20241010-en

Max time kernel

9s

Max time network

61s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.terabox.com udp
JP 210.148.85.47:80 www.terabox.com tcp

Files

memory/1516-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

Analysis: behavioral32

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

137s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.terabox.com udp
JP 210.148.85.47:80 www.terabox.com tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 47.85.148.210.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20241010-en

Max time kernel

119s

Max time network

130s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcessW.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcessW.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsProcessW.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 224

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

121s

Max time network

129s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1764 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1764 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1764 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1764 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1764 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1764 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1764 wrote to memory of 1732 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#1

Network

N/A

Files

memory/1732-0-0x0000000000190000-0x0000000000191000-memory.dmp

memory/1732-2-0x0000000000190000-0x0000000000191000-memory.dmp

memory/1732-4-0x0000000000190000-0x0000000000191000-memory.dmp

memory/1732-5-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1732-7-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1732-9-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1732-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1732-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

memory/1732-16-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1732-17-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1732-20-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/1732-22-0x00000000001D0000-0x00000000001D1000-memory.dmp

memory/1732-25-0x0000000000200000-0x0000000000201000-memory.dmp

memory/1732-27-0x0000000000200000-0x0000000000201000-memory.dmp

memory/1732-28-0x0000000000210000-0x0000000000211000-memory.dmp

memory/1732-30-0x0000000000210000-0x0000000000211000-memory.dmp

memory/1732-32-0x0000000000210000-0x0000000000211000-memory.dmp

memory/1732-33-0x0000000070FC0000-0x00000000723EC000-memory.dmp

memory/1732-36-0x0000000071611000-0x0000000071C65000-memory.dmp

memory/1732-37-0x0000000070FC0000-0x00000000723EC000-memory.dmp

memory/1732-38-0x0000000070FC0000-0x00000000723EC000-memory.dmp

Analysis: behavioral15

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20241010-en

Max time kernel

136s

Max time network

131s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2496 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 916 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 3024 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 2496 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 2496 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 2496 wrote to memory of 1500 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 2496 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 980 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 2732 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 2496 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1656 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1064 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 2496 wrote to memory of 1408 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe

"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBox.exe

C:\Users\Admin\AppData\Local\Temp\TeraBox.exe NoUpdate

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2004,12557635530359914015,16566177240267781274,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2000 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,12557635530359914015,16566177240267781274,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2932 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2004,12557635530359914015,16566177240267781274,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2004,12557635530359914015,16566177240267781274,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2004,12557635530359914015,16566177240267781274,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2096 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

-PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2496.0.153483833\827965951 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.122" -PcGuid "TBIMXV2-O_92B6E5B71B754E36BA4D93668AFFC273-C_0-D_3332313238333038313435362020202020202020-M_56CF32F83AF3-V_709161F0" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.2496.0.153483833\827965951 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.122" -PcGuid "TBIMXV2-O_92B6E5B71B754E36BA4D93668AFFC273-C_0-D_3332313238333038313435362020202020202020-M_56CF32F83AF3-V_709161F0" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.2496.1.1452248533\1983629357 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.122" -PcGuid "TBIMXV2-O_92B6E5B71B754E36BA4D93668AFFC273-C_0-D_3332313238333038313435362020202020202020-M_56CF32F83AF3-V_709161F0" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.terabox.com udp
JP 210.148.85.47:443 www.terabox.com tcp
US 8.8.8.8:53 global-staticplat.cdn.bcebos.com udp
US 8.8.8.8:53 terabox.com udp
US 8.8.8.8:53 terabox.com udp
US 8.8.8.8:53 terabox.com udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:80 terabox.com tcp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:80 terabox.com tcp
US 8.8.8.8:53 terabox.com udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:443 terabox.com tcp
US 8.8.8.8:53 repository.certum.pl udp
CN 119.167.229.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 www.terabox.com udp
GB 2.18.27.163:80 repository.certum.pl tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 111.170.23.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.110.38:443 global-staticplat.cdn.bcebos.com tcp
CN 117.92.139.38:443 global-staticplat.cdn.bcebos.com tcp
CN 222.216.122.38:443 global-staticplat.cdn.bcebos.com tcp
CN 123.244.94.38:443 global-staticplat.cdn.bcebos.com tcp
CN 111.177.8.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.105.172.38:443 global-staticplat.cdn.bcebos.com tcp
CN 116.163.33.38:443 global-staticplat.cdn.bcebos.com tcp
CN 140.249.244.38:443 global-staticplat.cdn.bcebos.com tcp
CN 119.167.229.38:443 global-staticplat.cdn.bcebos.com tcp
CN 111.170.23.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 125.74.110.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 117.92.139.38:443 global-staticplat.cdn.bcebos.com tcp
CN 222.216.122.38:443 global-staticplat.cdn.bcebos.com tcp
CN 123.244.94.38:443 global-staticplat.cdn.bcebos.com tcp
CN 111.177.8.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.105.172.38:443 global-staticplat.cdn.bcebos.com tcp
CN 116.163.33.38:443 global-staticplat.cdn.bcebos.com tcp
CN 140.249.244.38:443 global-staticplat.cdn.bcebos.com tcp
CN 119.167.229.38:443 global-staticplat.cdn.bcebos.com tcp
CN 111.170.23.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.110.38:443 global-staticplat.cdn.bcebos.com tcp
CN 117.92.139.38:443 global-staticplat.cdn.bcebos.com tcp
CN 222.216.122.38:443 global-staticplat.cdn.bcebos.com tcp
CN 123.244.94.38:443 global-staticplat.cdn.bcebos.com tcp
CN 111.177.8.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.105.172.38:443 global-staticplat.cdn.bcebos.com tcp
CN 116.163.33.38:443 global-staticplat.cdn.bcebos.com tcp
CN 140.249.244.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
N/A 127.0.0.1:49238 tcp
N/A 127.0.0.1:49240 tcp
N/A 127.0.0.1:49242 tcp

Files

memory/1128-0-0x0000000000320000-0x0000000000321000-memory.dmp

memory/2496-16-0x000000000037A000-0x000000000037B000-memory.dmp

memory/2496-17-0x0000000000370000-0x00000000009D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\config.ini

MD5 2ef28d50eee30466105ee388cb06b4d6
SHA1 90e13089889a69a19a74f0a8b6215a59c068a2ea
SHA256 f474b24f50d937efde851ba709c4581e840ba142ea1929c2d2cbea48162968bd
SHA512 9e5cfcbd20a6ccf4803fbb0ee68d33473726c5a2a7199525fbd6a395d8b0308369a0dc2503a7f634cffdc2f5de1e11aefb145c33b49c904e336242b5c49d6ea7

memory/2496-41-0x0000000000370000-0x00000000009D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab2E14.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2496-104-0x0000000000370000-0x00000000009D6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar2EC3.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

MD5 fafb78ec98c335ccf6644669d97b8327
SHA1 ffbacca5701273add40f96c69a4befc2aefdeb19
SHA256 b6a8fb72b50dec83f960ff4ac1b7ccdd0b1d86ebdcb20bf4fc2ebf7847c3b4e7
SHA512 c32a2a6c27267322764c60104a922183c9f8fdbaf908fbd5ee1ebb2dd4d41eb9017cd40e2f343b5fb123b4759f7c1a25d55859d0e799a9a68abfe3eeb22842f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

MD5 d5e98140c51869fc462c8975620faa78
SHA1 07e032e020b72c3f192f0628a2593a19a70f069e
SHA256 5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e
SHA512 9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

memory/2496-975-0x000000000A850000-0x000000000B050000-memory.dmp

memory/2496-976-0x000000000A850000-0x000000000B050000-memory.dmp

memory/1064-1545-0x0000000000170000-0x0000000000171000-memory.dmp

memory/1064-1543-0x0000000000170000-0x0000000000171000-memory.dmp

memory/1064-1577-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1064-1575-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1064-1579-0x0000000068550000-0x000000006997C000-memory.dmp

memory/1064-1573-0x0000000000220000-0x0000000000221000-memory.dmp

memory/1064-1572-0x0000000000200000-0x0000000000201000-memory.dmp

memory/1064-1570-0x0000000000200000-0x0000000000201000-memory.dmp

memory/1064-1567-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/1064-1565-0x00000000001F0000-0x00000000001F1000-memory.dmp

memory/1064-1562-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1064-1560-0x00000000001A0000-0x00000000001A1000-memory.dmp

memory/1064-1557-0x0000000000190000-0x0000000000191000-memory.dmp

memory/1064-1555-0x0000000000190000-0x0000000000191000-memory.dmp

memory/1064-1552-0x0000000000180000-0x0000000000181000-memory.dmp

memory/1064-1550-0x0000000000180000-0x0000000000181000-memory.dmp

memory/1064-1548-0x0000000000180000-0x0000000000181000-memory.dmp

memory/1064-1547-0x0000000000170000-0x0000000000171000-memory.dmp

Analysis: behavioral19

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

121s

Max time network

130s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2244 wrote to memory of 2412 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2244 wrote to memory of 2412 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2244 wrote to memory of 2412 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2244 wrote to memory of 2412 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2244 wrote to memory of 2412 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2244 wrote to memory of 2412 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2244 wrote to memory of 2412 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll

Network

N/A

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

119s

Max time network

131s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 220

Network

N/A

Files

N/A

Analysis: behavioral11

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

117s

Max time network

123s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2980 wrote to memory of 2432 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2980 wrote to memory of 2432 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2980 wrote to memory of 2432 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2980 wrote to memory of 2432 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2980 wrote to memory of 2432 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2980 wrote to memory of 2432 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2980 wrote to memory of 2432 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5012 wrote to memory of 3156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5012 wrote to memory of 3156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 5012 wrote to memory of 3156 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3156 -ip 3156

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 612

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20241010-en

Max time kernel

119s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ChromeNativeMessagingHost.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ChromeNativeMessagingHost.exe

"C:\Users\Admin\AppData\Local\Temp\ChromeNativeMessagingHost.exe"

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

159s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4472 wrote to memory of 4124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4472 wrote to memory of 4124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 4472 wrote to memory of 4124 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4124 -ip 4124

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 640

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 64.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

158s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4448 wrote to memory of 2780 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4448 wrote to memory of 2780 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4448 wrote to memory of 2780 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\AppUtil.dll

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe

"C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 105.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240708-en

Max time kernel

119s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe"

Network

N/A

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

156s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1988 wrote to memory of 4220 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1988 wrote to memory of 4220 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 1988 wrote to memory of 4220 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\kernel.dll,#1

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 91.65.42.20.in-addr.arpa udp

Files

memory/4220-1-0x0000000000580000-0x0000000000581000-memory.dmp

memory/4220-0-0x0000000000570000-0x0000000000571000-memory.dmp

memory/4220-6-0x0000000074531000-0x0000000074B85000-memory.dmp

memory/4220-5-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

memory/4220-4-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

memory/4220-3-0x0000000000780000-0x0000000000781000-memory.dmp

memory/4220-2-0x00000000006C0000-0x00000000006C1000-memory.dmp

memory/4220-7-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

memory/4220-11-0x0000000073EE0000-0x000000007530C000-memory.dmp

memory/4220-12-0x0000000073EE0000-0x000000007530C000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

122s

Max time network

132s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2248 wrote to memory of 2380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2248 wrote to memory of 2380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2248 wrote to memory of 2380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2248 wrote to memory of 2380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2248 wrote to memory of 2380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2248 wrote to memory of 2380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
PID 2248 wrote to memory of 2380 N/A C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdateUtil.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-493223053-2004649691-1575712786-1000\{77C8114E-75AB-45EB-8CBB-E79EFD9E7777} C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Token: SeAssignPrimaryTokenPrivilege N/A C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe N/A
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4592 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 888 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 4548 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 1540 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 4592 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 4592 wrote to memory of 4808 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 4592 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3384 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 4592 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 1428 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 4592 wrote to memory of 4604 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

Processes

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe

"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Autoupdate.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBox.exe

C:\Users\Admin\AppData\Local\Temp\TeraBox.exe NoUpdate

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2588,4229474854673200458,79104526672940052,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2616 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2588,4229474854673200458,79104526672940052,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=3000 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,4229474854673200458,79104526672940052,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,4229474854673200458,79104526672940052,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

-PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.4592.0.470608830\1975602119 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.231" -PcGuid "TBIMXV2-O_E0A5A4B6585F49B19B2F226DF60405E2-C_0-D_232138804165-M_EE81E66BE9E9-V_515D6195" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.4592.0.470608830\1975602119 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.231" -PcGuid "TBIMXV2-O_E0A5A4B6585F49B19B2F226DF60405E2-C_0-D_232138804165-M_EE81E66BE9E9-V_515D6195" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.4592.1.174784482\1097939572 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.231" -PcGuid "TBIMXV2-O_E0A5A4B6585F49B19B2F226DF60405E2-C_0-D_232138804165-M_EE81E66BE9E9-V_515D6195" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,4229474854673200458,79104526672940052,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2588,4229474854673200458,79104526672940052,131072 --enable-features=CastMediaRouteProvider --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=4424 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 71.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 www.terabox.com udp
JP 210.148.85.47:443 www.terabox.com tcp
US 8.8.8.8:53 47.85.148.210.in-addr.arpa udp
US 8.8.8.8:53 terabox.com udp
US 8.8.8.8:53 global-staticplat.cdn.bcebos.com udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:443 terabox.com tcp
N/A 224.0.0.251:5353 udp
JP 210.148.85.47:80 terabox.com tcp
JP 210.148.85.47:80 terabox.com tcp
US 8.8.8.8:53 226.21.18.104.in-addr.arpa udp
CN 61.170.99.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 repository.certum.pl udp
US 8.8.8.8:53 terabox.com udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:443 terabox.com tcp
GB 2.18.27.157:80 repository.certum.pl tcp
US 8.8.8.8:53 www.terabox.com udp
US 8.8.8.8:53 157.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 171.107.86.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
CN 106.225.194.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.42.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 121.14.135.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 175.4.51.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.230.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.142.207.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 www.staticcc.com udp
US 8.8.8.8:53 s2.teraboxcdn.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 static.line-scdn.net udp
GB 193.118.32.52:443 www.staticcc.com tcp
GB 193.118.32.52:443 www.staticcc.com tcp
GB 193.118.32.52:443 www.staticcc.com tcp
GB 193.118.32.52:443 www.staticcc.com tcp
BE 64.233.184.84:443 accounts.google.com tcp
NL 108.156.60.86:443 static.line-scdn.net tcp
GB 193.118.32.52:443 www.staticcc.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
US 8.8.8.8:53 firebase.googleapis.com udp
US 8.8.8.8:53 86.60.156.108.in-addr.arpa udp
US 8.8.8.8:53 84.184.233.64.in-addr.arpa udp
US 8.8.8.8:53 52.32.118.193.in-addr.arpa udp
US 8.8.8.8:53 8.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 www.google.com udp
GB 142.250.200.36:443 www.google.com tcp
GB 223.121.13.19:443 s2.teraboxcdn.com tcp
GB 223.121.13.19:443 s2.teraboxcdn.com tcp
GB 223.121.13.19:443 s2.teraboxcdn.com tcp
GB 223.121.13.19:443 s2.teraboxcdn.com tcp
GB 223.121.13.19:443 s2.teraboxcdn.com tcp
GB 223.121.13.19:443 s2.teraboxcdn.com tcp
GB 163.70.151.21:443 tcp
JP 210.148.85.32:443 tcp
JP 210.154.124.151:443 tcp
JP 210.154.124.151:443 tcp
JP 210.148.85.32:443 tcp
JP 210.148.85.32:443 tcp
JP 210.148.85.32:443 tcp
CN 61.170.99.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 151.124.154.210.in-addr.arpa udp
US 8.8.8.8:53 32.85.148.210.in-addr.arpa udp
US 8.8.8.8:53 232.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
BE 74.125.206.154:443 stats.g.doubleclick.net tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 www.google.co.uk udp
US 216.239.32.36:443 region1.analytics.google.com tcp
GB 172.217.169.67:443 www.google.co.uk tcp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 154.206.125.74.in-addr.arpa udp
N/A 127.0.0.1:64546 tcp
N/A 127.0.0.1:64548 tcp
N/A 127.0.0.1:64550 tcp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
US 8.8.8.8:53 udp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
CN 171.107.86.38:443 global-staticplat.cdn.bcebos.com tcp
CN 106.225.194.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
CN 125.74.42.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com tcp
CN 121.14.135.38:443 global-staticplat.cdn.bcebos.com tcp
CN 175.4.51.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.230.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.142.207.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
CN 61.170.99.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
CN 171.107.86.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 106.225.194.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.42.38:443 global-staticplat.cdn.bcebos.com tcp
CN 121.14.135.38:443 global-staticplat.cdn.bcebos.com tcp
CN 175.4.51.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.230.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.142.207.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/4592-10-0x0000000000D6A000-0x0000000000D6B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\config.ini

MD5 d8963ba7d5449b79ccd62711b52f3a3c
SHA1 82f04ebeabe06047f18c669ccb0eb1725d91595d
SHA256 4fba81ffd3f7b5e4e0a174dc8306e8a3957df08b2ca102330bf298663ea7c168
SHA512 2df0cc3e184042f15cb49bb48f667b1bebe6686f3431b538e264e3f7ef43117ddd39d923eee30f82b7ccecd45c8f3230bfd4d5422f233ca4bf82591c3a50b025

memory/4592-30-0x0000000000D60000-0x00000000013C6000-memory.dmp

memory/3384-68-0x0000000003650000-0x0000000003651000-memory.dmp

memory/3384-67-0x0000000002E30000-0x0000000002E31000-memory.dmp

memory/3384-72-0x00000000036B0000-0x00000000036B1000-memory.dmp

memory/3384-71-0x00000000036A0000-0x00000000036A1000-memory.dmp

memory/3384-70-0x0000000003690000-0x0000000003691000-memory.dmp

memory/3384-69-0x0000000003660000-0x0000000003661000-memory.dmp

memory/3384-73-0x00000000036C0000-0x00000000036C1000-memory.dmp

memory/3384-75-0x0000000065460000-0x000000006688C000-memory.dmp

memory/4592-106-0x0000000000D60000-0x00000000013C6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Local Storage\leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Cache\f_000015

MD5 0e3d96124ecfd1e2818dfd4d5f21352a
SHA1 098b1aa4b26d3c77d24dc2ffd335d2f3a7aeb5d7
SHA256 eef545efdb498b725fbabeedd5b80cec3c60357df9bc2943cfd7c8d5ae061dcc
SHA512 c02d65d901e26d0ed28600fa739f1aa42184e00b4e9919f1e4e9623fe9d07a2e2c35b0215d4f101afc1e32fc101a200ca4244eb1d9ca846065d387144451331c

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\852d6119-7f5f-4b6d-9bcf-4c6f88fb620d.tmp

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index~RFe5843f9.TMP

MD5 0d8d8e74bbafbc5047b2988970564629
SHA1 9ada5624cfd7a5c5daa83673f5688eb744f57d1a
SHA256 7b2012a96df1cb716531fff42e1ed046eb72ef99f449196f991ef0d2a12d69a9
SHA512 5f011abd6aa0b580fef1940b646a0803630fd332b73dd26df095999e16edb26622425cdc0053c07bed65596b3c5f71a8c79daaccea7591c9780a5b92f49127a6

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index

MD5 55c147983eeead277426f105febea9a5
SHA1 85ce12b78aa629664b0dbc0c8f420636fcf3de32
SHA256 4e80bbe577d7f1cf93cd626c7147897ab8e8ca3c94587fa3c6ee7555bd16a065
SHA512 85cea57deb66e2e8c6441ec62a1cf83e4621d94544898e4a00a558b55ce46a05b1d6155ac7403cea13032d950b91b79fa7dfe49179afd6eea436b406038a908a

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State

MD5 40c3faea1205041cc8aebba4fb9f1b29
SHA1 4493161d6f22e2323475f3527d70af6c2e45cbd7
SHA256 d2888060c74e281c453e572ff70b53ee9197caf5c42f925decd7c881442c5d54
SHA512 e92b3e50c26fe0cf874322ae665f4eac991ec92d9df98c132ed0619cc41a6e562531a75799224135670b034b547d3e74bf84a727c5231df30de9274c306bbffe

Analysis: behavioral20

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

154s

Command Line

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2680 wrote to memory of 3392 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2680 wrote to memory of 3392 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe
PID 2680 wrote to memory of 3392 N/A C:\Windows\system32\regsvr32.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Windows\system32\regsvr32.exe

regsvr32 /s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll

C:\Windows\SysWOW64\regsvr32.exe

/s C:\Users\Admin\AppData\Local\Temp\Bull140U.dll

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 209.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

121s

Max time network

128s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe"

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20241010-en

Max time kernel

118s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe"

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nso8C4A.tmp\NsisInstallUI.dll

MD5 69b36f5513e880105fe0994feef54e70
SHA1 57b689dbf36719e17a9f16ad5245c8605d59d4c0
SHA256 531d1191eded0bf76abb40f0367efa2f4e4554123dc2373cf23ee3af983b6d5f
SHA512 c5c09d81a601f8060acf6d9eeaa9e417843bb37b81d5de6b5c70fb404a529c2b906d4bb0995d574dd5a3b4986e3cbe20882aa3e8349e31ff26bdb832692596bd

\Users\Admin\AppData\Local\Temp\nso8C4A.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

C:\Users\Admin\AppData\Local\Temp\nso8C4A.tmp\nsProcessW.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

memory/2876-20-0x0000000003830000-0x0000000003870000-memory.dmp

memory/2876-96-0x0000000003830000-0x0000000003870000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

142s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe"

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBox_sl_b_1.32.0.1.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 100.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\nslBBEF.tmp\NsisInstallUI.dll

MD5 69b36f5513e880105fe0994feef54e70
SHA1 57b689dbf36719e17a9f16ad5245c8605d59d4c0
SHA256 531d1191eded0bf76abb40f0367efa2f4e4554123dc2373cf23ee3af983b6d5f
SHA512 c5c09d81a601f8060acf6d9eeaa9e417843bb37b81d5de6b5c70fb404a529c2b906d4bb0995d574dd5a3b4986e3cbe20882aa3e8349e31ff26bdb832692596bd

C:\Users\Admin\AppData\Local\Temp\nslBBEF.tmp\System.dll

MD5 8cf2ac271d7679b1d68eefc1ae0c5618
SHA1 7cc1caaa747ee16dc894a600a4256f64fa65a9b8
SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
SHA512 ce828fb9ecd7655cc4c974f78f209d3326ba71ced60171a45a437fc3fff3bd0d69a0997adaca29265c7b5419bdea2b17f8cc8ceae1b8ce6b22b7ed9120bb5ad3

C:\Users\Admin\AppData\Local\Temp\nslBBEF.tmp\nsProcessW.dll

MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

memory/4272-17-0x0000000005070000-0x0000000005080000-memory.dmp

memory/4272-118-0x0000000005070000-0x0000000005080000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

119s

Max time network

128s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1

Signatures

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\rundll32.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1

C:\Windows\SysWOW64\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NsisInstallUI.dll,#1

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 232

Network

N/A

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

120s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\BugReport.exe"

Signatures

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BugReport.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\BugReport.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\BugReport.exe

"C:\Users\Admin\AppData\Local\Temp\BugReport.exe"

C:\Users\Admin\AppData\Local\Temp\BugReport.exe

"C:\Users\Admin\AppData\Local\Temp\BugReport.exe" /repair "rp:" ""

Network

N/A

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240903-en

Max time kernel

117s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe"

Signatures

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe

"C:\Users\Admin\AppData\Local\Temp\HelpUtility.exe"

Network

N/A

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win7-20240729-en

Max time kernel

146s

Max time network

133s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1744 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 1744 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 1744 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 1744 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 1744 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2644 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 2652 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 640 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 1744 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 1496 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 1552 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 1744 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 1744 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 1744 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 1744 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 1744 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 1744 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 1744 wrote to memory of 588 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBox.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1992,2816264673215340917,1822850474385363209,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=1996 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1992,2816264673215340917,1822850474385363209,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2592 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1992,2816264673215340917,1822850474385363209,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=1992,2816264673215340917,1822850474385363209,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=1992,2816264673215340917,1822850474385363209,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 6.1; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;6.1.7601;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2080 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

-PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.1744.0.1875599563\1171079376 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.43" -PcGuid "TBIMXV2-O_E6DB4D6BD32047E4BB40BE6C678242CB-C_0-D_3332313238333038313435362020202020202020-M_666B6675A85F-V_1451574D" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.1744.0.1875599563\1171079376 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.43" -PcGuid "TBIMXV2-O_E6DB4D6BD32047E4BB40BE6C678242CB-C_0-D_3332313238333038313435362020202020202020-M_666B6675A85F-V_1451574D" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.1744.1.2029772159\2102062423 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.1.43" -PcGuid "TBIMXV2-O_E6DB4D6BD32047E4BB40BE6C678242CB-C_0-D_3332313238333038313435362020202020202020-M_666B6675A85F-V_1451574D" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\Admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly90ZXJhYm94LmNvbS9hdXRvdXBkYXRl" -srvwnd 30170 -unlogin

Network

Country Destination Domain Proto
US 8.8.8.8:53 terabox.com udp
US 8.8.8.8:53 terabox.com udp
US 8.8.8.8:53 global-staticplat.cdn.bcebos.com udp
US 8.8.8.8:53 terabox.com udp
US 8.8.8.8:53 www.terabox.com udp
CN 110.185.108.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:80 www.terabox.com tcp
JP 210.148.85.47:80 www.terabox.com tcp
US 8.8.8.8:53 terabox.com udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:443 terabox.com tcp
US 8.8.8.8:53 www.terabox.com udp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 121.14.135.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.142.207.38:443 global-staticplat.cdn.bcebos.com tcp
CN 106.225.194.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.99.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 repository.certum.pl udp
GB 2.18.27.157:80 repository.certum.pl tcp
CN 60.188.66.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.42.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.230.38:443 global-staticplat.cdn.bcebos.com tcp
N/A 127.0.0.1:49220 tcp
N/A 127.0.0.1:49222 tcp
N/A 127.0.0.1:49224 tcp
CN 110.185.108.38:443 global-staticplat.cdn.bcebos.com tcp
CN 121.14.135.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.142.207.38:443 global-staticplat.cdn.bcebos.com tcp
CN 106.225.194.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.99.38:443 global-staticplat.cdn.bcebos.com tcp
CN 60.188.66.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.42.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.230.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 terabox.com udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:443 terabox.com tcp
CN 110.185.108.38:443 global-staticplat.cdn.bcebos.com tcp
JP 210.148.85.47:443 terabox.com tcp
US 8.8.8.8:53 data.nephobox.com udp
JP 98.98.225.244:80 data.nephobox.com tcp
US 8.8.8.8:53 issuepcdn.freeterabox.com udp
US 104.18.53.69:80 issuepcdn.freeterabox.com tcp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 184.25.193.234:80 www.microsoft.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.73:80 crl.microsoft.com tcp
JP 210.148.85.47:443 terabox.com tcp
CN 121.14.135.38:443 tcp
CN 113.142.207.38:443 tcp
CN 106.225.194.38:443 tcp
CN 61.170.99.38:443 tcp
CN 60.188.66.38:443 tcp
CN 61.170.103.38:443 tcp
CN 125.74.42.38:443 tcp
CN 118.212.230.38:443 tcp
US 8.8.8.8:53 udp
SE 192.229.221.95:80 tcp
US 8.8.8.8:53 udp

Files

memory/1744-5-0x0000000001050000-0x00000000016B6000-memory.dmp

memory/1744-22-0x0000000001050000-0x00000000016B6000-memory.dmp

memory/1744-54-0x0000000001050000-0x00000000016B6000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab33BF.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar343F.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/1744-153-0x000000000BA70000-0x000000000C270000-memory.dmp

memory/1744-154-0x000000000BA70000-0x000000000C270000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6525274CBC2077D43D7D17A33C868C4F

MD5 2640f12fe6a9918fe99243d1af07e9db
SHA1 c5846b6f57287c613ca141a476ff0292e691583d
SHA256 0354999d2dd7f16e346759b83766953c0094eb88ea7fa20012270f3dfdf38ff5
SHA512 016ce4e2bcb9c36a2b96c8946331c7397b31da1fbaeb821da8f3e434c4ea793d396f334adb71e53f6f58bef2ec6a4a77dd54628cbc31a7159f6dd8dc8e7d2a0d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6525274CBC2077D43D7D17A33C868C4F

MD5 d5e98140c51869fc462c8975620faa78
SHA1 07e032e020b72c3f192f0628a2593a19a70f069e
SHA256 5c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e
SHA512 9bd164cc4b9ef07386762d3775c6d9528b82d4a9dc508c3040104b8d41cfec52eb0b7e6f8dc47c5021ce2fe3ca542c4ae2b54fd02d76b0eabd9724484621a105

memory/2228-1539-0x0000000000150000-0x0000000000151000-memory.dmp

memory/2228-1537-0x0000000000150000-0x0000000000151000-memory.dmp

memory/2228-1535-0x0000000000150000-0x0000000000151000-memory.dmp

memory/2228-1540-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2228-1569-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2228-1567-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2228-1565-0x0000000000280000-0x0000000000281000-memory.dmp

memory/2228-1564-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2228-1562-0x0000000000270000-0x0000000000271000-memory.dmp

memory/2228-1559-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2228-1557-0x0000000000220000-0x0000000000221000-memory.dmp

memory/2228-1554-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2228-1552-0x0000000000210000-0x0000000000211000-memory.dmp

memory/2228-1549-0x0000000000200000-0x0000000000201000-memory.dmp

memory/2228-1547-0x0000000000200000-0x0000000000201000-memory.dmp

memory/2228-1544-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2228-1542-0x0000000000160000-0x0000000000161000-memory.dmp

memory/2228-1570-0x0000000068400000-0x000000006982C000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TeraBox_status

MD5 5d0a2de326a55f93c66fba792623451f
SHA1 8d84f3bca6a390eeb4afd9ce478cd3933f49219d
SHA256 2763c06ddb3ba982dd9aaf314eb9ba2de3f3aa6282e65c7ea3a665cbc7448faa
SHA512 c1c2a4a13c1dd7f782cfce648182166118150a96372454788a9b73d521979dd0f160e6f304f549b6fd29f1d6e3e13a541ad85c7dc4b4b099957e68c7bde99280

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Download\AutoUpdate.xml

MD5 1ca91b22756dd2cbccb6ade5101092b0
SHA1 e65993dd0e0a08c5cb00089e14fd59674f589395
SHA256 5620fac38bc1a54ba7da3dc421192630f4e47529aab6c471238a86af5ae49c44
SHA512 13c76627443c4c53d51a2f5d1bebdeed0c0296f3276b74a5c3e9874fd652e2da045cfab04822d7528c74df9d6b2e45d247c75c2dc58abd6acde67dd8242e6f22

Analysis: behavioral26

Detonation Overview

Submitted

2024-10-23 15:26

Reported

2024-10-23 15:31

Platform

win10v2004-20241007-en

Max time kernel

143s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1045960512-3948844814-3059691613-1000\{0250DD65-71EE-46DA-93DC-D4FF51D2A4B7} C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 0f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e2000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df12000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeManageVolumePrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A
Token: SeSecurityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 752 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 4400 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 2888 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 752 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 752 wrote to memory of 3420 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe
PID 752 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 5096 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 1044 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 5092 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 4320 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe
PID 752 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 752 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 752 wrote to memory of 3312 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe
PID 752 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe
PID 752 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\TeraBox.exe C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

Processes

C:\Users\Admin\AppData\Local\Temp\TeraBox.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBox.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2588,8575395501567094143,8750312891541567085,131072 --enable-features=CastMediaRouteProvider --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2600 /prefetch:2

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2588,8575395501567094143,8750312891541567085,131072 --enable-features=CastMediaRouteProvider --lang=en-US --service-sandbox-type=network --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=2976 /prefetch:8

C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxWebService.exe"

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,8575395501567094143,8750312891541567085,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,8575395501567094143,8750312891541567085,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

-PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.752.0.1684545559\320430900 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.174" -PcGuid "TBIMXV2-O_DCC505B4E0A54490A94D27CC5B569DB4-C_0-D_232138804165-M_E24E87F0D14E-V_85E9511E" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1502 -PluginPath "C:\Users\Admin\AppData\Local\Temp\kernel.dll" -ChannelName terabox.752.0.1684545559\320430900 -QuitEventName TERABOX_KERNEL_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.174" -PcGuid "TBIMXV2-O_DCC505B4E0A54490A94D27CC5B569DB4-C_0-D_232138804165-M_E24E87F0D14E-V_85E9511E" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=renderer --no-sandbox --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --field-trial-handle=2588,8575395501567094143,8750312891541567085,131072 --enable-features=CastMediaRouteProvider --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --disable-extensions --ppapi-flash-path="C:\Users\Admin\AppData\Local\Temp\pepflashplayer.dll" --ppapi-flash-version=20.0.0.306 --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1

C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxHost.exe" -PluginId 1501 -PluginPath "C:\Users\Admin\AppData\Local\Temp\module\VastPlayer\VastPlayer.dll" -ChannelName terabox.752.1.502223713\1437421773 -QuitEventName TERABOX_VIDEO_PLAY_SDK_997C8EFA-C5ED-47A0-A6A8-D139CD6017F4 -TeraBoxId "" -IP "10.127.0.174" -PcGuid "TBIMXV2-O_DCC505B4E0A54490A94D27CC5B569DB4-C_0-D_232138804165-M_E24E87F0D14E-V_85E9511E" -Version "1.32.0.1" -DiskApiHttps 0 -StatisticHttps 0 -ReportCrash 1

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe

"C:\Users\Admin\AppData\Local\Temp\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\Admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly90ZXJhYm94LmNvbS9hdXRvdXBkYXRl" -srvwnd b006c -unlogin

C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe

"C:\Users\Admin\AppData\Local\Temp\TeraBoxRender.exe" --type=gpu-process --field-trial-handle=2588,8575395501567094143,8750312891541567085,131072 --enable-features=CastMediaRouteProvider --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres\locales" --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --log-severity=disable --resources-dir-path="C:\Users\Admin\AppData\Local\Temp\browserres" --user-agent="Mozilla/5.0; (Windows NT 10.0; WOW64); AppleWebKit/537.36; (KHTML, like Gecko); Chrome/86.0.4240.198; Safari/537.36; terabox;1.32.0.1;PC;PC-Windows;10.0.19041;WindowsTeraBox" --lang=en-US --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --log-file="C:\Users\Admin\AppData\Local\Temp\debug.log" --mojo-platform-channel-handle=4108 /prefetch:2

Network

Country Destination Domain Proto
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 terabox.com udp
US 8.8.8.8:53 global-staticplat.cdn.bcebos.com udp
JP 210.148.85.47:443 terabox.com tcp
N/A 224.0.0.251:5353 udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:80 terabox.com tcp
US 8.8.8.8:53 www.terabox.com udp
JP 210.148.85.47:80 www.terabox.com tcp
US 8.8.8.8:53 repository.certum.pl udp
N/A 127.0.0.1:56215 tcp
N/A 127.0.0.1:56217 tcp
N/A 127.0.0.1:56219 tcp
GB 2.18.27.157:80 repository.certum.pl tcp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 226.20.18.104.in-addr.arpa udp
US 8.8.8.8:53 47.85.148.210.in-addr.arpa udp
US 8.8.8.8:53 157.27.18.2.in-addr.arpa udp
US 8.8.8.8:53 terabox.com udp
JP 210.148.85.47:443 terabox.com tcp
JP 210.148.85.47:443 terabox.com tcp
US 8.8.8.8:53 www.terabox.com udp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
US 8.8.8.8:53 www.staticcc.com udp
US 8.8.8.8:53 s2.teraboxcdn.com udp
US 8.8.8.8:53 accounts.google.com udp
US 8.8.8.8:53 static.line-scdn.net udp
GB 193.118.32.53:443 www.staticcc.com tcp
GB 193.118.32.53:443 www.staticcc.com tcp
GB 193.118.32.53:443 www.staticcc.com tcp
GB 193.118.32.53:443 www.staticcc.com tcp
BE 64.233.184.84:443 accounts.google.com tcp
NL 108.156.60.48:443 static.line-scdn.net tcp
GB 169.197.114.137:443 s2.teraboxcdn.com tcp
GB 169.197.114.137:443 s2.teraboxcdn.com tcp
GB 169.197.114.137:443 s2.teraboxcdn.com tcp
GB 169.197.114.137:443 s2.teraboxcdn.com tcp
GB 169.197.114.137:443 s2.teraboxcdn.com tcp
US 8.8.8.8:53 53.32.118.193.in-addr.arpa udp
US 8.8.8.8:53 84.184.233.64.in-addr.arpa udp
US 8.8.8.8:53 48.60.156.108.in-addr.arpa udp
US 8.8.8.8:53 8.39.65.18.in-addr.arpa udp
US 8.8.8.8:53 firebase.googleapis.com udp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
US 8.8.8.8:53 connect.facebook.net udp
GB 142.250.200.42:443 firebase.googleapis.com tcp
GB 163.70.151.21:443 connect.facebook.net tcp
US 8.8.8.8:53 www.google.com udp
US 8.8.8.8:53 137.114.197.169.in-addr.arpa udp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 21.151.70.163.in-addr.arpa udp
GB 142.250.200.36:443 www.google.com tcp
US 8.8.8.8:53 ymg-api.terabox.com udp
JP 210.154.124.151:443 ymg-api.terabox.com tcp
JP 210.154.124.151:443 ymg-api.terabox.com tcp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 sofire.terabox.com udp
JP 210.148.85.32:443 sofire.terabox.com tcp
JP 210.148.85.32:443 sofire.terabox.com tcp
US 8.8.8.8:53 36.200.250.142.in-addr.arpa udp
US 8.8.8.8:53 151.124.154.210.in-addr.arpa udp
JP 210.148.85.32:443 sofire.terabox.com tcp
JP 210.148.85.32:443 sofire.terabox.com tcp
US 8.8.8.8:53 region1.analytics.google.com udp
US 8.8.8.8:53 stats.g.doubleclick.net udp
US 216.239.32.36:443 region1.analytics.google.com tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
US 8.8.8.8:53 www.google.co.uk udp
BE 74.125.206.154:443 stats.g.doubleclick.net tcp
US 216.239.32.36:443 region1.analytics.google.com tcp
GB 142.250.180.3:443 www.google.co.uk tcp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 232.16.217.172.in-addr.arpa udp
US 8.8.8.8:53 32.85.148.210.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 36.32.239.216.in-addr.arpa udp
US 8.8.8.8:53 154.206.125.74.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
JP 210.148.85.47:443 www.terabox.com tcp
JP 210.148.85.47:443 www.terabox.com tcp
CN 110.185.108.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.230.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.42.38:443 global-staticplat.cdn.bcebos.com tcp
CN 60.188.66.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.142.207.38:443 global-staticplat.cdn.bcebos.com tcp
CN 106.225.194.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.99.38:443 global-staticplat.cdn.bcebos.com tcp
CN 121.14.135.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 play.google.com udp
GB 172.217.16.238:443 play.google.com tcp
US 8.8.8.8:53 238.16.217.172.in-addr.arpa udp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
CN 110.185.108.38:443 global-staticplat.cdn.bcebos.com tcp
CN 118.212.230.38:443 global-staticplat.cdn.bcebos.com tcp
CN 125.74.42.38:443 global-staticplat.cdn.bcebos.com tcp
CN 60.188.66.38:443 global-staticplat.cdn.bcebos.com tcp
CN 113.142.207.38:443 global-staticplat.cdn.bcebos.com tcp
CN 106.225.194.38:443 global-staticplat.cdn.bcebos.com tcp
CN 61.170.99.38:443 global-staticplat.cdn.bcebos.com tcp
CN 121.14.135.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
CN 61.170.103.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 terabox.com udp
JP 210.148.85.47:443 terabox.com tcp
US 8.8.8.8:53 73.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 data.nephobox.com udp
JP 98.98.225.244:80 data.nephobox.com tcp
US 8.8.8.8:53 issuepcdn.freeterabox.com udp
US 104.18.53.69:80 issuepcdn.freeterabox.com tcp
CN 118.212.224.38:443 global-staticplat.cdn.bcebos.com tcp
US 8.8.8.8:53 244.225.98.98.in-addr.arpa udp
US 8.8.8.8:53 69.53.18.104.in-addr.arpa udp
JP 210.148.85.47:443 terabox.com tcp
CN 60.188.66.38:443 global-staticplat.cdn.bcebos.com tcp
CN 110.185.108.38:443 tcp
CN 118.212.230.38:443 tcp
CN 125.74.42.38:443 tcp
CN 113.142.207.38:443 tcp
CN 106.225.194.38:443 tcp
CN 61.170.99.38:443 tcp
CN 121.14.135.38:443 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 31.73.42.20.in-addr.arpa udp

Files

memory/752-5-0x00000000000EA000-0x00000000000EB000-memory.dmp

memory/752-24-0x00000000000E0000-0x0000000000746000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Local Storage\leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

memory/3088-164-0x0000000002D50000-0x0000000002D51000-memory.dmp

memory/3088-167-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

memory/3088-166-0x0000000002E70000-0x0000000002E71000-memory.dmp

memory/3088-165-0x0000000002E60000-0x0000000002E61000-memory.dmp

memory/3088-168-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

memory/3088-169-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

memory/3088-170-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

memory/3088-171-0x00000000655D0000-0x00000000669FC000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Cache\f_000019

MD5 0e3d96124ecfd1e2818dfd4d5f21352a
SHA1 098b1aa4b26d3c77d24dc2ffd335d2f3a7aeb5d7
SHA256 eef545efdb498b725fbabeedd5b80cec3c60357df9bc2943cfd7c8d5ae061dcc
SHA512 c02d65d901e26d0ed28600fa739f1aa42184e00b4e9919f1e4e9623fe9d07a2e2c35b0215d4f101afc1e32fc101a200ca4244eb1d9ca846065d387144451331c

memory/752-211-0x00000000000E0000-0x0000000000746000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index~RFe57f992.TMP

MD5 91f30dd34783f3ad56a563e3571805f3
SHA1 7b67462903972a2363af9c1baf4a3776dd5f4066
SHA256 582dfbfbe92c2efffeda82d89bf8bce74edf91dd0f866cff238e471208da56d4
SHA512 048b1da53664648a76b4fdcb294e132deacd582c052b3a70089bf78ce37edf40a1246b3469758fd99b99ad8a64806dfdd43b4aff0447313473d2f958823fcedd

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Code Cache\js\index-dir\the-real-index

MD5 47eb1c045c33567e000884c44fcdcd5e
SHA1 0091f8612c667f6ed8b0469fbf90fb8d04ac69aa
SHA256 4b1a44ce07e40df76518b7735ce325bd37158cfb1e4cecfffe1eec8f15e72a03
SHA512 388fc483d33c0296f1c77378ceb9a58e5a03806140b0690422a704b33f10c434f80d7e375515808395d742ff02d311dbc91d306784c30813d955b4c0c73306d8

C:\Users\Admin\AppData\Local\Temp\TeraBox_status

MD5 b886e574ecf20038c8aa131bc62c5371
SHA1 2dedddab63854e5f60159da1bc0c52bb1cb7c25b
SHA256 64a2f86fddf07d7b029b1c33c189f87a2fde6cd8962296a6dd00065d9f7df769
SHA512 586d7caa2020d7a8c0ddbb8b1cc3c641ecd5afe185c9c5d888f22a1ab851eac1b1ccdd999553df4e56f27bddfb27b6dbf9dffdad82dccde29139d719ac4ebe5e

C:\Users\Admin\AppData\Local\Temp\AutoUpdate\Download\AutoUpdate.xml

MD5 1ca91b22756dd2cbccb6ade5101092b0
SHA1 e65993dd0e0a08c5cb00089e14fd59674f589395
SHA256 5620fac38bc1a54ba7da3dc421192630f4e47529aab6c471238a86af5ae49c44
SHA512 13c76627443c4c53d51a2f5d1bebdeed0c0296f3276b74a5c3e9874fd652e2da045cfab04822d7528c74df9d6b2e45d247c75c2dc58abd6acde67dd8242e6f22

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State~RFe58ad42.TMP

MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

C:\Users\Admin\AppData\Local\Temp\TeraBox\browsercache\Network Persistent State

MD5 9792effb8f953e3efc079314a5d3170b
SHA1 43206bd955d12ede0e41d05a7582b93713ad85fb
SHA256 c8dcdf6175748c42e946507251a14d793fc656ac8fbbf7b9a3a333faedeb1ad5
SHA512 967bae8cb8f4256e3fab713cd2556641e3f1b08dc0e59b844a11095c3b1751c7f3d9de9137b8fbe1a523a2fb8ff92168f892d48be08fe09f18c90c5dfe77fa8f