Analysis
- user interaction
yes - max time kernel
1049s - max time network
1046s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
03/08/2026, 22:56
General
- Target https://www.terabox.com/sharing/link?surl=SLeaVCVWcKEZJGaIqacPJw
- Sample260803-2wnhkshb62
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 34 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 7 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 1 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 36 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 22 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.terabox.com/sharing/link?surl=SLeaVCVWcKEZJGaIqacPJw1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffa2e3bc188,0x7ffa2e3bc194,0x7ffa2e3bc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,299278049753414710,1331864508171252326,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,7444401853853560052,6778915115763787197,262144 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,6392429149028823491,14191855532220415904,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15219039331466674479,15461816424475600707,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,6175071923886692337,2414533292404982382,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,6408732998570119949,14752180931361025375,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,12240084833558447758,7123559096090728111,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4188,i,2745110106274343156,4065646060176341429,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4200,i,12990177121528305034,6238374280560906150,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3808,i,14616014693075032621,3757159581425254021,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,493138680623903153,14045705169464552237,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,4007576207548349466,1477662489985641011,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11403⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,4721116947024032961,10219676237539692135,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,4721116947024032961,10219676237539692135,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6648,i,7813473965405589096,3133476698995530957,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5028,i,17168178297294004128,18206075537045248845,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,6695003751359693480,18029657809809669621,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6848,i,6356816051923616597,1832174039942713447,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5084,i,6390336302276083784,17943699780993935633,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7072,i,13146085923265164883,10809085878075284433,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6620,i,12564674563610849260,17208579974793655330,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6752,i,13514912035783877151,11167776019769393200,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,10237941651280793549,16857184763499178891,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7608,i,5419144686621869235,9860326250494214367,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7612,i,4024997533901796172,15402859385473650773,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7344,i,13126189999755722205,15717910205941286033,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6664,i,15198556494075352146,1417816203923061682,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7616,i,7191325667362814866,7976599136783543512,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8004,i,8249929186321908835,12300245061047473545,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7540,i,13437206034978028150,6696956131299672147,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=7732 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8304,i,3268627214047643377,9499603333354936653,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8304,i,3268627214047643377,9499603333354936653,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8360,i,17410988390334115175,15820461097223692850,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8392 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8368,i,13037613741245526189,4905220913743574535,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8372 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8632,i,7569429372716768435,8732468859933561161,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7844,i,10698335589489631707,5781686497597929387,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8708 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8472,i,2556293211076868821,17057770624153762504,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,6736683850407554465,14657348447964649694,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\TeraBox_sl_b_1.46.0.172.exe"C:\Users\Admin\Downloads\TeraBox_sl_b_1.46.0.172.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBox.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBox.exe" -install "createdetectstartup" -install "createshortcut" "0" -install "createstartup"3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" "/s" "C:\Users\Admin\AppData\Roaming\TeraBox\YunShellExt64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe"/s" "C:\Users\Admin\AppData\Roaming\TeraBox\YunShellExt64.dll"4⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" "/s" "C:\Users\Admin\AppData\Roaming\TeraBox\YunOfficeAddin.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" "/s" "C:\Users\Admin\AppData\Roaming\TeraBox\YunOfficeAddin64.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe"/s" "C:\Users\Admin\AppData\Roaming\TeraBox\YunOfficeAddin64.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\YunUtilityService.exe"C:\Users\Admin\AppData\Roaming\TeraBox\YunUtilityService.exe" --install3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxWebService.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxWebService.exe" reg3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=9640,i,17304951568153043373,2091076177527345870,262144 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9656 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,1234297307224948025,15334308742564108247,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,17209649103801440604,8644591887741522050,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8436,i,6068617830747889627,1404675133216728666,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8164 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8136,i,9298062021648348951,10881882363293509,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8676 /prefetch:12⤵
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxWebService.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxWebService.exe" "terabox://transfer/?browserid=lTQg14zpNc05mw4Y00eMhEkMZdiOcXsBgXXQ1oGKDWSNeZ2lpcpoj-m-UV8=&seq=1fca61f886c84e02"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8720,i,16497486737074904790,17304099540186762438,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9224,i,2677564501408004497,5865322427961809209,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=9256,i,14387884297844173512,14585228995954992646,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=9692,i,151368232605935325,16364142234476397481,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5456,i,717622968301796834,4965263472610758188,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9804,i,9802967170204318166,17711003837878161591,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9792 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9972,i,8596424693501349945,14725165175535385174,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9976 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9768,i,6622462276115893127,5984596086510043051,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=10136,i,1880017868545057261,8154792688980376971,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8700,i,17806452551750527074,12513624661566637090,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9700 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=10376,i,12923956350958829880,12865256079890179266,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10852,i,15840892098068041588,12924459077137464097,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10804 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=10900,i,2325048755465154727,7344968034094044071,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10904 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=4756,i,8974130272473520841,18048210695445533531,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,7666265837532376310,5588031288179162323,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9728,i,7973557287399767762,1517375262518813249,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9656,i,8931440976421576571,10034100527755903954,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8124,i,9450719491997979504,17873306514836197976,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9392 /prefetch:142⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8124,i,4429335715908258285,5223147276059485459,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=10304,i,3793774050913168003,13004728785633637124,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9820,i,7911224239725598084,12383539756459362570,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=10864,i,15907014693304239311,6300685532054567493,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9724,i,7749268059788056394,303651575374249220,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=9712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=7952,i,18316534297002627584,8238581985523175089,2097152 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=10644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,6732421589772332758,16650967271189842311,524288 --field-trial-handle=2288,i,14718440022834232359,11268095959416397362,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBox.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBox.exe" AutoRun1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exeC:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe AutoRun2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\TeraBox" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --mojo-platform-channel-handle=1936 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --first-renderer-process --no-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=3264 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3852 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3864 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5432 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\AutoUpdate\AutoUpdate.exe"C:\Users\Admin\AppData\Roaming\TeraBox\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\Admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly9uZXBob2JveC5jb20vYXV0b3VwZGF0ZQ==" -srvwnd 000B004A -unlogin3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxHost.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxHost.exe" --mojo-named-platform-channel-pipe=6096.5236.16527329143355245660 --plugin_id=1000 --plugin_file_path="C:\Users\Admin\AppData\Roaming\TeraBox\kernel.dll" --app_cache_path="C:\Users\Admin\AppData\Roaming\TeraBox" --crash_report_url=https://sentry.tibibox.com/api/4/minidump/?sentry_key=60864a428339ea75b835f9af661947c6 --enable_crash_report=1 --dls_version=2.0.0.233⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\TeraBox\crashpad_handler.exeC:\Users\Admin\AppData\Roaming\TeraBox\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\TeraBox\plugin crash logs" "--metrics-dir=C:\Users\Admin\AppData\Roaming\TeraBox\plugin crash logs" --url=https://sentry.tibibox.com/api/4/minidump/?sentry_key=60864a428339ea75b835f9af661947c6 "--annotation=sentry={\"tags\":{\"uk\":\"\",\"dlsver\":\"2.0.0.23\",\"plugin_id\":\"1000\",\"kver\":\"1.0.0.16\"}}" --initial-client-data=0x360,0x364,0x368,0x33c,0x36c,0x126211c,0x12620f4,0x12621004⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=6004 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxHost.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxHost.exe" --mojo-named-platform-channel-pipe=6096.6100.13109185339446819589 --plugin_id=3 --plugin_file_path="C:\Users\Admin\AppData\Roaming\TeraBox\vastplayer.dll" --app_cache_path="C:\Users\Admin\AppData\Roaming\TeraBox" --crash_report_url=https://sentry.tibibox.com/api/4/minidump/?sentry_key=60864a428339ea75b835f9af661947c6 --enable_crash_report=1 --uk=4400743625840 --dls_version=2.0.0.233⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\TeraBox\crashpad_handler.exeC:\Users\Admin\AppData\Roaming\TeraBox\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\TeraBox\plugin crash logs" "--metrics-dir=C:\Users\Admin\AppData\Roaming\TeraBox\plugin crash logs" --url=https://sentry.tibibox.com/api/4/minidump/?sentry_key=60864a428339ea75b835f9af661947c6 "--annotation=sentry={\"tags\":{\"uk\":\"4400743625840\",\"dlsver\":\"2.0.0.23\",\"plugin_id\":\"3\",\"kver\":\"\"}}" --initial-client-data=0x2e8,0x2ec,0x2f0,0x2c4,0x2f4,0x126211c,0x12620f4,0x12621004⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5284 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4776 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5748 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=864 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5276 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5032 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6084 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2088 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4828 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --enable-sandbox --enable-blink-features --disable-blink-features --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4812 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=6052 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --app-user-model-id=electron.app.TeraBoxUnite --app-path="C:\Users\Admin\AppData\Roaming\TeraBox\resources\app.asar" --no-sandbox --no-zygote --node-integration-in-worker --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4876 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxUnite.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\TeraBox\cache" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5344 --field-trial-handle=1852,i,11571917646430682831,9781387802093201981,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Roaming\TeraBox\YunUtilityService.exeC:\Users\Admin\AppData\Roaming\TeraBox\YunUtilityService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxWebService.exe"C:\Users\Admin\AppData\Roaming\TeraBox\TeraBoxWebService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" F:\TeraBoxDownload\205284_Bulgaria_By Combolist.Xyz @SoloXmoon .txt1⤵
- Enumerates connected drives
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" F:\TeraBoxDownload\205284_Bulgaria_By Combolist.Xyz @SoloXmoon .txt1⤵
- Enumerates connected drives
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" F:\TeraBoxDownload\643215_edu_By Combolist.Xyz @SoloXmoon .txt1⤵
- Enumerates connected drives
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
5Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
blocklist
settings.dat
settings.dat
9f631677-5106-4a75-970b-e510b8953f3f.tmp
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000a8
f_0000a9
f_0000aa
f_0000ab
f_0000ac
f_0000ad
f_0000ae
f_0000af
f_0000b1
f_0000b2
f_0000b4
f_0000b5
f_0000b6
f_0000b8
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000c1
f_0000c2
f_0000ea
f_000152
f_00015c
f_000165
8800d5369d1e8800_0
temp-index
the-real-index
the-real-index
the-real-index~RFe590575.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe588edd.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe58438c.TMP
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5cd2d8.TMP
index.txt
index.txt
index.txt
index.txt
the-real-index
the-real-index
sync_diagnostic.log
OperationConfig
OperationConfig~RFe58def1.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe586ea3.TMP
d7d6ff91-ac86-4df8-9e74-7c6293354a0f.tmp
AppCache134302716969281502.txt
06912b00-f9da-435d-aeee-b562233b0a8a.tmp.ico
data_2
data_3
f_000005
f_000007
f_000013
f_000022
f_000027
f_000056
f_000057
f_000058
f_00005b
f_00005c
f_00005e
f_00006c
f_00006d
f_00007c
the-real-index
the-real-index
the-real-index
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5a1696.TMP
temp-index
MANIFEST-000001
Network Persistent State
e0a18dc4-7d96-4b87-91d6-4901c1499f4b.tmp
the-real-index
MANIFEST-000001
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
index
temp-index
Network Persistent State
aadbc72d-0dcb-406c-9f45-74749498020e.tmp
data_0
data_1
NsisInstallUI.dll
System.dll
guide.ini
nsProcessW.dll
default.dic
ccba5a5986c77e43.customDestinations-ms
MXLog_20260803185817_1
AutoUpdate.xml
upgrade_1460172_1461173.cab
TeraBox.exe
TeraBoxWebService.exe
YunOfficeAddin.dll
YunOfficeAddin64.dll
YunShellExt64.dll
YunUtilityService.exe
aiEditor-202505220052.zip
aiIndex-202509101141.zip
core-asar-202509111806.zip
msvcp140.dll
uninst.exe
vcruntime140.dll
TeraBox_sl_b_1.46.0.172.exe:Zone.Identifier
memory/900-5325-0x0000021323220000-0x0000021323320000-memory.dmp
memory/900-5377-0x0000021437100000-0x0000021437120000-memory.dmp
memory/900-5378-0x00000213366A0000-0x00000213366C0000-memory.dmp
memory/900-5454-0x0000021448D10000-0x0000021448E10000-memory.dmp
memory/900-5476-0x00000214492B0000-0x00000214493B0000-memory.dmp
memory/900-5333-0x0000021322E50000-0x0000021322F50000-memory.dmp
memory/900-5324-0x0000021323220000-0x0000021323320000-memory.dmp
memory/4768-4145-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4144-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4146-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4147-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4142-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4143-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4137-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4138-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4136-0x000000000E8A0000-0x000000000E8A1000-memory.dmp
memory/4768-4148-0x000000000E8A0000-0x000000000E8A1000-memory.dmp