URL:

https://d5.nephobox.com/issue/terabox/PCTeraBox/channel/TeraBox_sl_b_1.31.0.1.exe?to=gl&sign=BOTH-F3530edecde9cd71b79378b290804a96-Dw1qDqurhvz0szqGrSOHCqTWBAk%3D&region=tky&pkey=000050ef6c93cfbbbe4ce6416ff1ec8488ab

Full analysis: https://app.any.run/tasks/90a5371e-b10c-4376-afef-e77eea517d7c
Verdict: Malicious activity
Analysis date: June 25, 2024, 12:34:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
vmprotect
Indicators:
MD5:

EFF0F0D29B286F4645383B536ED09F17

SHA1:

0C583E0F01ABA0FDBD1C4075148476D085F70281

SHA256:

EF3144B19797ABA3529788A60BF7A7B75BD43F29DEC47699357373A1BA80FCA1

SSDEEP:

6:2IvbKAVVAXOKdyTdqJKM97Mi4fCOKG7fZKu:2I2AV1KYTdqlyi5o

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • Changes the autorun value in the registry

      • TeraBox.exe (PID: 2112)

    • Registers / Runs the DLL via REGSVR32.EXE

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • Creates a writable file in the system directory

      • YunUtilityService.exe (PID: 2376)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • Executable content was dropped or overwritten

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • The process creates files with name similar to system file names

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)
      • TeraBoxRender.exe (PID: 3444)

    • The process drops C-runtime libraries

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • Process drops legitimate windows executable

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • Creates a software uninstall entry

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • Reads the date of Windows installation

      • TeraBox.exe (PID: 2112)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2600)
      • regsvr32.exe (PID: 3972)

    • Reads security settings of Internet Explorer

      • TeraBoxWebService.exe (PID: 2004)
      • TeraBox.exe (PID: 2276)
      • AutoUpdate.exe (PID: 368)

    • Reads the Internet Settings

      • TeraBoxWebService.exe (PID: 2004)
      • TeraBox.exe (PID: 2276)
      • AutoUpdate.exe (PID: 368)

    • Checks Windows Trust Settings

      • TeraBox.exe (PID: 2276)
      • YunUtilityService.exe (PID: 2376)
      • AutoUpdate.exe (PID: 368)

    • Reads settings of System Certificates

      • TeraBox.exe (PID: 2276)
      • TeraBoxRender.exe (PID: 3184)
      • AutoUpdate.exe (PID: 368)

    • Executes as Windows Service

      • YunUtilityService.exe (PID: 2376)

    • Adds/modifies Windows certificates

      • YunUtilityService.exe (PID: 2376)

  • INFO

    • Application launched itself

      • msedge.exe (PID: 3400)

    • Reads the computer name

      • wmpnscfg.exe (PID: 2492)
      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)
      • TeraBox.exe (PID: 2112)
      • YunUtilityService.exe (PID: 1748)
      • TeraBoxWebService.exe (PID: 2004)
      • TeraBox.exe (PID: 2276)
      • TeraBoxRender.exe (PID: 3444)
      • TeraBoxRender.exe (PID: 3184)
      • TeraBoxRender.exe (PID: 2536)
      • YunUtilityService.exe (PID: 2376)
      • TeraBoxHost.exe (PID: 3536)
      • TeraBoxHost.exe (PID: 2448)
      • AutoUpdate.exe (PID: 368)

    • Checks supported languages

      • wmpnscfg.exe (PID: 2492)
      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)
      • TeraBox.exe (PID: 2112)
      • YunUtilityService.exe (PID: 1748)
      • TeraBoxWebService.exe (PID: 3704)
      • TeraBoxWebService.exe (PID: 2004)
      • TeraBox.exe (PID: 2276)
      • TeraBoxRender.exe (PID: 3444)
      • TeraBoxRender.exe (PID: 3200)
      • TeraBoxRender.exe (PID: 3184)
      • TeraBoxRender.exe (PID: 2512)
      • YunUtilityService.exe (PID: 2376)
      • TeraBoxHost.exe (PID: 3536)
      • TeraBoxRender.exe (PID: 2536)
      • AutoUpdate.exe (PID: 368)
      • TeraBoxHost.exe (PID: 2448)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2492)

    • The process uses the downloaded file

      • msedge.exe (PID: 4064)
      • msedge.exe (PID: 3400)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 3400)

    • Drops the executable file immediately after the start

      • msedge.exe (PID: 3400)

    • Reads Environment values

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)

    • Creates files or folders in the user directory

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)
      • TeraBox.exe (PID: 2112)
      • TeraBoxWebService.exe (PID: 2004)
      • TeraBox.exe (PID: 2276)
      • TeraBoxHost.exe (PID: 3536)
      • AutoUpdate.exe (PID: 368)
      • TeraBoxHost.exe (PID: 2448)

    • Create files in a temporary directory

      • TeraBox_sl_b_1.31.0.1.exe (PID: 3672)
      • TeraBox.exe (PID: 2276)
      • TeraBoxRender.exe (PID: 3184)

    • Reads the machine GUID from the registry

      • TeraBox.exe (PID: 2112)
      • TeraBoxWebService.exe (PID: 2004)
      • TeraBox.exe (PID: 2276)
      • TeraBoxRender.exe (PID: 3184)
      • YunUtilityService.exe (PID: 2376)
      • TeraBoxHost.exe (PID: 3536)
      • AutoUpdate.exe (PID: 368)

    • Checks proxy server information

      • TeraBoxWebService.exe (PID: 2004)
      • TeraBox.exe (PID: 2276)
      • AutoUpdate.exe (PID: 368)

    • Process checks computer location settings

      • TeraBox.exe (PID: 2276)
      • TeraBoxRender.exe (PID: 3200)
      • TeraBoxRender.exe (PID: 2512)

    • Reads the software policy settings

      • TeraBox.exe (PID: 2276)
      • TeraBoxRender.exe (PID: 3184)
      • YunUtilityService.exe (PID: 2376)
      • AutoUpdate.exe (PID: 368)

    • VMProtect protector has been detected

      • TeraBoxHost.exe (PID: 3536)

    • Creates files in the program directory

      • TeraBoxHost.exe (PID: 3536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
103
Monitored processes
56
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs terabox_sl_b_1.31.0.1.exe no specs terabox_sl_b_1.31.0.1.exe terabox.exe regsvr32.exe no specs regsvr32.exe no specs yunutilityservice.exe no specs teraboxwebservice.exe no specs msedge.exe no specs msedge.exe no specs terabox.exe teraboxwebservice.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs teraboxrender.exe no specs teraboxrender.exe teraboxrender.exe no specs teraboxrender.exe no specs teraboxrender.exe no specs yunutilityservice.exe THREAT teraboxhost.exe teraboxhost.exe autoupdate.exe msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
368"C:\Users\admin\AppData\Roaming\TeraBox\AutoUpdate\AutoUpdate.exe" -client_info "C:\Users\admin\AppData\Local\Temp\TeraBox_status" -update_cfg_url "aHR0cHM6Ly90ZXJhYm94LmNvbS9hdXRvdXBkYXRl" -srvwnd 3021a -unlogin C:\Users\admin\AppData\Roaming\TeraBox\AutoUpdate\AutoUpdate.exe
TeraBox.exe
User:
admin
Company:
Flextech Inc.
Integrity Level:
MEDIUM
Description:
TeraBoxUpdate
Exit code:
0
Version:
1.31.0.1
Modules
Images
c:\users\admin\appdata\roaming\terabox\autoupdate\autoupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
400"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
524"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3864 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
580"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=1024 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
660"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4456 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4092 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1284"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1516"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Users\admin\AppData\Roaming\TeraBox\YunUtilityService.exe" --installC:\Users\admin\AppData\Roaming\TeraBox\YunUtilityService.exe—TeraBox_sl_b_1.31.0.1.exe
User:
admin
Company:
Flextech Inc.
Integrity Level:
HIGH
Description:
TeraBox Service Used to Quickly Apply For Disk Space
Exit code:
0
Version:
1.31.0.1
Modules
Images
c:\users\admin\appdata\roaming\terabox\yunutilityservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\userenv.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
1840"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5328 --field-trial-handle=1336,i,6948227265991936742,8421750198859435237,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
62 058
Read events
61 526
Write events
493
Delete events
39

Modification events

(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3400) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
14E3B0664C7A2F00
(PID) Process:(3400) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault
Operation:delete valueName:S-1-5-21-1302019708-1500728564-335382590-1000
Value:
(PID) Process:(3400) msedge.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
Executable files
93
Suspicious files
706
Text files
102
Unknown types
1

Dropped files

PID
Process
Filename
Type
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF4e1b1.TMP —
MD5:—
SHA256:—
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF4e1c1.TMP —
MD5:—
SHA256:—
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF4e1d1.TMP —
MD5:—
SHA256:—
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF4e20f.TMP —
MD5:—
SHA256:—
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datbinary
MD5:4B74C392839DDD59792975091A30DB00
SHA256:7A5A3B8CC4D5BB579FA5E6C6A831964FB245A5CFF9AD3B80F5E9DC34DA4A7D53
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:CE3AC3673EB3498DDF7BEC3328D23765
SHA256:D2304AEDC7D32192364DCDECAF7A17972F3ABF909A79646A47B66917ECA30E9A
3400msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Last Versiontext
MD5:61FE7896F9494DCDF53480A325F4FB85
SHA256:ACFD3CD36E0DFCF1DCB67C7F31F2A5B9BA0815528A0C604D4330DFAA9E683E51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
111
DNS requests
148
Threats
56

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1372
svchost.exe
GET
304
23.53.40.56:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1060
svchost.exe
GET
304
23.53.40.83:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6db8a07497701bb0
unknown
—
—
unknown
2004
TeraBoxWebService.exe
GET
404
210.148.85.47:80
http://www.terabox.com/box-static/base/widget/httpProxy/_nomd5/crossdomain.xml
unknown
—
—
unknown
2276
TeraBox.exe
POST
200
210.148.85.47:80
http://terabox.com/statistics?clienttype=8&devuid=TBIMXV2%2DO%5F77F09A3E7DE74602BCD00C09CAE10A5D%2DC%5F0%2DD%5F4d51303030302031202020202020202020202020%2DM%5F12A9866C77DE%2DV%5FC4BA3647&channel=00000000000000000000000001000002&version=1.31.0.1&ver=1&id=1719319123FEA6B340BCD946F38B18CA26C7D9A97F&vip=0
unknown
—
—
unknown
1372
svchost.exe
GET
200
23.53.42.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2376
YunUtilityService.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
unknown
2376
YunUtilityService.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/rootr3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCEHgDGEJFcIpBz28BuO60qVQ%3D
unknown
—
—
unknown
2376
YunUtilityService.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
unknown
2376
YunUtilityService.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDBLeGItEWTEgQyVFBw%3D%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3400
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
400
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
400
msedge.exe
34.110.181.92:443
d5.nephobox.com
GOOGLE
US
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
400
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1372
svchost.exe
23.53.40.56:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
23.53.42.18:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
1372
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
3400
msedge.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
d5.nephobox.com
  • 34.110.181.92
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
ctldl.windowsupdate.com
  • 23.53.40.56
  • 23.53.40.49
  • 23.53.40.83
  • 23.53.40.35
whitelisted
crl.microsoft.com
  • 23.53.42.18
  • 23.53.41.248
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.bing.com
  • 104.126.37.170
  • 104.126.37.131
  • 104.126.37.186
  • 104.126.37.128
  • 104.126.37.184
  • 104.126.37.178
  • 104.126.37.168
  • 104.126.37.130
  • 104.126.37.171
  • 104.126.37.176
  • 104.126.37.179
  • 104.126.37.144
  • 104.126.37.155
  • 104.126.37.139
  • 104.126.37.137
  • 104.126.37.152
  • 104.126.37.153
  • 104.126.37.160
  • 104.126.37.136
  • 104.126.37.177
whitelisted
ntp.msn.com
  • 204.79.197.203
whitelisted
assets.msn.com
  • 23.53.42.115
  • 23.53.42.211
  • 23.53.42.200
  • 23.53.42.202
  • 23.53.42.209
  • 23.53.42.107
  • 23.53.42.105
  • 23.53.42.201
  • 23.53.42.113
  • 23.53.42.177
  • 23.53.42.187
  • 23.53.42.179
  • 23.53.42.184
  • 23.53.42.178
  • 23.53.42.186
  • 23.53.42.192
  • 23.53.42.193
whitelisted
r.bing.com
  • 104.126.37.146
  • 104.126.37.139
  • 104.126.37.155
  • 104.126.37.168
  • 104.126.37.144
  • 104.126.37.162
  • 104.126.37.153
  • 104.126.37.161
  • 104.126.37.163
whitelisted

Threats

PID
Process
Class
Message
400
msedge.exe
Misc activity
ET INFO DNS Query to File Sharing Domain (terabox .com)
400
msedge.exe
Misc activity
ET INFO DNS Query to File Sharing Domain (terabox .com)
400
msedge.exe
Misc activity
ET INFO DNS Query to File Sharing Domain (terabox .com)
400
msedge.exe
Misc activity
ET INFO DNS Query to File Sharing Domain (terabox .com)
400
msedge.exe
Misc activity
ET INFO DNS Query to File Sharing Domain (terabox .com)
400
msedge.exe
Misc activity
ET INFO DNS Query to File Sharing Domain (terabox .com)
400
msedge.exe
Misc activity
ET INFO Observed File Sharing Domain (terabox .com in TLS SNI)
400
msedge.exe
Misc activity
ET INFO Observed File Sharing Domain (terabox .com in TLS SNI)
400
msedge.exe
Misc activity
ET INFO DNS Query to File Sharing Domain (terabox .com)
400
msedge.exe
Misc activity
ET INFO Observed File Sharing Domain (terabox .com in TLS SNI)
Process
Message
TeraBoxHost.exe
vast_media--[2024-06-25 13:38:50:591] Initialized sdl_video_render_driver=software
TeraBoxHost.exe
vast_media--[2024-06-25 13:38:50:591] Initialized sdl_audio_play_driver=directsound
TeraBoxHost.exe
vast_media--[2024-06-25 13:38:50:591] Initialized hardware_type=3001
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://d5.nephobox.com/issue/terabox/PCTeraBox/channel/TeraBox_sl_b_1.31.0.1.exe?to=gl&sign=BOTH-F3530edecde9cd71b79378b290804a96-Dw1qDqurhvz0szqGrSOHCqTWBAk%3D&region=tky&pkey=000050ef6c93cfbbbe4ce6416ff1ec8488ab