ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 18:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
Size

771KB
MD5

ec827797becedda0a31effa5ca067afd
SHA1

0a7ccf0d62b87fd4172cb36148d5b3c9fbf285d8
SHA256

ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540
SHA512

9afc50faf49900b386db4a6dbcf2e7d3d2b2c685ff8ccaee165a517849908e874d7dafa6980dada4f8c37d5d9ec14aad17335307d861820fdb260267193f9c04
SSDEEP

12288:U761vvrXBDZZmDmSh7SHSjX4z4ZV4kzI6OcGfAkx4tOF6j+Z:U7qvrXo7ZNX4z4YbcGfAkx4tNE

Score

8^/10

persistence

Malware Config

Signatures

Downloads MZ/PE file

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	DropboxUpdate.exe

Executes dropped EXE 7 IoCs

pid	Process
1452	DropboxUpdate.exe
1372	DropboxUpdate.exe
1944	DropboxUpdate.exe
3988	DropboxUpdate.exe
3636	DropboxUpdate.exe
4584	DropboxUpdate.exe
3988	DropboxClient_189.4.8395.x64.exe

Loads dropped DLL 13 IoCs

pid	Process
1452	DropboxUpdate.exe
1372	DropboxUpdate.exe
1944	DropboxUpdate.exe
1944	DropboxUpdate.exe
1944	DropboxUpdate.exe
1944	DropboxUpdate.exe
1452	DropboxUpdate.exe
3988	DropboxUpdate.exe
3636	DropboxUpdate.exe
4584	DropboxUpdate.exe
4584	DropboxUpdate.exe
3636	DropboxUpdate.exe
3988	DropboxClient_189.4.8395.x64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
22	404	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	DropboxUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\libGLESv2.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\PyQt5.QtQml.pyd	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-processthreads-l1-1-1.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\Dropbox.VisualElementsManifest.xml	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-crt-math-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-crt-runtime-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_en.dll	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_zh-CN.dll	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Update\Install\{707FB009-E5A6-427E-9C9B-A8C0F4DECB55}\DropboxClient_189.4.8395.x64.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-string-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_id.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\msvcp140_1.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-memory-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-crt-convert-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_uk.dll	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ko.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_de.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\Qt5QuickWidgets.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\allocator_metrics.cp38-win_amd64.pyd	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-console-l1-2-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-file-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-heap-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\psmachine.dll	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_ko.dll	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-crt-stdio-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\fastpath.cp38-win_amd64.pyd	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\libffi-7.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\msvcp140.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-crt-heap-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-crt-private-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_pt-BR.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_zh-CN.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\Qt5OpenGL.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\apex.node	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\dropbox_sqlite_ext.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxUpdate.exe	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\npDropboxUpdate3.dll	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_es.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\Dropbox.exe	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\qt.conf	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\Qt5Quick.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-handle-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\concrt140.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxCrashHandler.exe	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_th.dll	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-localization-l1-2-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\dropbox_core.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\@PaxHeader	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\_bowbow.cp38-win_amd64.pyd	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\Qt5Sql.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\Qt5WinExtras.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-util-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_en.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psuser.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCleanup.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\PyQt5.sip.pyd	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\Qt5Gui.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\api-ms-win-core-libraryloader-l1-1-0.dll	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCrashHandler.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateOnDemand.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\DropboxUpdateProxy32.exe	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\PyQt5.QtGui.pyd	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\cryptography.hazmat.bindings._padding.pyd	DropboxClient_189.4.8395.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_189.4.8395\189.4.8395\dropbox_core_tprt.node	DropboxClient_189.4.8395.x64.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e5786f3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5786f3.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{099218A5-A723-43DC-8DB5-6173656A1E94}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A1F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5786f7.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\VersionIndependentProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6CC2A7CB440C2A4DBE17EE5DAC2110B\5A812990327ACD34D85B163756A6E149	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A378DB55-CBFE-483C-8697-710EAD506BBF}\InProcServer32\ThreadingModel = "Both"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{05378308-2559-4C71-B758-7DACD5A359BA}\ = "IProcessLauncher"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\Elevation	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\Elevation\IconReference = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\goopdate.dll,-1004"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc.1.0\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\LocalizedString = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\goopdate.dll,-3000"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{78F1393A-63FD-494A-BA89-2C3ECA4E8EC8}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.817.1\\psmachine.dll"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\VersionIndependentProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\LocalServer32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{96D1EED3-701E-4FE5-B996-A543A8465897}\ = "ServiceModule"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\LocalService = "dbupdatem"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\NumMethods\ = "10"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\LocalServer32	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\VersionIndependentProgID\ = "Dropbox.OneClickProcessLauncherMachine"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine.1.0	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\CurVer\ = "DropboxUpdate.CredentialDialogMachine.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E38012B-D35D-4278-BBFD-E5AC871D3E60}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A337332-37E4-4063-B4F3-6416846C8A33}\ProgID\ = "DropboxUpdate.CoreClass.1"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\AuthorizedLUAApp = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\ProxyStubClsid32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CurVer	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\ = "ServiceModule"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID\ = "DropboxUpdate.Update3WebMachineFallback.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A337332-37E4-4063-B4F3-6416846C8A33}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\SourceList\PackageName = "DropboxUpdateHelper.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FDA8FC46-0F9A-4A8C-8764-3B80880A9AEB}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EF028154-CA20-4F73-ACBB-82451B78F1E6}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B35122D2-0036-4536-AEEA-EEA68E54A460}\ProxyStubClsid32\ = "{A378DB55-CBFE-483C-8697-710EAD506BBF}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\ = "Dropbox Update Legacy On Demand"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\ProgID\ = "DropboxUpdate.OnDemandCOMClassMachine.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\ProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{76E258F0-DE86-4CEC-9D30-3F728A898741}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\ProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1\CLSID\ = "{9E396485-96EB-4906-B2C5-3E0F1E7748C3}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\ = "Dropbox Update Core Class"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback.1.0\CLSID\ = "{49423331-2B41-4EDE-838E-F8C8F3F6BF62}"	DropboxUpdate.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1452	DropboxUpdate.exe
1452	DropboxUpdate.exe
404	msiexec.exe
404	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1452	DropboxUpdate.exe
Token: SeShutdownPrivilege	1452	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	1452	DropboxUpdate.exe
Token: SeSecurityPrivilege	404	msiexec.exe
Token: SeCreateTokenPrivilege	1452	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	1452	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	1452	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	1452	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	1452	DropboxUpdate.exe
Token: SeTcbPrivilege	1452	DropboxUpdate.exe
Token: SeSecurityPrivilege	1452	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	1452	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	1452	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	1452	DropboxUpdate.exe
Token: SeSystemtimePrivilege	1452	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	1452	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	1452	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	1452	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	1452	DropboxUpdate.exe
Token: SeBackupPrivilege	1452	DropboxUpdate.exe
Token: SeRestorePrivilege	1452	DropboxUpdate.exe
Token: SeShutdownPrivilege	1452	DropboxUpdate.exe
Token: SeDebugPrivilege	1452	DropboxUpdate.exe
Token: SeAuditPrivilege	1452	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	1452	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	1452	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	1452	DropboxUpdate.exe
Token: SeUndockPrivilege	1452	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	1452	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	1452	DropboxUpdate.exe
Token: SeManageVolumePrivilege	1452	DropboxUpdate.exe
Token: SeImpersonatePrivilege	1452	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	1452	DropboxUpdate.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe
Token: SeTakeOwnershipPrivilege	404	msiexec.exe
Token: SeRestorePrivilege	404	msiexec.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 1452	3536	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe	88
PID 3536 wrote to memory of 1452	3536	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe	88
PID 3536 wrote to memory of 1452	3536	ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe	88
PID 1452 wrote to memory of 1372	1452	DropboxUpdate.exe	92
PID 1452 wrote to memory of 1372	1452	DropboxUpdate.exe	92
PID 1452 wrote to memory of 1372	1452	DropboxUpdate.exe	92
PID 1452 wrote to memory of 1944	1452	DropboxUpdate.exe	95
PID 1452 wrote to memory of 1944	1452	DropboxUpdate.exe	95
PID 1452 wrote to memory of 1944	1452	DropboxUpdate.exe	95
PID 1452 wrote to memory of 3988	1452	DropboxUpdate.exe	100
PID 1452 wrote to memory of 3988	1452	DropboxUpdate.exe	100
PID 1452 wrote to memory of 3988	1452	DropboxUpdate.exe	100
PID 1452 wrote to memory of 3636	1452	DropboxUpdate.exe	99
PID 1452 wrote to memory of 3636	1452	DropboxUpdate.exe	99
PID 1452 wrote to memory of 3636	1452	DropboxUpdate.exe	99
PID 4584 wrote to memory of 3988	4584	DropboxUpdate.exe	111
PID 4584 wrote to memory of 3988	4584	DropboxUpdate.exe	111
PID 4584 wrote to memory of 3988	4584	DropboxUpdate.exe	111

C:\Users\Admin\AppData\Local\Temp\ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe
"C:\Users\Admin\AppData\Local\Temp\ec8b735b020dcf9f7bcff1d8caf774724bab451ae07c3846c02f11554b02c540.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxUpdate.exe
  "C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxUpdate.exe" /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSnlyVmtvc0xjbUlMOG5QVHMxVHNsSlFLcW9vTHZMeHp6QUt5QTFJS3lnUGNuZnpOQ2lMU3Nuejh2RnpDN2NzTks3UU16UTNNRFkzdDdRd05GSFNVVkFxVGkwdXpzelBpODlNQVdvMk1qZXpNRFUyc0xRd05qRTNOekl4TjdXME5EUTBCYW9FYXJFd05qQXhNRE0wTkRhMXJBVUFQN2Nna1F-fkBNRVRBIn0"
  2⤵
  - Sets file execution options in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1372
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1944
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&experiments=buildid%3Dmain%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSnlyVmtvc0xjbUlMOG5QVHMxVHNsSlFLcW9vTHZMeHp6QUt5QTFJS3lnUGNuZnpOQ2lMU3Nuejh2RnpDN2NzTks3UU16UTNNRFkzdDdRd05GSFNVVkFxVGkwdXpzelBpODlNQVdvMk1qZXpNRFUyc0xRd05qRTNOekl4TjdXME5EUTBCYW9FYXJFd05qQXhNRE0wTkRhMXJBVUFQN2Nna1F-fkBNRVRBIn0&nolaunch=0" /installsource taggedmi /sessionid "{5C68D88C-7E65-429B-B9E2-5A5C00413E50}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3636
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5SlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcGxaR2RsT2pwbFNubHlWbXR2YzB4amJVbE1PRzVRVkhNeFZITnNTbEZMY1c5dlRIWk1lSHA2UVV0NVFURkpTM2xuVUdOdVpucE9RMmxNVTNOdWVqaDJSbnBETjJOelRrczNVVTE2VVROTlJGa3pkRGRSZDA1R1NGTlZWa0Z4Vkdrd2RYcHplbEJwT0RsTlFWZHZNazFxWlhwTlJGVXljMHhSZDA1cVJUTk9la2w0VGpkWE1FNUVVVEJDWVc5RllYSkZkMDVxUVhoTlJFMHdUa1JoTVhKQlZVRlFOMk5uYTFGLWZrQk5SVlJCSW4wIiBwcm90b2NvbD0iMy4wIiB2ZXJzaW9uPSIxLjMuODE3LjEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NUM2OEQ4OEMtN0U2NS00MjlCLUI5RTItNUE1QzAwNDEzRTUwfSIgdXNlcmlkPSJ7OTI2QzI2NUEtRDBGNi00NENELUE2MkUtNTk3RUIyREY5MUJDfSIgaW5zdGFsbHNvdXJjZT0idGFnZ2VkbWkiIHJlcXVlc3RpZD0iezYzMzk3MUMzLTJEOUEtNEI3Ni05MzlCLUQwNzNFNUZGRTAwRX0iPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuODE3LjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3988

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:404

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Program Files (x86)\Dropbox\Update\Install\{707FB009-E5A6-427E-9C9B-A8C0F4DECB55}\DropboxClient_189.4.8395.x64.exe
  "C:\Program Files (x86)\Dropbox\Update\Install\{707FB009-E5A6-427E-9C9B-A8C0F4DECB55}\DropboxClient_189.4.8395.x64.exe" /S /DBData:eyJUQUdTIjoiREJQUkVBVVRIOjplZGdlOjplSnlyVmtvc0xjbUlMOG5QVHMxVHNsSlFLcW9vTHZMeHp6QUt5QTFJS3lnUGNuZnpOQ2lMU3Nuejh2RnpDN2NzTks3UU16UTNNRFkzdDdRd05GSFNVVkFxVGkwdXpzelBpODlNQVdvMk1qZXpNRFUyc0xRd05qRTNOekl4TjdXME5EUTBCYW9FYXJFd05qQXhNRE0wTkRhMXJBVUFQN2Nna1F-fkBNRVRBIiwib21haGEtaW5zdGFsbGVyLWlkIjoiezkyNkMyNjVBLUQwRjYtNDRDRC1BNjJFLTU5N0VCMkRGOTFCQ30iLCJyZXF1ZXN0X3NlcXVlbmNlIjowfQ /InstallType:MACHINE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5786f6.rbs

Filesize
7KB

MD5
4e5b5a16d4a51b21ed50398b6f9371d2

SHA1
c99c82a2c7f7b692a4047c929c2cd96d17cbf964

SHA256
36a6016f6574cb5fee23557c469b4a5994383094808a599e7138ff18d9e0183f

SHA512
806667cca0c3a4f176b96af12f3cd75c43e8ad5e9015e05025d9a5043bba8dcffe198a79b53d0cf69f1925acaad6a353bc1bf73525bfa7fac4b10f04315f6639

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\@PaxHeader

Filesize
28B

MD5
d837f37586166ce0512008587d096d42

SHA1
e527039c63922d7f6d8a4ede285dbdd28c6171e1

SHA256
5a91e4e117ccacc7c7a47833e6dcd41b5fb52be6092887ea6afe2a8cabb6f795

SHA512
729ee9e7141916c3e998570d5b18feadb918e4ad932d396f1e7767dbac709933b1c22a5149937027afa632669f8112d7b99c3240458e421c13e83f43c8c50dce

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxCleanup.exe

Filesize
12KB

MD5
f0fe5d08258addaac332745de760f9c8

SHA1
9639cd7700d283ad09e664ac86d00ee084b52dea

SHA256
19998548707fce140fe34625a733605499586c603df5dc83a8389baee95b2157

SHA512
fa9f11932f2b1c616efb40f41095492a429a763900b576be07b64a8dc32aadf69868dcb223b092612092ff74cbfb3195dcc131ec2c9023d3a8735ec63686470e

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxCrashHandler.exe

Filesize
129KB

MD5
e3214461da70a51d0fe6ab76dcc753c1

SHA1
5ce885de14919fd7ba6ce35726480b098eaf5acc

SHA256
2e3925b6c2175a98024551fea9e0b8dbc54f4107322c97b1493add40ed8ab73b

SHA512
67668b4ce7102480a0f37113922c9197ebe90619a2cded3a484024902f167bc005fe11f50e3d9509e2d4a4cbad1865f61b20189ddf37e916ff01bbf38e9e2aa6

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxUpdate.exe

Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxUpdateBroker.exe

Filesize
51KB

MD5
d2ff8b38b49451db7ee4c2dee7d52603

SHA1
a795438595c17abfe4af7b03688effad17c9b3dc

SHA256
2d019ba06ecfd32752d7aeb6c97050c0be86312ebfbfeb1cf397c6b33d05ac2e

SHA512
677064ddc687febe8763a7fda4506a1e034d22c2cbcd1b43929d648b1a746a162e28cfdb1d6ad8cdf52f88278b6d400c7290f83b2aa17604a79385f55300667d

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxUpdateHelper.msi

Filesize
17KB

MD5
1ea0cbea297d9afc32c95a35f9139678

SHA1
8d68773613035b66109ef357eaa5529f67d9405b

SHA256
fe844126a8b67cf53afdb6fc80686505ffc96bcf8ee70993a9851507dae02d50

SHA512
96f7ad633b54cf68f7e8d14bce488386cade7fd670f14cbc29191ed1a12dd719a6f1c30b3ab3322472d507f1edadfb41ba8ecb627233196a099cda1344ed1860

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\DropboxUpdateOnDemand.exe

Filesize
9KB

MD5
47c87b68fda79cf17dc34fa79ef4e4c0

SHA1
d7cef2445136e4efa3b029867a230f4857984845

SHA256
d1d149e9723413bbce65f843e5c815d1ba0f188432f7cd42e744d45f64f9328f

SHA512
20dd32415685d5608b145ca4f2161e818cb8d94d3a9167c3df07e0180acd2dfcfb66afb6845c9c53853671c13b9f7149730c6fd0519e7953af574c213966b01b

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdate.dll

Filesize
757KB

MD5
6146ac52589a79850cbc9340c01dd1ef

SHA1
68de02ce898baa072b0cec8c7944ec9790767902

SHA256
6aeb7329c97c539299f2969daddc2c35880e7149c5118cb5c3ca1a79b4e2f1f6

SHA512
e0b5ca1310aed6e506838cbfec49c7927a2591e97b7ba9c9974130852aaf1d5dedac50d1d3b1895e955af106e71fd09cff0b62e2a45cd275e5e6ebba256c92ec

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdate.dll

Filesize
147KB

MD5
16574c413bebef222677bdb7e7c47c09

SHA1
e3ebc511e678a64bb04bb31e713e285860d2fa95

SHA256
ecedf63276a33acf8064434fc876e3bb37f25820a2f7b0b5b0361a153d8970c1

SHA512
13f5ae10f5841a2dec6f238bb89fb532186ec65d139c6b63a0c734358967ffeb1e9f451c0b49c40e9d841b9217a8e1a2cc3ad99bed19f6c716f02bcddcacaa16

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_da.dll

Filesize
32KB

MD5
1ac5617cafffbb69ab768095c77b4306

SHA1
c120a49e4886f839fb96c84f87727dd023fcec19

SHA256
8fadf121a5766032bfddd0f6342dd6e2a612996370ed1f5c548f5cbb5ac548f9

SHA512
fd26156f9651f5237df3461128547496ab623c5a34c691f410177c3198608de8618a199f48f3a02155ed3fcb8d9717fd3c3cc8834013a99f1dffa4f3d8913ff0

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_en.dll

Filesize
31KB

MD5
fc198c77a954eb0eda8424eac724584f

SHA1
d1bdeb781372cd4907e519c2fd81094441385536

SHA256
67d5c3f8a6e9415deef22148a4216518a7ee52b468ba6bb1c67020d56d9e3745

SHA512
74572d8422a57046ccf5729eae36c396028b9162581dad80f20299fa11426bf453a7ba5a34022ec3103a7b995aa9e77f5dc44ba9de1570b03b964b38559306d6

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_es-419.dll

Filesize
33KB

MD5
07cf9b2367462de21cd1c1ee5ef076ae

SHA1
15676dfe46d54e7a609fea052010b847709535ee

SHA256
4d43704f744093b41f9d3315c508933a91c481732b84e0b14bf642aa5d03e020

SHA512
a96d4b80215adc19f7af295e863017bf895038ea1346222337842139d9e5de018f8706fbb251d4012db262bc608a9ae4ae21dca08df3a5621d7e00281a491942

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_fr.dll

Filesize
25KB

MD5
91a6f2b9052cbe8f5462a9d34cec3732

SHA1
05dcf86370753dc1c9d7edcaf7ad6f6813764c72

SHA256
37bf4774e34a6df1231f696f119066b409d7ceb1b9271fcb74d07f1c88f35e59

SHA512
2b10fd0ac27ad4e9ca1cc224f4bc036843c259f1b740bc8f7d435a8f550433426c3018a015a4f1de73986d59f5bea49305fba962f59df837f6893f8c34d857e1

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_id.dll

Filesize
31KB

MD5
5ea2ba9a437c4b6bfbb228356ea3be59

SHA1
19d27cf893537002313808a4e32581f344e4eaca

SHA256
e0d5ea9edec2692553371e4579a63d5dc7c554867f3f90ebec722d97d2af87b5

SHA512
fb78b0c4d7066922cfa7a234e6e2023042d3e2f25cc6a6be5eb26782d836bf30f090eb15be77b4c211e9c7fd8bc28b7e92e50cb7bb2a045412c74e8982049fcb

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_ja.dll

Filesize
27KB

MD5
d22b960d1fa795eb7996d1be6a02aab2

SHA1
e526d5ce5719e1de891169305a367677f76e6e7a

SHA256
016567f8ee776cb57dfbc7e6a8908bef7004fd9abab4286800863c745c08e1c0

SHA512
40064f12538c55c2589bfa40ac8559aef71177ff7379e89c68ccb509c012a4295977eaf87e3a7be50c30e36d276b798217d7ce902240480f54f35fe44497d2ce

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_ko.dll

Filesize
27KB

MD5
19b6ce8683c1d7a6ed07b93966b5e415

SHA1
9ec79b491b4cc71fe6a3431ceb5fc26a217fed57

SHA256
4638e83c8e01e837078797f8ce2e4015a05aa7e6ee121dda107adc473f4c281b

SHA512
1fb52b00a2ed152a199357bff6fe4f994c7ba434bc3f3da960cf2a9ea52f41dae9cd3a0b840c87e25ff463077f1c32fc0f354fb24288c46a251e51b47f57ce80

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_ms.dll

Filesize
31KB

MD5
6922f23814bd549972b548acc4e6afce

SHA1
17a6e724904a09175b1c3ecf40e6929b89662585

SHA256
d7e3c82e12447a9aa4085317f65447607b75f62fa89edd38fb5621dbaad9211d

SHA512
f59d9e56e2a06fbd8853bccae6e69f6b51c07bc9c18c84e559d6e81bdec90c51c555676891d9a9c6233faedfacfd15941abd1c033710e14ba028cf82557109eb

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_no.dll

Filesize
32KB

MD5
6bfb6b741d1eb83a8d1a96680bc6da51

SHA1
9263e45de354b17b9091b688ac63aa31796647e1

SHA256
8a1622e758b4cdcdcef80095f59c604ba878b1c853d66a338459b4de32ed5fdb

SHA512
d65093e4c85cfa22054c9c09113a36360b23214ccf7f6cdf84df0d4d8a905ffa6a20e8385fb3fcf78fb96d91ce49f29826c07ee81fc62507218b48ef6231a5ed

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_pl.dll

Filesize
33KB

MD5
1eadd3df335b90ee62a74966c1693af5

SHA1
21e5152b54f08317f13b6c97ffd67d4d42e76aae

SHA256
16ffbd7af2dc7d11199bd769ac3355efb39b4267f0758ef8d60ce4bdf927d394

SHA512
9b9776d5e0e47acc6234913faf2421da4c896abe84f7129a928393d5ccc491ff8a92b82ef3b76b493e620bc6942e3248bc364f8669ebe2444fe477ed37956e8c

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_pt-BR.dll

Filesize
32KB

MD5
2ea9dbc90cf842de5ac5cced84d83a8d

SHA1
2a63a275a4d4252d4e92a2e2d5827f1cc1789a4b

SHA256
b500301065031c6826991f0b0e712e2ac09c465f686b27e0aa5121a9d2bc2529

SHA512
57d50c6124273655e4cbd3c476882b7795e3d58c44121c5260bb9efcfed75fb708e622eb4e67dd4e1dfb3fa7e1b9680ae35a51248c8dc901c64c6fc708c46fa2

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_ru.dll

Filesize
33KB

MD5
ce5254b7aa5cc2482449b12995976bc0

SHA1
d8aba69d1b11eae587c1e5357e08f3c66acc1c1e

SHA256
8e5ddf0615b84665e5cb5b13a0d5f72167c82dc4a86cc49616ea445f6b801eaf

SHA512
5dc50fec4f9685f74d4638ed0e2f8e4c493ddc10af0416a1fc495782962d16b158bae71171338230bd17d91cc686c3e9b82febb006c634791560385328b3ed3a

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_sv.dll

Filesize
32KB

MD5
c8a5dea2d0343249eac44e0dc550b2dd

SHA1
681081760d2983f2025e21356397b5bc067c3501

SHA256
401263a24666710b8895e0d5fa5857f7d86c4ec21595573894e07517e94b52ff

SHA512
bfceea37a5e525738380ee9049daca1913da5603ead0057f5e8f54022961db1cdf0da370e1af8b841997f1e46514eb5f4e3c4492cba66c83d6eaba1a568fe05a

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_th.dll

Filesize
31KB

MD5
1881415301940deb7d45b120a39679c7

SHA1
3bcc72d91e9a1c35f5b52768c9a77a0faf2f16e0

SHA256
63e7af52e0f6e41c351d33ed4928647ab3abbca3c767de570891c3ada13d4e1e

SHA512
6f35a017af72df217eb3e511f57d8c4796cfd996f30308cedf7b44c16cff3d34fbf5745df00398c1232e7f685425a2269cd1d35184c6b2007afaefed25549188

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_uk.dll

Filesize
32KB

MD5
17c6392aad88515222ffc54dad9a0f36

SHA1
9f0dad897f9648167b9f005b7e2ab86c6161e6d5

SHA256
cbd96676b5097470250dc8285c6523ed598ccb58a4990c78abba79d4e1a67e9e

SHA512
b5bd6ab5325e772347ab8de55ecaae8546b46bd9dc559c17c3b965b4627cfa25c406f4ca6bbe17f22e21678c80a3ec03260242f29b1beb817d78639e37a2f940

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\goopdateres_zh-TW.dll

Filesize
25KB

MD5
dbd5fa781509ed7d863ca11877f2a28e

SHA1
1b52ae5bb49c06ec7c25b7675093846978dc6856

SHA256
2217e104660a21c2c9be0ad68846fbb4f7ee16510ece768f055d9e9cbbd60a9b

SHA512
7d9b04cbc040ed6c4df8e10fbafec70500c9fcfe228a86e8ccbec4945bf04ecca6a475e20f4cbd36e5a89c6847e6107496ee23e36db0d748104bb01af8985505

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\npDropboxUpdate3.dll

Filesize
20KB

MD5
96f35eac30ff109fcfff4481e941abe7

SHA1
fddadd9cd0b9f5b632eb943890d09be1e5f87875

SHA256
11fc24b34e45e166cd2cebf54c4e77099d70feabb0d219f56aa5c93ac42f7145

SHA512
34251b6524cbf6c18dcfbb162a92cfec25f18520204f9411e4470153f076df56a28df563f8d43e67b8a80cd2948a97362bcf14bd078b3e0dfa3ff58393776a20

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\psmachine.dll

Filesize
10KB

MD5
3ff9a0d55207c7990240171126950c38

SHA1
0c09141a1702764ab9155047484823488e025a48

SHA256
2c90a7a0fbd4218f42501ebf92f2d04b676692521d589ab69ade3f155e2f87be

SHA512
cbbe906f18b77af3121e2c565a956982c70d80ffd66430fe461ebaa3aac4a45944030ee2f53e3d5b8dc3d2773d979ec6054931b327f44a9632db53975ab0f3a8

Download Submit
C:\Program Files (x86)\Dropbox\Temp\GUM7BE7.tmp\psuser.dll

Filesize
50KB

MD5
23eff955eab247f71a10466399a9d1f6

SHA1
91cb0db1b1050a52edd57d44ddf185da3383a91b

SHA256
fb898819d3892a86fd88069949b92e8bfb95333ccef13ba896d67a0bbaeea9f3

SHA512
742a8f77ad5de6eca2884bf8947b5f52932764b4235164870e6e9c35e7b04e88dd0b2dbbdecbf6374517356d45c5859efb456603e8222d5f25fbaee69f735435

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCleanup.exe

Filesize
37KB

MD5
d122f2761b01628d86a55faa2383fd23

SHA1
4a70b056017c55f568fe82f365b07c5ab99d6479

SHA256
a81a552290d9f63139fccc627db4415ac932cb56ef8d432edd333f411eb5cac4

SHA512
46ad2f216bb68ef0f9119fbea05c1580352f6f6e2934577cb92f5b07d55b3e4c2db470717f25ef966f5ec00fea1ee647347f7ba2eb111105361270c7e4bc91d8

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxCrashHandler.exe

Filesize
122KB

MD5
077acf900135e7a21256fbf93582e3e8

SHA1
326c33f3a7a1a72d69688579eadf7fea92ee8a2a

SHA256
d040f769f0bbd03fa2c00b27252eddc0126311d3b18b64f01baa6ad6121507d1

SHA512
4d43978bd66e8755f0dec55a04cec974cca45d51ffb6285be8307a0b69d16bc26221afa5691fa98d84c0ba36c38ffb1fcdf8e78a8cd94d55edd641efdd28b0ba

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateBroker.exe

Filesize
36KB

MD5
9623140a5d24f48f25d4892fe4e87837

SHA1
22cf3531fd634c930117e36ebe3a692d9718aca0

SHA256
421a06e46b5a64178e6493d73227a113e6b4d00c5f0a94a7cdbc57468b7c58c8

SHA512
f7cc766b711e3bd2580cad9f96eaf7a9a3446f58240bdef8880b44c42689f765f13cecf9a50d63154533fca49b12849c0e3a3ee75c889fd72fc05cbac92972c0

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateHelper.msi

Filesize
26KB

MD5
ad80274ebc288f8bcbfd7bf1e6b784a2

SHA1
7bfa68f1fa73986dd9c13ee719a2c0bc9bc2b9e8

SHA256
0772c75f19a0e35b3b02831563a72897d68fc7eb2b304f2d7cc58eca0a00cfe5

SHA512
d6a37fc7da74544d672ba98f07dbe2f521216ac1b383209d943ee0d8ff9aa9a66aa8bfe933a0df5baad7740ad913b559f89cb57de44acf5d4cfcc11f3bd177af

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\DropboxUpdateOnDemand.exe

Filesize
17KB

MD5
e5876305e4a6fbeb0a8a996069678c35

SHA1
848c8f6785957e4d53390b63cf290cbe3f13dc21

SHA256
9a95cc456dee246470520f7af91240863f7b7de45a8377387a878a24edab1465

SHA512
da58c5c9acc92ce4fa4387a4500c161b2ebf794d9821dcbfb1f52399468aa8107401447ddbd7aa754cb0ebe95edf87a7054715e4202bb0004b112777dd599284

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll

Filesize
11KB

MD5
92dc7ada5e36eb24f4ef0df2e0e661d6

SHA1
0fb274f55560e62296700d288f82b6a2f07dce38

SHA256
90a4c11eed768d2141232eb99df68dac9a4ea83e876eb3f11684de3a8aaa6fea

SHA512
bc80e144cf32717640cf8c8ad184ea5ed20b6b2eae9a85e34d874da6886daca17db823fd72cc300bd3088b016ed0e6c43d3149551c4c5fbe693a8a2a3a0611be

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll

Filesize
11KB

MD5
0ca9dfb60eef6d1784206a6572c37807

SHA1
f68121aa7b5ca9f9b9d89cb1332982175419abc6

SHA256
b031abba12072749addd4e960a8dd9e0aa680bf18830d06c26bc8c7189fce803

SHA512
e50fb9b07d5eec25a7bf601c336a768959ecc9d9cca28fcdc0fc59cfdf91a50a5fdbfdf8cee06ea88fc92d2cd777f9643e966cac6c50be419e47f45f5b97dbe5

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll

Filesize
76KB

MD5
b4fae9f0fba0808ffa781f64d0efd3e5

SHA1
a1e34e2d0eae40a8ba914813269cd1605a2f9554

SHA256
c2dd5ea075c72ffd5d0eaef97c847d7fa8d26437959f55122b3c89742fc209a8

SHA512
74ef9dfd54686009cc03c03d46210d2d1c5bb70ccf69cffa631a547df00096e8e87253fb33d2cfbbaa35b8f1e7f6c88079f56030874e19564513f8882c8cbbf2

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll

Filesize
328KB

MD5
1ffe272e5060e78c09ff2b6b54422cec

SHA1
bbcd4d909ec116cb9bdfa68f84131751ae7c9a6d

SHA256
941b64ed97e4598970e73e6bd34b43eafcf720cd63ca09c7f676624b2525f807

SHA512
3ea24e2dfd72e752ed56fa7f43655af6e007c5c663d215b095b94e4e3ea6c46568c54f245d6df1d71371b60ba19d08ba316c14187249d08dbce8558745148b32

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll

Filesize
233KB

MD5
f4085c549d6631ffa75be995f64ecc42

SHA1
b2db2abd4765bd4354d6272aa5748976a2e784d9

SHA256
8af2d02cd31cb858f8192a9c5ba32a7eb0cb73a0414c3bfde67f87254694aa89

SHA512
ddfaee0af9f52308d5ccf491923117c1ea48a4ca4a545106770c8d5525d83ff2e5a6bb4d3b2745ccf066270c367d2ad844dea3c7e1360fd853b3670f89818a1c

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll

Filesize
264KB

MD5
55e7f18785279511a08b82a848ec4d6c

SHA1
df41f8a2854ee9d2d0212891c0c838bf6a33188b

SHA256
9dca064ea0792d3293e636c7533a09914d4a97cc0afd92f38888c5c1ecf21f30

SHA512
c37714bc5cd8d211fac0c5d882309f9f3a3fa3770a5edb0d310321b6f4878a80d0d6091aa715f358bedf92c9646e90fce8ae7e1c3ffac2992f1794541c838879

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdate.dll

Filesize
119KB

MD5
940ff7bada2cd459a7d3f81df8599fec

SHA1
fad84dd74252deb6254703c925e2c796e16f1970

SHA256
71376dc57dbddfc0d943a69ce308e3e2f2210f1dd6a35d26a069f973ff6f86f4

SHA512
44578b03d605f22e43724c811756f9bd7ad9fd275d5a433ca1c1b49ba82316ab0af7a3b6689ac1accb077cca4b3d188f4f8096d9036d4d08a106126f1c2b447c

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_de.dll

Filesize
35KB

MD5
8ec648743a036ef57ee419488b01387f

SHA1
afa9fca0cfb21cc1f05b31f1b55b1f47e18f0a88

SHA256
9373bfaac15573f63b42cbcd39e4ef15a06d6a27696541f1274a2aef25570e70

SHA512
a7af27890c0fe3f86bff9ae03734442a2c0b4d9315a5a6221531270caa8dd6e55e66659f6c1062d589a08a41a92dc4101f76430d528694b037de73b4407e4e5a

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_en.dll

Filesize
28KB

MD5
e1351bc4e7b422120c6327bb77d0f917

SHA1
c3bccec5a9e271b593b3a8d64a2bd7e58ae41117

SHA256
695df0b39b2f86662bd7807e347575800ae22b631a0df2ee734af2f5b7f19cf7

SHA512
0d680b2e0cbc3654ef5aa9d2195054b43f5a5ec01df44226ad2f385cf065728daf9005f503ba89de9ce36639f7136206c0e2b63f5052451855531cc751498862

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_es.dll

Filesize
33KB

MD5
0e13d60b08d0653ccad9cd22cf13ec85

SHA1
2ac7fef4c9be1efca0c68ce7bb4b623d2824994f

SHA256
7dc6bb82fb6133e879309b0200aec7ae7c6346deb05a53daf1803443db3c8cbb

SHA512
94909d3e43cb0a90c6fc595fb24c5a90df4f9574bbc4f447dd534e6114c14f6905bb07a758719fd45fd357f28575bdd3043335ac0dbfe498ff3c286654b9ce6a

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_fr.dll

Filesize
34KB

MD5
ffdd38e5ae41822c584b092eefed9df0

SHA1
91da41c12fa3afcac80d0077c0b3fce918b5a4f2

SHA256
3f3ac9e29e480d1c6eb271a538bb966953c9464659d044cdccd8c99df7f703a1

SHA512
e06d12b1caf8c23496c7a75f7454443ba721691e245d183ec750e95b013423310e921587c0d95e5ecce1a816c8b538290f3018b098c788f0e14403fa3cce9a0c

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_it.dll

Filesize
33KB

MD5
cf26a8d0d58a87db417185922c761687

SHA1
e28c3c48594d5aef78966d0e210dd826c2f69a2d

SHA256
83c860a5942fd6b307c428869a1debb188fa4a8dc27d2ffe4abe0b8453254e7b

SHA512
fad6342c211b0597a9962c0bceb853e07f705f42baf92ac7a288fe5ea608c038923f509d9d77041eaecfa6f5f926138b524ee6cd4154526169eabb675c5ee9b9

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_nl.dll

Filesize
34KB

MD5
7d26147723dcf53d0d1b10f98f891d91

SHA1
501674d1e4d53d0d6b92875c65118f7f5ceccf66

SHA256
5f577d78457e5010c90b3614f94eb3b03f4f66c752191e25ce2b4f397d481ad9

SHA512
deefae29107edd6c240308b7e05680b1f9a8f2525fff29a6cc47742345a21f285c6285440c26a36555b97b1d73e8b16a712177f8fcef70aea6d5da0e35123f15

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_no.dll

Filesize
28KB

MD5
523bbcf17d5160eaa4c8586cf765baca

SHA1
53d7247e9bda01605c416ac7b3c202a7259c07b0

SHA256
9b7ca2244e135d6fb6aa4d1fea59f587d05aa6ea14168fcee0f7f875306a96f0

SHA512
50f6de77b998ee773a1fd8968633a7f8760264dc2f36f23f8230df00f4f68f629feab6d188e16b2f758b8a7da8199718714e40a3832205df1508191f949acbe2

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_pt-BR.dll

Filesize
25KB

MD5
e6ed0ab3143e7527f3159be425c3b9cf

SHA1
1baf02be9490737a962136f919955dea2042db3b

SHA256
0ae191c66821991a56d4a9d4d991c2d6547bc2c92315a75226710f0537aefc12

SHA512
348adf2d8771f9e42b3b82203afa2aef296a6008175ed954643fd41f7bb89257c2c069c35b5a4dba2d585675c1fde3187de30c8b8c7fb07b037633c6e74d748e

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_ru.dll

Filesize
29KB

MD5
dd8a17c42c9786a5f84792105b62e1dd

SHA1
c346ef8979d23a0c169f589ebf43a083d7bd30e6

SHA256
b6dcbae871c21d0da4216cd07a4ca4df50ec112a804611bc46418a5bb5ffb03e

SHA512
c6d7f0c5572eb28e86d2a7df6a049378e5314b61a49e933611c827dedd075973e9339a4c03f30cb4a19305be13b353d492dbd9948e264b3c11de417c1520878e

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_sv.dll

Filesize
16KB

MD5
2fca458af444b88ffe0a7da1fbe0fbe7

SHA1
49eaff8db5ab3cc4b8ca20583dbfab0d543a9649

SHA256
66d551e648e179457653fdd468e93bacad0db7f50f03086d90f6fa113e86796f

SHA512
cc0a59279d9b478ca1688f8e6147054ef2f9e45471ee40d1489badf43892029062d2ea606d0fa9fea3836ebea0a78fb165a60184d1992bff8f27a4a1d0dbefc2

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_th.dll

Filesize
29KB

MD5
6b2c4d36e16b0ccf165445b26a60e30d

SHA1
37f45805e9abc8be521ca56226b32f3ac3a2c664

SHA256
bc504a39a7ff515e5d639afd4963e0db818634e9432d26abc5ccd5fe99856288

SHA512
727658e6367f5b2eea067e7d09185083e22cb2e13e624d2ea1e4576c36cfa632e15fd5c984000d8f5fb85eace7cfe33a0d7a69c82b8149e750b71356b3b043c9

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\goopdateres_zh-CN.dll

Filesize
25KB

MD5
0a62f2c2d232d98a8438a3d449a520f3

SHA1
308fef4ccf6926977e5bc1064f554fab0d4ba36a

SHA256
084a88a2171690934370cc603c0d809ffb9f0e55aeaa4055f38af2239d0606e5

SHA512
db74ca3fce77ce1207041494c9b4d1e86c39e9e796e8e8a31ac53e6db187b4cdc70f3b330d77db0ec0b2282b76fe9da379e7065c042993fd9044e5c1c7dec13a

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\npDropboxUpdate3.dll

Filesize
15KB

MD5
6705497021c5bf9174b1368a3f4795a3

SHA1
b65fe21d301e52914c9f7acb7f882c8b3c4989c3

SHA256
b8dee58136f408be31799c50e2ea0b9afd992497866fc02ce9a82a210576c1fa

SHA512
9edb0727e7c7ef19c3855a25e99ff06c168ac8dd2022fa0d9890405080550759022debf03259a6826d0f008890680f87cc49375a1c580907a9147cdbecba15f9

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\npDropboxUpdate3.dll

Filesize
22KB

MD5
f479656062ab571ded4b6552d2a2e79c

SHA1
a7adbb369750a67591b6718eea63a382d64ae623

SHA256
1289e4f640baedcf14e373e95818a254785c8b6a1e6b6b4f8f8b680a6a871863

SHA512
5a9dc78fb85cc6f8ef14ea4e71b8c6d139d756e1d39589a332515cb7fc580928015a0d4b651f0bb45c15d6b45bdd2e33fc2c9cde64bbf6ad41fc19ac7d0a090c

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll

Filesize
5KB

MD5
1e08da7f7483861243a4ab9f1f992236

SHA1
7255c58907713e4081570d41da893130714977dc

SHA256
ce7d03f4c310533b18c9b7ff0254bde2f83316617d3c4210231498fc0a5a290e

SHA512
bc310ff1e0edfb4be8eeb3e260f08d79e1865da09612e411e99446cbbad2dba7b75f389b9cbb7b6dd157e409b1b35f7c09aad5bfe2bf890cdebcf93996428575

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll

Filesize
30KB

MD5
a1f302d396b2564f66ffedcfb5881cfd

SHA1
b840d3b9cea4fcca6191a4b37cf91e08f90bcdd9

SHA256
81d7e364d0e23a6c6f142dfa439be1549f61657d67c27de4b664ebfe62a34360

SHA512
1249fbfb6f00de842c58e05377886c5badf02247d88898f6c0f44c3e5bcf1d59e4a9f600104f748da06b6ef0940319ced8cae0243d30ac772fefbcd399ae8397

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll

Filesize
112KB

MD5
b0174e8b53e71c0c2f932d0beba42bbe

SHA1
040b4cdabe1aa0362a5db1cc3f35ef4fbec94d1b

SHA256
044d922fff56946fad7156b01d23297c56ae592e7d47da4f699fd4ec08d0294a

SHA512
ac96da4c592ae0dcbb2b739f08af0da01dae3dde6516d2b96b86cb79ac4e5a72f11c06ea64fdfd05851a3c1bbf6a2635780287e98b83533b70707483bd6e4369

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll

Filesize
64KB

MD5
48ecbcef7048f0a3eb9088479ca4cb94

SHA1
7d4e1fe20c32b4affdc6ed7f1668abb8a4c11c3e

SHA256
a4a093f6209e5309b14a2a6cdcbf1e7367262429f81b8d03d4e39a2013f6544b

SHA512
bc3cf5550e96c898fe4ff0288be2f6d45fa9a1b2003bd6a5b452bfe8834e2dab4693e6cdc0160578f3f01b19089274ac4f8534e8212f382566e4924f92db3498

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll

Filesize
67KB

MD5
11a840b406c8bb1373c28ad5f647ec0b

SHA1
d7f683da3b7432d35bfcfbb4b873f8497b811530

SHA256
055024ed4c3ac1deddb70cf795bcac62fb1ad5fe2526b5b4153445ce064998e0

SHA512
8d1abed911f2718c47f87afbae538661a4f7055ae362687c8510f1babf46ef2e3960ecda6eb67bae79c0688bae837e9c9d3f4b8e9b317157b107be03ccb8e131

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psmachine.dll

Filesize
211KB

MD5
70663a8818622003e50b36bb392b880e

SHA1
23670b780d232e70a6cfa5b2d350992d43ef722a

SHA256
3582062df2b1120e6cbe47a4c5066b0f3e0959518ab572a62f2817e55bab6518

SHA512
0a62442874598ed8e7986a99dd9d9d4d07e987586454731feea6427fd9b2190d5d2fc502e2efade839d010ac7e11135daf0921275a911037284ebfbf8bd3c3e0

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.817.1\psuser.dll

Filesize
22KB

MD5
b0b82ac2e7a3b3ea4ed132521ab8e687

SHA1
dce1ea06b069e62e8cb8ba2ea71d983b2bffe5d5

SHA256
21a0d6a9037a0f2374060ade61dca3ae2aaa8ff337e30c050784fcc3b18e6ace

SHA512
969ec5408067507248a84cb63145a518998683099b1e275e092d1cf0ff4e823e27400406ef7753901becbfcee635c9966e1c8808ca7b644568bf9062f9d45412

Download Submit
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

Filesize
57KB

MD5
0890dad014951ae940308dff08c9ba65

SHA1
4b7695ed63febf7f7b93b923df8e8486473202f2

SHA256
267ae514d9395c9b5ff0b6af50fbefe92646f69638ab1b8c917c805c741accae

SHA512
2abef2ec0b2fa3f9fb23f57d508cf5a42e7719f2d90f99f5b788e8a706102e8128c3669917660854778238a2d5f0fc66dcbcb51f4df87724215ae66ebb77c556

Download Submit
C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe

Filesize
52KB

MD5
40456e0d23f060cf66fff5e23fd45b21

SHA1
25f99c281a01f9c621c8964dbf614d63245887fe

SHA256
7ff7c47cd3c30d3f32613af8432598ccd2381cb09709590646ee1f6a2279a592

SHA512
b26d223e74c6b489e94b8c17a079c749b0b43e5e80c5517a65aedd61b7b38012cf374e10a685b9c8806a6f74a1113204dbc7079eb25f5f048292bf82ecf09773

Download Submit
C:\Program Files (x86)\Dropbox\Update\Install\{707FB009-E5A6-427E-9C9B-A8C0F4DECB55}\DropboxClient_189.4.8395.x64.exe

Filesize
28KB

MD5
bc9514d77028cdd3769f1e7fa6c62a28

SHA1
bb439a3e681a330372c6a3f296719b291f84882c

SHA256
c76ba6c1f1dce96cceb1f25d2de6658d011de0c84922399e6c31cf57f0edfa75

SHA512
663d100564807ac37451fe7154233cac31c7c00860264e6baab90f0869157f52e753a13344f9405ea30bc20095884afe7baceb485b47d0be6d2c997378ac3715

Download Submit
C:\Program Files (x86)\Dropbox\Update\Install\{707FB009-E5A6-427E-9C9B-A8C0F4DECB55}\DropboxClient_189.4.8395.x64.exe

Filesize
67KB

MD5
c1995208d578db648e0202934e72601b

SHA1
fc81862082fad957e89db5d04694397e845f92ed

SHA256
6fe65b7a364fc91e7226de0587e50a44fa896ecf1f7101c0bfd9b0573ced3dd2

SHA512
cfe7fdd462914d6d7a0da6219428a5948a7c51356a050ba953008d12f64afd44cbecf524d2d6279991fe68c4fd961840c283fcc1105ad87e1ea7d023fe956219

Download Submit
C:\Program Files (x86)\Dropbox\Update\Install\{707FB009-E5A6-427E-9C9B-A8C0F4DECB55}\DropboxClient_189.4.8395.x64.exe

Filesize
67KB

MD5
38941d68bdd0f1ab09f74cd1b2d07621

SHA1
0bcb86896c4df52449a90473638cbe9f362ee710

SHA256
298f7234324bff1e3c360f51240fd3d9044b5ec959ffcd7415bf7810a48cd932

SHA512
635fd125c212230ce2bb2c67e32d2323814f7e63f276b96a660cff621de268ed62cbfce1403d5018e9bcab620394cb1fd6d668889f313aceda6e30e773493871

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst5997.tmp\System.dll

Filesize
11KB

MD5
c6e19f882ac7c89c517ec158d8bee0e3

SHA1
4bd07cb821aca4d2eb32e7f74ae620780d8b958d

SHA256
817929ce4af784af2f28db0eea5cc9a16fa28e8ed0b3bd497ed8dda0619207a3

SHA512
cbf559f48b66e2bdf9e0de75d48f169fe2a112e34981c1463856e50807ff05f63afb512afd99503126d9f700ed4eda9bfa45fd38ded5d55d4c8738043ec7e62f

Download Submit
C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job

Filesize
924B

MD5
de2084fd37a1176187a3e48354302636

SHA1
84bc00a1340d60c71d3538e976fa6738e198a1cb

SHA256
d52d41b3d98f68dfdcc52366aeaae82ea99b5f7aa8570ca6f5bc9e572056557f

SHA512
0fd5f7a2d59b99b806096873eecc8c495d3be9a9ed9bb7a2b5bff547e3cd6faf36ecb73915bd6a9d2a095b7e943179a9aaffa167048df876f2b94be2e43e3bf2

Download Submit
memory/1452-67-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/3636-374-0x00000000013F0000-0x00000000013F1000-memory.dmp

Filesize
4KB

Download
memory/3636-393-0x00000000013F0000-0x00000000013F1000-memory.dmp

Filesize
4KB

Download