316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9

Analysis

max time kernel
69s
max time network
139s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/01/2024, 01:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe
Size

639KB
MD5

503b7b29960031a67740fb72c1ff1698
SHA1

9a249727620598a6f4926961e412c09874d781a1
SHA256

316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9
SHA512

d924942a30e9ab753ef4039ba1e213e41083f9a8899f7589ea69484b81ef3f0f8454c10834ea3f7f83c1477c98730dbb1af31ad46e8dd43ae235409236d39969
SSDEEP

12288:U/iSueucQg+FAu7b8inZKNySAeIRcp1EZcxTjnw3LLy+N8MCJjm8/n+eg:U/iqJQgSA1N1rPd7Qy+NGBv+b

Score

8^/10

evasion persistence

Malware Config

Signatures

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
1736	netsh.exe
3024	netsh.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe\DisableExceptionChainValidation = "0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DropboxUpdate.exe	DropboxUpdate.exe

Executes dropped EXE 7 IoCs

pid	Process
2768	DropboxUpdate.exe
1308	DropboxUpdate.exe
1804	DropboxUpdate.exe
2232	DropboxUpdate.exe
2116	DropboxUpdate.exe
2268	DropboxUpdate.exe
2132	DropboxClient_149.3.4541.x64.exe

Loads dropped DLL 28 IoCs

pid	Process
1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe
2768	DropboxUpdate.exe
2768	DropboxUpdate.exe
2768	DropboxUpdate.exe
2768	DropboxUpdate.exe
1308	DropboxUpdate.exe
1308	DropboxUpdate.exe
1308	DropboxUpdate.exe
2768	DropboxUpdate.exe
1804	DropboxUpdate.exe
1804	DropboxUpdate.exe
1804	DropboxUpdate.exe
1804	DropboxUpdate.exe
2768	DropboxUpdate.exe
2768	DropboxUpdate.exe
2768	DropboxUpdate.exe
2768	DropboxUpdate.exe
2232	DropboxUpdate.exe
2116	DropboxUpdate.exe
2116	DropboxUpdate.exe
2116	DropboxUpdate.exe
2268	DropboxUpdate.exe
2268	DropboxUpdate.exe
2268	DropboxUpdate.exe
2268	DropboxUpdate.exe
2116	DropboxUpdate.exe
2268	DropboxUpdate.exe
2132	DropboxClient_149.3.4541.x64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2364	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1801A0BFF52C676E5F51CA71C5350277	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1801A0BFF52C676E5F51CA71C5350277	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7C5C79D5EA2EAA218D5C63883951605	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E573CDF4C6D731D56A665145182FD759_1D978D5EA8275AA72D1BFCD66AF4A751	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	DropboxUpdate.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7C5C79D5EA2EAA218D5C63883951605	DropboxUpdate.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_de.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\backup.targetsize-64.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\gslides.targetsize-256.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-32_contrast-white.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\gdoc.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\DropboxUpdateHelper.msi	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Qt5OpenGL.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\api-ms-win-core-timezone-l1-1-0.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\TileSmall.contrast-black_scale-150.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\TinyTile.scale-100.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Qt5QuickWidgets.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-36.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-40_altform-unplated.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\api-ms-win-crt-multibyte-l1-1-0.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\api-ms-win-crt-time-l1-1-0.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\d3dcompiler_47.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.scale-200.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-36_altform-unplated_contrast-black.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-256_contrast-black.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\_cffi_backend.cp38-win_amd64.pyd	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\wininfinitedrivers_wow64_native.cp38-win_amd64.pyd	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\StoreLogo.contrast-white_scale-100.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\StoreLogo.scale-125.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\gslides.targetsize-32.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\TileSmall.contrast-white_scale-100.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\external_drive.targetsize-64.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-16_contrast-black.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_pl.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\DropboxUpdateOnDemand.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\Dropbox.exe	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\msvcp140_2.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\TileSmall.contrast-white.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-30_altform-unplated.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_id.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_ja.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\Download\{CC46080E-4C33-4981-859A-BBA2F780F31E}\149.3.4541\DropboxClient_149.3.4541.x64.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\TileSmall.scale-150.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\gdoc.targetsize-64.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-32_altform-unplated_contrast-black.png	DropboxClient_149.3.4541.x64.exe
File opened for modification	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\DropboxUpdate.exe	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\user32_native.cp38-win_amd64.pyd	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\win32api.cp38-win_amd64.pyd	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-20_altform-unplated_contrast-white.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-256_altform-unplated_contrast-black.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_it.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\StoreLogo.scale-200.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-24_contrast-black.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\opengl32sw.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\StoreLogo.contrast-black_scale-400.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\StoreLogo.contrast-white_scale-150.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_es-419.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_uk.dll	DropboxUpdate.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\DropboxOfficeAddIn64.14.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\libffi-7.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\msvcp140_1.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-20_contrast-white.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\logo.targetsize-20_altform-unplated_contrast-black.png	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\advapi32_native.cp38-win_amd64.pyd	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\api-ms-win-crt-runtime-l1-1-0.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\libGLESv2.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\pythoncom38.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\tprt.cp38-win_amd64.pyd	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\python38.dll	DropboxClient_149.3.4541.x64.exe
File created	C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Assets\TileSmall.contrast-white_scale-150.png	DropboxClient_149.3.4541.x64.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\f761d02.msi	msiexec.exe
File created	C:\Windows\Installer\f761d05.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\f761d05.ipi	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job	DropboxUpdate.exe
File created	C:\Windows\Installer\f761d02.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F05.tmp	msiexec.exe
File created	C:\Windows\Installer\f761d07.msi	msiexec.exe
File created	C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job	DropboxUpdate.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1760	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\CLSID = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\Policy = "3"	DropboxUpdate.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DropboxUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd1900000001000000100000003b878212830eb36469856f1c683b836c040000000100000010000000e67b586f7046bfe0aa51f6660b119dd90f00000001000000200000003689022b62bd20e807ccc1f32720ab2a9eeb0712e84cc373464b29cc436def97140000000100000014000000b76ba2eaa8aa848c79eab4da0f98b2c59576b9f41800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee4b0000000100000044000000420033003900380042003800300031003300340046003700320032003000390035003400370034003300390044004200320031004100420033003000380044005f0000002000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4	DropboxUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DropboxUpdate.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DropboxUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DropboxUpdate.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DC422F86-7267-4AF2-8F4F-A20C060621DE}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F448B4EA-A094-491A-BF61-9AF6CD450C7D}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB1A6CB5-D9B8-4B90-AC79-D141ACF2E0A7}\InprocHandler32\ = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.583.1\\psmachine.dll"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E54806CB-0046-4BCF-B389-3A6F732DC6E6}\LocalizedString = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.583.1\\goopdate.dll,-3000"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\LocalizedString = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.583.1\\goopdate.dll,-3000"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CredentialDialogMachine\ = "DropboxUpdate CredentialDialog"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\ProxyStubClsid32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\Elevation\IconReference = "@C:\\Program Files (x86)\\Dropbox\\Update\\1.3.583.1\\goopdate.dll,-1004"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CurVer	DropboxUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AB1A6CB5-D9B8-4B90-AC79-D141ACF2E0A7}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoCreateAsync\CurVer\ = "DropboxUpdate.CoCreateAsync.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CurVer	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\ProxyStubClsid32\ = "{2238B48A-39A5-4CE2-84D1-D885DF695B11}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\LocalServer32	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A496C5D9-84FE-4E84-9D20-7481589E1C23}\ProgID\ = "DropboxUpdate.CoCreateAsync.1.0"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassSvc\CurVer\ = "DropboxUpdate.OnDemandCOMClassSvc.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreClass\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\LocalServer32\ = "\"C:\\Program Files (x86)\\Dropbox\\Update\\1.3.583.1\\DropboxUpdateOnDemand.exe\""	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine\CLSID\ = "{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback\CLSID\ = "{49423331-2B41-4EDE-838E-F8C8F3F6BF62}"	DropboxUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\NumMethods\ = "4"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{90AC42F5-B136-4079-B7A1-0A61FC86685D}\ = "IApp"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E396485-96EB-4906-B2C5-3E0F1E7748C3}\ProgID\ = "DropboxUpdate.CoreMachineClass.1"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F}	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\ProgID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe\AppID = "{96D1EED3-701E-4FE5-B996-A543A8465897}"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E6CC2A7CB440C2A4DBE17EE5DAC2110B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{60ACA18E-54E6-43F8-A1A4-C4176B6C994E}\NumMethods\ = "4"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachine\CurVer\ = "DropboxUpdate.Update3WebMachine.1.0"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{58237066-0A7A-4C18-B132-D7BE280A6327}\NumMethods	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.ProcessLauncher\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}\LocalServer32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{49423331-2B41-4EDE-838E-F8C8F3F6BF62}\VersionIndependentProgID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\DropboxUpdate.exe	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8EEF2D6E-1CE5-4823-88D0-7F727719D0A2}\ = "IBrowserHttpRequest2"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D8474489-B2C1-4CE8-852D-FF8A916C91F0}\NumMethods\ = "4"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{04F3B937-6C9D-4DAC-9477-8C35E24B25D1}\ = "Dropbox Update Broker Class Factory"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{831F99E1-2250-4065-8975-7408E726825F}\ = "IGoogleUpdate3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachine\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback.1.0\CLSID	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3D412914-1C4F-447D-80D2-E7F9BB302B05}\ProxyStubClsid32\ = "{2238B48A-39A5-4CE2-84D1-D885DF695B11}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Dropbox.OneClickProcessLauncherMachine.1.0\ = "Dropbox.OneClickProcessLauncher"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3363994D-A786-4A32-A745-48B9B6EA709A}\LocalServer32	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass.1\CLSID	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\CLSID\ = "{28F751F5-74E3-4C46-8174-D8D8A6BAF83F}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76E258F0-DE86-4CEC-9D30-3F728A898741}\ = "Dropbox Update Legacy On Demand"	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5A812990327ACD34D85B163756A6E149\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8A89190B-400F-47DB-960A-7D5A1325A2C8}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8158CAB-1B7C-4A15-860E-AAA364E77334}\ProxyStubClsid32\ = "{2238B48A-39A5-4CE2-84D1-D885DF695B11}"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{CECD4BFB-9F43-4540-B72C-706BE66B375E}\ = "IPackage"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82821E4E-4B46-430D-8BB8-8B480FC9D8A5}\ = "Dropbox.OneClickProcessLauncher"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.OnDemandCOMClassMachineFallback\ = "Dropbox Update Legacy On Demand"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E58F67C2-BC84-4C7C-AC35-4FFBB25A47E6}\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C52C4100-E8C6-438B-AEAC-43C99F7CCC26}\NumMethods	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4DE7C611-9E6D-468F-8AA2-26C08DB4A687}\NumMethods\ = "10"	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.CoreMachineClass\CurVer	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DropboxUpdate.Update3WebMachineFallback\ = "DropboxUpdate Update3Web"	DropboxUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{78F1393A-63FD-494A-BA89-2C3ECA4E8EC8}\InprocServer32\ = "C:\\Program Files (x86)\\Dropbox\\Update\\1.3.583.1\\psmachine.dll"	DropboxUpdate.exe

Modifies system certificate store 2 TTPs 10 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	DropboxUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 4b0000000100000044000000420033003900380042003800300031003300340046003700320032003000390035003400370034003300390044004200320031004100420033003000380044005f0000001800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee140000000100000014000000b76ba2eaa8aa848c79eab4da0f98b2c59576b9f40f00000001000000200000003689022b62bd20e807ccc1f32720ab2a9eeb0712e84cc373464b29cc436def97040000000100000010000000e67b586f7046bfe0aa51f6660b119dd91900000001000000100000003b878212830eb36469856f1c683b836c0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	DropboxUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54362000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 1900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd90b000000010000001200000044006900670069004300650072007400000014000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd155090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	DropboxUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD	DropboxUpdate.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD\Blob = 0300000001000000140000001c58a3a8518e8759bf075b76b750d4f2df264fcd1900000001000000100000003b878212830eb36469856f1c683b836c040000000100000010000000e67b586f7046bfe0aa51f6660b119dd90f00000001000000200000003689022b62bd20e807ccc1f32720ab2a9eeb0712e84cc373464b29cc436def97140000000100000014000000b76ba2eaa8aa848c79eab4da0f98b2c59576b9f41800000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000c2040000308204be308203a6a003020102021006d8d904d5584346f68a2fa754227ec4300d06092a864886f70d01010b05003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3231303431343030303030305a170d3331303431333233353935395a304f310b300906035504061302555331153013060355040a130c446967694365727420496e633129302706035504031320446967694365727420544c53205253412053484132353620323032302043413130820122300d06092a864886f70d01010105000382010f003082010a0282010100c14bb3654770bcdd4f58dbec9cedc366e51f311354ad4a66461f2c0aec6407e52edcdcb90a20eddfe3c4d09e9aa97a1d8288e51156db1e9f58c251e72c340d2ed292e156cbf1795fb3bb87ca25037b9a52416610604f571349f0e8376783dfe7d34b674c2251a6df0e9910ed57517426e27dc7ca622e131b7f238825536fc13458008b84fff8bea75849227b96ada2889b15bca07cdfe951a8d5b0ed37e236b4824b62b5499aecc767d6e33ef5e3d6125e44f1bf71427d58840380b18101faf9ca32bbb48e278727c52b74d4a8d697dec364f9cace53a256bc78178e490329aefb494fa415b9cef25c19576d6b79a72ba2272013b5d03d40d321300793ea99f50203010001a38201823082017e30120603551d130101ff040830060101ff020100301d0603551d0e04160414b76ba2eaa8aa848c79eab4da0f98b2c59576b9f4301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300e0603551d0f0101ff040403020186301d0603551d250416301406082b0601050507030106082b06010505070302307606082b06010505070101046a3068302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304006082b060105050730028634687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63727430420603551d1f043b30393037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274476c6f62616c526f6f7443412e63726c303d0603551d2004363034300b06096086480186fd6c02013007060567810c01013008060667810c0102013008060667810c0102023008060667810c010203300d06092a864886f70d01010b050003820101008032ce5e0bdd6e5a0d0aafe1d684cbc08efa8570edda5db30cf72b7540fe850afaf33178b7704b1a8958ba80bdf36b1de97ecf0bba589c59d490d3fd6cfdd0986db771825bcf6d0b5a09d07bdec443d82aa4de9e41265fbb8f99cbddaee1a86f9f87fe74b71f1b20abb14fc6f5675d5d9b3ce9ff69f7616cd6d9f3fd36c6ab038876d24b2e7586e3fcd8557d26c21177df3e02b67cf3ab7b7a86366fb8f7d89371cf86df7330fa7babed2a59c842843b11171a52f3c90e147da25b7267ba71ed574766c5b8024a65345e8bd02a3c209c51994ce7529ef76b112b0d927e1de88aeb36164387ea2a63bf753febdec403bb0a3cf730efebaf4cfc8b3610733ef3a4	DropboxUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\SystemCertificates\CA\Certificates\1C58A3A8518E8759BF075B76B750D4F2DF264FCD	DropboxUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	DropboxUpdate.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2768	DropboxUpdate.exe
2364	msiexec.exe
2364	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2768	DropboxUpdate.exe
Token: SeShutdownPrivilege	2768	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	2768	DropboxUpdate.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeSecurityPrivilege	2364	msiexec.exe
Token: SeCreateTokenPrivilege	2768	DropboxUpdate.exe
Token: SeAssignPrimaryTokenPrivilege	2768	DropboxUpdate.exe
Token: SeLockMemoryPrivilege	2768	DropboxUpdate.exe
Token: SeIncreaseQuotaPrivilege	2768	DropboxUpdate.exe
Token: SeMachineAccountPrivilege	2768	DropboxUpdate.exe
Token: SeTcbPrivilege	2768	DropboxUpdate.exe
Token: SeSecurityPrivilege	2768	DropboxUpdate.exe
Token: SeTakeOwnershipPrivilege	2768	DropboxUpdate.exe
Token: SeLoadDriverPrivilege	2768	DropboxUpdate.exe
Token: SeSystemProfilePrivilege	2768	DropboxUpdate.exe
Token: SeSystemtimePrivilege	2768	DropboxUpdate.exe
Token: SeProfSingleProcessPrivilege	2768	DropboxUpdate.exe
Token: SeIncBasePriorityPrivilege	2768	DropboxUpdate.exe
Token: SeCreatePagefilePrivilege	2768	DropboxUpdate.exe
Token: SeCreatePermanentPrivilege	2768	DropboxUpdate.exe
Token: SeBackupPrivilege	2768	DropboxUpdate.exe
Token: SeRestorePrivilege	2768	DropboxUpdate.exe
Token: SeShutdownPrivilege	2768	DropboxUpdate.exe
Token: SeDebugPrivilege	2768	DropboxUpdate.exe
Token: SeAuditPrivilege	2768	DropboxUpdate.exe
Token: SeSystemEnvironmentPrivilege	2768	DropboxUpdate.exe
Token: SeChangeNotifyPrivilege	2768	DropboxUpdate.exe
Token: SeRemoteShutdownPrivilege	2768	DropboxUpdate.exe
Token: SeUndockPrivilege	2768	DropboxUpdate.exe
Token: SeSyncAgentPrivilege	2768	DropboxUpdate.exe
Token: SeEnableDelegationPrivilege	2768	DropboxUpdate.exe
Token: SeManageVolumePrivilege	2768	DropboxUpdate.exe
Token: SeImpersonatePrivilege	2768	DropboxUpdate.exe
Token: SeCreateGlobalPrivilege	2768	DropboxUpdate.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe
Token: SeTakeOwnershipPrivilege	2364	msiexec.exe
Token: SeRestorePrivilege	2364	msiexec.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2768	1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe	28
PID 1848 wrote to memory of 2768	1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe	28
PID 1848 wrote to memory of 2768	1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe	28
PID 1848 wrote to memory of 2768	1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe	28
PID 1848 wrote to memory of 2768	1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe	28
PID 1848 wrote to memory of 2768	1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe	28
PID 1848 wrote to memory of 2768	1848	316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe	28
PID 2768 wrote to memory of 1308	2768	DropboxUpdate.exe	29
PID 2768 wrote to memory of 1308	2768	DropboxUpdate.exe	29
PID 2768 wrote to memory of 1308	2768	DropboxUpdate.exe	29
PID 2768 wrote to memory of 1308	2768	DropboxUpdate.exe	29
PID 2768 wrote to memory of 1308	2768	DropboxUpdate.exe	29
PID 2768 wrote to memory of 1308	2768	DropboxUpdate.exe	29
PID 2768 wrote to memory of 1308	2768	DropboxUpdate.exe	29
PID 2768 wrote to memory of 1804	2768	DropboxUpdate.exe	34
PID 2768 wrote to memory of 1804	2768	DropboxUpdate.exe	34
PID 2768 wrote to memory of 1804	2768	DropboxUpdate.exe	34
PID 2768 wrote to memory of 1804	2768	DropboxUpdate.exe	34
PID 2768 wrote to memory of 1804	2768	DropboxUpdate.exe	34
PID 2768 wrote to memory of 1804	2768	DropboxUpdate.exe	34
PID 2768 wrote to memory of 1804	2768	DropboxUpdate.exe	34
PID 2768 wrote to memory of 2232	2768	DropboxUpdate.exe	33
PID 2768 wrote to memory of 2232	2768	DropboxUpdate.exe	33
PID 2768 wrote to memory of 2232	2768	DropboxUpdate.exe	33
PID 2768 wrote to memory of 2232	2768	DropboxUpdate.exe	33
PID 2768 wrote to memory of 2232	2768	DropboxUpdate.exe	33
PID 2768 wrote to memory of 2232	2768	DropboxUpdate.exe	33
PID 2768 wrote to memory of 2232	2768	DropboxUpdate.exe	33
PID 2768 wrote to memory of 2116	2768	DropboxUpdate.exe	32
PID 2768 wrote to memory of 2116	2768	DropboxUpdate.exe	32
PID 2768 wrote to memory of 2116	2768	DropboxUpdate.exe	32
PID 2768 wrote to memory of 2116	2768	DropboxUpdate.exe	32
PID 2768 wrote to memory of 2116	2768	DropboxUpdate.exe	32
PID 2768 wrote to memory of 2116	2768	DropboxUpdate.exe	32
PID 2768 wrote to memory of 2116	2768	DropboxUpdate.exe	32
PID 2268 wrote to memory of 2132	2268	DropboxUpdate.exe	37
PID 2268 wrote to memory of 2132	2268	DropboxUpdate.exe	37
PID 2268 wrote to memory of 2132	2268	DropboxUpdate.exe	37
PID 2268 wrote to memory of 2132	2268	DropboxUpdate.exe	37
PID 2268 wrote to memory of 2132	2268	DropboxUpdate.exe	37
PID 2268 wrote to memory of 2132	2268	DropboxUpdate.exe	37
PID 2268 wrote to memory of 2132	2268	DropboxUpdate.exe	37

C:\Users\Admin\AppData\Local\Temp\316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe
"C:\Users\Admin\AppData\Local\Temp\316252c5abc83d8409ae6c3d876c8fdefa8565f8e5fb0b24f19b2042ec3318c9.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\DropboxUpdate.exe
  C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\DropboxUpdate.exe /installsource taggedmi /install "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&omahaexperiments=update_channel%3Dforums%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJmaXhlZF9idWlsZCI6IjE0OS4zLjQ1NDEiLCJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeXpzT2drQVFBTkNya0swTjJabjl6SXlkRmhRMC1EZFV4T0FrSUFsb0ZpMDAzbDFmX3o3bThweTdacDRHSGMweU0xaVctdXJXV3AySGJmdWctNmF1VnZXaGVPXzI0WFpVZDhvaEJtVDJpR0lXbVVtYVVqLU5UWF85Wl9BaVNBRWRFeE1GQUVfTUVwbWRaUnNwZ3BVb0FOOGZGVlVnTnd-fkBNRVRBIn0"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regsvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    PID:1308
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /handoff "appguid={CC46080E-4C33-4981-859A-BBA2F780F31E}&appname=Dropbox&needsadmin=Prefers&omahaexperiments=update_channel%3Dforums%7CThu%2C%2031%20Dec%202099%2023%3A59%3A59%20GMT&dropbox_data=eyJmaXhlZF9idWlsZCI6IjE0OS4zLjQ1NDEiLCJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeXpzT2drQVFBTkNya0swTjJabjl6SXlkRmhRMC1EZFV4T0FrSUFsb0ZpMDAzbDFmX3o3bThweTdacDRHSGMweU0xaVctdXJXV3AySGJmdWctNmF1VnZXaGVPXzI0WFpVZDhvaEJtVDJpR0lXbVVtYVVqLU5UWF85Wl9BaVNBRWRFeE1GQUVfTUVwbWRaUnNwZ3BVb0FOOGZGVlVnTnd-fkBNRVRBIn0&nolaunch=0" /installsource taggedmi /sessionid "{BBDC87E7-7EC1-47D3-A197-B41D08176001}"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2116
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5Sm1hWGhsWkY5aWRXbHNaQ0k2SWpFME9TNHpMalExTkRFaUxDSlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcG1hWEpsWm05NE9qcGxTbmRPZVhwelQyZHJRVkZCVGtOeWEwc3dUakphYmpsNlNYbGtSbWhSTUMxRVpGVjRUMEZyU1VGc2IwWnBNREF6YkRGbVgzbzNiVGh3ZVRkYWNEUkhTR013ZVUweGFWY3RkWEpYVjNBeVNHSm1kV2N0Tm1GMVZuWlhhR1ZQWHpJMFdGcFZaRGh2YUVKdFZESnBSMGxYYlZWdFlWVnFMVTVVV0Y4NVdsOUJhVk5CUldSRmVFMUdRVVZmVFVWd2JXUmFVbk53WjNCVmIwRk9PR1pHVmxWblRuZC1ma0JOUlZSQkluMCIgcHJvdG9jb2w9IjMuMCIgdmVyc2lvbj0iMS4zLjU4My4xIiBpc21hY2hpbmU9IjEiIHNlc3Npb25pZD0ie0JCREM4N0U3LTdFQzEtNDdEMy1BMTk3LUI0MUQwODE3NjAwMX0iIHVzZXJpZD0ie0MyNzhDQURCLUY3REMtNEM3Ni1CMkM0LTJGQzY5QTg4MDg5M30iIGluc3RhbGxzb3VyY2U9InRhZ2dlZG1pIiByZXF1ZXN0aWQ9IntGQjY4RDA1RS0zMjI2LTRFOTAtODVFQy0wMjYxRDJBRDBBMEF9Ij48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iNi4xIiBzcD0iU2VydmljZSBQYWNrIDEiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntEODk2OEZGMi1FMEIxLTRBMTMtQTNFMi1DOUYyOTk1RjNCQzZ9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuNTgzLjEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJ1cGRhdGVfY2hhbm5lbD1mb3J1bXN8VGh1LCAzMSBEZWMgMjA5OSAyMzo1OTo1OSBHTVQiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48L2FwcD48L3JlcXVlc3Q-
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies system certificate store
    PID:2232
- - C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
    "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /regserver
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1804

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2364

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Program Files (x86)\Dropbox\Update\Install\{2D121BE5-2858-4E6F-91EE-664D23355D3D}\DropboxClient_149.3.4541.x64.exe
  "C:\Program Files (x86)\Dropbox\Update\Install\{2D121BE5-2858-4E6F-91EE-664D23355D3D}\DropboxClient_149.3.4541.x64.exe" /S /DBData:eyJmaXhlZF9idWlsZCI6IjE0OS4zLjQ1NDEiLCJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeXpzT2drQVFBTkNya0swTjJabjl6SXlkRmhRMC1EZFV4T0FrSUFsb0ZpMDAzbDFmX3o3bThweTdacDRHSGMweU0xaVctdXJXV3AySGJmdWctNmF1VnZXaGVPXzI0WFpVZDhvaEJtVDJpR0lXbVVtYVVqLU5UWF85Wl9BaVNBRWRFeE1GQUVfTUVwbWRaUnNwZ3BVb0FOOGZGVlVnTnd-fkBNRVRBIiwib21haGEtaW5zdGFsbGVyLWlkIjoie0MyNzhDQURCLUY3REMtNEM3Ni1CMkM0LTJGQzY5QTg4MDg5M30iLCJyZXF1ZXN0X3NlcXVlbmNlIjowfQ /InstallType:MACHINE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  PID:2132
- - C:\Program Files (x86)\Dropbox\Client_149.3.4541\Dropbox.exe
    "C:\Program Files (x86)\Dropbox\Client\..\Client_149.3.4541\Dropbox.exe" /install /InstallType:MACHINE /InstallDir:"C:\Program Files (x86)\Dropbox\Client" /KillEveryone:YES /DBData:eyJmaXhlZF9idWlsZCI6IjE0OS4zLjQ1NDEiLCJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeXpzT2drQVFBTkNya0swTjJabjl6SXlkRmhRMC1EZFV4T0FrSUFsb0ZpMDAzbDFmX3o3bThweTdacDRHSGMweU0xaVctdXJXV3AySGJmdWctNmF1VnZXaGVPXzI0WFpVZDhvaEJtVDJpR0lXbVVtYVVqLU5UWF85Wl9BaVNBRWRFeE1GQUVfTUVwbWRaUnNwZ3BVb0FOOGZGVlVnTnd-fkBNRVRBIiwib21haGEtaW5zdGFsbGVyLWlkIjoie0MyNzhDQURCLUY3REMtNEM3Ni1CMkM0LTJGQzY5QTg4MDg5M30iLCJyZXF1ZXN0X3NlcXVlbmNlIjowfQ
    3⤵
    PID:2052
  - - C:\Windows\system32\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall firewall delete rule name=Dropbox
      4⤵
      Modifies Windows Firewall
      PID:1736
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt.52.0.dll"
      4⤵
      PID:1192
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        /S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt.52.0.dll"
        5⤵
        
        PID:2308
  - - C:\Windows\System32\sc.exe
      C:\Windows\System32\sc.exe failure DbxSvc reset= 3600 actions= restart/5000/restart/30000//
      4⤵
      Launches sc.exe
      PID:1760
  - - C:\Windows\system32\runonce.exe
      "C:\Windows\system32\runonce.exe" -r
      4⤵
      PID:908
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\SysWOW64\regsvr32.exe /S "C:\Program Files (x86)\Dropbox\Client\149.3.4541\DropboxOfficeAddin64.14.dll"
      4⤵
      PID:2748
  - - C:\Windows\system32\regsvr32.exe
      C:\Windows\system32\regsvr32.exe /S "C:\Program Files (x86)\Dropbox\Client\149.3.4541\DropboxOfficeAddin.14.dll"
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\regsvr32.exe
      C:\Windows\SysWOW64\regsvr32.exe /S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt64.52.0.dll"
      4⤵
      PID:2088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      PID:1640
  - - C:\Windows\system32\netsh.exe
      C:\Windows\system32\netsh.exe advfirewall firewall add rule name=Dropbox dir=in action=allow "program=C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any
      4⤵
      Modifies Windows Firewall
      PID:3024
- C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
  "C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBkcm9wYm94X2RhdGE9ImV5Sm1hWGhsWkY5aWRXbHNaQ0k2SWpFME9TNHpMalExTkRFaUxDSlVRVWRUSWpvaVJFSlFVa1ZCVlZSSU9qcG1hWEpsWm05NE9qcGxTbmRPZVhwelQyZHJRVkZCVGtOeWEwc3dUakphYmpsNlNYbGtSbWhSTUMxRVpGVjRUMEZyU1VGc2IwWnBNREF6YkRGbVgzbzNiVGh3ZVRkYWNEUkhTR013ZVUweGFWY3RkWEpYVjNBeVNHSm1kV2N0Tm1GMVZuWlhhR1ZQWHpJMFdGcFZaRGh2YUVKdFZESnBSMGxYYlZWdFlWVnFMVTVVV0Y4NVdsOUJhVk5CUldSRmVFMUdRVVZmVFVWd2JXUmFVbk53WjNCVmIwRk9PR1pHVmxWblRuZC1ma0JOUlZSQklpd2ljbVZ4ZFdWemRGOXpaWEYxWlc1alpTSTZNSDAiIHByb3RvY29sPSIzLjAiIHZlcnNpb249IjEuMy41ODMuMSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9IntCQkRDODdFNy03RUMxLTQ3RDMtQTE5Ny1CNDFEMDgxNzYwMDF9IiB1c2VyaWQ9IntDMjc4Q0FEQi1GN0RDLTRDNzYtQjJDNC0yRkM2OUE4ODA4OTN9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgcmVxdWVzdGlkPSJ7NDkzMTg5OTAtRDIxOC00NDE2LUFBQjItQzA4NzQzREQwQ0Q3fSI-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjYuMSIgc3A9IlNlcnZpY2UgUGFjayAxIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7Q0M0NjA4MEUtNEMzMy00OTgxLTg1OUEtQkJBMkY3ODBGMzFFfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTQ5LjMuNDU0MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRfdGltZV9tcz0iNDg5NTMiIGRvd25sb2FkZWQ9IjE1MTAxODQ2NCIgdG90YWw9IjE1MTAxODQ2NCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  PID:2700

C:\Windows\system32\regsvr32.exe
/S /n /i:\"hklm_reg\" "C:\Program Files (x86)\Dropbox\Client\DropboxExt64.52.0.dll"
1⤵
PID:1740

C:\Windows\system32\DbxSvc.exe
C:\Windows\system32\DbxSvc.exe
1⤵
PID:1520

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
1⤵
PID:2024

C:\Windows\system32\regsvr32.exe
/S "C:\Program Files (x86)\Dropbox\Client\149.3.4541\DropboxOfficeAddin64.14.dll"
1⤵
PID:1080

C:\Windows\SysWOW64\regsvr32.exe
/S "C:\Program Files (x86)\Dropbox\Client\149.3.4541\DropboxOfficeAddin.14.dll"
1⤵
PID:2500

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /firstrun 1 /noappwasrunning /DBData:eyJmaXhlZF9idWlsZCI6IjE0OS4zLjQ1NDEiLCJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeXpzT2drQVFBTkNya0swTjJabjl6SXlkRmhRMC1EZFV4T0FrSUFsb0ZpMDAzbDFmX3o3bThweTdacDRHSGMweU0xaVctdXJXV3AySGJmdWctNmF1VnZXaGVPXzI0WFpVZDhvaEJtVDJpR0lXbVVtYVVqLU5UWF85Wl9BaVNBRWRFeE1GQUVfTUVwbWRaUnNwZ3BVb0FOOGZGVlVnTnd-fkBNRVRBIiwicmVxdWVzdF9zZXF1ZW5jZSI6MH0
1⤵
PID:2452
- C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
  "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:exit-monitor -method:collectupload -session-token:390d9925-ce6e-4de3-8318-559b1e0f400d -target-handle:376 -target-shutdown-event:368 -target-restart-event:312 "-target-command-line:\"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe\" /firstrun 1 /noappwasrunning /DBData:eyJmaXhlZF9idWlsZCI6IjE0OS4zLjQ1NDEiLCJUQUdTIjoiREJQUkVBVVRIOjpmaXJlZm94OjplSndOeXpzT2drQVFBTkNya0swTjJabjl6SXlkRmhRMC1EZFV4T0FrSUFsb0ZpMDAzbDFmX3o3bThweTdacDRHSGMweU0xaVctdXJXV3AySGJmdWctNmF1VnZXaGVPXzI0WFpVZDhvaEJtVDJpR0lXbVVtYVVqLU5UWF85Wl9BaVNBRWRFeE1GQUVfTUVwbWRaUnNwZ3BVb0FOOGZGVlVnTnd-fkBNRVRBIiwicmVxdWVzdF9zZXF1ZW5jZSI6MH0" -python-version:3.8.12 -handler-pipe:\\.\pipe\crashpad_2452_CKULCSRTPPFEMFIU
  2⤵
  PID:2552
- C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
  "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:crashpad-handler --monitor-self --monitor-self-argument=-type:crashpad-handler --monitor-self-annotation=product_name=desktop_crashpad --monitor-self-annotation=client_session_id=390d9925-ce6e-4de3-8318-559b1e0f400d --monitor-self-annotation=buildno=Dropbox-win-149.3.4541 --no-upload-gzip --no-rate-limit --capture-python --no-identify-client-via-url --database=C:\Users\Admin\AppData\Local\Dropbox\Crashpad --metrics-dir=0 --url=https://d.dropbox.com/report_crashpad_minidump --https-pin=0x23,0xf2,0xed,0xff,0x3e,0xde,0x90,0x25,0x9a,0x9e,0x30,0xf4,0xa,0xf8,0xf9,0x12,0xa5,0xe5,0xb3,0x69,0x4e,0x69,0x38,0x44,0x3,0x41,0xf6,0x6,0xe,0x1,0x4f,0xfa --https-pin=0xaf,0xf9,0x88,0x90,0x6d,0xde,0x12,0x95,0x5d,0x9b,0xeb,0xbf,0x92,0x8f,0xdc,0xc3,0x1c,0xce,0x32,0x8d,0x5b,0x93,0x84,0xf2,0x1c,0x89,0x41,0xca,0x26,0xe2,0x3,0x91 --https-pin=0x5a,0x88,0x96,0x47,0x22,0xe,0x54,0xd6,0xbd,0x8a,0x16,0x81,0x72,0x24,0x52,0xb,0xb5,0xc7,0x8e,0x58,0x98,0x4b,0xd5,0x70,0x50,0x63,0x88,0xb9,0xde,0xf,0x7,0x5f --https-pin=0xfe,0xa2,0xb7,0xd6,0x45,0xfb,0xa7,0x3d,0x75,0x3c,0x1e,0xc9,0xa7,0x87,0xc,0x40,0xe1,0xf7,0xb0,0xc5,0x61,0xe9,0x27,0xb9,0x85,0xbf,0x71,0x18,0x66,0xe3,0x6f,0x22 --https-pin=0x76,0xee,0x85,0x90,0x37,0x4c,0x71,0x54,0x37,0xbb,0xca,0x6b,0xba,0x60,0x28,0xea,0xdd,0xe2,0xdc,0x6d,0xbb,0xb8,0xc3,0xf6,0x10,0xe8,0x51,0xf1,0x1d,0x1a,0xb7,0xf5 --https-pin=0x6d,0xbf,0xae,0x0,0xd3,0x7b,0x9c,0xd7,0x3f,0x8f,0xb4,0x7d,0xe6,0x59,0x17,0xaf,0x0,0xe0,0xdd,0xdf,0x42,0xdb,0xce,0xac,0x20,0xc1,0x7c,0x2,0x75,0xee,0x20,0x95 --https-pin=0x1e,0xa3,0xc5,0xe4,0x3e,0xd6,0x6c,0x2d,0xa2,0x98,0x3a,0x42,0xa4,0xa7,0x9b,0x1e,0x90,0x67,0x86,0xce,0x9f,0x1b,0x58,0x62,0x14,0x19,0xa0,0x4,0x63,0xa8,0x7d,0x38 --https-pin=0x87,0xaf,0x34,0xd6,0x6f,0xb3,0xf2,0xfd,0xf3,0x6e,0x9,0x11,0x1e,0x9a,0xba,0x2f,0x6f,0x44,0xb2,0x7,0xf3,0x86,0x3f,0x3d,0xb,0x54,0xb2,0x50,0x23,0x90,0x9a,0xa5 --https-pin=0xbc,0xfb,0x44,0xaa,0xb9,0xad,0x2,0x10,0x15,0x70,0x6b,0x41,0x21,0xea,0x76,0x1c,0x81,0xc9,0xe8,0x89,0x67,0x59,0xf,0x6f,0x94,0xae,0x74,0x4d,0xc8,0x8b,0x78,0xfb --https-pin=0xab,0x98,0x49,0x52,0x76,0xad,0xf1,0xec,0xaf,0xf2,0x8f,0x35,0xc5,0x30,0x48,0x78,0x1e,0x5c,0x17,0x18,0xda,0xb9,0xc8,0xe6,0x7a,0x50,0x4f,0x4f,0x6a,0x51,0x32,0x8f --https-pin=0x49,0x5,0x46,0x66,0x23,0xab,0x41,0x78,0xbe,0x92,0xac,0x5c,0xbd,0x65,0x84,0xf7,0xa1,0xe1,0x7f,0x27,0x65,0x2d,0x5a,0x85,0xaf,0x89,0x50,0x4e,0xa2,0x39,0xaa,0xaa --https-pin=0x56,0x32,0xd9,0x7b,0xfa,0x77,0x5b,0xf3,0xc9,0x9d,0xde,0xa5,0x2f,0xc2,0x55,0x34,0x10,0x86,0x40,0x16,0x72,0x9c,0x52,0xdd,0x65,0x24,0xc8,0xa9,0xc3,0xb4,0x48,0x9f --https-pin=0x2a,0x8f,0x2d,0x8a,0xf0,0xeb,0x12,0x38,0x98,0xf7,0x4c,0x86,0x6a,0xc3,0xfa,0x66,0x90,0x54,0xe2,0x3c,0x17,0xbc,0x7a,0x95,0xbd,0x2,0x34,0x19,0x2d,0xc6,0x35,0xd0 --https-pin=0x32,0xb6,0x4b,0x66,0x72,0x7a,0x20,0x63,0xe4,0x6,0x6f,0x3b,0x95,0x8c,0xb0,0xaa,0xee,0x57,0x6a,0x5e,0xce,0xfd,0x95,0x33,0x99,0xbb,0x88,0x74,0x73,0x1d,0x95,0x87 --https-pin=0xf5,0x3c,0x22,0x5,0x98,0x17,0xdd,0x96,0xf4,0x0,0x65,0x16,0x39,0xd2,0xf8,0x57,0xe2,0x10,0x70,0xa5,0x9a,0xbe,0xd9,0x7,0x94,0x0,0xd9,0xf6,0x95,0x50,0x69,0x0 --https-pin=0x67,0xdc,0x4f,0x32,0xfa,0x10,0xe7,0xd0,0x1a,0x79,0xa0,0x73,0xaa,0xc,0x9e,0x2,0x12,0xec,0x2f,0xfc,0x3d,0x77,0x9e,0xa,0xa7,0xf9,0xc0,0xf0,0xe1,0xc2,0xc8,0x93 --https-pin=0x19,0x6,0xc6,0x12,0x4d,0xbb,0x43,0x85,0x78,0xd0,0xe,0x6,0x6d,0x50,0x54,0xc6,0xc3,0x7f,0xf,0xa6,0x2,0x8c,0x5,0x54,0x5e,0x9,0x94,0xed,0xda,0xec,0x86,0x29 --https-pin=0x1d,0x75,0xd0,0x83,0x1b,0x9e,0x8,0x85,0x39,0x4d,0x32,0xc7,0xa1,0xbf,0xdb,0x3d,0xbc,0x1c,0x28,0xe2,0xb0,0xe8,0x39,0x1f,0xb1,0x35,0x98,0x1d,0xbc,0x5b,0xa9,0x36 --annotation=machine_id=12cce00e-511f-47e5-8588-7df67886da42 --annotation=platform=win --annotation=platform_version=7 --initial-client-data=0x164,0x168,0x16c,0x138,0x170,0x7fef6d0bcb8,0x7fef6d0bc78,0x7fef6d0bc88
  2⤵
  PID:2752
- C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
  "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /restartexplorer
  2⤵
  PID:2020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "ver"
  2⤵
  PID:1764
- C:\Program Files (x86)\Dropbox\Client\149.3.4541\QtWebEngineProcess.exe
  "C:\Program Files (x86)\Dropbox\Client\149.3.4541\QtWebEngineProcess.exe" --type=renderer --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=BackgroundFetch,MojoVideoCapture,SurfaceSynchronization,UsePdfCompositorServiceForPrint,UserActivationV2,VizDisplayCompositor --disable-databases --disable-gpu-compositing --service-pipe-token=2571255419189772353 --lang=en-US --webengine-schemes=dbx-local:hs;qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=2571255419189772353 --renderer-client-id=2 --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Dropbox\Client\149.3.4541\QtWebEngineProcess.exe
  "C:\Program Files (x86)\Dropbox\Client\149.3.4541\QtWebEngineProcess.exe" --type=renderer --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --enable-features=AllowContentInitiatedDataUrlNavigations --disable-features=BackgroundFetch,MojoVideoCapture,SurfaceSynchronization,UsePdfCompositorServiceForPrint,UserActivationV2,VizDisplayCompositor --disable-databases --disable-gpu-compositing --service-pipe-token=4487694447555761310 --lang=en-US --webengine-schemes=dbx-local:hs;qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=4487694447555761310 --renderer-client-id=3 --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2468

C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
"C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe" /ondemand
1⤵
PID:2432

C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
"C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" -type:crashpad-handler --no-identify-client-via-url --no-periodic-tasks --no-rate-limit --no-upload-gzip --monitor-self-annotation=buildno=Dropbox-win-149.3.4541 --monitor-self-annotation=client_session_id=390d9925-ce6e-4de3-8318-559b1e0f400d --monitor-self-annotation=product_name=desktop_crashpad --database=C:\Users\Admin\AppData\Local\Dropbox\Crashpad --url=https://d.dropbox.com/report_crashpad_minidump --https-pin=0x23,0xf2,0xed,0xff,0x3e,0xde,0x90,0x25,0x9a,0x9e,0x30,0xf4,0xa,0xf8,0xf9,0x12,0xa5,0xe5,0xb3,0x69,0x4e,0x69,0x38,0x44,0x3,0x41,0xf6,0x6,0xe,0x1,0x4f,0xfa --https-pin=0xaf,0xf9,0x88,0x90,0x6d,0xde,0x12,0x95,0x5d,0x9b,0xeb,0xbf,0x92,0x8f,0xdc,0xc3,0x1c,0xce,0x32,0x8d,0x5b,0x93,0x84,0xf2,0x1c,0x89,0x41,0xca,0x26,0xe2,0x3,0x91 --https-pin=0x5a,0x88,0x96,0x47,0x22,0xe,0x54,0xd6,0xbd,0x8a,0x16,0x81,0x72,0x24,0x52,0xb,0xb5,0xc7,0x8e,0x58,0x98,0x4b,0xd5,0x70,0x50,0x63,0x88,0xb9,0xde,0xf,0x7,0x5f --https-pin=0xfe,0xa2,0xb7,0xd6,0x45,0xfb,0xa7,0x3d,0x75,0x3c,0x1e,0xc9,0xa7,0x87,0xc,0x40,0xe1,0xf7,0xb0,0xc5,0x61,0xe9,0x27,0xb9,0x85,0xbf,0x71,0x18,0x66,0xe3,0x6f,0x22 --https-pin=0x76,0xee,0x85,0x90,0x37,0x4c,0x71,0x54,0x37,0xbb,0xca,0x6b,0xba,0x60,0x28,0xea,0xdd,0xe2,0xdc,0x6d,0xbb,0xb8,0xc3,0xf6,0x10,0xe8,0x51,0xf1,0x1d,0x1a,0xb7,0xf5 --https-pin=0x6d,0xbf,0xae,0x0,0xd3,0x7b,0x9c,0xd7,0x3f,0x8f,0xb4,0x7d,0xe6,0x59,0x17,0xaf,0x0,0xe0,0xdd,0xdf,0x42,0xdb,0xce,0xac,0x20,0xc1,0x7c,0x2,0x75,0xee,0x20,0x95 --https-pin=0x1e,0xa3,0xc5,0xe4,0x3e,0xd6,0x6c,0x2d,0xa2,0x98,0x3a,0x42,0xa4,0xa7,0x9b,0x1e,0x90,0x67,0x86,0xce,0x9f,0x1b,0x58,0x62,0x14,0x19,0xa0,0x4,0x63,0xa8,0x7d,0x38 --https-pin=0x87,0xaf,0x34,0xd6,0x6f,0xb3,0xf2,0xfd,0xf3,0x6e,0x9,0x11,0x1e,0x9a,0xba,0x2f,0x6f,0x44,0xb2,0x7,0xf3,0x86,0x3f,0x3d,0xb,0x54,0xb2,0x50,0x23,0x90,0x9a,0xa5 --https-pin=0xbc,0xfb,0x44,0xaa,0xb9,0xad,0x2,0x10,0x15,0x70,0x6b,0x41,0x21,0xea,0x76,0x1c,0x81,0xc9,0xe8,0x89,0x67,0x59,0xf,0x6f,0x94,0xae,0x74,0x4d,0xc8,0x8b,0x78,0xfb --https-pin=0xab,0x98,0x49,0x52,0x76,0xad,0xf1,0xec,0xaf,0xf2,0x8f,0x35,0xc5,0x30,0x48,0x78,0x1e,0x5c,0x17,0x18,0xda,0xb9,0xc8,0xe6,0x7a,0x50,0x4f,0x4f,0x6a,0x51,0x32,0x8f --https-pin=0x49,0x5,0x46,0x66,0x23,0xab,0x41,0x78,0xbe,0x92,0xac,0x5c,0xbd,0x65,0x84,0xf7,0xa1,0xe1,0x7f,0x27,0x65,0x2d,0x5a,0x85,0xaf,0x89,0x50,0x4e,0xa2,0x39,0xaa,0xaa --https-pin=0x56,0x32,0xd9,0x7b,0xfa,0x77,0x5b,0xf3,0xc9,0x9d,0xde,0xa5,0x2f,0xc2,0x55,0x34,0x10,0x86,0x40,0x16,0x72,0x9c,0x52,0xdd,0x65,0x24,0xc8,0xa9,0xc3,0xb4,0x48,0x9f --https-pin=0x2a,0x8f,0x2d,0x8a,0xf0,0xeb,0x12,0x38,0x98,0xf7,0x4c,0x86,0x6a,0xc3,0xfa,0x66,0x90,0x54,0xe2,0x3c,0x17,0xbc,0x7a,0x95,0xbd,0x2,0x34,0x19,0x2d,0xc6,0x35,0xd0 --https-pin=0x32,0xb6,0x4b,0x66,0x72,0x7a,0x20,0x63,0xe4,0x6,0x6f,0x3b,0x95,0x8c,0xb0,0xaa,0xee,0x57,0x6a,0x5e,0xce,0xfd,0x95,0x33,0x99,0xbb,0x88,0x74,0x73,0x1d,0x95,0x87 --https-pin=0xf5,0x3c,0x22,0x5,0x98,0x17,0xdd,0x96,0xf4,0x0,0x65,0x16,0x39,0xd2,0xf8,0x57,0xe2,0x10,0x70,0xa5,0x9a,0xbe,0xd9,0x7,0x94,0x0,0xd9,0xf6,0x95,0x50,0x69,0x0 --https-pin=0x67,0xdc,0x4f,0x32,0xfa,0x10,0xe7,0xd0,0x1a,0x79,0xa0,0x73,0xaa,0xc,0x9e,0x2,0x12,0xec,0x2f,0xfc,0x3d,0x77,0x9e,0xa,0xa7,0xf9,0xc0,0xf0,0xe1,0xc2,0xc8,0x93 --https-pin=0x19,0x6,0xc6,0x12,0x4d,0xbb,0x43,0x85,0x78,0xd0,0xe,0x6,0x6d,0x50,0x54,0xc6,0xc3,0x7f,0xf,0xa6,0x2,0x8c,0x5,0x54,0x5e,0x9,0x94,0xed,0xda,0xec,0x86,0x29 --https-pin=0x1d,0x75,0xd0,0x83,0x1b,0x9e,0x8,0x85,0x39,0x4d,0x32,0xc7,0xa1,0xbf,0xdb,0x3d,0xbc,0x1c,0x28,0xe2,0xb0,0xe8,0x39,0x1f,0xb1,0x35,0x98,0x1d,0xbc,0x5b,0xa9,0x36 --annotation=machine_id=12cce00e-511f-47e5-8588-7df67886da42 --annotation=platform=win --annotation=platform_version=7 --initial-client-data=0x17c,0x180,0x184,0x13c,0x188,0x7fef6d0bcb8,0x7fef6d0bc78,0x7fef6d0bc88
1⤵
PID:2204

C:\Program Files (x86)\Dropbox\Update\1.3.583.1\DropboxUpdateOnDemand.exe
"C:\Program Files (x86)\Dropbox\Update\1.3.583.1\DropboxUpdateOnDemand.exe" -Embedding
1⤵
PID:2428

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2432

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x474
1⤵
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f761d06.rbs

Filesize
7KB

MD5
8f8201f4015094b1a75dc1def4277ffd

SHA1
d1a03fb52500534b8f64297e47c39a3b1662e573

SHA256
78de802364e392cc3cdacc0666e0ffcb06c935f45c5e9751335fb0fa62045961

SHA512
104170978d3ad347296e8a0b81a9bfb2eee034e86166befb88ce0a73b83cd3fa2c2a038637fbbb9cc0782f8b6339e2daa56952e074362f98788bd2c899ac6b47

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\TileSmall.png

Filesize
1KB

MD5
645c36ad987a44815982891679635145

SHA1
9dc5396d7a569d009d32ac08ac343559fea113d5

SHA256
7b8d04dbc781bb2ef7c6697177f41ecca6d1abbb9b6264700d1b9da87a7c4e38

SHA512
e8444cb16d2584508a699fa0a0f9afbef9325a505ccd56df5571a59875f81edb4e7b7518f197e879be7bc86e8206aacfec8977f8ed73ee65294c586442f941a5

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\TinyTile.contrast-black.png

Filesize
1KB

MD5
1cc3e00ddedbfc96d1bc4fba575ef45b

SHA1
540257c36d64656febd7eac22ae2784da3af55e2

SHA256
39fad5cbb4e4cbcbf7ae6f319536f09850814690bb1dcbe319d1e733a4577e7f

SHA512
65b14e4613e69ed3d062bac0ab10f0d0990bd65fc10593d7319841a0898311f08a37c7f0bc2d83f970319b3e439eb052d14bd18b91d8e10147964b3f53a94cc5

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\TinyTile.contrast-white.png

Filesize
1KB

MD5
6a3cd7d6943756adf70ccb12eaa0f913

SHA1
f0c2290ff6e7ce32c64e28a2cde832310f9dbd1d

SHA256
ae4a90f3837784aa05a9c93cdf1afc4bdfab944f26e924ef8d60093063fe3d1f

SHA512
4ec794914649cb9ae8e194d2254faa43334d898650733c03c1fde96d42cad2c898f00808980310c05dd24e0f7b6b791c1052c74fa0da2bc2229d432aa609822a

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\TinyTile.png

Filesize
1KB

MD5
185c0fed630b215f22a800d49bd1f449

SHA1
17380675ec0f35de43e5927ddfa86154f1574c67

SHA256
561ca42a1519c230756e7dc551329da441e6e7789f6156f7ac515be094b1ca83

SHA512
b034afc68d6b0846b5546e1b29847bbd9b4c041e15c2bb5ff61e0129c798c871a78241e1dd263bd0182a781fb192cb9b621d978fa4090c519e1683d6568998d4

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\backup.png

Filesize
6KB

MD5
1521c0a628944271f2bc1e19978913db

SHA1
62dcff433a57e17a24eae81638744df31068f693

SHA256
5bfc58e4b27a8405effcf108856d2650299afcf55eab83e95370c9b6066709b0

SHA512
39c0b9ab739bb777ff1e2c64d71e910d6859f50f0b0f243d34610f30f4b312185ae70f715880b4918b272f01e51e5be127f2b40c37cb3419ca3650c2248b66bc

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\binder.png

Filesize
2KB

MD5
873fbb8d6c4031515ffe4fa2fca98f1c

SHA1
6647f17a25a2e11e8b43ea057c14d77d8b0485c8

SHA256
f582ca6fdf085b23240b35411040b0b5bff6c2ec1ed5b2c0f7add35c88c65914

SHA512
1c29ccf8be145285a85783b979294af651582564d62839766c549d9a76ead223c7db73abe2de65fd30fbc30a174c14677eea4f4258374cfeb519b5a2e75ceb09

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\external_drive.png

Filesize
6KB

MD5
2c5ff4c40104d73684602b8822502e79

SHA1
bb8034e2603fbd74408239b733e47f2fff668d5f

SHA256
971d455f91faf6bf320ed366f0881fc613c3228daa9ed91e0d6c864ece1a735e

SHA512
b4270bcd6cf9badc7ba7343760863961da179ba1f87545e61c27f37b4d652cf0333c5451f7ffc52628ba0d24861d6a692d0eb9d3ee247511a735b6f7b5f10743

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\gdoc.png

Filesize
1KB

MD5
380d7a105141884a3a4369618ec809ca

SHA1
c87753703e478f9b1194990e29c25315c0387db0

SHA256
4541fbe81bc51114ef18706d2b37a44c1c5ba14454fc26b8a058bb31bd8cfb79

SHA512
40c16d9281d74b47d197d103e7ba52ca2fca30811389bc2a699f4ae9fa30ada55e6327840c43cb3139231c3f7a7ad841d7154950e6258e806e628115794574bf

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\gsheet.png

Filesize
1KB

MD5
8029ccc1e62854e19c74582fdc915634

SHA1
4dc6094aecb1bfdf87cdc0123a2f1f905bc83df2

SHA256
70f5bf52350b6aaf67ad1296a947ba2a87c12dbbef76d1c3f73fec723977a81b

SHA512
f37822df1dc52e955b990b138a88064edd92d134773c4dd0950e298ee7f8812e16cdfd64f6511c45f9618c99d8343ac2b973f67b5a852bda0e4c8f267caf6d1b

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\gslides.png

Filesize
1KB

MD5
d698a0f00979142b5991ab54db41ad64

SHA1
ded38ecebbb506d1b8b719c57f5ac8614dded702

SHA256
c6ed27af06f6d5e565469d95bd7ac077418971bb1dc7f2fe068d07cf0f84284e

SHA512
cadb690d88987de1ce8ea1d1fa2f93e86e6ea093a9623f5bc48d2f8cbb6e29d05525d358595902a0179b516b043bede63e2c7df3313a2658c84d2dfda0af0536

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.contrast-black.png

Filesize
850B

MD5
b832b83311da4c4ed1ab6841faf9e095

SHA1
5ec25bd5ce1914ee348afa22ffa79163b59b644a

SHA256
f1169f6b53191be05946e9ced0dbb6676b61ac9902db3218e69eb5ed4252d67a

SHA512
f5895b26b61d31046c97de5ba04d2d18587941c3e39e85e2d9a2de3bce7bff608011849dbea1982e4a2401e1c4b0a02c566e9d63c2dcfe3a2b69ecf9a473bb31

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.contrast-white.png

Filesize
829B

MD5
5667327e1c37cac08cfb45f4fa04fa16

SHA1
d6ec47f3a5276a4081f24922b9510e691bef098f

SHA256
b483f895037bb12a7d9f4678382479abbfc67a898d5da76606011d133e119396

SHA512
319f81c5023197b1011f58f074ce7aae81210201db56f7af21d436c710489511c17a02e584416c6787b1cb31e06b67dcc232700b38994d2e1dd1db402f3f2095

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.png

Filesize
807B

MD5
9d05fc2b1d201d34a32f9e0fc7fc6b28

SHA1
b74925f23d9ebbf9a170f0f6ee2307277c535be2

SHA256
5b4295cda56616386c8a51e9950c4b6bf881da8e38a3b06af45dbc383efe2a9a

SHA512
073a84635557810b0fb8cddc5b54c8afe6cdaf2af666aae5bf4ec89ab79f06367bc4e5717538314faa11ccc6ae619f7a3353a878f32cfeebabac99c545cc55b9

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-16.png

Filesize
369B

MD5
65314a1f7cdbaa7d2d54e55ebe01f6b2

SHA1
064dda6eb14cf6502ab501a31c61ecb2749dba3f

SHA256
480bd88e54f2f39583b7360b7412486067dc8f0acdfb9396ca4b2571349515b7

SHA512
ac0e7a59de1c595a107e2ff0c044e27627629c3c9f66cf40503a9e4d3252577f8db75b60fe777833f391165f1fd0926fadea2fef71810292e6a7365747bbbcae

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-16_altform-unplated_contrast-black.png

Filesize
352B

MD5
69425172b704c2ae99ce43d4c2ec3e77

SHA1
55b9ca414b419377c93d799385b1e5f17905a6fd

SHA256
768dedd2f167c28e0e628326fdb17f9d0a3b50d2776600968ad00682a6a84de4

SHA512
26cc0ae704ed6abf31eec3d99425b70577a136edeeee252b43f2922e871cf9427cbc4566d1dcd5018c0c5ef2e8f5ea2eceb732ac696b744cc0e1a880afff5ee6

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-16_altform-unplated_contrast-white.png

Filesize
382B

MD5
078e5ae7004ca5f443d3a92627caeb8f

SHA1
c03b04cb32d3e7f24aab7a4ce2bda96820edadb2

SHA256
7fcccb4c85dcc54849c88d74241db75e5174160e0e364558073d6e6c01ad107e

SHA512
691f3e8b09449c5663f0ca5b0f71f1d4cd10997c361f29e2e5be7b577253d744c2a4283a61cdcdf873718d36281c63e3dbf21703198c26d389037184419c54a5

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-20.png

Filesize
433B

MD5
08fff0895f5bd8d5a347b441e48ad41a

SHA1
b9331637e59137bb8d75251bf85677099a24ca27

SHA256
92ecfadf6d728ab3346f8498bab501014be35881bb605d585209033c0c8738cd

SHA512
64ee594903afcbf3848ad37c094be60815104ea0aa17f5e287600448e95902e07820ed0bb6b840ccc78a3b60d8b37e7dd4c23e322670e588b8df21a3e0cef56d

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-20_altform-unplated_contrast-black.png

Filesize
429B

MD5
f568f4b386b0e96165f0bea8f20a2f90

SHA1
0dbb7d102401e27e01bed8bdfca59103931eef4d

SHA256
fc27012a9f08d137a192e4651fe1170348fba0e755bc20dcd18a040761764028

SHA512
cfd190ef7b29d0dbf461517726e8e179b07bff0f6e5be0a1b40cdc4f89fcc1093b5d79ff319b2231c8924fbc017a9e2e98a510fb25923be2040dbd6d1a27d060

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-20_altform-unplated_contrast-white.png

Filesize
424B

MD5
8fa8d6175c2e3cd8b8c5a7174c872490

SHA1
3c40b505d69bc9a4d8115caa6995a49a8c652c6c

SHA256
9ba3a66c924c24287fff271985cd9cbc41d98ea3003ff079485ed16096b40af8

SHA512
88a89452f59e1089b19090d2cd7981288576f0929a0e5598ef6b60b828e1986160bd0ca1e4b1f73cb43ef9b5605ca4520c353f80135e0824c86103aa539132ac

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-24.png

Filesize
549B

MD5
17df27edb43d66bf07ee73f901bbc036

SHA1
fc2c1f284c008754d73284eb41ccb6bc13866366

SHA256
b1c4bb67f7d23a1f7c7a336ffd7b6c9eac64d166c62c71f01900057acf6ffc97

SHA512
a9996454106e500fa29db69b1fb234f23bf2b64906b316a53e675881b7c97f652f510ef8e86306eb6ee4fe868f55013a9d855b42ea5aa35400569203d49cd4d1

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-24_altform-unplated_contrast-black.png

Filesize
545B

MD5
89b16af41887fa5d59d6d4196736412a

SHA1
89837e2da2f33418f63095ebae076cd42d3e96c7

SHA256
962a367ddb4e1a3c1b4d15c5bccb26c8dacdf90874709b2049137c6611cedbce

SHA512
f45e803282ee568be2de32c2f82d3a0971d4bfb8b9c1e45ce010b01284c0db13f8da30a4029e7d32834df097b222b7899b559ccf25a202c91c9561a49a727989

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-24_altform-unplated_contrast-white.png

Filesize
525B

MD5
eb8547e09e4cc9c9bfe3d22a5bb030d6

SHA1
e971788950eec3ec33d42fd1884ef460beae7b4a

SHA256
fc2025e7019faf3c3e2f6bf953710aecd4d77eb3a270c301e14acb056a3f5e41

SHA512
0bb2029260147f4d1041e9cb4a7696248158992cbc0334ca09ef433c1fbeebbfb667edee18f1ed2518383883f575eee8e01f0948e3075166b34120f42b8ae2e9

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-256.png

Filesize
3KB

MD5
05178135c922f70c73c4bf161dcf30c4

SHA1
740e84bac96b585837a3680025f31bb41f5574cc

SHA256
017de63c54a90a3fd5355ccb74b1030d7ddbd3795d17d5531d8d3b4925d09e5f

SHA512
07bff7f3cf5e0cd6c57e4ecdd42d91d8243261a760592b971bfd51170a88572447cd43bd0a7676136a56f8dd8ef4e25e2da218b9334c93a6ed7dec3d62883aeb

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-256_altform-unplated_contrast-black.png

Filesize
4KB

MD5
19717d9e418bc3f3bef1cdf2f5df2ceb

SHA1
dd703ce05d68c79f9245f85e30631f84a619a616

SHA256
db7844bdeb530f730adcd6e8133c0268bb4f623a126cc021d896f3bd3b5bbcc3

SHA512
bc81017ab7baa23d4776dc24e27823208b59406e374211b455220fb93a5817eaa18372cc00ba3b13899884f5463a0dd088d233c6f9effebda961f0dfc9c8dadf

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-256_altform-unplated_contrast-white.png

Filesize
3KB

MD5
b001c9070f08bb5d0fd365b5e2cf20d6

SHA1
f7e19e04b4ba0d2ddf4bc1bfeb294549193900a1

SHA256
00c062d5b17bfecc284c1a2cae4ab3982475726be67fcdc031051a2a069079f2

SHA512
576d34bd5d81b19dde57105804b2bbdca0faede9275e8c1cfd9707edfcc00bc5ee9add3f08865e5827e9f143c798ccca8ed002f1995af8bf9473b237ccece2f9

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-30.png

Filesize
634B

MD5
a8dfa7f601b7943c10d2629a64400874

SHA1
ca14836647c3ed3e23b8ccc1b14113cc949b8ac4

SHA256
0f1d81715883c6335a6cd9e7d5eef096ffe151844c0754e61ba5051a0d3fd6d9

SHA512
feca8e247dec925fb5a8a6daf207f81af8fd908905b2f4a5fcdb0243f55482dfb69526c547455ff70084ed5b5da3ebe691f35af1af7e7c9121fd6eed9bb755f5

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-30_altform-unplated_contrast-black.png

Filesize
632B

MD5
9b83d3e977e41230a9e9a094e412f7bd

SHA1
116051a28db47ef22845804aba210688779bffd9

SHA256
c7965f12e0d493c4282994e07dbc051b26dd5d95fe390527f6506a5877e068b1

SHA512
ce2b7754fb3e6c33a1dd9186829da3b981d784bc08fc6fa383bd172e4275e88f81dc4a3897c3036b471bde6db4ef33766d65716ed8ecc18acd53978b55b1fc00

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-30_altform-unplated_contrast-white.png

Filesize
608B

MD5
193dd3ed9285ebbf0fb79a93228decbc

SHA1
f2475b74c9171be2ca0f47555941554ca13a58ff

SHA256
96519fbbba9029fc6214df166334808e86df8751f7405a0b8af812c870a56c96

SHA512
30aac97523d7b8ffc86bf58392843d730bef9b96a8828ace6be9217eb06a35320facb902c039b7f5209d5c11105a5991c45eeca144902ef20cb3f930bb84def3

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-32.png

Filesize
649B

MD5
c1a26f91bd23a6a6c865b1bca72912a8

SHA1
9178bedf3666d30adb8af404a211cd9735a13f9c

SHA256
0532b07e9decf2e53c44a17207a7c93b57e2285e6f65f349750bde4a4e6f72f4

SHA512
92302b24d68e6b5b1d88e23454b3434d98bf967c4079ef5a928fbe5bb25aa9f38fcd6f95ad5d667fb800a33c62a55207f7da83318a40cefb694006f13716f2cb

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-32_altform-unplated_contrast-black.png

Filesize
683B

MD5
189f28a3247afbf1b17ae9a9cc788874

SHA1
721206a8ad829d646a0c73d90dedfdf475022d2c

SHA256
5e4bef37189b940b417efdc91f0abf569edb8e067d5bac1864a1eb47a68946be

SHA512
96ffd4627f8f207d5121551d338320a939db3c568e2489277fadb6b6aa09197cc6aae80b1474c00e1779f5900324eb25b27035abe8df7c4044295f67743eb74a

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-32_altform-unplated_contrast-white.png

Filesize
673B

MD5
f08f237ba9df76e5344f6d1dde7d7072

SHA1
d0e3c52453402fb40e9813b92bf5bce556cb13f5

SHA256
5ff9fba41b80869407e9df6799aab8a9d3ab86b086b93a0173f66f8faafe4689

SHA512
8613437ff8b8be50a8ba117d37e3172d650f8e953fa088c35e0012a8f26813bff33a98e8bb1f8be5bbcfcbfa7789b995a895b02f44595526ec916297be99f147

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-36.png

Filesize
749B

MD5
a5394ee13baefd246c0bf6060d38ec6a

SHA1
d4ab4e8de5564b0e20525a9baa0f8e0b5cb2a05d

SHA256
7d70ccd21823c7918de26edddf6b3a35773512b074225bc3b24b028d1a0596af

SHA512
c5a91ff923ca3821844dd2ab04bb472c336e6bfcb881fb955825e3d0f001361d31178d56a25ae979978b0175b2a61ab67b864bcff910d8b9225329b532ba2ad8

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-36_altform-unplated_contrast-black.png

Filesize
780B

MD5
b051e689507b22feec226d43423065a7

SHA1
da364c9e89b13f9a9178dce90ea944c5e9d6d817

SHA256
89fd40e83ff38d64fe6427cb74cc3ac5ac09de46536a74a2df0208909094740d

SHA512
d9a453081e125fb0905d33520ca0e92e2c5499bce4744fbc82c6a5ff559a788ef50e0b0f08f7b532e582f0ebfcc67558fda50be3e230bec81e599387e2962e51

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-36_altform-unplated_contrast-white.png

Filesize
757B

MD5
919c6a3342aa9825a42dc1bd2b5ea9b3

SHA1
abf02acab448481a41cacaa6a8b151a0ffc33f6d

SHA256
82b4667bdb04975842375cdb2d3adea035166366e6dad08a3d5c5e4e884ef87b

SHA512
72239cfdd4d680be0ba4b91e48ec1e1c4b929212c462f6f3547d753753e55f4f82470cab5c490706e1feda50757bb2c02492834225d585faf0e960fa924337e8

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-40.png

Filesize
787B

MD5
68168f044f85ea9faf4ca6d3e570596e

SHA1
9d7fbb23beb1dd424f2ff5a5f60ca7f3361fecab

SHA256
ba53865cc9bf60d1b21daa381bd3ae27b75c26fd45d8ff4393f88686bfcec2d1

SHA512
2365d5f565bb68e27d6a4c8dd89a23752335db4c5c51506e202c1d785562e72651c71deecff903ed83b5bf7281480aa86da6f90338cab0567153aa23da6b8341

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-40_altform-unplated_contrast-black.png

Filesize
824B

MD5
82c51668274bf0785a9a546a6e257bc0

SHA1
3e49dc4194de95aa4b28c210289710620fedc3e3

SHA256
dbe1f856324c36cb597cae985f4f1d65e12d63a9435a43457207caa7712d9d2f

SHA512
61e49ed0dcaf8adb1e014047e499977cfcfd238b0b98cff9cf177afe30d6500b6070ebdec9eb485b25db9d08ce123f7efebb4bf405790ad665a898cf44bc85f9

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-40_altform-unplated_contrast-white.png

Filesize
761B

MD5
856d9b6612bfe8459d498de81a7ecf6f

SHA1
f483bb191ad1672102be0907c54d3a168db81426

SHA256
b665198e59b16b6a095f65a01d1e2d6247b6c9694dadc3ec4c2a95986538aa9c

SHA512
fd28d57102e5a93151ee66a4226e8a69f365177d58417d8c39a6600a40181f5d547a5228521c9e5d25abdd57790a311b920fd9d8d3f7d366fa8c76ededde55b6

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-48.png

Filesize
868B

MD5
dfbfe6972b7e6bb875970fe4dbad66db

SHA1
f1594ed9bdbc5c2459a2af984275392d9077e7c5

SHA256
6fe5eb7d05d520584f2158e8669264977a437f7daf75b7994f13aedfd2381539

SHA512
dd8a9aacbb50380a4d9b9049c82500471601a9897e26e2e4cafa28f2ec556bdefd8e61bf976569b46da9368cd8c183d56a8d0b68ec7d20b02fca0d48d91b789f

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-48_altform-unplated_contrast-black.png

Filesize
969B

MD5
2d4e69bf887108188e1b6409d6cc6d28

SHA1
6031820b4c718bbc491bb45f10cf5d850b4192a4

SHA256
b91fdbc9c46552c90c0ca41ee8fcd543f383dd6f50bc15f04e6b25e8fa29f4b1

SHA512
1680597b3742037e868c1cbaa0840f808a20a84da324bf562b988eb1dcff1bfe0062aaba91f9415f39229850e849b08263916fec6700fe7f88e2018a8277e3e9

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-48_altform-unplated_contrast-white.png

Filesize
879B

MD5
b5f8ede4d336a3c1e2d5e4eade79f7df

SHA1
ca95bfcfb47d1565912bc174c7958de0c1a31571

SHA256
abba9fbb0af323e7c41bcc85a771950101f4442706f1d1fd8f0c1c5c64d2fc11

SHA512
fb1eba806ab29ade63ee9eb1caa18e518364df4298377e7633c4a0dd5833238e6dcc6f1e4a72ae94f8a84420a3c4fd404b23154f901eba34b30a135ab25c263d

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-60.png

Filesize
918B

MD5
927bd7b732e69a2d7643613797504edc

SHA1
c1ce251e91479d27c6b63452e13aacd3a1af1e60

SHA256
bc4c7c205e546bce49c87f7c61791ddcca6ee4de5eb99ce50a578bdab146f138

SHA512
96b9f3d04206a5f6101ab9c41ec784463ce071d4639d5eddcae38a213feb0082df6356c6a1c433ac3bb237dc47e5a9efe7af01e60acc1034691799858a00f5d6

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-60_altform-unplated_contrast-black.png

Filesize
1001B

MD5
c64c679151797c7cec14d20826941b23

SHA1
d514236b750eb2ab35200696c26e677c614331db

SHA256
85e92f78430d788acd376c9213a70aefc2ec15df1cd0b3188e28cb4f5f0979b6

SHA512
7625d4d96387daf4d9ca34b883c7e6b8bc5e69a091668799494850e5495a42bf26c4e84b4162cd98b1797ad3da617fff4b98dd93caee93986fdb026b998da750

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-60_altform-unplated_contrast-white.png

Filesize
939B

MD5
de6e9dcc0f9602e11e72de142ce9301b

SHA1
6ef7b6ef1e515ec535ed7d103c7d1cefdc39e85e

SHA256
470869b40f07e488c5150036e97170c544013b27e7256bf80846f085da3a8ab6

SHA512
9e0201792791d92b1b1f6dd60c74dddaddbca74ecac4af8eb58a026f3347434c1a23d17d43d7a7ff2fcdd5cb63878ad224a3218de8719933394513b85161fad0

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-64.png

Filesize
1KB

MD5
24b4e008c6baad1294e1d8790d878d14

SHA1
5c07780175e1b6273dfd0b48c93700b4a7d9bf48

SHA256
c290188a41172f8158c0f975e744b7400592fdab11e119a4093539ad83270586

SHA512
ff6675989dbea879217b736407dc117232574a8ded2d350d57d9a01b81a75f0e46f876a55f252437faaa586313b50a345269dd7bd62263e037d67a8db2059547

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-64_altform-unplated_contrast-black.png

Filesize
1KB

MD5
c00560d1004df880d2eb6bd21bbaa4f4

SHA1
f8127b702e4f68293ec28f9dbeb44ad0505a1d4a

SHA256
10e278df172c7444c8cc1c3b199d353e4fcaea2f03ea1807ae1ba20970d9e3f7

SHA512
4dcd94b21f7645a566e029a67c65a36430d44cce9d9fe91aeda9d865c8d45025afc523edcf3f609904f542b5f33b54ece0129230e9279998d7511fbb34ac9b3b

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-64_altform-unplated_contrast-white.png

Filesize
1KB

MD5
3d43b758d4dd1ce79fa92f4a698f746e

SHA1
809f9ac50b247b3e8f35eee63a2e24bfafeb81c0

SHA256
ed5a2cc70db8bb0b07f67565d2a2a4a33e5102102f39aaf6a0d3bab2621a9391

SHA512
0abb9cae2ec6c4f793ba1bd3307d4565650cfb5a86a7d06a9934a71d31df87d21e6335e742cd06555fcdc77afe420c0784e60e8dc61892330fd7e924415e614a

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-72.png

Filesize
1KB

MD5
4b346abab3232c47018299359809e6d6

SHA1
fb5f589c86b9c972d5c9efbc04e0d872580b0a78

SHA256
239b121a9a36aa687205c73d3899b130e5ed12d75c2030fdc654765eb890faac

SHA512
265b64f380c4813a903842fb9424a5e16f9f27b84b9884701e748e378002677685288ee0c2900c8deb8049b7c4f6b1cfaceb07fe0d12953168d43c7b241a7053

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-72_altform-unplated_contrast-black.png

Filesize
1KB

MD5
f15310347945945998a85b0fe5c9670a

SHA1
57e3f5379db970366d588bfc3069ccdfb38b3e4c

SHA256
e47eb78010e8a7a79781def9442f5addfc3b0fbede2a721084a4b7f2e8810e47

SHA512
bb4b42ac77ceffd16f0e6d55f2b4ecbed2b5eb32b18221d2d2e868e730b76a12f6baabbc59b206bd527b7ad8afe020f4524afd292913e29b2315548adc60012a

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-72_altform-unplated_contrast-white.png

Filesize
1KB

MD5
7647225793f5170319924bdc50183754

SHA1
d908065adf3c5a96d59990f46b65032d285ccb08

SHA256
4bb3259d2836a8f904f5703c42e3c7db4924ff3bedc8847b45d2828b43e5c8ed

SHA512
f71db03541fb579765a454af7bf71b5ddf138fd63e97eb99c1151cad66beb746bc4ec98e71d77fe346c76b754489cd7d7aa75ae6459505c2cd94b90c483e4afe

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-80.png

Filesize
1KB

MD5
1b0c87801219f54d1c75d37af3b9ecca

SHA1
9336dc30097f1833fb152f79179ab9321bd42ee4

SHA256
a972691debb27d28217e363c2a02023907c4ee51fdd58fcf0c60d64b856e7e31

SHA512
1cd9377b2e63cc6836de1cc8e628a0ea6eb150adcde489446442c8c9e5347c9dd105eccfef3346a12ee6bd5a5b8ca44d0a0ad4a1a97c0e086909428aafcfb705

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-80_altform-unplated_contrast-black.png

Filesize
1KB

MD5
ff0aa94fe7faaf13a53278adc2698c32

SHA1
8c61b01052f520362bff5fa648a60fadee65ff21

SHA256
6684bf37a8dc1b5424e756c33b3f90bb881181dfd85d57470eb3c18fcef5e656

SHA512
140a141485a0e143227802ea2b24dd3dfc03486e2539cc67e9315f0c761850abb525c6b2d7a41cbdd56063dd11afa06f6562deedd17d8d2b9cc729d91a4a82b7

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-80_altform-unplated_contrast-white.png

Filesize
1KB

MD5
7db0293e6fcc87abc9a0945aff79dfe3

SHA1
49809dcf23a37c30787d261feadc8d73888d99ba

SHA256
cdc8afbdfc96aa91d1e3df6ee6223e23b041fab55429ca375d4c528ff23babf7

SHA512
741896be2d34887c913365534f0dfb5c0e0354a4d282c2ce1521524e305c4903711022f2595d4d3026901c85736431de9b50b07ff6268ec25b8e01635f25653d

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-96.png

Filesize
1KB

MD5
47861a490c54e0a983b98f53dacac06a

SHA1
d904739cf33ff959362b771445bcf404c730a4ca

SHA256
122e0ada5316373920063713ec84087e6769b2280e75858af9ec6586daf72cd6

SHA512
6cb6f04a7310222a2fc9eb69bbaa1d67601628a684e69c14a5d20a859edfd5e17ffdaaa02bde09fe78c0557065d0b24fd7c555cef7a065f5dbeda83820a9e5fc

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-96_altform-unplated_contrast-black.png

Filesize
1KB

MD5
9d782eafeb535514b02ff0ee296e8f1b

SHA1
86960bc19ca4c65302facd570799662a12fe2b12

SHA256
7c40b6cfcd8bcbb201a2edf811022a37ca47b73e85ec5785996477adcd0eaace

SHA512
af627d93fd037ff7262f6442c27208ac102cf36677edca6363dd56f9c2c554041600a55f3b877bf26be343d8ee980021a77682239715d7f6a9fcb2f97146a53a

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\logo.targetsize-96_altform-unplated_contrast-white.png

Filesize
1KB

MD5
ed52cd09bf929b70c0ae9fd2007b20bf

SHA1
faa7a71ee9b105e462688b56e0f2d226223400fd

SHA256
b644ea2d909241dbfdcc7caed90d4a8d9cae526939832ea5312161e60fc24bd5

SHA512
2d7b89d1930f1eb54fd2eae71314e414c24489b9bdbb89b0feba5bcf2d4b8068659d1b46914426d62f4165b956738154f5edc7aa6f3c9e98ec7feb2e6b4ea16c

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\paper.png

Filesize
1KB

MD5
a8e9958ccac2302842a51ce8c3597a15

SHA1
e84388e779905f9e6a8669b77f753fc9934d67de

SHA256
1b70de7d87bc179dfc982a1216ee04b979a87de7ad08e5b34dcd99c0c48b254e

SHA512
0c30613bae5122012c64e78a926fe852c030de8f11293ace44afc8070db43a13311d3256c1a9990a043cf67194e0ab47e232569ff994fbabd2905c81d56a6aa1

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\papert.png

Filesize
1KB

MD5
434fe67c25c16b2b745def4231ae181a

SHA1
4c4bd93227163abd1b9f46223bfe80fc3e5daa86

SHA256
5abdd49966d4e240b77b786dbc6a995d1e6d653f0d611d0c3fddd4e45030aef4

SHA512
4ed202e2b91b1a1826b303dbe7ebb0e3e6a02cd9441cda5f95e0af438fc29239c20255254678908e933555b8bfb835264a4f25b87b6f766b3bf9e1001956d454

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\passwords.png

Filesize
5KB

MD5
3f6bef094242aad215be2433c7529a63

SHA1
e5c08b505035752086e0bfd070bca097129816de

SHA256
bd15f021e8ba0f65ed8acb83b75c144318cd07908fb1821368ec2e43731e20f7

SHA512
870e5a196e05e8ccfc694603166999ad06c3d4ebcb5f3dfea257e0faf0f0d8d19f62b49e8ba2de228c342143d1b17af68ce188eefc1347291f35a691be18607f

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\Assets\web.png

Filesize
1KB

MD5
172079b04dcc970e7a7bf41fc79e6065

SHA1
ebd4df4290499ed92fb805e51e790f98b5b2e636

SHA256
6ccfe6bff51de7b8d70d1b26b33241cb387e13b81e344204daedab0e50704d61

SHA512
4b1a7c89e4281489cd4fc0b0b3cb1f742d1bb28d302f142029c810db9305c44802849e07cbaf309ba02bb1d259255fa5248086f4976e2722434dbcf4eab01490

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\QtWebEngineProcess.exe

Filesize
45KB

MD5
f9ef8635ff1100c89fabd91cdddee2c8

SHA1
1da944ce765b18abab67907863d154a1738543ff

SHA256
d783416cb376f463493de57a8fba194ba3b6f3599c0504b58107590f3e392316

SHA512
62c7a800bdbfec8d25b43edf05a38bc9ca0643c8b867f3818a18edbfaab4e000898f8e986b9698481ad252acde508d4400b09890cfe3a2e03641a74629e06b4d

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\driver_amd64\dbx-canary.sys

Filesize
19KB

MD5
83d9cd73553c7bf2798a964059af1676

SHA1
a7bc873cc6aad6e3633697978f9bfe7ad476127b

SHA256
73dcc64ab18111f7e2957f7ed76c090477964a0ef1071573ad916fca33043653

SHA512
e9f4076dadfaad2d8b541240495bf9a5602dcd44becfc018159a65f908b1b65bb05699ec391b1396091f0801904568e4bffcffcabb8a05cef2bb6935b7cd4812

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\driver_amd64\dbx.inf

Filesize
5KB

MD5
865f72fed5782833abdb89ba16facd8a

SHA1
dd45c5355674f90a66bce9d394ee9b48f4d82b3c

SHA256
0ea53b1fac9114a58b74c7736ab07056f60cb3cbcedc739862ded534cada0dce

SHA512
c99c6c1c715956c2094ea6c472fb0e9e5ca26e38e701f8b45ad4f99268eca1b8ec657956e97687ec89439570c3d27a330a5fefcf1f623b966fe82de496c455bc

Download Submit
C:\Program Files (x86)\Dropbox\Client\149.3.4541\driver_x86\dbx-canary.sys

Filesize
26KB

MD5
fa7b3eb4de80716baa8648df4f616258

SHA1
d22f87443397321a23ebd72cfea9b49218a63ddf

SHA256
39da3bd07c575077a5f92cab8fab8282213c893ca2fd5de4f70cbba96a83bcd6

SHA512
0b5eafb680274d1dac0d4afcee508e228f6944fbc98effda476e0bed49a1b881d7210609d7959513d375ff3a5a5a0dde086d820d24ae9e42cddf0ddcd6637e22

Download Submit
C:\Program Files (x86)\Dropbox\Client\Dropbox.VisualElementsManifest.xml

Filesize
396B

MD5
fafa4764b538688f54a8870a6266953b

SHA1
1391f794e8f8ec225c3ea2e126895a83ffb6e67d

SHA256
5fa4fd55ca699114374e8df0b93afac5d9005536cb2f127f9337d7d1fcc64a97

SHA512
57a3d0b963831b059d5098b3240b4f5ba5e7f1ee849e44e7e96297d58e996a57469358685daae7da9eb3ecf98e8c4e266db0512e22a797789f7c80e76b2dd726

Download Submit
C:\Program Files (x86)\Dropbox\Client\DropboxExt.52.0.dll

Filesize
57KB

MD5
79759cb9f5c4eb9d1e9e23877312cbb6

SHA1
b233bdba01fb3f3ff01b655aa0b13dcc33705324

SHA256
82b08dae2c91928dfd67a6bea9f6f886355c0021133d1da08dd63987cfd41156

SHA512
d3c889b6f8115a72f99170f3e82398b84cbcf3cf9fb51a9923efbb4f10e57ef430a3460aea5b4e167608790a29f51a437c862be1223146f83ba430bf9d27e16e

Download Submit
C:\Program Files (x86)\Dropbox\Client\DropboxExt64.52.0.dll

Filesize
25KB

MD5
630b065739b2c77007072ed9a3e2711d

SHA1
ca052204d8bfd8e2bf1f9681e5f00033ebab1caf

SHA256
6c2dbc6fe17a715661be06e6b598802c282b1bd864021b6321880bba2786761d

SHA512
a1c2e7598628e9d7eee8f2d3b9d904db019f9cdcf31390c26d75339a97814a6f2281fe963defae17ec0ad4a09a03f5f77d516d68a2e94090f2af02dbac22648a

Download Submit
C:\Program Files (x86)\Dropbox\Client\DropboxUninstaller.exe

Filesize
62KB

MD5
8f5d741095ba34e20f11d12b7ff56544

SHA1
c7045e3aee7914f3d64b9cdb7c696c67def40c30

SHA256
4d6d4f0f897c66bb5edf457ecfc0cf302e2a5eeb06712f79e32c9040c91b714c

SHA512
292454e761fc91f1369ea25d7b3dd8a6cdce7ccdd7b7809a43fe70eaa8ec4e135e83aa466b930dbffc3a8d108de11a2d80e92061e72ffc0ce25890b65e5a648c

Download Submit
C:\Program Files (x86)\Dropbox\Client\PackageAssets\Dropbox.msix

Filesize
214KB

MD5
25a713ed0e804d591caa70e7365a0d37

SHA1
5046fa4c114f3b3a7b8cb1d12b8b97b1b5436fdc

SHA256
6616aa1139b4ed168caa14ab41d684d06144d6dc01e467645b92b0de912b219a

SHA512
aa6c93453d474c8253125dc4350880f29136cfaa69f1bfa126522083db435feeccc30576dd163145e015d42cb1eeecfda74e5d312fe74fe5309ba25cf12bff43

Download Submit
C:\Program Files (x86)\Dropbox\Client\newDropbox.exe

Filesize
92KB

MD5
189bbd38e95fd7f43fd34600b94e3482

SHA1
7941384de57244eec35257e358286d89c95b9938

SHA256
6bb7440f5f36a9cf90e1695fb65509784b06b3be46fdaa300b743fe8abe9a504

SHA512
820ecf134f866cd874ae888ccf51363c5c811a18c64b5068bffc6230ed261ef802c985811a8a3174e026afe5a73e7288e4b60c49bf0593d5c1c94750efe8d047

Download Submit
C:\Program Files (x86)\Dropbox\Client\qt.conf

Filesize
87B

MD5
545b33112be4b4ac271eb1dfd85df62e

SHA1
d012ba73c292981467fe43eb275c99d4c7f65385

SHA256
8699129be78c28f69f598f4d7fdd07dbbc66de3f46ae0053ac40772d63238a91

SHA512
3914f43b13c204c7b592a281a489bfea10d09805265f7dc7be101bf8a3efa88e3d461134766fac5d0d64a7b3dd9285ed71d0d0b48ee8b9b2669ac39a0c78e395

Download Submit
C:\Program Files (x86)\Dropbox\Client\resources.pri

Filesize
37KB

MD5
01da37d23d82ae46e79055a14eae948b

SHA1
fc65920fb2d6aff4bc161f61f3db4091e8f3e674

SHA256
4f234d425ba5762843ceeee816979612904e44d3cf2a42f96b5b90f2167a1e91

SHA512
6d5f0f58d6937b96424905c5600119dcf86d41576ca1eea7d6526d6ffc138e0008251ad064570debaee376ff135e9ba49c439eb76d393b55b09f1f9e944c705a

Download Submit
C:\Program Files (x86)\Dropbox\Client_149.3.4541\149.3.4541\Strings\language-es-ES\Resources.resw

Filesize
7KB

MD5
fed758a433fae9f6bd6461b769845d55

SHA1
89f1efcb9a9d568af64b109b72ed6ab77803f15e

SHA256
75997383b6597a725ecdc87f688ef632e218bb627bb724c347416937deab768f

SHA512
a04a35ca6129feea3987e261d24fbd4b2419511119ebce5c7f3d34d369eee122ecd16cad395a73812f255498ede9782d8eaec4fa7e966e340353b35600ca0977

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\DropboxUpdateHelper.msi

Filesize
24KB

MD5
c8930105ef370d14c12eaef50d25599f

SHA1
fed3516ea96190bf4dc60acf9a9fa07df995138d

SHA256
f4661f85b144f7fe76c961c8d497016fdd8b4c74914614aa51f8b30e396ed747

SHA512
ab5660e0b713d0e2d0cd257ff086dc57ac17d1cf6cde2ec87e6608ec64cdd61a2f7caa01492535890699afcb37be8069c60432c268ff1451ae8d4bb7286f2fdf

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\DropboxUpdateOnDemand.exe

Filesize
73KB

MD5
a06fb9f76b63d619270f513457feb580

SHA1
4aa3e5dd3a80b887014f5082637a33aed7d64c7b

SHA256
f203dde06f7bfe0d4f8b198c8f08298a686705aeb9940d40b52adf20175b2ebd

SHA512
d0a7a034bc116e581a9ac0f86122cba4b112a021f93a601ac04f6de678b7da038db6f5b1a749e9f2695b17a5610fa8349c1c80cebd5932809a2cc924bda070c8

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdate.dll

Filesize
796KB

MD5
b204e16a10ada0048a44f2c48ed99cb7

SHA1
6b06dfb5a45670880c738b356e9b9067e02c6fc8

SHA256
a7d00652b200bba8142560d075d8160a2e369e81341a2e67608752e5e146de40

SHA512
74362a7ee563d543b2bacfd1098e3d97ab2638e22fba9c203643313555572a79e3a9033d6c60aa338820c6ec6b3ee13ccd7d77afb6a7f56ca32495f0cedc1ed5

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_de.dll

Filesize
33KB

MD5
f994b548ed3f24f7c44f846a6a66d03b

SHA1
a26e07951a9f6ac73ca594c3c0839197cd017f86

SHA256
a4c9d61c1599e8e96a756ba53e071da2f5c294f24829255b3ddb7a49fe2d8d38

SHA512
5f75bb5ecba82a46b0df07c0e2e6d82c8782ef686e26d66f628ff92687874a6fcd90716d8daa59432ecb833bcfd1640d2c5cc2fec7d9c88b5b8a26cd0173be3f

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_es.dll

Filesize
30KB

MD5
9fb1ccac68879b18f14d678d82b44126

SHA1
55f77ca926fb178dfa6bfa69c7c62ccc8b57acf6

SHA256
008eda20c911b4f9f47e77a7e605acf7e40aa7a64a36e2378f590519973932c3

SHA512
f7b1a52e66a6f34751217b6a6e2028f0d5eda81425274646efdca096c5c09c51a49caf0bb95318861d907aa1b4ce558e53f12347d36e0174abe4645f491c6d5d

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_id.dll

Filesize
29KB

MD5
49928e6699e698a76dfb3d9cd3974254

SHA1
9c3867f594375db3d506ec68ca199496fe7376e7

SHA256
7d8eee0be11860a206e4101ae30783ff41062212c4d33f52c1086494ae438a4b

SHA512
6a22d34c423495f851866649e4d89185e27c934c0ecfff5c9c091d2c50b0ebf05f79342cc0ae9260e8150c4e4f50f9c534a1bdaeb1977e2c9d2122f07a366935

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_ja.dll

Filesize
25KB

MD5
7be97af8ad7948822f72822b6ee76574

SHA1
51d9787d4a15ff392eaed91910e2186f2b1ebce5

SHA256
0ef390700a07c8a1e94d90f00efe9a4511b07e093c0d140c535ff8410d3d24fc

SHA512
56b6fbcf9ea7e59c32f12bf0e78da4061c1c05b7c107f947602c3014694f8712ba678180bad166ec59af8ff6e16f3e74755e8585864d6c09ada589f944b0d1a7

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_nl.dll

Filesize
31KB

MD5
91faf0d590c51980f81e75f0a20c2f3e

SHA1
fced50afe8b520c2e0688b349a87d9a136013705

SHA256
e8814543e5ff553234be005a59057a5fd3151fe4f8a881789c83204efbf82304

SHA512
fb61bae3a9821e67d83676892252641389e693a9dff684e894558e53f90308beadb1b8f2e07b2108e88de847866f1e9b0f6dc0483bda5ba2eaa98ba3d293c85f

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_pl.dll

Filesize
31KB

MD5
8215472c8437d73805798116178a706a

SHA1
776b8fe75e4cc25282d9c85829a461286c72321d

SHA256
abf60bf16156fd5eee26e3fab6fe99d03a121bf4f5e4ab21587a0b3aac3eb033

SHA512
fbd8c523fd4c15cae76019692591afdba67395ac76dd8086bd1c02836e57f8b7ce094059ab86b09562832b770d70a6896f22fd82e5473ba67f8f239e5236d4ef

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_sv.dll

Filesize
30KB

MD5
fefbb2799639aab7965e8e6434b3fd78

SHA1
a679bc2b50c2dcc1ade625a8fa07aee5a4c0c47b

SHA256
88774b499897bd8ed60f8c0944aa58cef395a3d1d2622debc641c3d1e752494e

SHA512
35952998b1e7a62998ed56ebf953c0c31192825ddd4dec9426cabb3a7d8961896c124bbcac0dd94e9c976ef8f0cb97c3e4d31794b9c81b57b6214daeca47c88c

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_uk.dll

Filesize
29KB

MD5
1a949347ef2842e504fe6072b3d05bea

SHA1
9eee8a9498f2b3f5d0ddec2e47f1244291532b7f

SHA256
b78cef55b125306398e7cb036bdc8cef119e1272d51b73095dcaba910d75ad79

SHA512
0e17415636b95deb15b2798d2a182d59c86152cc54c4da9ed1401d6c0e71aa991a9fc04045045303472b19c4751035e21d6e6474e069db7b961e780094ed9f49

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\goopdateres_zh-CN.dll

Filesize
22KB

MD5
27d7add5d7e171993e679199bda7b789

SHA1
05df5d76e51529ca26075b9d4086e3569bd619af

SHA256
9de62f7b48505b1c958a9aa64d7c96bc1d9af426f8e7b078ba91e93ff0d80006

SHA512
aaac196f6092e80f1a10d326f345fef786f975614afbf4ff174d56a5934b0b9348fef81585f36ba0245133c2b8bb6913d2795585c490acb9496a95046fbdf549

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\npDropboxUpdate3.dll

Filesize
271KB

MD5
78b77ec86ea6c87e13d370790a4efd56

SHA1
b909d99d542f174e0e662e516f634bb5c55c49ed

SHA256
a02e672b48b6cc54c8259737d5f5e4747679ab33a58bc27b6e413e04f865f040

SHA512
7c4de9dc0937179660f239922fc6731739aec965274794194590c7ad7657c6b71deeb5bafd79753ab043d0745b0798f7ba9af0cd7b80d0ba2ac7fab50ffc135c

Download Submit
C:\Program Files (x86)\Dropbox\Update\1.3.583.1\psuser.dll

Filesize
208KB

MD5
7944d9a8d7228f8768e7d058c0775fb0

SHA1
c38de018e8e49695414a6964f3b4e3aecf14e760

SHA256
17127e93d782f33a5c36ee5e14207faf4922e57fe1132ad21df13948ef3affb2

SHA512
6535a1bfbf7f681cf44c60c7e9b54c17c0a9deda4cebd45b2dc7872c46ecbbd548fbe480544b355be1c03be1c74b0b53ff75055705fed8e99f4aa781db695f26

Download Submit
C:\Program Files (x86)\Dropbox\Update\Download\{CC46080E-4C33-4981-859A-BBA2F780F31E}\149.3.4541\DropboxClient_149.3.4541.x64.exe

Filesize
125KB

MD5
acaa6260c0ef3405d73af09e06561ffb

SHA1
a9dd9c973ca93f055adff0c69441e66ba6ccb2b1

SHA256
63988a7828acf565930a6c897aa21b976a619f3c569e525407efea4d9750bfd8

SHA512
80f4ca442caa177f7c8d7b137d116026aa40a1cb3778bef2e70ade5f22bc925d7433cc160ff97a53f7c75248592ba65e5153ffcb41df12308c063ecbbebcf9be

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\DropboxCrashHandler.exe

Filesize
127KB

MD5
947c0e34a6b72a4920b15a559e38d49c

SHA1
a743bf36e37b9da6b991fce3345df580aa4b9cc4

SHA256
3806e5642f9461150ef712a9a4e58e2f87d1378c0e17b5457daa6b921006a9f5

SHA512
317d3828ca3a65dfaaf3b16e6fd32bd60dbe49112cb21c9222e34056e33edec3d7565ee668b322acb84f5d93ba0d6aad67c3e7e9952817bc2c234b69017249e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\DropboxUpdate.exe

Filesize
127KB

MD5
8ad76e0b347bb690697535ce95b1c656

SHA1
10d2622a3965d21215a953ed924d01788a9805ed

SHA256
7655221b493047c61285e1de78807d0584920b0d14d150e2487da9728b1926f3

SHA512
35fbda7f05865b3a50454dba5ba3738eb8a5fd6d2eea5e9415d8d517811d51c50cca6c7b47a5b19f1ff1f4101567137fe18805f4f740289456da1ff2af682504

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\DropboxUpdateBroker.exe

Filesize
73KB

MD5
1771b7999fe6c1df9899a65600ff3664

SHA1
0c393207a037cc6353888093ba94128386cf1098

SHA256
85b1b63b09cdfc89beb3eef125cdf2f8b1ab063d75d7b635c7d375910b084532

SHA512
011bbd1525b2fd49921fc242721bd2774841195a08034e84bacec1fd7128a4a465b7b28c340ca6c5d8195e8ba07c06651d1fc8d51a06795a78a1af15431f69e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdate.dll

Filesize
1.1MB

MD5
0f1e2bad10d73facf7ab3ba80f5625c3

SHA1
d742e7d7633fe28b44b278d9ae7749baea616ca8

SHA256
74ffb484faf1619a66bb69ffa939e0abf3bc8863502b8b71676bc5c02e527fe0

SHA512
73544fc67186147035b7ba7c05fd971d2093ccc4b3d6c2c192762bd0513221bfb9654e588670a5305998144c99ee2a2fd8df7c460b8a1ebf74ae7c5a104645d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_da.dll

Filesize
30KB

MD5
cd818ec56f23b0bc382caea8909a8829

SHA1
31cd5362b281badb9808586c944d05633c85499d

SHA256
86328819f60eac3ae2780362c1a0797ea05439a522e5333e2133b46d2675fa8d

SHA512
750081c84a82e72cb32541c6e1ab2a1fb15a260ece72c5d6c084e904ecc350de2a1c4c52c218576f215e87ebc0d89fd949ba4553b81038d9eeffe77962ab5b4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_es-419.dll

Filesize
31KB

MD5
72c13e6e79ae7b49da18c78699223784

SHA1
800230a0169abb20772f935bc41c62165ba07178

SHA256
3577c802ad941c256bbe1a02564fcb1602ff0d9af8c0a81c249b66855fb65b90

SHA512
ea8537a6772f4fb0142997042bab4b51bb4d91d23b6b6fc1e14ea179b6220c9a43a9193915ba5cbc446b2d6cd487dc3e1773acb47ed978517ac0710a31662808

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_fr.dll

Filesize
32KB

MD5
691413d30e999758b8479db54cc612e3

SHA1
7f97482ad6dfd47baba15b40fd2e82e2a3992bbc

SHA256
7fe8391e579d6d113e57d55578541cc8e2b888a3c85e9b8b5d7099e1c1af833b

SHA512
11d9a6af7926d648165eb979288e789e2d740a160937a7037f834a2197a0a2fae436b7cc048ffd7a4bbf810e6af80ccd270c87d019a505a077219dd27125c7fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_it.dll

Filesize
31KB

MD5
a54a6465db48a42cb1f16f38ca766d6a

SHA1
24be451536900fcbf8027cfbc14835b79dedc119

SHA256
ad767e6da08c63a00afaac7ae4bb462831e24a463bbcd11cfbc1eb6f210f503d

SHA512
d8254ebff59c4d55b9715100bb498b6af44a58a2806c4fd6ee9c9946e6773fb6620277cf5339bf5fb0b520445e85fa86f4d7872d5e40f10902574bb42ac41359

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_ko.dll

Filesize
25KB

MD5
6c42d74a49551f41e1db3d7f9036e4ec

SHA1
394bf2e5b5fd5a99b10665451a5bdf1d36e0f736

SHA256
bf748ea6fc73a79d6840d8574b8c0194d92079569342e094381d3be9b1cacb1b

SHA512
ca3b3e83e5400f7c189941f8eb3ff5b9deb71c180eb09104a0c9bdcfb49c0f7b1e52e901ed10f787cc6d69425c86119905754ac9340843cac84dd43014156972

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_ms.dll

Filesize
29KB

MD5
47b582a2e96988542a7073fbddc3041f

SHA1
03a6fd1b00907fb178aaf12fabcfcd746594e6fe

SHA256
aac32e1b59d66a79f0647b6325f0117ffc8c447cc033da76d1635c4398e579af

SHA512
73deef1d9d2773202879a0fb01f4a5e5b8e4e1a4dba2c31525a62fac71c62caeab8f54266140e085078c97216fdfb165fbd1d28d27ff3ff7b783c587365a685d

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_no.dll

Filesize
30KB

MD5
ad43d656b93577bb58cdc2c45f4157bf

SHA1
e75f2ebd30685fe2753094d055be7f6d9387f50d

SHA256
cb1ec0d4669be83f2bb266a6259bdf496fe4fa63eba7853bb2c6468341054582

SHA512
0c209c4bc469c0004d8d1677c3bc792aa97676028c1ec11daae101917737e35019fd3d7ffa8caec09371065738b90b9acbde034ad01c54665ea3a4148660b149

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_pt-BR.dll

Filesize
30KB

MD5
0cb08ba541fc1fe9d328b4118cf8ef3d

SHA1
c4740b46464d8a7d45e4d9112dae1a71ec769b71

SHA256
8ce83b50b07a0d2dd1c08984a42e5ad6aedd6a14aece66e130035f4dae46a28e

SHA512
25c7f725390b12769494bfef6044fba700b7b9fcb30d8943466f8b5cb54d101a4e1535d8dd5a98eaf0d9e73e73f56c15add852311fc0983c4fb207038b6a23e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_ru.dll

Filesize
30KB

MD5
fc0edc3a7c63d2ace14b41509d0cd42b

SHA1
b289071afa1f3223f97adaa7418cad5150fb98ec

SHA256
bd504aa963e7d693eb4a20496610c85e348bc79a64ab78a2dfb003021fe9fced

SHA512
e9506facfea8b38acdc38ce8fda900e6cf1a2d211915fdb773de583064dfe6c42f7fc9253c087b12da5d95d188cb4c99135fed49a7a6d88ed5884961e9da0e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_th.dll

Filesize
28KB

MD5
fadda38e700622e2946ce43ee5f52477

SHA1
a8917b9d749cb3dae82560645a585f019c46e208

SHA256
3021b3472fc72fd3759458cff6029aac29415dd9fc51c5395ba28151c415e473

SHA512
c3c9f9f327257024ed7c690c3cf75d960cf71033b583761c33c5d0b4d711344834f11f9683043e6f7bbd244e0234f82f6aad0b95a3bc91a3785598ce671fb2fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_zh-TW.dll

Filesize
22KB

MD5
94616c23c986985c683d86679c134613

SHA1
437d90ec1ad288ae6658f3aa8ed24a94081c7a01

SHA256
cbbf268240c9c113f065320bea78de2ac3f40f0c4845313975bba42b98b47f8b

SHA512
4a96ed319ea4f4243be49bada7da6436df43285eecf2f803a41e03d9dd6b6e499e536a419a53d076bb3eafda1e515a7cf85bffa290b297d21502647468d418bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\GUM1890.tmp\psmachine.dll

Filesize
208KB

MD5
5c8590364bdd31a91fbbab4a8e738400

SHA1
2a30722cffa6625b7f18c4b96bcdd8d62b0a39dd

SHA256
37e755ce945003bd6443d43479a2300cb4cfcc1e3b8262b8bf5c43a69b77e50f

SHA512
694f87401dded0a38e38bc9a25877c06eee5f49d145e2d47b8fae73512d62125c1e327d928dba3775d4f3a0332990872e9102eafd9b6e176a0873907422107da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar48F3.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsy234.tmp\System.dll

Filesize
11KB

MD5
c6e19f882ac7c89c517ec158d8bee0e3

SHA1
4bd07cb821aca4d2eb32e7f74ae620780d8b958d

SHA256
817929ce4af784af2f28db0eea5cc9a16fa28e8ed0b3bd497ed8dda0619207a3

SHA512
cbf559f48b66e2bdf9e0de75d48f169fe2a112e34981c1463856e50807ff05f63afb512afd99503126d9f700ed4eda9bfa45fd38ded5d55d4c8738043ec7e62f

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Windows\System32\SET4492.tmp

Filesize
23KB

MD5
0d8ed317fa34cfcb87f1bac3a46fba47

SHA1
e2eb38770ba63750632820f66b8443f367c7be36

SHA256
ccb135f29187dcd88ddddd3d1bcadd2e7e3a079b30562df7a7843e83013862b1

SHA512
d7c41311cf5c7fc6ef60db482323ab95472bb41480ec4aafa191ffdbf30dc79a1b3c7320456d624873250d06527de8f6a67bb462e0c9a56f70ab2dc5e4259643

Download Submit
C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job

Filesize
906B

MD5
ae27070066e28ab01d4abaf5698f3bca

SHA1
b28abef8865246d81f06a4fbe3511a31691d85ec

SHA256
7890c9a281242a44a3f3cf52d31193631343f5c8ea11a5a933f5509539b42fe5

SHA512
1ab3db3ad27e0c8b591f17d1e7502d929d1493eca0e079d26cdd9bb883586273b710957b476a0edf0ad84598b56c8fda68f487d0c21d79a69995600d1f0828c1

Download Submit
\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdate.dll

Filesize
896KB

MD5
abe2fdddb2b9da91eb59ceb624131fde

SHA1
137191d2d512c5f89c31ea2a050e8949caf44acd

SHA256
72df1250cd914dfd6324f6c98af471b08d778862376cce148699fc77ff1b7e54

SHA512
8ab1b9c71427353d37fae858da49a370f624c12c8a87a23595f0c9a30f7f57da1c7d93f572dee011343480686dd5bb80f7dc6c2656d06bb0465a083efa40cafa

Download Submit
\Users\Admin\AppData\Local\Temp\GUM1890.tmp\goopdateres_en.dll

Filesize
29KB

MD5
237923b1d626526b864a05376d8e33bd

SHA1
583016f1334f3da5f22a01a2823ad8c73307f222

SHA256
ae5780c69b3afbab16d58c5c822a283d04088d4189ae1f469d5f4fe3ed043931

SHA512
915bf26bc8d0ae0da79cbb5df43d4c01ab2d7dd87c28f0efd72fe9e22ac8c5caad93f7b665a3554ef61b51f43d35b166aae914b59da21695aeb60139656d86fc

Download Submit
memory/2052-1198-0x000007FEEFCF0000-0x000007FEEFF2F000-memory.dmp

Filesize
2.2MB

Download
memory/2052-1195-0x000007FEEF590000-0x000007FEEFAE6000-memory.dmp

Filesize
5.3MB

Download
memory/2052-1197-0x000007FEF2410000-0x000007FEF264A000-memory.dmp

Filesize
2.2MB

Download
memory/2052-1196-0x000007FEEFF30000-0x000007FEF03B8000-memory.dmp

Filesize
4.5MB

Download
memory/2052-1199-0x000007FEE8E50000-0x000007FEE91F8000-memory.dmp

Filesize
3.7MB

Download
memory/2116-413-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2116-337-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2432-3596-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/2432-3687-0x00000000044E0000-0x00000000044E1000-memory.dmp

Filesize
4KB

Download
memory/2452-3630-0x00000000192E0000-0x0000000019360000-memory.dmp

Filesize
512KB

Download
memory/2452-3432-0x000007FEF24C0000-0x000007FEF26FA000-memory.dmp

Filesize
2.2MB

Download
memory/2452-3434-0x000007FEE8E50000-0x000007FEE91F8000-memory.dmp

Filesize
3.7MB

Download
memory/2452-3534-0x00000000028A0000-0x00000000028AA000-memory.dmp

Filesize
40KB

Download
memory/2452-3533-0x00000000028A0000-0x00000000028AA000-memory.dmp

Filesize
40KB

Download
memory/2452-3532-0x00000000028A0000-0x00000000028AA000-memory.dmp

Filesize
40KB

Download
memory/2452-3531-0x00000000028A0000-0x00000000028AA000-memory.dmp

Filesize
40KB

Download
memory/2452-3690-0x0000000016840000-0x00000000168C0000-memory.dmp

Filesize
512KB

Download
memory/2452-3691-0x00000000165A0000-0x0000000016620000-memory.dmp

Filesize
512KB

Download
memory/2452-3693-0x000000001A620000-0x000000001A6A0000-memory.dmp

Filesize
512KB

Download
memory/2452-3578-0x000000000FF60000-0x000000000FFE0000-memory.dmp

Filesize
512KB

Download
memory/2452-3582-0x0000000012EC0000-0x0000000012F40000-memory.dmp

Filesize
512KB

Download
memory/2452-3584-0x0000000012EC0000-0x0000000012F40000-memory.dmp

Filesize
512KB

Download
memory/2452-3587-0x0000000013070000-0x00000000130F0000-memory.dmp

Filesize
512KB

Download
memory/2452-3589-0x0000000013370000-0x00000000133F0000-memory.dmp

Filesize
512KB

Download
memory/2452-3591-0x0000000016110000-0x0000000016190000-memory.dmp

Filesize
512KB

Download
memory/2452-3595-0x00000000163F0000-0x0000000016470000-memory.dmp

Filesize
512KB

Download
memory/2452-3594-0x00000000163F0000-0x0000000016470000-memory.dmp

Filesize
512KB

Download
memory/2452-3593-0x0000000016110000-0x0000000016190000-memory.dmp

Filesize
512KB

Download
memory/2452-3590-0x0000000016110000-0x0000000016190000-memory.dmp

Filesize
512KB

Download
memory/2452-3588-0x0000000013370000-0x00000000133F0000-memory.dmp

Filesize
512KB

Download
memory/2452-3586-0x000000000E780000-0x000000000E781000-memory.dmp

Filesize
4KB

Download
memory/2452-3585-0x0000000013070000-0x00000000130F0000-memory.dmp

Filesize
512KB

Download
memory/2452-3581-0x0000000012EC0000-0x0000000012F40000-memory.dmp

Filesize
512KB

Download
memory/2452-3580-0x0000000011C70000-0x0000000011CF0000-memory.dmp

Filesize
512KB

Download
memory/2452-3579-0x0000000011C70000-0x0000000011CF0000-memory.dmp

Filesize
512KB

Download
memory/2452-3577-0x000000000FF60000-0x000000000FFE0000-memory.dmp

Filesize
512KB

Download
memory/2452-3431-0x000007FEEFF30000-0x000007FEF03B8000-memory.dmp

Filesize
4.5MB

Download
memory/2452-3597-0x00000000028A0000-0x00000000028AA000-memory.dmp

Filesize
40KB

Download
memory/2452-3598-0x00000000028A0000-0x00000000028AA000-memory.dmp

Filesize
40KB

Download
memory/2452-3635-0x0000000019820000-0x00000000198A0000-memory.dmp

Filesize
512KB

Download
memory/2452-3637-0x0000000019820000-0x00000000198A0000-memory.dmp

Filesize
512KB

Download
memory/2452-3641-0x00000000028A0000-0x00000000028AA000-memory.dmp

Filesize
40KB

Download
memory/2452-3634-0x0000000019820000-0x00000000198A0000-memory.dmp

Filesize
512KB

Download
memory/2452-3633-0x00000000195A0000-0x0000000019620000-memory.dmp

Filesize
512KB

Download
memory/2452-3632-0x00000000195A0000-0x0000000019620000-memory.dmp

Filesize
512KB

Download
memory/2452-3631-0x00000000192E0000-0x0000000019360000-memory.dmp

Filesize
512KB

Download
memory/2452-3433-0x000007FEEFCF0000-0x000007FEEFF2F000-memory.dmp

Filesize
2.2MB

Download
memory/2452-3667-0x000000001A780000-0x000000001A800000-memory.dmp

Filesize
512KB

Download
memory/2452-3669-0x000000001A780000-0x000000001A800000-memory.dmp

Filesize
512KB

Download
memory/2452-3670-0x000000001F230000-0x000000001F2B0000-memory.dmp

Filesize
512KB

Download
memory/2452-3671-0x000000001F230000-0x000000001F2B0000-memory.dmp

Filesize
512KB

Download
memory/2452-3673-0x000000001A4A0000-0x000000001A520000-memory.dmp

Filesize
512KB

Download
memory/2452-3674-0x000000001A520000-0x000000001A5A0000-memory.dmp

Filesize
512KB

Download
memory/2452-3675-0x000000001A520000-0x000000001A5A0000-memory.dmp

Filesize
512KB

Download
memory/2452-3672-0x000000001A4A0000-0x000000001A520000-memory.dmp

Filesize
512KB

Download
memory/2452-3678-0x000000001A520000-0x000000001A5A0000-memory.dmp

Filesize
512KB

Download
memory/2452-3666-0x000000001A780000-0x000000001A800000-memory.dmp

Filesize
512KB

Download
memory/2452-3430-0x000007FEEF590000-0x000007FEEFAE6000-memory.dmp

Filesize
5.3MB

Download
memory/2452-3692-0x000000001A5A0000-0x000000001A620000-memory.dmp

Filesize
512KB

Download
memory/2560-3575-0x0000000077DC0000-0x0000000077DC1000-memory.dmp

Filesize
4KB

Download
memory/2560-3540-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2768-42-0x0000000000380000-0x0000000000381000-memory.dmp

Filesize
4KB

Download